Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(574)

Side by Side Diff: content/browser/frame_host/render_frame_host_impl.cc

Issue 2534393003: (Reland) Remove about:srcdoc url conversion. (Closed)
Patch Set: Rebase. Created 4 years ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright 2013 The Chromium Authors. All rights reserved. 1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "content/browser/frame_host/render_frame_host_impl.h" 5 #include "content/browser/frame_host/render_frame_host_impl.h"
6 6
7 #include <utility> 7 #include <utility>
8 8
9 #include "base/bind.h" 9 #include "base/bind.h"
10 #include "base/command_line.h" 10 #include "base/command_line.h"
(...skipping 1185 matching lines...) Expand 10 before | Expand all | Expand 10 after
1196 // Without this check, an evil renderer can trick the browser into creating 1196 // Without this check, an evil renderer can trick the browser into creating
1197 // a navigation entry for a banned URL. If the user clicks the back button 1197 // a navigation entry for a banned URL. If the user clicks the back button
1198 // followed by the forward button (or clicks reload, or round-trips through 1198 // followed by the forward button (or clicks reload, or round-trips through
1199 // session restore, etc), we'll think that the browser commanded the 1199 // session restore, etc), we'll think that the browser commanded the
1200 // renderer to load the URL and grant the renderer the privileges to request 1200 // renderer to load the URL and grant the renderer the privileges to request
1201 // the URL. To prevent this attack, we block the renderer from inserting 1201 // the URL. To prevent this attack, we block the renderer from inserting
1202 // banned URLs into the navigation controller in the first place. 1202 // banned URLs into the navigation controller in the first place.
1203 process->FilterURL(false, &validated_params.url); 1203 process->FilterURL(false, &validated_params.url);
1204 process->FilterURL(true, &validated_params.referrer.url); 1204 process->FilterURL(true, &validated_params.referrer.url);
1205 for (std::vector<GURL>::iterator it(validated_params.redirects.begin()); 1205 for (std::vector<GURL>::iterator it(validated_params.redirects.begin());
1206 it != validated_params.redirects.end(); ++it) { 1206 it != validated_params.redirects.end(); ++it) {
1207 process->FilterURL(false, &(*it)); 1207 process->FilterURL(false, &(*it));
1208 } 1208 }
1209 process->FilterURL(true, &validated_params.searchable_form_url); 1209 process->FilterURL(true, &validated_params.searchable_form_url);
1210 1210
1211 // Without this check, the renderer can trick the browser into using 1211 // Without this check, the renderer can trick the browser into using
1212 // filenames it can't access in a future session restore. 1212 // filenames it can't access in a future session restore.
1213 if (!CanAccessFilesOfPageState(validated_params.page_state)) { 1213 if (!CanAccessFilesOfPageState(validated_params.page_state)) {
1214 bad_message::ReceivedBadMessage( 1214 bad_message::ReceivedBadMessage(
1215 GetProcess(), bad_message::RFH_CAN_ACCESS_FILES_OF_PAGE_STATE); 1215 GetProcess(), bad_message::RFH_CAN_ACCESS_FILES_OF_PAGE_STATE);
1216 return; 1216 return;
(...skipping 2046 matching lines...) Expand 10 before | Expand all | Expand 10 after
3263 NavigationEntryImpl* pending_entry = 3263 NavigationEntryImpl* pending_entry =
3264 NavigationEntryImpl::FromNavigationEntry( 3264 NavigationEntryImpl::FromNavigationEntry(
3265 frame_tree_node()->navigator()->GetController()->GetPendingEntry()); 3265 frame_tree_node()->navigator()->GetController()->GetPendingEntry());
3266 if (pending_entry && pending_entry->GetUniqueID() == params.nav_entry_id) { 3266 if (pending_entry && pending_entry->GetUniqueID() == params.nav_entry_id) {
3267 pending_nav_entry_id = params.nav_entry_id; 3267 pending_nav_entry_id = params.nav_entry_id;
3268 is_renderer_initiated = pending_entry->is_renderer_initiated(); 3268 is_renderer_initiated = pending_entry->is_renderer_initiated();
3269 } 3269 }
3270 3270
3271 return NavigationHandleImpl::Create( 3271 return NavigationHandleImpl::Create(
3272 params.url, frame_tree_node_, is_renderer_initiated, 3272 params.url, frame_tree_node_, is_renderer_initiated,
3273 params.was_within_same_page, params.is_srcdoc, base::TimeTicks::Now(), 3273 params.was_within_same_page, base::TimeTicks::Now(),
3274 pending_nav_entry_id, params.gesture, 3274 pending_nav_entry_id, params.gesture,
3275 false); // started_from_context_menu 3275 false); // started_from_context_menu
3276 } 3276 }
3277 3277
3278 // Determine if the current NavigationHandle can be used. 3278 // Determine if the current NavigationHandle can be used.
3279 if (navigation_handle_ && navigation_handle_->GetURL() == params.url) { 3279 if (navigation_handle_ && navigation_handle_->GetURL() == params.url) {
3280 return std::move(navigation_handle_); 3280 return std::move(navigation_handle_);
3281 } 3281 }
3282 3282
3283 // If the URL does not match what the NavigationHandle expects, treat the 3283 // If the URL does not match what the NavigationHandle expects, treat the
(...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after
3316 3316
3317 // Reset any existing NavigationHandle. 3317 // Reset any existing NavigationHandle.
3318 navigation_handle_.reset(); 3318 navigation_handle_.reset();
3319 } 3319 }
3320 3320
3321 // There is no pending NavigationEntry in these cases, so pass 0 as the 3321 // There is no pending NavigationEntry in these cases, so pass 0 as the
3322 // pending_nav_entry_id. If the previous handle was a prematurely aborted 3322 // pending_nav_entry_id. If the previous handle was a prematurely aborted
3323 // navigation loaded via LoadDataWithBaseURL, propagate the entry id. 3323 // navigation loaded via LoadDataWithBaseURL, propagate the entry id.
3324 return NavigationHandleImpl::Create( 3324 return NavigationHandleImpl::Create(
3325 params.url, frame_tree_node_, is_renderer_initiated, 3325 params.url, frame_tree_node_, is_renderer_initiated,
3326 params.was_within_same_page, params.is_srcdoc, base::TimeTicks::Now(), 3326 params.was_within_same_page, base::TimeTicks::Now(),
3327 entry_id_for_data_nav, params.gesture, 3327 entry_id_for_data_nav, params.gesture,
3328 false); // started_from_context_menu 3328 false); // started_from_context_menu
3329 } 3329 }
3330 3330
3331 } // namespace content 3331 } // namespace content
OLDNEW
« no previous file with comments | « content/browser/frame_host/navigator_impl.cc ('k') | content/browser/frame_host/render_frame_host_manager.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698