CSP: "local schemes" should inherit policy when window.opened.

CSP: "local schemes" should inherit policy when window.opened.

https://w3c.github.io/webappsec-csp/#initialize-document-csp mandates
that resources with "local schemes" ('data:', 'blob:', 'filesystem:',
'about:') inherit the policy of their opening context when opened via
things like 'window.open'. We're not doing that, but we ought to.

BUG=669086
R=jochen@chromium.org

Committed: https://crrev.com/e598765e4822eac833a547abca92ce87a1287dc0
Cr-Commit-Position: refs/heads/master@{#435233}

[Mike West, 2016-11-29 11:22:09]

The CQ bit was checked by mkwst@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-11-29 11:22:20]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Mike West, 2016-11-29 11:22:52]

mkwst@chromium.org changed reviewers:
+ dcheng@chromium.org

[Mike West, 2016-11-29 11:22:53]

jochen@, dcheng@: mind taking a look at this follow-on to the other CL you're
reviewing?

[commit-bot: I haz the power, 2016-11-29 12:20:55]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-11-29 12:20:56]

Dry run: Try jobs failed on following builders:
  mac_chromium_rel_ng on master.tryserver.chromium.mac (JOB_FAILED,
http://build.chromium.org/p/tryserver.chromium.mac/builders/mac_chromium_rel_...)

[dcheng, 2016-11-29 22:37:23]

lgtm with nits

https://codereview.chromium.org/2530343006/diff/1/third_party/WebKit/Source/c...
File third_party/WebKit/Source/core/dom/Document.cpp (right):

https://codereview.chromium.org/2530343006/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/dom/Document.cpp:5517: if (m_frame &&
m_frame->tree().parent())
Random musing: this feels kind of similar to
https://cs.chromium.org/chromium/src/third_party/WebKit/Source/core/loader/Do...,
it sure would be nice if we could combine them (though I'd need to simplify the
latter to use SecurityContext generically)

Would you mind adding a TODO(dcheng) for this?

https://codereview.chromium.org/2530343006/diff/1/third_party/WebKit/Source/c...
third_party/WebKit/Source/core/dom/Document.cpp:5519: else if (m_frame &&
m_frame->client())
Nit: I think we should be able to assume client() is non-null here; are there
cases where it isn't?

[Mike West, 2016-11-30 09:37:32]

The CQ bit was checked by mkwst@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-11-30 09:37:53]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[Mike West, 2016-11-30 12:32:26]

Patchset #3 (id:40001) has been deleted

[Mike West, 2016-11-30 12:32:32]

The CQ bit was checked by mkwst@chromium.org

[Mike West, 2016-11-30 12:32:32]

The patchset sent to the CQ was uploaded after l-g-t-m from dcheng@chromium.org
Link to the patchset: https://codereview.chromium.org/2530343006/#ps20001
(title: "feedback")

[commit-bot: I haz the power, 2016-11-30 12:32:43]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-11-30 12:36:46]

CQ is committing da patch.

Bot data: {"patchset_id": 20001, "attempt_start_ts": 1480509152405730,
"parent_rev": "5d54e3db1c1f93007dd18286370bbc75d15211df", "commit_rev":
"d175867bb090ed11ce5a4d00ec38dc7424a93d8e"}

[commit-bot: I haz the power, 2016-11-30 12:37:13]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2016-11-30 12:38:59]

Description was changed from

==========
CSP: "local schemes" should inherit policy when window.opened.

https://w3c.github.io/webappsec-csp/#initialize-document-csp mandates
that resources with "local schemes" ('data:', 'blob:', 'filesystem:',
'about:') inherit the policy of their opening context when opened via
things like 'window.open'. We're not doing that, but we ought to.

BUG=669086
R=jochen@chromium.org
==========

to

==========
CSP: "local schemes" should inherit policy when window.opened.

https://w3c.github.io/webappsec-csp/#initialize-document-csp mandates
that resources with "local schemes" ('data:', 'blob:', 'filesystem:',
'about:') inherit the policy of their opening context when opened via
things like 'window.open'. We're not doing that, but we ought to.

BUG=669086
R=jochen@chromium.org

Committed: https://crrev.com/e598765e4822eac833a547abca92ce87a1287dc0
Cr-Commit-Position: refs/heads/master@{#435233}
==========

[commit-bot: I haz the power, 2016-11-30 12:39:00]

Patchset 2 (id:??) landed as
https://crrev.com/e598765e4822eac833a547abca92ce87a1287dc0
Cr-Commit-Position: refs/heads/master@{#435233}