Remove opener URLs from CreateNewWindowParams.

content/browser/frame_host/render_frame_host_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_impl.h"
 
 #include <algorithm>
 #include <utility>
 
 #include "base/bind.h"
@@ skipping 2427 matching lines @@
                                disposition, initial_rect, user_gesture);
 }
 
 void RenderFrameHostImpl::CreateNewWindow(
     mojom::CreateNewWindowParamsPtr params,
     const CreateNewWindowCallback& callback) {
   DCHECK_CURRENTLY_ON(BrowserThread::UI);
 
   bool no_javascript_access = false;
 
+  // Filter out URLs that this process cannot request.
+  GetProcess()->FilterURL(false, &params->target_url);
+
   // Ignore creation when sent from a frame that's not current or created.
   bool can_create_window =
       frame_tree_node_->current_frame_host() == this && render_frame_created_ &&
       GetContentClient()->browser()->CanCreateWindow(
-          this, params->opener_url, params->opener_top_level_frame_url,
-          params->opener_security_origin, params->window_container_type,
+          this, last_committed_url(),
+          frame_tree_node_->frame_tree()->GetMainFrame()->last_committed_url(),
+          last_committed_origin_.GetURL(), params->window_container_type,
           params->target_url, params->referrer, params->frame_name,
           params->disposition, *params->features, params->user_gesture,
           params->opener_suppressed, &no_javascript_access);
 
   mojom::CreateNewWindowReplyPtr reply = mojom::CreateNewWindowReply::New();
   if (!can_create_window) {
     RunCreateWindowCompleteCallback(callback, std::move(reply),
                                     MSG_ROUTING_NONE, MSG_ROUTING_NONE,
                                     MSG_ROUTING_NONE, 0);
     return;
@@ skipping 38 matching lines @@
           if (rdh)
             rdh->BlockRequestsForRoute(id);
         },
         GlobalFrameRoutingId(render_process_id, main_frame_route_id));
     BrowserThread::PostTask(BrowserThread::IO, FROM_HERE,
                             block_requests_for_route);
   }
 
   DCHECK(IsRenderFrameLive());
 
-  // Actually validate the params and create the window.
-  mojom::CreateNewWindowParamsPtr validated_params(params.Clone());
-  GetProcess()->FilterURL(false, &validated_params->target_url);
-
-  // TODO(nick): http://crbug.com/674307 |opener_url|, |opener_security_origin|,
-  // and |opener_top_level_frame_url| should not be parameters; we can just use
-  // last_committed_url(), etc. Of these, |opener_top_level_frame_url| is
-  // particularly egregious, since an oopif isn't expected to know its top URL.
-  GetProcess()->FilterURL(false, &validated_params->opener_url);
-  GetProcess()->FilterURL(true, &validated_params->opener_security_origin);
-
   delegate_->CreateNewWindow(this, render_view_route_id, main_frame_route_id,
-                             main_frame_widget_route_id, *validated_params,
+                             main_frame_widget_route_id, *params,
                              cloned_namespace.get());
 
   // If we did not create a WebContents to host the renderer-created
   // RenderFrame/RenderView/RenderWidget objects, make sure to send invalid
   // routing ids back to the renderer.
   if (main_frame_route_id != MSG_ROUTING_NONE) {
     bool succeeded =
         RenderWidgetHost::FromID(render_process_id,
                                  main_frame_widget_route_id) != nullptr;
     if (!succeeded) {
@@ skipping 1258 matching lines @@
 }
 
 void RenderFrameHostImpl::ForwardGetInterfaceToRenderFrame(
     const std::string& interface_name,
     mojo::ScopedMessagePipeHandle pipe) {
   GetRemoteInterfaces()->GetInterface(interface_name, std::move(pipe));
 }
 #endif
 
 }  // namespace content