Keep subdomains of an isolated origin in the isolated origin's SiteInstance.

content/browser/isolated_origin_util.cc

Index: content/browser/isolated_origin_util.cc
diff --git a/content/browser/isolated_origin_util.cc b/content/browser/isolated_origin_util.cc
new file mode 100644
index 0000000000000000000000000000000000000000..811ded12b16e488da3d24594b393fc59b9e28b49
--- /dev/null
+++ b/content/browser/isolated_origin_util.cc
@@ -0,0 +1,27 @@
+// Copyright (c) 2017 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/isolated_origin_util.h"
+
+#include "base/strings/string_util.h"
+#include "url/gurl.h"
+
+namespace content {
+
+// static
+bool IsolatedOriginUtil::DoesOriginMatchIsolatedOrigin(
+    const url::Origin& origin,
+    const url::Origin& isolated_origin) {
+  if (origin.scheme() != isolated_origin.scheme())
+    return false;
+
+  if (origin.port() != isolated_origin.port())
+    return false;
+
+  // Subdomains of an isolated origin are considered to be in the same isolated
+  // origin.
+  return origin.GetURL().DomainIs(isolated_origin.host());

[Charlie Reis, 2017/06/28 01:02:18]

Huh, I wouldn't have expected this to work given the name.  (Sounds like it just
compares against eTLD+1.)  I suppose it's really more of a IsSubdomainOf?

[alexmos, 2017/06/28 18:29:51]

Yeah, it behaves like IsSubdomainOf; this is more clear from comments on
url::DomainIs, which implements it internally.  I think the name is really
misleading and also caused me to take a while to find this.  Initially, I tried
reusing IsSubdomainOfHost in Blink's OriginAccessEntry.cpp, where it's an
anonymous namespace helper used for document.domain validation, and exposing
that more generally from url/, but then noticed GURL::DomainIs does pretty much
the same thing.  The Blink code should probably also use url::DomainIs now that
url/ can be used there.  Maybe we should consider renaming these to
IsSubdomainOf, though that name does feel vague about allowing exact domain
matches, and not necessarily subdomains.

[Charlie Reis, 2017/06/28 20:56:57]

Yes, there may be some ways to make this clearer.  We can revisit independent of
this CL.

[ncarter (slow), 2017/06/28 21:07:49]

fwiw I did the same double take too.

url::Origin has a DomainIs method, just use that?

[alexmos, 2017/06/29 21:54:01]

Done.  Thanks, I didn't notice it was also exposed from url::Origin. 

+}
+
+}  // namespace content