GeolocationPermissionContext: only use origin from embedder url.

chrome/browser/geolocation/geolocation_infobar_delegate.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/geolocation/geolocation_infobar_delegate.h"
 
+#include "base/strings/string_split.h"
 #include "chrome/browser/content_settings/permission_queue_controller.h"
 #include "chrome/browser/google/google_util.h"
 #include "chrome/browser/infobars/infobar_service.h"
 #include "content/public/browser/navigation_details.h"
 #include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/web_contents.h"
 #include "grit/generated_resources.h"
 #include "grit/locale_settings.h"
 #include "grit/theme_resources.h"
 #include "net/base/net_util.h"
@@ skipping 41 matching lines @@
 }
 
 bool GeolocationInfoBarDelegate::Accept() {
   SetPermission(true, true);
   return true;
 }
 
 void GeolocationInfoBarDelegate::SetPermission(bool update_content_setting,
                                                bool allowed) {
   if (web_contents()) {
-    controller_->OnPermissionSet(id_, requesting_frame_,
-                                 web_contents()->GetURL(),
+    GURL embedder = web_contents()->GetLastCommittedURL();
+    if (embedder.has_ref()) {
+      // The ref (the hash) is not important here, and including it may cause a
+      // comparison failure later because it can change.
+      std::vector<std::string> parts;
+      base::SplitString(embedder.spec(), '#', &parts);
+      embedder = GURL(parts[0]);

[joth, 2013/09/12 16:43:13]

rather than grepping for # I think you can use this to remove one component:
  embedder = embedder.ReplaceComponents(...)

Although, geolocation is keyed entirely off the origin -- path & query
components are also irrelevant. So you should be just using .GetOrigin() here or
wherever the comparisons occur.

[Michael van Ouwerkerk, 2013/09/12 16:50:41]

Done.

+    }
+
+    controller_->OnPermissionSet(id_, requesting_frame_, embedder,

[bulach, 2013/09/12 16:28:41]

probably best to have just the controller and context sanitizing their inputs by
using GetOrigin(), wdyt?

[Michael van Ouwerkerk, 2013/09/12 16:50:41]

Done.

                                  update_content_setting, allowed);
   }
 }
 
 void GeolocationInfoBarDelegate::InfoBarDismissed() {
   SetPermission(false, false);
 }
 
 int GeolocationInfoBarDelegate::GetIconID() const {
   return IDR_GEOLOCATION_INFOBAR_ICON;
@@ skipping 43 matching lines @@
       "https://www.google.com/support/chrome/bin/answer.py?answer=142065";
 #endif
 
   web_contents()->OpenURL(content::OpenURLParams(
       google_util::AppendGoogleLocaleParam(GURL(kGeolocationLearnMoreUrl)),
       content::Referrer(),
       (disposition == CURRENT_TAB) ? NEW_FOREGROUND_TAB : disposition,
       content::PAGE_TRANSITION_LINK, false));
   return false;  // Do not dismiss the info bar.
 }