Index: content/browser/frame_host/render_frame_proxy_host.cc |
diff --git a/content/browser/frame_host/render_frame_proxy_host.cc b/content/browser/frame_host/render_frame_proxy_host.cc |
index 1107e77fe4508b99b5a2f3446bf766bf59c7ad7d..5a4a169e5906e95fa0756a43e27dad73f4e1c95c 100644 |
--- a/content/browser/frame_host/render_frame_proxy_host.cc |
+++ b/content/browser/frame_host/render_frame_proxy_host.cc |
@@ -16,6 +16,7 @@ |
#include "content/browser/frame_host/render_widget_host_view_child_frame.h" |
#include "content/browser/renderer_host/render_view_host_impl.h" |
#include "content/browser/renderer_host/render_widget_host_view_base.h" |
+#include "content/browser/resource_request_body_browser_utils.h" |
#include "content/browser/site_instance_impl.h" |
#include "content/common/frame_messages.h" |
#include "content/common/frame_owner_properties.h" |
@@ -32,7 +33,8 @@ typedef base::hash_map<RenderFrameProxyHostID, RenderFrameProxyHost*> |
RoutingIDFrameProxyMap; |
base::LazyInstance<RoutingIDFrameProxyMap>::DestructorAtExit |
g_routing_id_frame_proxy_map = LAZY_INSTANCE_INITIALIZER; |
-} |
+ |
+} // namespace |
// static |
RenderFrameProxyHost* RenderFrameProxyHost::FromID(int process_id, |
@@ -250,6 +252,14 @@ void RenderFrameProxyHost::OnOpenURL( |
if (!site_instance_->IsRelatedSiteInstance(current_rfh->GetSiteInstance())) |
return; |
+ // Verify if the request originator (*not* |current_rfh|) has access to the |
+ // contents of the POST body. |
+ if (!CanReadRequestBody(GetSiteInstance(), params.resource_request_body)) { |
+ bad_message::ReceivedBadMessage(GetProcess(), |
+ bad_message::RFPH_ILLEGAL_UPLOAD_PARAMS); |
+ return; |
+ } |
+ |
// Since this navigation targeted a specific RenderFrameProxy, it should stay |
// in the current tab. |
DCHECK_EQ(WindowOpenDisposition::CURRENT_TAB, params.disposition); |