Reenable framebusting deprecation, change it to allow navigation if iframe has ever had a user gestu

third_party/WebKit/Source/core/frame/Frame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
@@ skipping 29 matching lines @@
 #include "core/inspector/InspectorInstrumentation.h"
 #include "core/inspector/InstanceCounters.h"
 #include "core/layout/LayoutPart.h"
 #include "core/layout/api/LayoutPartItem.h"
 #include "core/loader/EmptyClients.h"
 #include "core/loader/FrameLoaderClient.h"
 #include "core/loader/NavigationScheduler.h"
 #include "core/page/FocusController.h"
 #include "core/page/Page.h"
 #include "platform/Histogram.h"
-#include "platform/UserGestureIndicator.h"
 
 namespace blink {
 
 using namespace HTMLNames;
 
 Frame::~Frame() {
   InstanceCounters::decrementCounter(InstanceCounters::FrameCounter);
   ASSERT(!m_owner);
 }
 
@@ skipping 103 matching lines @@
 
   if (targetFrame != this &&
       !securityContext()->isSandboxed(SandboxTopNavigation) &&
       targetFrame == tree().top()) {
     DEFINE_STATIC_LOCAL(EnumerationHistogram, framebustHistogram,
                         ("WebCore.Framebust", 4));
     const unsigned userGestureBit = 0x1;
     const unsigned allowedBit = 0x2;
     unsigned framebustParams = 0;
     UseCounter::count(&targetFrame, UseCounter::TopNavigationFromSubFrame);
-    bool hasUserGesture = UserGestureIndicator::processingUserGesture();
+    bool hasUserGesture =
+        isLocalFrame()
+            ? toLocalFrame(this)->document()->hasReceivedUserGesture()

[Rick Byers, 2016/10/06 16:26:47]

I've been looking over all the places that take a UserGestureIndicator and I'm
nervous about the other cases you haven't yet instrumented.  For example, it
seems there are accessibility scenarios.  It would be bad it frame-busting
worked for input-driven navigation but not accessibility-tool driven navigation,
right?

One mitigation could be to also check processingUserGesture here.  But really
the only full solution is probably to audit every single instance of
UserGestureIndicator and associate a Document with it :-(

+            : false;
     if (hasUserGesture)
       framebustParams |= userGestureBit;
     if (isAllowedNavigation)
       framebustParams |= allowedBit;
     framebustHistogram.count(framebustParams);
     // Frame-busting used to be generally allowed in most situations, but may now blocked if there is no user gesture.
     if (!RuntimeEnabledFeatures::
             framebustingNeedsSameOriginOrUserGestureEnabled())
       return true;
     if (hasUserGesture || isAllowedNavigation)
@@ skipping 141 matching lines @@
 
   ASSERT(page());
 
   if (m_owner)
     m_owner->setContentFrame(*this);
   else
     page()->setMainFrame(this);
 }
 
 }  // namespace blink