Prevent 'javascript:' URL execution in sandboxed frame.

third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 75 matching lines @@
     KURL url = document().completeURL(m_URL);
     if (protocolIsJavaScript(m_URL)) {
         scriptURL = url;
         url = blankURL();
     }
 
     if (!loadOrRedirectSubframe(url, m_frameName, replaceCurrentItem))
         return;
     if (!contentFrame() || scriptURL.isEmpty() || !contentFrame()->isLocalFrame())
         return;
+    if (contentFrame()->owner()->getSandboxFlags() & SandboxOrigin)
+        return;
     toLocalFrame(contentFrame())->script().executeScriptIfJavaScriptURL(scriptURL);
 }
 
 void HTMLFrameElementBase::frameOwnerPropertiesChanged()
 {
     // Don't notify about updates if contentFrame() is null, for example when
     // the subframe hasn't been created yet.
     if (contentFrame())
         document().frame()->loader().client()->didChangeFrameOwnerProperties(this);
 }
@@ skipping 140 matching lines @@
     frameOwnerPropertiesChanged();
 }
 
 void HTMLFrameElementBase::setMarginHeight(int marginHeight)
 {
     m_marginHeight = marginHeight;
     frameOwnerPropertiesChanged();
 }
 
 } // namespace blink