Add deprecation message for top navigations from sandbox w/ 'allow-top-navigation' but no gesture

third_party/WebKit/Source/core/frame/Frame.cpp

 /*
  * Copyright (C) 1998, 1999 Torben Weis <weis@kde.org>
  *                     1999 Lars Knoll <knoll@kde.org>
  *                     1999 Antti Koivisto <koivisto@kde.org>
  *                     2000 Simon Hausmann <hausmann@kde.org>
  *                     2000 Stefan Schimanski <1Stein@gmx.de>
  *                     2001 George Staikos <staikos@kde.org>
  * Copyright (C) 2004, 2005, 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All
  * rights reserved.
  * Copyright (C) 2005 Alexey Proskuryakov <ap@nypop.com>
@@ skipping 174 matching lines @@
       targetFrame == tree().top()) {
     DEFINE_STATIC_LOCAL(EnumerationHistogram, framebustHistogram,
                         ("WebCore.Framebust", 4));
     const unsigned userGestureBit = 0x1;
     const unsigned allowedBit = 0x2;
     unsigned framebustParams = 0;
     UseCounter::count(&targetFrame, UseCounter::TopNavigationFromSubFrame);
 
     if (hasUserGesture)
       framebustParams |= userGestureBit;
+    if (isAllowedNavigation)
+      framebustParams |= allowedBit;
+    framebustHistogram.count(framebustParams);
+
     if (sandboxed) {  // Sandboxed with 'allow-top-navigation'.
       UseCounter::count(&targetFrame, UseCounter::TopNavInSandboxWithPerm);
       if (!hasUserGesture) {
         UseCounter::count(&targetFrame,
                           UseCounter::TopNavInSandboxWithPermButNoGesture);
+        String message =
+            "Navigating the top-level window from a sandboxed iframe with "
+            "'allow-top-navigation' will soon require that the iframe has "
+            "received a user gesture. See "
+            "https://www.chromestatus.com/features/5629582019395584.";
+        printNavigationWarning(targetFrame, message.latin1().data());
       }
+      return true;
     }
 
-    if (isAllowedNavigation)
-      framebustParams |= allowedBit;
-    framebustHistogram.count(framebustParams);
     if (hasUserGesture || isAllowedNavigation)
       return true;
     // Frame-busting used to be generally allowed in most situations, but may
     // now blocked if the document initiating the navigation has never received
     // a user gesture.
     if (!RuntimeEnabledFeatures::
             framebustingNeedsSameOriginOrUserGestureEnabled()) {
-      String targetFrameDescription =
-          targetFrame.isLocalFrame()
-              ? "with URL '" +
-                    toLocalFrame(targetFrame).document()->url().getString() +
-                    "'"
-              : "with origin '" +
-                    targetFrame.securityContext()
-                        ->getSecurityOrigin()
-                        ->toString() +
-                    "'";
-      String message = "Frame with URL '" +
-                       toLocalFrame(this)->document()->url().getString() +
-                       "' attempted to navigate its top-level window " +
-                       targetFrameDescription +
-                       ". Navigating the top-level window from a cross-origin "
-                       "iframe will soon require that the iframe has received "
-                       "a user gesture. See "
-                       "https://www.chromestatus.com/features/"
-                       "5851021045661696.";
-      printNavigationWarning(message);
+      String message =
+          "Navigating the top-level window from a cross-origin "
+          "iframe will soon require that the iframe has received "
+          "a user gesture. See "
+          "https://www.chromestatus.com/features/"
+          "5851021045661696.";
+      printNavigationWarning(targetFrame, message.latin1().data());
       return true;
     }
     errorReason =
         "The frame attempting navigation is targeting its top-level window, "
         "but is neither same-origin with its target nor has it received a "
         "user gesture. See "
         "https://www.chromestatus.com/features/5851021045661696.";
     printNavigationErrorMessage(targetFrame, errorReason.latin1().data());
     if (isLocalFrame()) {
       toLocalFrame(this)->navigationScheduler().schedulePageBlock(
@@ skipping 143 matching lines @@
 
   ASSERT(page());
 
   if (m_owner)
     m_owner->setContentFrame(*this);
   else
     page()->setMainFrame(this);
 }
 
 }  // namespace blink