Only do security checks on javascript: URLs for frames for loading

third_party/WebKit/Source/core/html/HTMLFrameElementBase.h

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann <hausmann@kde.org>
  * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
@@ skipping 23 matching lines @@
     bool canContainRangeEndPoint() const final { return false; }
 
     // FrameOwner overrides:
     ScrollbarMode scrollingMode() const override { return m_scrollingMode; }
     int marginWidth() const override { return m_marginWidth; }
     int marginHeight() const override { return m_marginHeight; }
 
 protected:
     HTMLFrameElementBase(const QualifiedName&, Document&);
 
-    bool isURLAllowed() const;
+    enum ReasonForCallingURLAllowed { WillLoadURL, WillNotLoadURL };
+    bool isURLAllowed(ReasonForCallingURLAllowed) const;
 
     void parseAttribute(const QualifiedName&, const AtomicString&, const AtomicString&) override;
     InsertionNotificationRequest insertedInto(ContainerNode*) override;
     void didNotifySubtreeInsertionsToDocument() final;
     void attachLayoutTree(const AttachContext& = AttachContext()) override;
 
     // FIXME: Remove this method once we have input routing in the browser
     // process. See http://crbug.com/339659.
     void defaultEventHandler(Event*) override;
 
@@ skipping 28 matching lines @@
 inline bool isHTMLFrameElementBase(const HTMLElement& element)
 {
     return isHTMLFrameElement(element) || isHTMLIFrameElement(element);
 }
 
 DEFINE_HTMLELEMENT_TYPE_CASTS_WITH_FUNCTION(HTMLFrameElementBase);
 
 } // namespace blink
 
 #endif // HTMLFrameElementBase_h