iframes with allowpaymentrequest attribute are allowed to make payment requests.

third_party/WebKit/Source/modules/payments/PaymentRequest.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/payments/PaymentRequest.h"
 
 #include "bindings/core/v8/ExceptionState.h"
 #include "bindings/core/v8/JSONValuesForV8.h"
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 #include "bindings/core/v8/ScriptState.h"
 #include "bindings/modules/v8/V8PaymentDetails.h"
 #include "core/EventTypeNames.h"
 #include "core/dom/DOMException.h"
 #include "core/dom/ExceptionCode.h"
 #include "core/events/Event.h"
 #include "core/events/EventQueue.h"
+#include "core/frame/FrameOwner.h"
 #include "modules/EventTargetModulesNames.h"
 #include "modules/payments/PaymentAddress.h"
 #include "modules/payments/PaymentItem.h"
 #include "modules/payments/PaymentRequestUpdateEvent.h"
 #include "modules/payments/PaymentResponse.h"
 #include "modules/payments/PaymentShippingOption.h"
 #include "modules/payments/PaymentsValidators.h"
 #include "mojo/public/cpp/bindings/interface_request.h"
 #include "mojo/public/cpp/bindings/wtf_array.h"
 #include "platform/mojo/MojoHelper.h"
@@ skipping 375 matching lines @@
   static const char* const validValues[] = {
       "shipping", "delivery", "pickup",
   };
   for (size_t i = 0; i < WTF_ARRAY_LENGTH(validValues); i++) {
     if (shippingType == validValues[i])
       return shippingType;
   }
   return validValues[0];
 }
 
+bool allowedToUsePaymentRequest(const Frame* frame) {
+  // To determine whether a Document object |document| is allowed to use the
+  // feature indicated by attribute name |allowpaymentrequest|, run these steps:
+
+  // 1. If |document| has no browsing context, then return false.
+  if (!frame)
+    return false;
+
+  // 2. If |document|'s browsing context is a top-level browsing context, then
+  // return true.
+  if (frame->isMainFrame())
+    return true;
+
+  // 3. If |document|'s browsing context has a browsing context container that
+  // is an iframe element with an |allowpaymentrequest| attribute specified, and
+  // whose node document is allowed to use the feature indicated by
+  // |allowpaymentrequest|, then return true.
+  if (frame->owner() && frame->owner()->allowPaymentRequest())
+    return allowedToUsePaymentRequest(frame->tree().parent());
+
+  // 4. Return false.
+  return false;
+}
+
 }  // namespace
 
 PaymentRequest* PaymentRequest::create(
     ScriptState* scriptState,
     const HeapVector<PaymentMethodData>& methodData,
     const PaymentDetails& details,
     ExceptionState& exceptionState) {
   return new PaymentRequest(scriptState, methodData, details, PaymentOptions(),
                             exceptionState);
 }
@@ skipping 155 matching lines @@
   validateAndConvertPaymentMethodData(methodData, &validatedMethodData,
                                       exceptionState);
   if (exceptionState.hadException())
     return;
 
   if (!scriptState->getExecutionContext()->isSecureContext()) {
     exceptionState.throwSecurityError("Must be in a secure context");
     return;
   }
 
-  if (!scriptState->domWindow()->frame() ||
-      !scriptState->domWindow()->frame()->isMainFrame()) {
+  if (!allowedToUsePaymentRequest(scriptState->domWindow()->frame())) {
     exceptionState.throwSecurityError(
-        "Must be in a top-level browsing context");
+        "Must be in a top-level browsing context or an iframe needs to specify "
+        "'allowpaymentrequest' explicitly");
     return;
   }
 
   PaymentDetails fixedDetails(details);
   validateAndFixupPaymentDetails(fixedDetails, exceptionState);
   if (exceptionState.hadException())
     return;
 
   if (fixedDetails.hasError() && !fixedDetails.error().isEmpty()) {
     exceptionState.throwTypeError("Error value should be empty");
@@ skipping 185 matching lines @@
   m_completeTimer.stop();
   m_completeResolver.clear();
   m_showResolver.clear();
   m_abortResolver.clear();
   if (m_clientBinding.is_bound())
     m_clientBinding.Close();
   m_paymentProvider.reset();
 }
 
 }  // namespace blink