Remove about:srcdoc url conversion.

content/browser/child_process_security_policy_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/child_process_security_policy_impl.h"
 
 #include <algorithm>
 #include <utility>
 
 #include "base/command_line.h"
@@ skipping 608 matching lines @@
 
   state->second->RevokeReadRawCookies();
 }
 
 bool ChildProcessSecurityPolicyImpl::CanRequestURL(
     int child_id, const GURL& url) {
   if (!url.is_valid())
     return false;  // Can't request invalid URLs.
 
   if (IsPseudoScheme(url.scheme())) {
-    // Every child process can request <about:blank>.
-    if (base::LowerCaseEqualsASCII(url.spec(), url::kAboutBlankURL))
+    // Every child process can request <about:blank> and <about:srcdoc>

[Charlie Reis, 2016/11/23 08:25:21]

nit: End with period.

[arthursonzogni, 2016/11/23 14:39:26]

Done.

+    if (url == url::kAboutBlankURL || url == content::kAboutSrcDocURL)
       return true;
     // URLs like <about:version>, <about:crash>, <view-source:...> shouldn't be
     // requestable by any child process.  Also, this case covers
     // <javascript:...>, which should be handled internally by the process and
     // not kicked up to the browser.
     return false;
   }
 
   // Blob and filesystem URLs require special treatment, since they embed an
   // inner origin.
@@ skipping 16 matching lines @@
   // Also allow URLs destined for ShellExecute and not the browser itself.
   return !GetContentClient()->browser()->IsHandledURL(url) &&
          !net::URLRequest::IsHandledURL(url);
 }
 
 bool ChildProcessSecurityPolicyImpl::CanCommitURL(int child_id,
                                                   const GURL& url) {
   if (!url.is_valid())
     return false;  // Can't commit invalid URLs.
 
   // Of all the pseudo schemes, only about:blank is allowed to commit.

[Charlie Reis, 2016/11/23 08:25:20]

Do we need to allow about:srcdoc here, or will that never get this far?

[arthursonzogni, 2016/11/23 14:39:26]

Good question!

CanCommitURL is called inside several function in 
* /content/browser/child_process_security_policy_impl.cc
* /content/browser/blob_storage/blob_dispatcher_host.cc

Where it can't be called with <about:srcdoc>:
* In CanRequestURL: Never called because of the early return.
* In CanCommitURL: Called only with blob: and file: scheme.
* In HasPermissionsForFileSystemFile: called only with file: scheme.
* In OnRegisterPublicBlobURL: called only with blob: scheme.

Where it is called with <about:srcdoc>
* In CanSetAsOriginHeader -> I think the correct behaviour is that it
  must returns false. It is the case if CanCommitURL(<about:srcdoc>)
  returns false too.

Thus, if we don't touch anything, the global behavior is preserved
(and is correct according to me). The only problem is that the meaning
of CanCommitURL is not respected because <about:srcdoc> can actually be
committed. Do you think CanCommitURL(<about:srcdoc>) should be true?

[Charlie Reis, 2016/11/23 18:03:37]

Glad to hear.

In the abstract, yes, about:srcdoc can commit, so it's a little odd for this to
return false in that case.  Sounds like that would only matter in future
possible uses for CanCommitURL, though, and we have test coverage that should
catch the problem if it does start to matter.  Thus, I'm ok either way for this
CL.

[Charlie Reis, 2016/11/24 00:17:00]

Nick brings up the point that it's probably saner for CanCommitURL to return
true for about:srcdoc if we can, even if it happens to work in most cases.

   if (IsPseudoScheme(url.scheme()))
-    return base::LowerCaseEqualsASCII(url.spec(), url::kAboutBlankURL);
+    return url == url::kAboutBlankURL;
 
   // Blob and filesystem URLs require special treatment; validate the inner
   // origin they embed.
   if (url.SchemeIsBlob() || url.SchemeIsFileSystem()) {
     if (IsMalformedBlobUrl(url))
       return false;
 
     url::Origin origin(url);
     return origin.unique() || CanCommitURL(child_id, GURL(origin.Serialize()));
   }
@@ skipping 313 matching lines @@
   base::AutoLock lock(lock_);
 
   SecurityStateMap::iterator state = security_state_.find(child_id);
   if (state == security_state_.end())
     return false;
 
   return state->second->can_send_midi_sysex();
 }
 
 }  // namespace content