Prevent 'javascript:' URL execution in sandboxed frame.

Prevent 'javascript:' URL execution in sandboxed frame.

[1] notes that Chrome is violating step 1 of [2] by allowing
`<iframe sandbox=allow-scripts src="javascript:alert(1)">` to execute
JavaScript in an origin distinct from its parent (due to sandboxing).
This patch closes that gap with Firefox.

[1]: https://github.com/w3c/webappsec-secure-contexts/issues/26#issuecomment-214801969
[2]: https://html.spec.whatwg.org/multipage/browsers.html#javascript-protocol

BUG=629083
R=jochen@chromium.org

Committed: https://crrev.com/b20beeee90777c7a7cf3ed05fd1946938175a8a1
Cr-Commit-Position: refs/heads/master@{#406255}

[Mike West, 2016-07-18 14:25:09]

The CQ bit was checked by mkwst@chromium.org to run a CQ dry run

[Mike West, 2016-07-18 14:25:36]

WDYT, Jochen? The test is pretty terrible, but I don't have better ideas.

[commit-bot: I haz the power, 2016-07-18 14:25:40]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-07-18 16:53:50]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-07-18 16:53:50]

Dry run: This issue passed the CQ dry run.

[jochen (gone - plz use gerrit), 2016-07-19 12:20:49]

lgtm

[Mike West, 2016-07-19 12:42:07]

The CQ bit was checked by mkwst@chromium.org

[commit-bot: I haz the power, 2016-07-19 12:42:36]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-07-19 12:47:50]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2016-07-19 12:50:24]

Description was changed from

==========
Prevent 'javascript:' URL execution in sandboxed frame.

[1] notes that Chrome is violating step 1 of [2] by allowing
`<iframe sandbox=allow-scripts src="javascript:alert(1)">` to execute
JavaScript in an origin distinct from its parent (due to sandboxing).
This patch closes that gap with Firefox.


[1]:
https://github.com/w3c/webappsec-secure-contexts/issues/26#issuecomment-21480...
[2]: https://html.spec.whatwg.org/multipage/browsers.html#javascript-protocol

BUG=629083
R=jochen@chromium.org
==========

to

==========
Prevent 'javascript:' URL execution in sandboxed frame.

[1] notes that Chrome is violating step 1 of [2] by allowing
`<iframe sandbox=allow-scripts src="javascript:alert(1)">` to execute
JavaScript in an origin distinct from its parent (due to sandboxing).
This patch closes that gap with Firefox.

[1]:
https://github.com/w3c/webappsec-secure-contexts/issues/26#issuecomment-21480...
[2]: https://html.spec.whatwg.org/multipage/browsers.html#javascript-protocol

BUG=629083
R=jochen@chromium.org

Committed: https://crrev.com/b20beeee90777c7a7cf3ed05fd1946938175a8a1
Cr-Commit-Position: refs/heads/master@{#406255}
==========

[commit-bot: I haz the power, 2016-07-19 12:50:25]

Patchset 1 (id:??) landed as
https://crrev.com/b20beeee90777c7a7cf3ed05fd1946938175a8a1
Cr-Commit-Position: refs/heads/master@{#406255}