Initial Implementation of Iframe Attribute for Feature Policy (Part 3)

third_party/WebKit/Source/core/loader/FrameLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008, 2009, 2010, 2011 Apple Inc. All rights
  * reserved.
  * Copyright (C) 2008 Nokia Corporation and/or its subsidiary(-ies)
  * Copyright (C) 2008, 2009 Torch Mobile Inc. All rights reserved.
  * (http://www.torchmobile.com/)
  * Copyright (C) 2008 Alp Toker <alp@atoker.com>
  * Copyright (C) Research In Motion Limited 2009. All rights reserved.
  * Copyright (C) 2011 Kris Jordan <krisjordan@gmail.com>
  * Copyright (C) 2011 Google Inc. All rights reserved.
@@ skipping 599 matching lines @@
                                       ->parent()
                                       ->securityContext()
                                       ->getFeaturePolicy());
       const String& featurePolicyHeader =
           m_documentLoader->response().httpHeaderField(
               HTTPNames::Feature_Policy);
       Vector<String> messages;
       const WebParsedFeaturePolicy& parsedHeader = parseFeaturePolicy(
           featurePolicyHeader, m_frame->securityContext()->getSecurityOrigin(),
           &messages);
-      m_frame->securityContext()->initializeFeaturePolicy(parsedHeader,
-                                                          parentFeaturePolicy);
+      WebParsedFeaturePolicy containerPolicy;
+      if (m_frame->owner()) {

[dglazkov, 2017/03/20 20:57:12]

I wonder if even need to do anything with feature policy in situations when we
don't have a frame owner?

[lunalu1, 2017/03/20 21:07:01]

There are two ways to define feature policy. One is though HTTP header (in this
case, a frame owner is not required). The other is through iframe attribute
"allow" (see this CL). icelland@ please correct me if I am wrong

[dglazkov, 2017/03/20 22:18:26]

I could be wrong, but if I remember correctly, the only time when FrameOwner is
nullptr is when it's an SVGImage or a popup (or maybe something similar). Would
we still need to initialize feature policy for those?

+        containerPolicy = getContainerPolicyFromAllowedFeatures(
+            m_frame->owner()->allowedFeatures(),
+            m_frame->securityContext()->getSecurityOrigin());
+      }
+      m_frame->securityContext()->initializeFeaturePolicy(
+          parsedHeader, containerPolicy, parentFeaturePolicy);
       for (auto& message : messages) {
         m_frame->document()->addConsoleMessage(ConsoleMessage::create(
             OtherMessageSource, ErrorMessageLevel,
             "Error with Feature-Policy header: " + message));
       }
       if (!parsedHeader.isEmpty())
         client()->didSetFeaturePolicyHeader(parsedHeader);
     }
   }
 
@@ skipping 1406 matching lines @@
       frameLoadRequest.clientRedirect());
 
   loader->setLoadType(loadType);
   loader->setNavigationType(navigationType);
   loader->setReplacesCurrentHistoryItem(loadType ==
                                         FrameLoadTypeReplaceCurrentItem);
   return loader;
 }
 
 }  // namespace blink