Keep subdomains of an isolated origin in the isolated origin's SiteInstance.

content/browser/child_process_security_policy_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/child_process_security_policy_impl.h"
 
 #include <algorithm>
 #include <utility>
 
 #include "base/command_line.h"
 #include "base/debug/dump_without_crashing.h"
 #include "base/files/file_path.h"
 #include "base/logging.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/metrics/histogram_macros.h"
 #include "base/strings/string_split.h"
 #include "base/strings/string_util.h"
 #include "build/build_config.h"
+#include "content/browser/isolated_origin_util.h"
 #include "content/browser/site_instance_impl.h"
 #include "content/common/resource_request_body_impl.h"
 #include "content/common/site_isolation_policy.h"
 #include "content/public/browser/browser_context.h"
 #include "content/public/browser/browser_thread.h"
 #include "content/public/browser/child_process_data.h"
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/common/bindings_policy.h"
@@ skipping 1055 matching lines @@
 
   SecurityStateMap::iterator state = security_state_.find(child_id);
   if (state == security_state_.end())
     return false;
 
   return state->second->can_send_midi_sysex();
 }
 
 void ChildProcessSecurityPolicyImpl::AddIsolatedOrigin(
     const url::Origin& origin) {
-  CHECK(!origin.unique())
-      << "Cannot register a unique origin as an isolated origin.";
-  CHECK(!IsIsolatedOrigin(origin))
+  CHECK(IsolatedOriginUtil::IsValidIsolatedOrigin(origin));
+
+  base::AutoLock lock(lock_);
+  CHECK(!isolated_origins_.count(origin))
       << "Duplicate isolated origin: " << origin.Serialize();
 
-  base::AutoLock lock(lock_);
   isolated_origins_.insert(origin);
 }
 
 void ChildProcessSecurityPolicyImpl::AddIsolatedOriginsFromCommandLine(
     const std::string& origin_list) {
   for (const base::StringPiece& origin_piece :
        base::SplitStringPiece(origin_list, ",", base::TRIM_WHITESPACE,
                               base::SPLIT_WANT_NONEMPTY)) {
     url::Origin origin((GURL(origin_piece)));
     if (!origin.unique())
       AddIsolatedOrigin(origin);
   }
 }
 
 bool ChildProcessSecurityPolicyImpl::IsIsolatedOrigin(
     const url::Origin& origin) {
+  url::Origin unused_result;
+  return GetMatchingIsolatedOrigin(origin, &unused_result);
+}
+
+bool ChildProcessSecurityPolicyImpl::GetMatchingIsolatedOrigin(
+    const url::Origin& origin,
+    url::Origin* result) {
+  *result = url::Origin();
   base::AutoLock lock(lock_);
-  return isolated_origins_.find(origin) != isolated_origins_.end();
+
+  // If multiple isolated origins are registered with a common domain suffix,
+  // return the most specific one.  For example, if foo.isolated.com and
+  // isolated.com are both isolated origins, bar.foo.isolated.com should return
+  // foo.isolated.com.
+  bool found = false;
+  for (auto isolated_origin : isolated_origins_) {
+    if (IsolatedOriginUtil::DoesOriginMatchIsolatedOrigin(origin,
+                                                          isolated_origin)) {
+      if (!found || result->host().length() < isolated_origin.host().length()) {
+        *result = isolated_origin;
+        found = true;
+      }
+    }
+  }
+
+  return found;
+}
+
+void ChildProcessSecurityPolicyImpl::RemoveIsolatedOriginForTesting(
+    const url::Origin& origin) {
+  base::AutoLock lock(lock_);
+  isolated_origins_.erase(origin);
 }
 
 }  // namespace content