window.close() should work from a sandboxed iframe if iframe is opener

third_party/WebKit/Source/core/frame/Frame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
@@ skipping 189 matching lines @@
           toLocalFrame(this)->document());
     return false;
   }
   if (!isAllowedNavigation && !errorReason.isNull())
     printNavigationErrorMessage(targetFrame, errorReason.latin1().data());
   return isAllowedNavigation;
 }
 
 bool Frame::canNavigateWithoutFramebusting(const Frame& targetFrame,
                                            String& reason) {
+  if (&targetFrame == this)
+    return true;
+
   if (securityContext()->isSandboxed(SandboxNavigation)) {
-    // Sandboxed frames can navigate their own children.
-    if (targetFrame.tree().isDescendantOf(this))
-      return true;
-
-    // They can also navigate popups, if the 'allow-sandbox-escape-via-popup'
-    // flag is specified.
-    if (targetFrame == targetFrame.tree().top() &&
-        targetFrame.tree().top() != tree().top() &&
-        !securityContext()->isSandboxed(
-            SandboxPropagatesToAuxiliaryBrowsingContexts))
-      return true;
-
-    // Top navigation can be opted-in.
-    if (!securityContext()->isSandboxed(SandboxTopNavigation) &&
-        targetFrame == tree().top())
-      return true;
-
-    // Otherwise, block the navigation.
-    if (securityContext()->isSandboxed(SandboxTopNavigation) &&
-        targetFrame == tree().top())
-      reason =
-          "The frame attempting navigation of the top-level window is "
-          "sandboxed, but the 'allow-top-navigation' flag is not set.";
-    else
+    if (!targetFrame.tree().isDescendantOf(this) &&
+        !targetFrame.isMainFrame()) {
       reason =
           "The frame attempting navigation is sandboxed, and is therefore "
           "disallowed from navigating its ancestors.";
-    return false;
+      return false;
+    }
+
+    // Sandboxed frames can also navigate popups, if the
+    // 'allow-sandbox-escape-via-popup' flag is specified, or if
+    // 'allow-popups' flag is specified, or if the
+    if (targetFrame.isMainFrame() && targetFrame != tree().top() &&
+        securityContext()->isSandboxed(
+            SandboxPropagatesToAuxiliaryBrowsingContexts) &&
+        (securityContext()->isSandboxed(SandboxPopups) ||
+         targetFrame.client()->opener() != this)) {
+      reason =
+          "The frame attempting navigation is sandboxed and is trying "
+          "to navigate a popup, but is not the popup's opener and is not "
+          "set to propagate sandboxing to popups.";
+      return false;
+    }
+
+    // Top navigation is forbidden unless opted-in. allow-top-navigation
+    // will also skips origin checks.
+    if (targetFrame == tree().top()) {
+      if (securityContext()->isSandboxed(SandboxTopNavigation)) {
+        reason =
+            "The frame attempting navigation of the top-level window is "
+            "sandboxed, but the 'allow-top-navigation' flag is not set.";
+        return false;
+      }
+      return true;
+    }
   }
 
   ASSERT(securityContext()->getSecurityOrigin());
   SecurityOrigin& origin = *securityContext()->getSecurityOrigin();
 
   // This is the normal case. A document can navigate its decendant frames,
   // or, more generally, a document can navigate a frame if the document is
   // in the same origin as any of that frame's ancestors (in the frame
   // hierarchy).
   //
@@ skipping 84 matching lines @@
 
   ASSERT(page());
 
   if (m_owner)
     m_owner->setContentFrame(*this);
   else
     page()->setMainFrame(this);
 }
 
 }  // namespace blink