Block renderer-initiated main frame navigations to data URLs

third_party/WebKit/Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
@@ skipping 725 matching lines @@
 
   KURL url = request.resourceRequest().url();
   if (m_frame->script().executeScriptIfJavaScriptURL(url, nullptr))
     return false;
 
   if (!request.originDocument()->getSecurityOrigin()->canDisplay(url)) {
     reportLocalLoadFailed(m_frame, url.elidedString());
     return false;
   }
 
+  // Block content-initiated, top-frame navigations to data URLs.
+  if (m_frame->isMainFrame() &&
+      !request.resourceRequest().isSameDocumentNavigation() &&
+      !m_frame->client()->allowContentInitiatedDataUrlNavigations(
+          request.originDocument()->url()) &&
+      !request.originDocument()->getSecurityOrigin()->canNavigateInTopFrame(
+          url)) {
+    reportTopLevelNavigationFailed(m_frame, url.elidedString());
+    return false;
+  }
+
   if (!request.form() && request.frameName().isEmpty())
     request.setFrameName(m_frame->document()->baseTarget());
   return true;
 }
 
 static bool shouldNavigateTargetFrame(NavigationPolicy policy) {
   switch (policy) {
     case NavigationPolicyCurrentTab:
       return true;
 
@@ skipping 216 matching lines @@
 void FrameLoader::reportLocalLoadFailed(LocalFrame* frame, const String& url) {
   DCHECK(!url.isEmpty());
   if (!frame)
     return;
 
   frame->document()->addConsoleMessage(
       ConsoleMessage::create(SecurityMessageSource, ErrorMessageLevel,
                              "Not allowed to load local resource: " + url));
 }
 
+void FrameLoader::reportTopLevelNavigationFailed(LocalFrame* frame,
+                                                 const String& url) {
+  DCHECK(!url.isEmpty());
+  if (!frame)
+    return;
+
+  frame->document()->addConsoleMessage(ConsoleMessage::create(
+      SecurityMessageSource, ErrorMessageLevel,
+      "Not allowed to top-level navigate to resource: " + url));
+}
+
 void FrameLoader::stopAllLoaders() {
   if (m_frame->document()->pageDismissalEventBeingDispatched() !=
       Document::NoDismissal)
     return;
 
   // If this method is called from within this method, infinite recursion can
   // occur (3442218). Avoid this.
   if (m_inStopAllLoaders)
     return;
 
@@ skipping 759 matching lines @@
   // TODO(japhet): This is needed because the browser process DCHECKs if the
   // first entry we commit in a new frame has replacement set. It's unclear
   // whether the DCHECK is right, investigate removing this special case.
   bool replaceCurrentItem = loadType == FrameLoadTypeReplaceCurrentItem &&
                             (!opener() || !request.url().isEmpty());
   loader->setReplacesCurrentHistoryItem(replaceCurrentItem);
   return loader;
 }
 
 }  // namespace blink