Add URL origin checks for Service Worker (un)registration

content/browser/child_process_security_policy_impl.cc

Index: content/browser/child_process_security_policy_impl.cc
diff --git a/content/browser/child_process_security_policy_impl.cc b/content/browser/child_process_security_policy_impl.cc
index 68f4e81fbef0c73f41b93147023c8a7bb8841c6c..4a2c6b56a40bbc1e78860d3a81aa283460fbd1d4 100644
--- a/content/browser/child_process_security_policy_impl.cc
+++ b/content/browser/child_process_security_policy_impl.cc
@@ -890,4 +890,18 @@ bool ChildProcessSecurityPolicyImpl::CanSendMidiSysExMessage(int child_id) {
   return state->second->can_send_midi_sysex();
 }
 
+bool ChildProcessSecurityPolicyImpl::CanRegisterServiceWorker(

[Tom Sepez, 2014/06/17 17:43:19]

These don't have to live in CPSP because they don't persist any state between
calls.  CPSP should always follow the pattern that there's a grant() call at
some point and later on, a can() call when the renderer wants to do something
that it thinks it is allowed to do.  If it doesn't follow that pattern, then the
check can move up to the caller. 

+    const GURL& document_url,
+    const GURL& pattern,
+    const GURL& script_url) {
+  return document_url.GetOrigin() == pattern.GetOrigin() &&
+         document_url.GetOrigin() == script_url.GetOrigin();

[michaeln, 2014/06/17 23:50:30]

These same-origin checks are not a matter of 'policy', these are a matter of
spec correctness. The spec correctness parts of this belong directly in the
/service_worker directory.

The 'policy' part of this has to do with chrome's content settings, we should
ask the embedder (aka chrome). Here's what we did for appcache and this is kinda
similar.

bool ChromeAppCacheService::CanCreateAppCache(
    const GURL& manifest_url, const GURL& first_party) {
  DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
  return GetContentClient()->browser()->AllowAppCache(
      manifest_url, first_party, resource_context_);
}

Content shell always says 'yes', chrome sometimes decides to say 'no'.

+}
+
+bool ChildProcessSecurityPolicyImpl::CanUnregisterServiceWorker(
+    const GURL& document_url,
+    const GURL& pattern) {
+  return document_url.GetOrigin() == pattern.GetOrigin();
+}
+
 }  // namespace content