Replicate feature policy container policies.

third_party/WebKit/Source/core/html/HTMLFrameOwnerElement.cpp

 /*
  * Copyright (C) 2006, 2007, 2009 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 188 matching lines @@
 }
 
 DOMWindow* HTMLFrameOwnerElement::contentWindow() const {
   return m_contentFrame ? m_contentFrame->domWindow() : 0;
 }
 
 void HTMLFrameOwnerElement::setSandboxFlags(SandboxFlags flags) {
   m_sandboxFlags = flags;
   // Don't notify about updates if contentFrame() is null, for example when
   // the subframe hasn't been created yet.
-  if (contentFrame())
-    document().frame()->loader().client()->didChangeSandboxFlags(contentFrame(),
-                                                                 flags);
+  if (contentFrame()) {
+    document().frame()->loader().client()->didChangeFramePolicy(
+        contentFrame(), m_sandboxFlags, m_containerPolicy);
+  }
 }
 
 bool HTMLFrameOwnerElement::isKeyboardFocusable() const {
   return m_contentFrame && HTMLElement::isKeyboardFocusable();
 }
 
 void HTMLFrameOwnerElement::disposeWidgetSoon(FrameViewBase* frameViewBase) {
   if (s_updateSuspendCount) {
     widgetsPendingDispose().insert(frameViewBase);
     return;
   }
   frameViewBase->dispose();
 }
 
+void HTMLFrameOwnerElement::updateContainerPolicy() {
+  m_containerPolicy = getContainerPolicyFromAllowedFeatures(
+      allowedFeatures(), SecurityOrigin::create(m_absoluteURL));

[alexmos, 2017/04/06 00:44:22]

Is creating an origin directly from the src URL really the right thing for
feature policy?  Would it work for cases like about:blank which inherits the
parent origin, iframe sandbox flags which would typically make the frame's real
origin unique, etc?

[iclelland, 2017/04/09 03:25:54]

The way we have defined it in the spec, specifying a frame policy like `<iframe
src="url" allow="feature">` should construct a policy that enables the feature
in the frame, just for the origin of the document specified by "url". If the
framed document subsequently navigates itself to a different domain, then the
feature will not be enabled in the navigated-to document. (There are other
mechanisms for specifying that all origins should be allowed, but the default is
to respect the src attribute as the intention of the parent document).

about:blank is an interesting case that I hadn't considered. Perhaps rather than
storing m_absoluteURL, I should factor that out into a method here, something
like 'getEffectiveFeaturePolicyOrigin' that would handle all of the edge cases
and return the origin that should be used.

+  // Don't notify about updates if contentFrame() is null, for example when
+  // the subframe hasn't been created yet.
+  if (contentFrame()) {
+    document().frame()->loader().client()->didChangeFramePolicy(
+        contentFrame(), m_sandboxFlags, m_containerPolicy);
+  }
+}
+
 void HTMLFrameOwnerElement::frameOwnerPropertiesChanged() {
+  updateContainerPolicy();

[lunalu1, 2017/04/05 22:30:03]

I don't think we need to update it here?

[iclelland, 2017/04/09 03:25:54]

Thanks; that was older code from a previous iteration I should have removed.
Done.

   // Don't notify about updates if contentFrame() is null, for example when
   // the subframe hasn't been created yet.
   if (contentFrame())
     document().frame()->loader().client()->didChangeFrameOwnerProperties(this);
 }
 
 void HTMLFrameOwnerElement::dispatchLoad() {
   dispatchScopedEvent(Event::create(EventTypeNames::load));
 }
 
 const WebVector<WebFeaturePolicyFeature>&
 HTMLFrameOwnerElement::allowedFeatures() const {
   DEFINE_STATIC_LOCAL(WebVector<WebFeaturePolicyFeature>, features, ());
   return features;
 }
 
+const WebParsedFeaturePolicy& HTMLFrameOwnerElement::containerPolicy() const {
+  return m_containerPolicy;
+}
+
 Document* HTMLFrameOwnerElement::getSVGDocument(
     ExceptionState& exceptionState) const {
   Document* doc = contentDocument();
   if (doc && doc->isSVGDocument())
     return doc;
   return nullptr;
 }
 
 void HTMLFrameOwnerElement::setWidget(FrameViewBase* frameViewBase) {
   if (frameViewBase == m_widget)
@@ skipping 48 matching lines @@
 }
 
 FrameViewBase* HTMLFrameOwnerElement::ownedWidget() const {
   return m_widget.get();
 }
 
 bool HTMLFrameOwnerElement::loadOrRedirectSubframe(
     const KURL& url,
     const AtomicString& frameName,
     bool replaceCurrentItem) {
+  m_absoluteURL = url;

[lunalu1, 2017/04/05 22:30:03]

it seems like this is the only place this url is used. Why can't we just pass
this url to updateContainerPolicy() so that we don't need to store it as a class
member?

[iclelland, 2017/04/09 03:25:54]

Thanks for catching that -- we don't need to anymore, so I've removed it.

+  updateContainerPolicy();
+
   LocalFrame* parentFrame = document().frame();
   if (contentFrame()) {
     contentFrame()->navigate(document(), url, replaceCurrentItem,
                              UserGestureStatus::None);
     return true;
   }
 
   if (!document().getSecurityOrigin()->canDisplay(url)) {
     FrameLoader::reportLocalLoadFailed(parentFrame, url.getString());
     return false;
@@ skipping 19 matching lines @@
 }
 
 DEFINE_TRACE(HTMLFrameOwnerElement) {
   visitor->trace(m_contentFrame);
   visitor->trace(m_widget);
   HTMLElement::trace(visitor);
   FrameOwner::trace(visitor);
 }
 
 }  // namespace blink