Throw when blocking top-level navigation.

third_party/WebKit/Source/core/frame/Location.cpp

 /*
  * Copyright (C) 2008, 2010 Apple Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
  * 2.  Redistributions in binary form must reproduce the above copyright
@@ skipping 117 matching lines @@
 }
 
 String Location::hash() const
 {
     if (!m_frame)
         return String();
 
     return DOMURLUtilsReadOnly::hash(url());
 }
 
-void Location::setHref(LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, const String& url)
+void Location::setHref(LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, const String& url, ExceptionState& exceptionState)
 {
     if (!m_frame)
         return;
-    setLocation(url, currentWindow, enteredWindow);
+    setLocation(url, currentWindow, enteredWindow, &exceptionState);
 }
 
 void Location::setProtocol(LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, const String& protocol, ExceptionState& exceptionState)
 {
     if (!m_frame)
         return;
     KURL url = toLocalFrame(m_frame)->document()->url();
     if (!url.setProtocol(protocol)) {
         exceptionState.throwDOMException(SyntaxError, "'" + protocol + "' is an invalid protocol.");
         return;
     }
-    setLocation(url.getString(), currentWindow, enteredWindow);
+    setLocation(url.getString(), currentWindow, enteredWindow, &exceptionState);
 }
 
-void Location::setHost(LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, const String& host)
+void Location::setHost(LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, const String& host, ExceptionState& exceptionState)
 {
     if (!m_frame)
         return;
     KURL url = toLocalFrame(m_frame)->document()->url();
     url.setHostAndPort(host);
-    setLocation(url.getString(), currentWindow, enteredWindow);
+    setLocation(url.getString(), currentWindow, enteredWindow, &exceptionState);
 }
 
-void Location::setHostname(LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, const String& hostname)
+void Location::setHostname(LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, const String& hostname, ExceptionState& exceptionState)
 {
     if (!m_frame)
         return;
     KURL url = toLocalFrame(m_frame)->document()->url();
     url.setHost(hostname);
-    setLocation(url.getString(), currentWindow, enteredWindow);
+    setLocation(url.getString(), currentWindow, enteredWindow, &exceptionState);
 }
 
-void Location::setPort(LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, const String& portString)
+void Location::setPort(LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, const String& portString, ExceptionState& exceptionState)
 {
     if (!m_frame)
         return;
     KURL url = toLocalFrame(m_frame)->document()->url();
     url.setPort(portString);
-    setLocation(url.getString(), currentWindow, enteredWindow);
+    setLocation(url.getString(), currentWindow, enteredWindow, &exceptionState);
 }
 
-void Location::setPathname(LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, const String& pathname)
+void Location::setPathname(LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, const String& pathname, ExceptionState& exceptionState)
 {
     if (!m_frame)
         return;
     KURL url = toLocalFrame(m_frame)->document()->url();
     url.setPath(pathname);
-    setLocation(url.getString(), currentWindow, enteredWindow);
+    setLocation(url.getString(), currentWindow, enteredWindow, &exceptionState);
 }
 
-void Location::setSearch(LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, const String& search)
+void Location::setSearch(LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, const String& search, ExceptionState& exceptionState)
 {
     if (!m_frame)
         return;
     KURL url = toLocalFrame(m_frame)->document()->url();
     url.setQuery(search);
-    setLocation(url.getString(), currentWindow, enteredWindow);
+    setLocation(url.getString(), currentWindow, enteredWindow, &exceptionState);
 }
 
-void Location::setHash(LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, const String& hash)
+void Location::setHash(LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, const String& hash, ExceptionState& exceptionState)
 {
     if (!m_frame)
         return;
     KURL url = toLocalFrame(m_frame)->document()->url();
     String oldFragmentIdentifier = url.fragmentIdentifier();
     String newFragmentIdentifier = hash;
     if (hash[0] == '#')
         newFragmentIdentifier = hash.substring(1);
     url.setFragmentIdentifier(newFragmentIdentifier);
     // Note that by parsing the URL and *then* comparing fragments, we are
     // comparing fragments post-canonicalization, and so this handles the
     // cases where fragment identifiers are ignored or invalid.
     if (equalIgnoringNullity(oldFragmentIdentifier, url.fragmentIdentifier()))
         return;
-    setLocation(url.getString(), currentWindow, enteredWindow);
+    setLocation(url.getString(), currentWindow, enteredWindow, &exceptionState);
 }
 
 void Location::assign(LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, const String& url, ExceptionState& exceptionState)
 {
     if (!m_frame)
         return;
     setLocation(url, currentWindow, enteredWindow, &exceptionState);
 }
 
 void Location::replace(LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, const String& url, ExceptionState& exceptionState)
@@ skipping 11 matching lines @@
         return;
     m_frame->reload(FrameLoadTypeReload, ClientRedirectPolicy::ClientRedirect);
 }
 
 void Location::setLocation(const String& url, LocalDOMWindow* currentWindow, LocalDOMWindow* enteredWindow, ExceptionState* exceptionState, SetLocation locationPolicy)
 {
     ASSERT(m_frame);
     if (!m_frame || !m_frame->host())
         return;
 
-    if (!currentWindow->frame() || !currentWindow->frame()->canNavigate(*m_frame))
+    if (!currentWindow->frame())
         return;
 
+    if (!currentWindow->frame()->canNavigate(*m_frame)) {
+        if (exceptionState)
+            exceptionState->throwSecurityError("The current window does not have permission to navigate the target frame to '" + url + "'.");
+        return;
+    }
+
     Document* enteredDocument = enteredWindow->document();
     if (!enteredDocument)
         return;
 
     KURL completedURL = enteredDocument->completeURL(url);
     if (completedURL.isNull())
         return;
     if (exceptionState && !completedURL.isValid()) {
         exceptionState->throwDOMException(SyntaxError, "'" + url + "' is not a valid URL.");
         return;
     }
 
     if (m_frame->domWindow()->isInsecureScriptAccess(*currentWindow, completedURL))
         return;
 
     V8DOMActivityLogger* activityLogger = V8DOMActivityLogger::currentActivityLoggerIfIsolatedWorld();
     if (activityLogger) {
         Vector<String> argv;
         argv.append("LocalDOMWindow");
         argv.append("url");
         argv.append(enteredDocument->url());
         argv.append(completedURL);
         activityLogger->logEvent("blinkSetAttribute", argv.size(), argv.data());
     }
     m_frame->navigate(*currentWindow->document(), completedURL, locationPolicy == SetLocation::ReplaceThisFrame, UserGestureStatus::None);
 }
 
 } // namespace blink