iframes with allowpaymentrequest attribute are allowed to make payment requests.

third_party/WebKit/Source/modules/payments/PaymentRequest.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/payments/PaymentRequest.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/JSONValuesForV8.h"
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 #include "bindings/core/v8/ScriptState.h"
 #include "bindings/modules/v8/V8PaymentDetails.h"
 #include "core/EventTypeNames.h"
 #include "core/dom/DOMException.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/events/Event.h"
 #include "core/events/EventQueue.h"
+#include "core/frame/FrameOwner.h"
+#include "core/html/HTMLIFrameElement.h"
 #include "modules/EventTargetModulesNames.h"
+#include "modules/payments/HTMLIFrameElementPayments.h"
 #include "modules/payments/PaymentAddress.h"
 #include "modules/payments/PaymentItem.h"
 #include "modules/payments/PaymentRequestUpdateEvent.h"
 #include "modules/payments/PaymentResponse.h"
 #include "modules/payments/PaymentShippingOption.h"
 #include "modules/payments/PaymentsValidators.h"
 #include "mojo/public/cpp/bindings/interface_request.h"
 #include "mojo/public/cpp/bindings/wtf_array.h"
 #include "platform/mojo/MojoHelper.h"
 #include "public/platform/InterfaceProvider.h"
@@ skipping 393 matching lines @@
 
 mojom::blink::PaymentDetailsPtr maybeKeepShippingOptions(
     mojom::blink::PaymentDetailsPtr details,
     bool keep) {
   if (!keep)
     details->shipping_options.resize(0);
 
   return details;
 }
 
+bool allowedToUsePaymentRequest(const Frame* frame) {
+  // To determine whether a Document object |document| is allowed to use the
+  // feature indicated by attribute name |allowpaymentrequest|, run these steps:
+
+  // 1. If |document| has no browsing context, then return false.
+  if (!frame)
+    return false;
+
+  // 2. If |document|'s browsing context is a top-level browsing context, then
+  // return true.
+  if (frame->isMainFrame())
+    return true;
+
+  // 3. If |document|'s browsing context has a browsing context container that
+  // is an iframe element with an |allowpaymentrequest| attribute specified, and
+  // whose node document is allowed to use the feature indicated by
+  // |allowpaymentrequest|, then return true.
+  HTMLFrameOwnerElement* ownerElement = toHTMLFrameOwnerElement(frame->owner());
+  if (ownerElement && isHTMLIFrameElement(ownerElement)) {
+    HTMLIFrameElement* iframe = toHTMLIFrameElement(ownerElement);
+    if (HTMLIFrameElementPayments::from(*iframe).allowPaymentRequest(*iframe))
+      return allowedToUsePaymentRequest(frame->tree().parent());
+  }
+
+  // 4. Return false.
+  return false;
+}
+
 }  // namespace
 
 PaymentRequest* PaymentRequest::create(
     ScriptState* scriptState,
     const HeapVector<PaymentMethodData>& methodData,
     const PaymentDetails& details,
     ExceptionState& exceptionState) {
   return new PaymentRequest(scriptState, methodData, details, PaymentOptions(),
                             exceptionState);
 }
@@ skipping 160 matching lines @@
   validateAndConvertPaymentMethodData(methodData, &validatedMethodData,
                                       exceptionState);
   if (exceptionState.hadException())
     return;
 
   if (!scriptState->getExecutionContext()->isSecureContext()) {
     exceptionState.throwSecurityError("Must be in a secure context");
     return;
   }
 
-  if (!scriptState->domWindow()->frame() ||
-      !scriptState->domWindow()->frame()->isMainFrame()) {
+  if (!allowedToUsePaymentRequest(scriptState->domWindow()->frame())) {
     exceptionState.throwSecurityError(
-        "Must be in a top-level browsing context");
+        "Must be in a top-level browsing context or an iframe needs to specify "
+        "'allowpaymentrequest' explicitly");
     return;
   }
 
   bool keepShippingOptions = validatePaymentDetails(details, exceptionState);
   if (exceptionState.hadException())
     return;
 
   if (details.hasError() && !details.error().isEmpty()) {
     exceptionState.throwTypeError("Error value should be empty");
     return;
@@ skipping 186 matching lines @@
   m_completeTimer.stop();
   m_completeResolver.clear();
   m_showResolver.clear();
   m_abortResolver.clear();
   if (m_clientBinding.is_bound())
     m_clientBinding.Close();
   m_paymentProvider.reset();
 }
 
 }  // namespace blink