fix service worker cross-origin problem in multibuffers

media/blink/resource_multibuffer_data_provider.cc

Index: media/blink/resource_multibuffer_data_provider.cc
diff --git a/media/blink/resource_multibuffer_data_provider.cc b/media/blink/resource_multibuffer_data_provider.cc
index 0acae612b9d2deeaacd1920a965d609ac91a74d8..5bb74d6e8736c9f68cf162975754361b1291fbbf 100644
--- a/media/blink/resource_multibuffer_data_provider.cc
+++ b/media/blink/resource_multibuffer_data_provider.cc
@@ -164,6 +164,7 @@ void ResourceMultiBufferDataProvider::willFollowRedirect(
       if (url_data_->multibuffer()->map().empty() && fifo_.empty())
         return;
 
+      std::unique_ptr<ActiveLoader> active_loader = std::move(active_loader_);

[DaleCurtis, 2016/05/10 22:42:09]

How come active_loader_ needs to out live Fail()? Seems this could just be
active_loader_ = nullptr or done after fail?

[hubbe, 2016/05/11 00:06:38]

Good question, I was lazily doing this the same as in some other places. Cleaned
up here and elsewhere.

       url_data_->Fail();
     }
   }
@@ -278,6 +279,7 @@ void ResourceMultiBufferDataProvider::didReceiveResponse(
       destination_url_data->multibuffer()->OnDataProviderEvent(this);
       return;
     } else {
+      std::unique_ptr<ActiveLoader> active_loader = std::move(active_loader_);
       destination_url_data->Fail();
       return;
     }
@@ -312,6 +314,16 @@ void ResourceMultiBufferDataProvider::didReceiveResponse(
     // cause clients to start using the new UrlData.
     old_url_data->RedirectTo(destination_url_data);
   }
+
+  // This test is vital for security!
+  const GURL& original_url = response.wasFetchedViaServiceWorker()
+                                 ? response.originalURLViaServiceWorker()
+                                 : response.url();
+  if (!url_data_->ValidateDataOrigin(original_url.GetOrigin())) {
+    std::unique_ptr<ActiveLoader> active_loader = std::move(active_loader_);
+    url_data_->Fail();
+    return;
+  }
 }
 
 void ResourceMultiBufferDataProvider::didReceiveData(WebURLLoader* loader,