Keep subdomains of an isolated origin in the isolated origin's SiteInstance.

content/browser/isolated_origin_util.h

+// Copyright (c) 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_BROWSER_ISOLATED_ORIGIN_UTIL_H_
+#define CONTENT_BROWSER_ISOLATED_ORIGIN_UTIL_H_
+
+#include "url/origin.h"
+
+namespace content {
+
+class IsolatedOriginUtil {
+ public:
+  // Checks whether |origin| matches the isolated origin specified by
+  // |isolated_origin|.  Subdomains are considered to match isolated origins,
+  // so this will be true if
+  // (1) |origin| has the same scheme, host, and port as |isolated_origin|, or
+  // (2) |origin| has the same scheme and port as |isolated_origin|, and its
+  //     host is a subdomain of |isolated_origin|'s host.
+  // This does not consider site URLs, which don't care about port.
+  //
+  // For example, if |isolated_origin| is https://isolated.foo.com, this will
+  // return true if |origin| is https://isolated.foo.com or
+  // https://bar.isolated.foo.com, but it will return false for an |origin| of
+  // https://unisolated.foo.com or https://foo.com.
+  static bool DoesOriginMatchIsolatedOrigin(const url::Origin& origin,

[Charlie Reis, 2017/06/28 20:56:57]

Looking closer, it seems like there's only one caller to this
(ChildProcessSecurityPolicyImpl::GetMatchingIsolatedOrigin).  Is there a reason
we need a util file for this, or can it just be a helper function inside CPSP? 
Maybe you see additional uses for it in the future?

[alexmos, 2017/06/29 21:54:02]

You're right that CPSP is the only caller (originally I had other call sites
that got cleaned up).  I was about to move it, but while addressing Nick's
comments, I ended up adding another helper here, IsValidIsolatedOrigin, which I
also wanted to expose to unit tests, so now we need to decide whether the util
file makes sense for both. :)

I guess I was hesitant to clutter CPSP with this logic, which felt like it
didn't belong there, even as a private helper.  I think this also might be
needed in other places later on, e.g., to throw away invalid origins in
clickthrough isolation.  But I also see the point that we could move these out
of CPSP at the point when we need to use them more widely, and keep them
internal to CPSP until then.  WDYT?

[Charlie Reis, 2017/06/29 23:27:23]

If it's more than one function and has a chance of being useful elsewhere, it's
fine to leave it here.  Thanks!

+                                            const url::Origin& isolated_origin);
+};
+
+}  // namespace content
+
+#endif  // CONTENT_BROWSER_ISOLATED_ORIGIN_UTIL_H_