Allows MHTM page to open a popup

third_party/WebKit/Source/core/loader/DocumentLoader.cpp

 /*
  * Copyright (C) 2006, 2007, 2008 Apple Inc. All rights reserved.
  * Copyright (C) 2011 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  *
  * 1.  Redistributions of source code must retain the above copyright
  *     notice, this list of conditions and the following disclaimer.
@@ skipping 780 matching lines @@
   ArchiveResource* main_resource =
       fetcher_->CreateArchive(main_resource_.Get());
   if (!main_resource)
     return false;
   // The origin is the MHTML file, we need to set the base URL to the document
   // encoded in the MHTML so relative URLs are resolved properly.
   EnsureWriter(main_resource->MimeType(), main_resource->Url());
   if (!frame_)
     return false;
 
-  // The Document has now been created.
-  frame_->GetDocument()->EnforceSandboxFlags(kSandboxAll);
+  // The MHTML page is loaded in full sandboxing mode with the only
+  // exception to open new top-level windows. Since the MHTML page stays in a
+  // unquie origin with script execution disabled, the risk to navigate to
+  // 'blob:'' and 'filesystem:'' URLs that allow code execution in the page's
+  // "real" origin is mitigated.
+  frame_->GetDocument()->EnforceSandboxFlags(
+      kSandboxAll &
+      ~(kSandboxPopups | kSandboxPropagatesToAuxiliaryBrowsingContexts));
 
   CommitData(main_resource->Data()->Data(), main_resource->Data()->size());
   return true;
 }
 
 const AtomicString& DocumentLoader::ResponseMIMEType() const {
   return response_.MimeType();
 }
 
 const KURL& DocumentLoader::UnreachableURL() const {
@@ skipping 273 matching lines @@
                      InstallNewDocumentReason::kJavascriptURL,
                      kForceSynchronousParsing, KURL());
   if (!source.IsNull())
     writer_->AppendReplacingData(source);
   EndWriting();
 }
 
 DEFINE_WEAK_IDENTIFIER_MAP(DocumentLoader);
 
 }  // namespace blink