Index: content/public/browser/download_url_parameters.h |
diff --git a/content/public/browser/download_url_parameters.h b/content/public/browser/download_url_parameters.h |
index 7a580a3f9c7268f7a8e1a29d22d5e1cca2f57ef7..1496236a427bf9b3a355efeb7d768045ee3bf7fa 100644 |
--- a/content/public/browser/download_url_parameters.h |
+++ b/content/public/browser/download_url_parameters.h |
@@ -61,31 +61,28 @@ class CONTENT_EXPORT DownloadUrlParameters { |
typedef std::vector<RequestHeadersNameValuePair> RequestHeadersType; |
// Construct DownloadUrlParameters for downloading the resource at |url| and |
- // associating the download with |web_contents|. |
- // |
- // DEPRECATED: Using this method can cause the request to be associated with |
- // the wrong site instance where multiple iframes are involved. Use the |
- // DownloadUrlParameters constructor below and specify the process and frame |
- // IDs explicitly. |
- static std::unique_ptr<DownloadUrlParameters> FromWebContents( |
+ // associating the download with the main frame of the given WebContents. |
+ static std::unique_ptr<DownloadUrlParameters> CreateForWebContentsMainFrame( |
WebContents* web_contents, |
const GURL& url); |
- // Construct DownloadUrlParameters for downloading the resource at |url| and |
- // associating the download with the WebContents identified by |
- // |render_process_host_id| and |render_view_host_routing_id|. |
- // |
- // If the download is not associated with a WebContents, then set the IDs to |
- // -1. |
+ // Constructs a download not associated with a frame. |
// |
- // NOTE: Initiating downloads that are not associated with a WebContents is |
- // not safe and should only be done in a limited set of cases where the |
- // download URL has been previously vetted. A download that's initiated |
- // without associating it with a WebContents don't receive the same security |
- // checks as a request that's associated with one. Hence, downloads that are |
- // not associated with a WebContents should only be made for URLs that are |
- // either trusted or URLs that have previously been successfully issued using |
- // a non-privileged WebContents. |
+ // It is not safe to have downloads not associated with a frame and |
+ // this should only be done in a limited set of cases where the download URL |
+ // has been previously vetted. A download that's initiated without |
+ // associating it with a fraem don't receive the same security checks |
asanka
2016/05/13 20:53:41
*frame
|
+ // as a request that's associated with one. Hence, downloads that are not |
+ // associated with a frame should only be made for URLs that are either |
+ // trusted or URLs that have previously been successfully issued using a |
+ // non-privileged frame. |
+ DownloadUrlParameters( |
+ const GURL& url, |
+ net::URLRequestContextGetter* url_request_context_getter); |
+ |
+ // The RenderView routing ID must correspond to the RenderView of the |
+ // RenderFrame, both of which share the same RenderProcess. This may be a |
+ // different RenderView than the WebContents' main RenderView. |
asanka
2016/05/13 20:53:41
Shall we get rid of the RVID in DownloadUrlParamet
brettw
2016/05/13 21:20:57
I tried this on the path to generating this patch.
|
DownloadUrlParameters( |
const GURL& url, |
int render_process_host_id, |
@@ -214,6 +211,9 @@ class CONTENT_EXPORT DownloadUrlParameters { |
bool prefer_cache() const { return prefer_cache_; } |
const Referrer& referrer() const { return referrer_; } |
const std::string& referrer_encoding() const { return referrer_encoding_; } |
+ |
+ // These will be -1 if the request is not associated with a frame. See |
+ // the constructors for more. |
int render_process_host_id() const { return render_process_host_id_; } |
int render_view_host_routing_id() const { |
return render_view_host_routing_id_; |
@@ -221,6 +221,7 @@ class CONTENT_EXPORT DownloadUrlParameters { |
int render_frame_host_routing_id() const { |
return render_frame_host_routing_id_; |
} |
+ |
const RequestHeadersType& request_headers() const { return request_headers_; } |
net::URLRequestContextGetter* url_request_context_getter() { |
return url_request_context_getter_.get(); |