Throw an exception when denying access to 'Frame's 'location' setter.

Source/core/page/DOMWindow.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2010 Apple Inc. All rights reserved.
  * Copyright (C) 2010 Nokia Corporation and/or its subsidiary(-ies)
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 1553 matching lines @@
 }
 
 void DOMWindow::printErrorMessage(const String& message)
 {
     if (message.isEmpty())
         return;
 
     pageConsole()->addMessage(JSMessageSource, ErrorMessageLevel, message);
 }
 
+// FIXME: Once we're throwing exceptions for cross-origin access violations, we will always sanitize the target
+// frame details, so we can safely combine 'crossDomainAccessErrorMessage' with this method after considering
+// exactly which details may be exposed to JavaScript.
+//
+// http://crbug.com/17325
+String DOMWindow::sanitizedCrossDomainAccessErrorMessage(DOMWindow* activeWindow)
+{
+    const KURL& activeWindowURL = activeWindow->document()->url();
+    if (activeWindowURL.isNull())
+        return String();
+
+    ASSERT(!activeWindow->document()->securityOrigin()->canAccess(document()->securityOrigin()));
+
+    SecurityOrigin* activeOrigin = activeWindow->document()->securityOrigin();
+    String message = "Blocked a frame with origin \"" + activeOrigin->toString() + "\" from accessing a cross-origin frame.";
+
+    // FIXME: Evaluate which details from 'crossDomainAccessErrorMessage' may safely be reported to JavaScript.
+
+    return message;
+}
+
 String DOMWindow::crossDomainAccessErrorMessage(DOMWindow* activeWindow)
 {
     const KURL& activeWindowURL = activeWindow->document()->url();
     if (activeWindowURL.isNull())
         return String();
 
     ASSERT(!activeWindow->document()->securityOrigin()->canAccess(document()->securityOrigin()));
 
     // FIXME: This message, and other console messages, have extra newlines. Should remove them.
     SecurityOrigin* activeOrigin = activeWindow->document()->securityOrigin();
@@ skipping 141 matching lines @@
 
     Frame* child = frame->tree()->scopedChild(index);
     if (child)
         return child->domWindow();
 
     return 0;
 }
 
 
 } // namespace WebCore