Prevent sandboxed iframes from bypassing WebSocket mixed content checks.

Source/modules/websockets/NewWebSocketChannelImpl.cpp

Index: Source/modules/websockets/NewWebSocketChannelImpl.cpp
diff --git a/Source/modules/websockets/NewWebSocketChannelImpl.cpp b/Source/modules/websockets/NewWebSocketChannelImpl.cpp
index d081154a8bfc51b23d66775cdf3a3bfb8d48640a..a03e4b03da72ad1be0d6c01a38b8b19ba90a457c 100644
--- a/Source/modules/websockets/NewWebSocketChannelImpl.cpp
+++ b/Source/modules/websockets/NewWebSocketChannelImpl.cpp
@@ -134,8 +134,13 @@ bool NewWebSocketChannelImpl::connect(const KURL& url, const String& protocol)
     if (!m_handle)
         return false;
 
-    if (executionContext()->isDocument() && document()->frame() && !document()->frame()->loader().mixedContentChecker()->canConnectInsecureWebSocket(document()->securityOrigin(), url))
-        return false;
+    if (executionContext()->isDocument() && document()->frame()) {
+        if (!document()->frame()->loader().mixedContentChecker()->canConnectInsecureWebSocket(document()->securityOrigin(), url))
+            return false;
+        Frame* top = document()->frame()->tree().top();
+        if (top != document()->frame() && !toLocalFrame(top)->loader().mixedContentChecker()->canConnectInsecureWebSocket(toLocalFrame(top)->document()->securityOrigin(), url))
+            return false;
+    }
     if (MixedContentChecker::isMixedContent(document()->securityOrigin(), url)) {
         String message = "Connecting to a non-secure WebSocket server from a secure origin is deprecated.";
         document()->addConsoleMessage(JSMessageSource, WarningMessageLevel, message);