Restrict navigator.getInstalledRelatedApps() to top-level frames

third_party/WebKit/Source/modules/installedapp/NavigatorInstalledApp.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "modules/installedapp/NavigatorInstalledApp.h"
 
 #include "bindings/core/v8/CallbackPromiseAdapter.h"
 #include "bindings/core/v8/ScriptPromise.h"
 #include "bindings/core/v8/ScriptPromiseResolver.h"
 #include "bindings/core/v8/ScriptState.h"
@@ skipping 62 matching lines @@
   ScriptPromise promise = resolver->promise();
 
   InstalledAppController* appController = controller();
   if (!appController) {  // If the associated frame is detached
     DOMException* exception = DOMException::create(
         InvalidStateError, "The object is no longer associated to a document.");
     resolver->reject(exception);
     return promise;
   }
 
+  if (!appController->supplementable()->isMainFrame()) {
+    DOMException* exception =
+        DOMException::create(InvalidStateError,
+                             "getInstalledRelatedApps() is only supported in "
+                             "top-level browsing contexts.");
+    resolver->reject(exception);
+    return promise;
+  }
+
   appController->getInstalledRelatedApps(
       WTF::wrapUnique(
           new CallbackPromiseAdapter<RelatedAppArray, void>(resolver)));
   return promise;
 }
 
 InstalledAppController* NavigatorInstalledApp::controller() {
   if (!supplementable()->frame())
     return nullptr;
 
   return InstalledAppController::from(*supplementable()->frame());
 }
 
 const char* NavigatorInstalledApp::supplementName() {
   return "NavigatorInstalledApp";
 }
 
 DEFINE_TRACE(NavigatorInstalledApp) {
   Supplement<Navigator>::trace(visitor);
 }
 
 }  // namespace blink