(re-land) Disallow navigations to blob URLs with non-canonical origins.

(re-land) Disallow navigations to blob URLs with non-canonical origins.

Re-landing this with a fix for xhr-to-blob-in-isolated-world.html

BUG=646278
TEST=content_browsertests, included

Committed: https://crrev.com/a76cc407d8a8530f05b03ece9a831b72f568aef1
Cr-Commit-Position: refs/heads/master@{#420436}

[ncarter (slow), 2016-09-21 22:44:01]

nick@chromium.org changed reviewers:
+ creis@chromium.org, japhet@chromium.org

[ncarter (slow), 2016-09-21 22:44:01]

nate: please review the layouttest

charlie: the only change is the layouttest, but I wanted to raise one question.
If we're affecting XHRs here, and there's a bunch of other places where we
consult CanRequestURL,. then I wonder if I need to proactively whitelist
'blob:blobinternal' URLs?

[Nate Chapin, 2016-09-21 22:44:59]

k. lgtm

[Charlie Reis, 2016-09-21 23:19:44]

On 2016/09/21 22:44:01, ncarter wrote:
> nate: please review the layouttest
> 
> charlie: the only change is the layouttest, but I wanted to raise one
question.
> If we're affecting XHRs here, and there's a bunch of other places where we
> consult CanRequestURL,. then I wonder if I need to proactively whitelist
> 'blob:blobinternal' URLs?

TIL.

I suppose the fact that nothing else broke the last time you landed this means
that Streams (which appear to be the users of blob:blobinternal) don't go
through CanRequestURL or CanCommitURL, or don't have any tests at all.  That's
odd in itself, but suggests we probably safe (assuming they have at least some
tests).  The PlzNavigate bot did seem ok with most of its tests on
https://build.chromium.org/p/chromium.fyi/builders/Browser%20Side%20Navigatio...,
and I think it uses these.

LGTM.

[ncarter (slow), 2016-09-22 18:21:48]

The CQ bit was checked by nick@chromium.org to run a CQ dry run

[ncarter (slow), 2016-09-22 18:22:06]

Added blobinternal:// support. PTAL

[commit-bot: I haz the power, 2016-09-22 18:22:27]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[ncarter (slow), 2016-09-22 18:24:42]

The CQ bit was checked by nick@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-09-22 18:24:52]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Charlie Reis, 2016-09-22 18:29:22]

Yeah, probably safer this way.  Thanks for the extra unit test to cover it. 
LGTM.

[ncarter (slow), 2016-09-22 18:36:06]

The CQ bit was unchecked by nick@chromium.org

[ncarter (slow), 2016-09-22 18:36:06]

The CQ bit was checked by nick@chromium.org

[ncarter (slow), 2016-09-22 18:36:07]

The patchset sent to the CQ was uploaded after l-g-t-m from japhet@chromium.org
Link to the patchset: https://codereview.chromium.org/2365433002/#ps60001
(title: "Remove newline")

[commit-bot: I haz the power, 2016-09-22 18:36:17]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-09-22 20:03:25]

Committed patchset #4 (id:60001)

[commit-bot: I haz the power, 2016-09-22 20:18:08]

Description was changed from

==========
(re-land) Disallow navigations to blob URLs with non-canonical origins.

Re-landing this with a fix for xhr-to-blob-in-isolated-world.html

BUG=646278
TEST=content_browsertests, included
==========

to

==========
(re-land) Disallow navigations to blob URLs with non-canonical origins.

Re-landing this with a fix for xhr-to-blob-in-isolated-world.html

BUG=646278
TEST=content_browsertests, included

Committed: https://crrev.com/a76cc407d8a8530f05b03ece9a831b72f568aef1
Cr-Commit-Position: refs/heads/master@{#420436}
==========

[commit-bot: I haz the power, 2016-09-22 20:18:10]

Patchset 4 (id:??) landed as
https://crrev.com/a76cc407d8a8530f05b03ece9a831b72f568aef1
Cr-Commit-Position: refs/heads/master@{#420436}