Block renderer-initiated main frame navigations to data URLs

third_party/WebKit/Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
@@ skipping 730 matching lines @@
 
   KURL url = request.GetResourceRequest().Url();
   if (frame_->GetScriptController().ExecuteScriptIfJavaScriptURL(url, nullptr))
     return false;
 
   if (!request.OriginDocument()->GetSecurityOrigin()->CanDisplay(url)) {
     ReportLocalLoadFailed(frame_, url.ElidedString());
     return false;
   }
 
+  // Block content-initiated, top-frame navigations to data URLs.
+  if (frame_->IsMainFrame() &&
+      !request.GetResourceRequest().IsSameDocumentNavigation() &&
+      !frame_->Client()->AllowContentInitiatedDataUrlNavigations(
+          request.OriginDocument()->Url()) &&
+      !request.OriginDocument()->GetSecurityOrigin()->CanNavigateInTopFrame(
+          url)) {
+    ReportTopLevelNavigationFailed(frame_, url.ElidedString());
+    return false;
+  }
+
   if (!request.Form() && request.FrameName().IsEmpty())
     request.SetFrameName(frame_->GetDocument()->BaseTarget());
   return true;
 }
 
 static bool ShouldNavigateTargetFrame(NavigationPolicy policy) {
   switch (policy) {
     case kNavigationPolicyCurrentTab:
       return true;
 
@@ skipping 219 matching lines @@
 void FrameLoader::ReportLocalLoadFailed(LocalFrame* frame, const String& url) {
   DCHECK(!url.IsEmpty());
   if (!frame)
     return;
 
   frame->GetDocument()->AddConsoleMessage(
       ConsoleMessage::Create(kSecurityMessageSource, kErrorMessageLevel,
                              "Not allowed to load local resource: " + url));
 }
 
+void FrameLoader::ReportTopLevelNavigationFailed(LocalFrame* frame,
+                                                 const String& url) {
+  DCHECK(!url.IsEmpty());
+  if (!frame)
+    return;
+
+  frame->GetDocument()->AddConsoleMessage(ConsoleMessage::Create(
+      kSecurityMessageSource, kErrorMessageLevel,
+      "Not allowed to top-level navigate to resource: " + url));
+}
+
 void FrameLoader::StopAllLoaders() {
   if (frame_->GetDocument()->PageDismissalEventBeingDispatched() !=
       Document::kNoDismissal)
     return;
 
   // If this method is called from within this method, infinite recursion can
   // occur (3442218). Avoid this.
   if (in_stop_all_loaders_)
     return;
 
@@ skipping 774 matching lines @@
   // TODO(japhet): This is needed because the browser process DCHECKs if the
   // first entry we commit in a new frame has replacement set. It's unclear
   // whether the DCHECK is right, investigate removing this special case.
   bool replace_current_item = load_type == kFrameLoadTypeReplaceCurrentItem &&
                               (!Opener() || !request.Url().IsEmpty());
   loader->SetReplacesCurrentHistoryItem(replace_current_item);
   return loader;
 }
 
 }  // namespace blink