Prevent appcache creation from suborigins and sandboxed pages.

third_party/WebKit/Source/core/loader/appcache/ApplicationCacheHost.cpp

 /*
  * Copyright (C) 2009 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 116 matching lines @@
 void ApplicationCacheHost::SelectCacheWithoutManifest() {
   if (host_)
     host_->SelectCacheWithoutManifest();
 }
 
 void ApplicationCacheHost::SelectCacheWithManifest(const KURL& manifest_url) {
   DCHECK(document_loader_);
 
   LocalFrame* frame = document_loader_->GetFrame();
   Document* document = frame->GetDocument();
+  if (document->IsSandboxed(kSandboxOrigin) ||
+      document->GetSecurityOrigin()->HasSuborigin()) {
+    // Prevent sandboxes and suborigins from establishing application caches.
+    SelectCacheWithoutManifest();
+    return;
+  }
   if (document->IsSecureContext()) {
     UseCounter::Count(document,
                       UseCounter::kApplicationCacheManifestSelectSecureOrigin);
     UseCounter::CountCrossOriginIframe(
         *document, UseCounter::kApplicationCacheManifestSelectSecureOrigin);
   } else {
     Deprecation::CountDeprecation(
         document, UseCounter::kApplicationCacheManifestSelectInsecureOrigin);
     Deprecation::CountDeprecationCrossOriginIframe(
         *document, UseCounter::kApplicationCacheManifestSelectInsecureOrigin);
@@ skipping 200 matching lines @@
   NotifyApplicationCache(kErrorEvent, 0, 0, reason, url.GetString(), status,
                          message);
 }
 
 DEFINE_TRACE(ApplicationCacheHost) {
   visitor->Trace(dom_application_cache_);
   visitor->Trace(document_loader_);
 }
 
 }  // namespace blink