Add URL origin checks for Service Worker (un)registration

content/browser/child_process_security_policy_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/child_process_security_policy_impl.h"
 
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
@@ skipping 872 matching lines @@
 bool ChildProcessSecurityPolicyImpl::CanSendMidiSysExMessage(int child_id) {
   base::AutoLock lock(lock_);
 
   SecurityStateMap::iterator state = security_state_.find(child_id);
   if (state == security_state_.end())
     return false;
 
   return state->second->can_send_midi_sysex();
 }
 
+bool ChildProcessSecurityPolicyImpl::CanRegisterServiceWorker(

[Tom Sepez, 2014/06/17 17:43:19]

These don't have to live in CPSP because they don't persist any state between
calls.  CPSP should always follow the pattern that there's a grant() call at
some point and later on, a can() call when the renderer wants to do something
that it thinks it is allowed to do.  If it doesn't follow that pattern, then the
check can move up to the caller. 

+    const GURL& document_url,
+    const GURL& pattern,
+    const GURL& script_url) {
+  return document_url.GetOrigin() == pattern.GetOrigin() &&
+         document_url.GetOrigin() == script_url.GetOrigin();

[michaeln, 2014/06/17 23:50:30]

These same-origin checks are not a matter of 'policy', these are a matter of
spec correctness. The spec correctness parts of this belong directly in the
/service_worker directory.

The 'policy' part of this has to do with chrome's content settings, we should
ask the embedder (aka chrome). Here's what we did for appcache and this is kinda
similar.

bool ChromeAppCacheService::CanCreateAppCache(
    const GURL& manifest_url, const GURL& first_party) {
  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
  return GetContentClient()->browser()->AllowAppCache(
      manifest_url, first_party, resource_context_);
}

Content shell always says 'yes', chrome sometimes decides to say 'no'.

+}
+
+bool ChildProcessSecurityPolicyImpl::CanUnregisterServiceWorker(
+    const GURL& document_url,
+    const GURL& pattern) {
+  return document_url.GetOrigin() == pattern.GetOrigin();
+}
+
 }  // namespace content