(Re-)introduce AncestorThrottle to handle 'X-Frame-Options'.

third_party/WebKit/Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
@@ skipping 1685 matching lines @@
 
   takeObjectSnapshot();
 }
 
 void FrameLoader::applyUserAgent(ResourceRequest& request) {
   String userAgent = this->userAgent();
   DCHECK(!userAgent.isNull());
   request.setHTTPUserAgent(AtomicString(userAgent));
 }
 
-bool FrameLoader::shouldInterruptLoadForXFrameOptions(
-    const String& content,
-    const KURL& url,
-    unsigned long requestIdentifier) {
-  UseCounter::count(m_frame->domWindow()->document(),
-                    UseCounter::XFrameOptions);
-
-  Frame* topFrame = m_frame->tree().top();
-  if (m_frame == topFrame)
-    return false;
-
-  XFrameOptionsDisposition disposition = parseXFrameOptionsHeader(content);
-
-  switch (disposition) {
-    case XFrameOptionsSameOrigin: {
-      UseCounter::count(m_frame->domWindow()->document(),
-                        UseCounter::XFrameOptionsSameOrigin);
-      RefPtr<SecurityOrigin> origin = SecurityOrigin::create(url);
-      // Out-of-process ancestors are always a different origin.
-      if (!topFrame->isLocalFrame() ||
-          !origin->isSameSchemeHostPort(
-              toLocalFrame(topFrame)->document()->getSecurityOrigin()))
-        return true;
-      for (Frame* frame = m_frame->tree().parent(); frame;
-           frame = frame->tree().parent()) {
-        if (!frame->isLocalFrame() ||
-            !origin->isSameSchemeHostPort(
-                toLocalFrame(frame)->document()->getSecurityOrigin())) {
-          UseCounter::count(
-              m_frame->domWindow()->document(),
-              UseCounter::XFrameOptionsSameOriginWithBadAncestorChain);
-          break;
-        }
-      }
-      return false;
-    }
-    case XFrameOptionsDeny:
-      return true;
-    case XFrameOptionsAllowAll:
-      return false;
-    case XFrameOptionsConflict: {
-      ConsoleMessage* consoleMessage = ConsoleMessage::createForRequest(
-          JSMessageSource, ErrorMessageLevel,
-          "Multiple 'X-Frame-Options' headers with conflicting values ('" +
-              content + "') encountered when loading '" + url.elidedString() +
-              "'. Falling back to 'DENY'.",
-          url, requestIdentifier);
-      m_frame->document()->addConsoleMessage(consoleMessage);
-      return true;
-    }
-    case XFrameOptionsInvalid: {
-      ConsoleMessage* consoleMessage = ConsoleMessage::createForRequest(
-          JSMessageSource, ErrorMessageLevel,
-          "Invalid 'X-Frame-Options' header encountered when loading '" +
-              url.elidedString() + "': '" + content +
-              "' is not a recognized directive. The header will be ignored.",
-          url, requestIdentifier);
-      m_frame->document()->addConsoleMessage(consoleMessage);
-      return false;
-    }
-    default:
-      NOTREACHED();
-      return false;
-  }
-}
-
 bool FrameLoader::shouldTreatURLAsSameAsCurrent(const KURL& url) const {
   return m_currentItem && url == m_currentItem->url();
 }
 
 bool FrameLoader::shouldTreatURLAsSrcdocDocument(const KURL& url) const {
   if (!url.isAboutSrcdocURL())
     return false;
   HTMLFrameOwnerElement* ownerElement = m_frame->deprecatedLocalOwner();
   if (!isHTMLIFrameElement(ownerElement))
     return false;
@@ skipping 154 matching lines @@
                          m_documentLoader ? m_documentLoader->url() : String());
   return tracedValue;
 }
 
 inline void FrameLoader::takeObjectSnapshot() const {
   TRACE_EVENT_OBJECT_SNAPSHOT_WITH_ID("loading", "FrameLoader", this,
                                       toTracedValue());
 }
 
 }  // namespace blink