service worker: Don't control a subframe of an insecure context

content/child/service_worker/service_worker_network_provider.cc

Index: content/child/service_worker/service_worker_network_provider.cc
diff --git a/content/child/service_worker/service_worker_network_provider.cc b/content/child/service_worker/service_worker_network_provider.cc
index dab3db7517595f4598357183fb9f3af54ad28a42..6755a9eb11936e2ade5c9c7582155a57989240e7 100644
--- a/content/child/service_worker/service_worker_network_provider.cc
+++ b/content/child/service_worker/service_worker_network_provider.cc
@@ -11,6 +11,10 @@
 #include "content/common/service_worker/service_worker_messages.h"
 #include "content/common/service_worker/service_worker_utils.h"
 #include "content/public/common/browser_side_navigation_policy.h"
+#include "third_party/WebKit/public/platform/WebString.h"
+#include "third_party/WebKit/public/web/WebDocument.h"
+#include "third_party/WebKit/public/web/WebLocalFrame.h"
+#include "third_party/WebKit/public/web/WebSandboxFlags.h"
 
 namespace content {
 
@@ -52,7 +56,7 @@ std::unique_ptr<ServiceWorkerNetworkProvider>
 ServiceWorkerNetworkProvider::CreateForNavigation(
     int route_id,
     const RequestNavigationParams& request_params,
-    blink::WebSandboxFlags sandbox_flags,
+    blink::WebLocalFrame* frame,
     bool content_initiated) {
   bool browser_side_navigation = IsBrowserSideNavigationEnabled();
   bool should_create_provider_for_window = false;
@@ -74,8 +78,17 @@ ServiceWorkerNetworkProvider::CreateForNavigation(
            service_worker_provider_id == kInvalidServiceWorkerProviderId);
   } else {
     should_create_provider_for_window =
-        (sandbox_flags & blink::WebSandboxFlags::Origin) !=
+        (frame->effectiveSandboxFlags() & blink::WebSandboxFlags::Origin) !=
         blink::WebSandboxFlags::Origin;
+    // Check if |frame| is a subframe of an insecure context.
+    // |frame|'s document is not yet created, so check the parent
+    // document directly.
+    if (should_create_provider_for_window) {
+      blink::WebFrame* parent = frame->parent();
+      blink::WebString errorMessage;
+      if (parent && !parent->document().isSecureContext(errorMessage))

[falken, 2016/05/24 11:29:58]

Some tests fail. It looks like this can't be done because parent can be "remote"
(out of process iframe), in which case parent->document() fails.

Is there a way to check security context of a WebFrame including remote frames?

[falken, 2016/05/24 13:16:37]

I see now, there is WebSecurityOrigin. Updated the patch.

[Charlie Reis, 2016/05/24 17:22:00]

Yep, that's the right way.  +alexmos to verify it's used correctly here.  (See
also mek@'s comment.)

[alexmos, 2016/05/24 18:51:55]

Yes, remote frames should have correct SecurityOrigins (which we replicate from
the corresponding local frame).  We've also recently refactored
SecurityOrigin::isPotentiallyTrustworthy and Document::isSecureContext to work
correctly with remote frames (see issue 571079).  Ideally you'd just call
WebDocument::isSecureContext on the |frame|'s document, so it's too bad that it
isn't created yet.

+1 to jww@'s suggestion to unify this walk with the one in
Document::isSecureContext if possible.

+        should_create_provider_for_window = false;
+    }
   }
 
   // Now create the ServiceWorkerNetworkProvider (with invalid id if needed).