Throw an exception when denying access to 'Frame's 'location' setter.

Source/bindings/v8/BindingSecurity.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 16 matching lines @@
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
 #include "bindings/v8/BindingSecurity.h"
 
 #include "bindings/v8/V8Binding.h"
 #include "core/dom/Document.h"
 #include "core/html/HTMLFrameElementBase.h"
-#include "core/html/parser/HTMLParserIdioms.h"
 #include "core/page/DOMWindow.h"
 #include "core/page/Frame.h"
 #include "core/page/Settings.h"
 #include "weborigin/SecurityOrigin.h"
 
 namespace WebCore {
 
-static bool canAccessDocument(Document* targetDocument, SecurityReportingOption reportingOption = ReportSecurityError)
+static bool isDocumentAccessibleFromDOMWindow(Document* targetDocument, DOMWindow* activeWindow)
 {
     if (!targetDocument)
         return false;
 
-    DOMWindow* active = activeDOMWindow();
-    if (!active)
+    if (!activeWindow)
         return false;
 
-    if (active->document()->securityOrigin()->canAccess(targetDocument->securityOrigin()))
+    if (activeWindow->document()->securityOrigin()->canAccess(targetDocument->securityOrigin()))
+        return true;
+
+    return false;
+}
+
+static bool canAccessDocument(Document* targetDocument, ExceptionState& es)
+{
+    DOMWindow* activeWindow = activeDOMWindow();
+    if (isDocumentAccessibleFromDOMWindow(targetDocument, activeWindow))
+        return true;
+
+    es.throwSecurityError(targetDocument->domWindow()->sanitizedCrossDomainAccessErrorMessage(activeWindow), targetDocument->domWindow()->crossDomainAccessErrorMessage(activeWindow));
+    return false;
+}
+
+static bool canAccessDocument(Document* targetDocument, SecurityReportingOption reportingOption = ReportSecurityError)
+{
+    DOMWindow* activeWindow = activeDOMWindow();
+    if (isDocumentAccessibleFromDOMWindow(targetDocument, activeWindow))
         return true;
 
     if (reportingOption == ReportSecurityError) {
         if (Frame* frame = targetDocument->frame())
-            frame->domWindow()->printErrorMessage(targetDocument->domWindow()->crossDomainAccessErrorMessage(active));
+            frame->domWindow()->printErrorMessage(targetDocument->domWindow()->crossDomainAccessErrorMessage(activeWindow));
     }
 
     return false;
 }
 
 bool BindingSecurity::shouldAllowAccessToFrame(Frame* target, SecurityReportingOption reportingOption)
 {
     return target && canAccessDocument(target->document(), reportingOption);
 }
 
+bool BindingSecurity::shouldAllowAccessToFrame(Frame* target, ExceptionState& es)
+{
+    return target && canAccessDocument(target->document(), es);
+}
+
 bool BindingSecurity::shouldAllowAccessToNode(Node* target)
 {
     return target && canAccessDocument(target->document());
 }
 
-bool BindingSecurity::allowSettingFrameSrcToJavascriptUrl(HTMLFrameElementBase* frame, const String& value)
-{
-    return !protocolIsJavaScript(stripLeadingAndTrailingHTMLSpaces(value)) || canAccessDocument(frame->contentDocument());
 }
-
-}