Block framebusts without a user gesture

third_party/WebKit/Source/core/frame/Frame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
@@ skipping 24 matching lines @@
 #include "core/frame/LocalDOMWindow.h"
 #include "core/frame/Settings.h"
 #include "core/frame/UseCounter.h"
 #include "core/html/HTMLFrameElementBase.h"
 #include "core/input/EventHandler.h"
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/inspector/InstanceCounters.h"
 #include "core/layout/LayoutPart.h"
 #include "core/loader/EmptyClients.h"
 #include "core/loader/FrameLoaderClient.h"
+#include "core/loader/NavigationScheduler.h"
 #include "core/page/FocusController.h"
 #include "core/page/Page.h"
 #include "platform/Histogram.h"
 #include "platform/UserGestureIndicator.h"
 
 namespace blink {
 
 using namespace HTMLNames;
 
 Frame::~Frame()
@@ skipping 106 matching lines @@
     }
 
     return false;
 }
 
 bool Frame::canNavigate(const Frame& targetFrame)
 {
     String errorReason;
     bool isAllowedNavigation = canNavigateWithoutFramebusting(targetFrame, errorReason);
 
-    // Frame-busting is generally allowed, but blocked for sandboxed frames lacking the 'allow-top-navigation' flag.
     if (targetFrame != this && !securityContext()->isSandboxed(SandboxTopNavigation) && targetFrame == tree().top()) {
         DEFINE_STATIC_LOCAL(EnumerationHistogram, framebustHistogram, ("WebCore.Framebust", 4));
         const unsigned userGestureBit = 0x1;
         const unsigned allowedBit = 0x2;
         unsigned framebustParams = 0;
         UseCounter::count(&targetFrame, UseCounter::TopNavigationFromSubFrame);
-        if (UserGestureIndicator::processingUserGesture())
+        bool hasUserGesture = UserGestureIndicator::processingUserGesture();
+        if (hasUserGesture)
             framebustParams |= userGestureBit;
         if (isAllowedNavigation)
             framebustParams |= allowedBit;
         framebustHistogram.count(framebustParams);
-        return true;
+        // Frame-busting used to be generally allowed in most situations, but may now blocked if there is no user gesture.
+        if (!RuntimeEnabledFeatures::framebustingNeedsSameOriginOrUserGestureEnabled())
+            return true;
+        if (hasUserGesture || isAllowedNavigation)
+            return true;
+        errorReason = "The frame attempting navigation is targeting its top-level window, but is neither same-origin with its target nor is it processing a user gesture. See https://www.chromestatus.com/features/5851021045661696.";
+        printNavigationErrorMessage(targetFrame, errorReason.latin1().data());
+        if (isLocalFrame())
+            toLocalFrame(this)->navigationScheduler().schedulePageBlock(toLocalFrame(this)->document());
+        return false;
     }
     if (!isAllowedNavigation && !errorReason.isNull())
         printNavigationErrorMessage(targetFrame, errorReason.latin1().data());
     return isAllowedNavigation;
 }
 
 bool Frame::canNavigateWithoutFramebusting(const Frame& targetFrame, String& reason)
 {
     if (securityContext()->isSandboxed(SandboxNavigation)) {
         // Sandboxed frames can navigate their own children.
         if (targetFrame.tree().isDescendantOf(this))
             return true;
 
         // They can also navigate popups, if the 'allow-sandbox-escape-via-popup' flag is specified.
         if (targetFrame == targetFrame.tree().top() && targetFrame.tree().top() != tree().top() && !securityContext()->isSandboxed(SandboxPropagatesToAuxiliaryBrowsingContexts))
             return true;
 
+        // Top navigation can be opted-in.
+        if (!securityContext()->isSandboxed(SandboxTopNavigation) && targetFrame == tree().top())
+            return true;
+
         // Otherwise, block the navigation.
         if (securityContext()->isSandboxed(SandboxTopNavigation) && targetFrame == tree().top())
             reason = "The frame attempting navigation of the top-level window is sandboxed, but the 'allow-top-navigation' flag is not set.";
         else
             reason = "The frame attempting navigation is sandboxed, and is therefore disallowed from navigating its ancestors.";
         return false;
     }
 
     ASSERT(securityContext()->getSecurityOrigin());
     SecurityOrigin& origin = *securityContext()->getSecurityOrigin();
@@ skipping 87 matching lines @@
 
     ASSERT(page());
 
     if (m_owner)
         m_owner->setContentFrame(*this);
     else
         page()->setMainFrame(this);
 }
 
 } // namespace blink