Block 'javascript:' navigation in the correct document.

third_party/WebKit/Source/core/html/HTMLFrameElementBase.cpp

 /*
  * Copyright (C) 1999 Lars Knoll (knoll@kde.org)
  *           (C) 1999 Antti Koivisto (koivisto@kde.org)
  *           (C) 2000 Simon Hausmann (hausmann@kde.org)
  *           (C) 2001 Dirk Mueller (mueller@kde.org)
  * Copyright (C) 2004, 2006, 2008, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
@@ skipping 14 matching lines @@
 
 #include "bindings/core/v8/ScriptController.h"
 #include "bindings/core/v8/ScriptEventListener.h"
 #include "core/HTMLNames.h"
 #include "core/dom/Attribute.h"
 #include "core/dom/Document.h"
 #include "core/frame/FrameView.h"
 #include "core/frame/LocalFrame.h"
 #include "core/frame/RemoteFrame.h"
 #include "core/frame/RemoteFrameView.h"
+#include "core/frame/csp/ContentSecurityPolicy.h"
 #include "core/html/parser/HTMLParserIdioms.h"
 #include "core/loader/FrameLoader.h"
 #include "core/loader/FrameLoaderClient.h"
 #include "core/page/FocusController.h"
 #include "core/page/Page.h"
 
 namespace blink {
 
 using namespace HTMLNames;
 
@@ skipping 32 matching lines @@
     m_URL = AtomicString(blankURL().getString());
 
   LocalFrame* parentFrame = document().frame();
   if (!parentFrame)
     return;
 
   // Support for <frame src="javascript:string">
   KURL scriptURL;
   KURL url = document().completeURL(m_URL);
   if (protocolIsJavaScript(m_URL)) {
-    scriptURL = url;
+    // We'll set/execute |scriptURL| iff CSP allows us to execute inline
+    // JavaScript. If CSP blocks inline JavaScript, then exit early if
+    // we're trying to execute script in an existing document. If we're
+    // executing JavaScript to create a new document (e.g.
+    // '<iframe src="javascript:...">' then continue loading 'about:blank'
+    // so that the frame is populated with something reasonable.
+    if (ContentSecurityPolicy::shouldBypassMainWorld(&document()) ||
+        document().contentSecurityPolicy()->allowJavaScriptURLs(
+            this, document().url(), OrdinalNumber::first())) {
+      scriptURL = url;
+    } else {
+      if (contentFrame())
+        return;
+    }
+
     url = blankURL();
   }
 
   if (!loadOrRedirectSubframe(url, m_frameName, replaceCurrentItem))
     return;
   if (!contentFrame() || scriptURL.isEmpty() || !contentFrame()->isLocalFrame())
     return;
   if (contentFrame()->owner()->getSandboxFlags() & SandboxOrigin)
     return;
   toLocalFrame(contentFrame())
@@ skipping 148 matching lines @@
   m_marginWidth = marginWidth;
   frameOwnerPropertiesChanged();
 }
 
 void HTMLFrameElementBase::setMarginHeight(int marginHeight) {
   m_marginHeight = marginHeight;
   frameOwnerPropertiesChanged();
 }
 
 }  // namespace blink