Avoid using ContentBrowserClient::IsIllegalOrigin in ResourceDispatcherHost.

content/browser/security_exploit_browsertest.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdint.h>
 
 #include "base/command_line.h"
 #include "base/containers/hash_tables.h"
 #include "base/macros.h"
 #include "base/strings/utf_string_conversions.h"
@@ skipping 383 matching lines @@
 
   // Send a second message from the interstitial page, and make sure that the
   // "evil" message doesn't arrive in the intervening period.
   ASSERT_TRUE(ExecuteScript(interstitial_page->GetMainFrame(),
                             "window.domAutomationController.send(\"okay2\");"));
   ASSERT_TRUE(message_queue.WaitForMessage(&message));
   ASSERT_EQ("\"okay2\"", message);
   ASSERT_EQ("\"okay2\"", interstitial->last_command());
 }
 
 class IsolatedAppContentBrowserClient : public TestContentBrowserClient {

[jam, 2016/08/01 20:06:01]

not needed anymore

[ananta, 2016/08/02 00:40:50]

Done.

  public:
   bool IsIllegalOrigin(content::ResourceContext* resource_context,
                        int child_process_id,
                        const GURL& origin) override {
     // Simulate a case where an app origin is not in an app process.
     return true;
   }
 };
 
 // Renderer processes should not be able to spoof Origin HTTP headers.
 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, InvalidOriginHeaders) {
   // Create a set of IPC messages with various Origin headers.
   ResourceRequest chrome_origin_msg(
       CreateXHRRequestWithOrigin("chrome://settings"));
   ResourceRequest embedder_isolated_origin_msg(
       CreateXHRRequestWithOrigin("https://isolated.bar.com"));
   ResourceRequest invalid_origin_msg(CreateXHRRequestWithOrigin("invalidurl"));
   ResourceRequest invalid_scheme_origin_msg(
       CreateXHRRequestWithOrigin("fake-scheme://foo"));
 
   GURL web_url("http://foo.com/simple_page.html");
   NavigateToURL(shell(), web_url);
   RenderFrameHost* web_rfh = shell()->web_contents()->GetMainFrame();
 
+  ResourceDispatcherHost::Get()->AddSchemeForAccessCheck("https");
+
+  ResourceDispatcherHost::Get()->AddOriginAccessInformation(
+      shell()->web_contents()->GetBrowserContext()->GetResourceContext(),
+      "https://isolated.bar.com");
+
   // Web processes cannot make XHRs with chrome:// Origin headers.
   {
     RenderProcessHostWatcher web_process_killed(
         web_rfh->GetProcess(),
         RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
     IPC::IpcSecurityTestUtil::PwnMessageReceived(
         web_rfh->GetProcess()->GetChannel(),
         ResourceHostMsg_RequestResource(web_rfh->GetRoutingID(),
                                         kRequestIdNotPreviouslyUsed,
                                         chrome_origin_msg));
@@ skipping 111 matching lines @@
   // separate task of the message loop, so ensure that the process is still
   // considered alive.
   EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection());
 
   exit_observer.Wait();
   EXPECT_FALSE(exit_observer.did_exit_normally());
   ResourceDispatcherHost::Get()->SetDelegate(nullptr);
 }
 
 }  // namespace content