Merge 59866 - 20100520 Justin Schuh <jschuh@chromium.org>...

WebCore/html/HTMLFrameElementBase.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 16 matching lines @@
 #include "CSSHelper.h"
 #include "Document.h"
 #include "EventNames.h"
 #include "FocusController.h"
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameTree.h"
 #include "FrameView.h"
 #include "HTMLFrameSetElement.h"
 #include "HTMLNames.h"
+#include "ScriptController.h"
 #include "ScriptEventListener.h"
 #include "KURL.h"
 #include "MappedAttribute.h"
 #include "Page.h"
 #include "RenderFrame.h"
 #include "Settings.h"
 
 namespace WebCore {
 
 using namespace HTMLNames;
@@ skipping 10 matching lines @@
 {
 }
 
 bool HTMLFrameElementBase::isURLAllowed() const
 {
     if (m_URL.isEmpty())
         return true;
 
     const KURL& completeURL = document()->completeURL(m_URL);
 
+    if (protocolIsJavaScript(completeURL)) { 
+        Document* contentDoc = this->contentDocument();
+        if (contentDoc && !ScriptController::canAccessFromCurrentOrigin(contentDoc->frame()))
+            return false;
+    }
+
     // Don't allow more than 200 total frames in a set. This seems
     // like a reasonable upper bound, and otherwise mutually recursive
     // frameset pages can quickly bring the program to its knees with
     // exponential growth in the number of frames.
     // FIXME: This limit could be higher, but because WebKit has some
     // algorithms that happen while loading which appear to be N^2 or
     // worse in the number of frames, we'll keep it at 200 for now.
     if (Frame* parentFrame = document()->frame()) {
         if (parentFrame->page()->frameCount() > 200)
             return false;
@@ skipping 219 matching lines @@
 
 void HTMLFrameElementBase::willRemove()
 {
     if (m_remainsAliveOnRemovalFromTree)
         return;
 
     HTMLFrameOwnerElement::willRemove();
 }
 
 } // namespace WebCore