Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(230)

Unified Diff: content/browser/child_process_security_policy_impl.cc

Issue 2358193002: Revert of Disallow navigations to blob URLs with non-canonical origins. (Closed)
Patch Set: Created 4 years, 3 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
Index: content/browser/child_process_security_policy_impl.cc
diff --git a/content/browser/child_process_security_policy_impl.cc b/content/browser/child_process_security_policy_impl.cc
index 111b070f1e1b496e7a852b027b89343b99188ff0..652a7ac175420cba631376bba186834094a5d1f8 100644
--- a/content/browser/child_process_security_policy_impl.cc
+++ b/content/browser/child_process_security_policy_impl.cc
@@ -579,14 +579,6 @@
return false;
}
- // https://crbug.com/646278 Valid blob URLs should contain canonically
- // serialized origins.
- if (url.SchemeIsBlob() &&
- !base::StartsWith(url.GetContent(), url::Origin(url).Serialize() + "/",
- base::CompareCase::INSENSITIVE_ASCII)) {
- return false;
- }
-
// If the process can commit the URL, it can request it.
if (CanCommitURL(child_id, url))
return true;
@@ -604,14 +596,6 @@
// Of all the pseudo schemes, only about:blank is allowed to commit.
if (IsPseudoScheme(url.scheme()))
return base::LowerCaseEqualsASCII(url.spec(), url::kAboutBlankURL);
-
- // https://crbug.com/646278 Valid blob URLs should contain canonically
- // serialized origins.
- if (url.SchemeIsBlob() &&
- !base::StartsWith(url.GetContent(), url::Origin(url).Serialize() + "/",
- base::CompareCase::INSENSITIVE_ASCII)) {
- return false;
- }
// TODO(creis): Tighten this for Site Isolation, so that a URL from a site
// that is isolated can only be committed in a process dedicated to that site.
« no previous file with comments | « content/browser/blob_storage/blob_url_browsertest.cc ('k') | content/browser/child_process_security_policy_unittest.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698