Add security checks to scheduled actions

third_party/WebKit/Source/bindings/core/v8/ScheduledAction.cpp

Index: third_party/WebKit/Source/bindings/core/v8/ScheduledAction.cpp
diff --git a/third_party/WebKit/Source/bindings/core/v8/ScheduledAction.cpp b/third_party/WebKit/Source/bindings/core/v8/ScheduledAction.cpp
index e395e84105f5c0b3b08eff72f22df8340f73ab9a..a84d288607e9a7e17d3355500fd5f8f79dd1d362 100644
--- a/third_party/WebKit/Source/bindings/core/v8/ScheduledAction.cpp
+++ b/third_party/WebKit/Source/bindings/core/v8/ScheduledAction.cpp
@@ -30,6 +30,7 @@
 
 #include "bindings/core/v8/ScheduledAction.h"
 
+#include "bindings/core/v8/BindingSecurity.h"
 #include "bindings/core/v8/ScriptController.h"
 #include "bindings/core/v8/ScriptSourceCode.h"
 #include "bindings/core/v8/SourceLocation.h"
@@ -46,14 +47,26 @@
 namespace blink {
 
 ScheduledAction* ScheduledAction::create(ScriptState* scriptState,
+                                         ExecutionContext* target,

[haraken, 2017/02/21 13:10:20]

Is the target execution context different from
scriptState->getExecutionContext()?

[jochen (gone - plz use gerrit), 2017/02/21 13:13:02]

possibly - you could invoke setTimeout on a same-origin window

[haraken, 2017/02/21 13:23:10]

Ah, right.

Maybe would it be nicer to move the CHECK to
ScheduledAction::execute(ExecutionContext* context)? Then you have the target
execution context already. Also we already have a branch for the main thread.

                                          const ScriptValue& handler,
                                          const Vector<ScriptValue>& arguments) {
   ASSERT(handler.isFunction());
+  if (!scriptState->world().isWorkerWorld()) {
+    CHECK(BindingSecurity::shouldAllowAccessToFrame(
+        enteredDOMWindow(scriptState->isolate()), toDocument(target)->frame(),
+        BindingSecurity::ErrorReportOption::DoNotReport));
+  }
   return new ScheduledAction(scriptState, handler, arguments);
 }
 
 ScheduledAction* ScheduledAction::create(ScriptState* scriptState,
+                                         ExecutionContext* target,
                                          const String& handler) {
+  if (!scriptState->world().isWorkerWorld()) {
+    CHECK(BindingSecurity::shouldAllowAccessToFrame(
+        enteredDOMWindow(scriptState->isolate()), toDocument(target)->frame(),
+        BindingSecurity::ErrorReportOption::DoNotReport));
+  }
   return new ScheduledAction(scriptState, handler);
 }