Chromium Code Reviews
DescriptionCorrectly set 'firstPartyForCookies' in 'RenderFrameImpl::willSendRequest'.
Currently, we're grabbing the top-level frame's document, and using its
'firstPartyForCookies'. This is incorrect, as it doesn't walk the ancestor
chain to verify same-siteness, and doubly incorrect as it punts entirely
if the top-level frame is in a different process.
alexmos@ fixed the underlying issue with the 'firstPartyForCookies' method
in https://codereview.chromium.org/2046593003, so we no longer need this
workaround.
This patch does require a small change to 'firstPartyForCookies' to deal
with imported documents, however; they don't have a frame, which the
current code doesn't check for, which leads to null-derefs in every test
that uses imports. This patch handles them by looking for their master
document, and returning its value.
R=jochen@chromium.org
Committed: https://crrev.com/b1d1a95d912c54d4183f05feb6d377380552b1f3
Cr-Commit-Position: refs/heads/master@{#401280}
Patch Set 1 #Patch Set 2 : tests #Patch Set 3 : Missed one. #
Dependent Patchsets: Messages
Total messages: 7 (3 generated)
|
||||||||||||||||||||||||||||||||||||||||||||||