Custom handlers should throw SecurityError exception if the URL's origin differs from the document'…

Source/modules/navigatorcontentutils/NavigatorContentUtils.cpp

 /*
  * Copyright (C) 2011, Google Inc. All rights reserved.
  * Copyright (C) 2014, Samsung Electronics. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
@@ skipping 50 matching lines @@
         "tel",
         "urn",
         "webcal",
         "wtai",
         "xmpp",
     };
     for (size_t i = 0; i < WTF_ARRAY_LENGTH(protocols); ++i)
         protocolWhitelist->add(protocols[i]);
 }
 
-static bool verifyCustomHandlerURL(const KURL& baseURL, const String& url, ExceptionState& exceptionState)
+static bool verifyCustomHandlerURL(const Document& document, const String& url, ExceptionState& exceptionState)
 {
     // The specification requires that it is a SyntaxError if the "%s" token is
     // not present.
     static const char token[] = "%s";
     int index = url.find(token);
     if (-1 == index) {
         exceptionState.throwDOMException(SyntaxError, "The url provided ('" + url + "') does not contain '%s'.");
         return false;
     }
 
     // It is also a SyntaxError if the custom handler URL, as created by removing
     // the "%s" token and prepending the base url, does not resolve.
     String newURL = url;
     newURL.remove(index, WTF_ARRAY_LENGTH(token) - 1);
 
+    KURL baseURL = document.baseURL();
     KURL kurl(baseURL, newURL);
 
     if (kurl.isEmpty() || !kurl.isValid()) {
         exceptionState.throwDOMException(SyntaxError, "The custom handler URL created by removing '%s' and prepending '" + baseURL.string() + "' is invalid.");
         return false;
     }
 
+    // The specification says that the API throws SecurityError exception if the URL's origin differs from the document's origin.
+    if (!document.securityOrigin()->canRequest(kurl)) {
+        exceptionState.throwSecurityError("Can only register custom handler in the document's origin.");
+        return false;
+    }
+
     return true;
 }
 
 static bool isProtocolWhitelisted(const String& scheme)
 {
     if (!protocolWhitelist)
         initProtocolHandlerWhitelist();
 
     StringBuilder builder;
     unsigned length = scheme.length();
@@ skipping 38 matching lines @@
 PassOwnPtrWillBeRawPtr<NavigatorContentUtils> NavigatorContentUtils::create(PassOwnPtr<NavigatorContentUtilsClient> client)
 {
     return adoptPtrWillBeNoop(new NavigatorContentUtils(client));
 }
 
 void NavigatorContentUtils::registerProtocolHandler(Navigator& navigator, const String& scheme, const String& url, const String& title, ExceptionState& exceptionState)
 {
     if (!navigator.frame())
         return;
 
-    ASSERT(navigator.frame()->document());
-    KURL baseURL = navigator.frame()->document()->baseURL();
+    Document* document = navigator.frame()->document();
+    ASSERT(document);
 
-    if (!verifyCustomHandlerURL(baseURL, url, exceptionState))
+    if (!verifyCustomHandlerURL(*document, url, exceptionState))
         return;
 
     if (!verifyCustomHandlerScheme(scheme, exceptionState))
         return;
 
     ASSERT(navigator.frame()->page());
-    NavigatorContentUtils::from(*navigator.frame()->page())->client()->registerProtocolHandler(scheme, baseURL, KURL(ParsedURLString, url), title);
+    NavigatorContentUtils::from(*navigator.frame()->page())->client()->registerProtocolHandler(scheme, document->baseURL(), KURL(ParsedURLString, url), title);
 }
 
 static String customHandlersStateString(const NavigatorContentUtilsClient::CustomHandlersState state)
 {
     DEFINE_STATIC_LOCAL(const String, newHandler, ("new"));
     DEFINE_STATIC_LOCAL(const String, registeredHandler, ("registered"));
     DEFINE_STATIC_LOCAL(const String, declinedHandler, ("declined"));
 
     switch (state) {
     case NavigatorContentUtilsClient::CustomHandlersNew:
@@ skipping 13 matching lines @@
     DEFINE_STATIC_LOCAL(const String, declined, ("declined"));
 
     if (!navigator.frame())
         return declined;
 
     Document* document = navigator.frame()->document();
     ASSERT(document);
     if (document->activeDOMObjectsAreStopped())
         return declined;
 
-    KURL baseURL = document->baseURL();
-
-    if (!verifyCustomHandlerURL(baseURL, url, exceptionState))
+    if (!verifyCustomHandlerURL(*document, url, exceptionState))
         return declined;
 
     if (!verifyCustomHandlerScheme(scheme, exceptionState))
         return declined;
 
     ASSERT(navigator.frame()->page());
-    return customHandlersStateString(NavigatorContentUtils::from(*navigator.frame()->page())->client()->isProtocolHandlerRegistered(scheme, baseURL, KURL(ParsedURLString, url)));
+    return customHandlersStateString(NavigatorContentUtils::from(*navigator.frame()->page())->client()->isProtocolHandlerRegistered(scheme, document->baseURL(), KURL(ParsedURLString, url)));
 }
 
 void NavigatorContentUtils::unregisterProtocolHandler(Navigator& navigator, const String& scheme, const String& url, ExceptionState& exceptionState)
 {
     if (!navigator.frame())
         return;
 
-    ASSERT(navigator.frame()->document());
-    KURL baseURL = navigator.frame()->document()->baseURL();
+    Document* document = navigator.frame()->document();
+    ASSERT(document);
 
-    if (!verifyCustomHandlerURL(baseURL, url, exceptionState))
+    if (!verifyCustomHandlerURL(*document, url, exceptionState))
         return;
 
     if (!verifyCustomHandlerScheme(scheme, exceptionState))
         return;
 
     ASSERT(navigator.frame()->page());
-    NavigatorContentUtils::from(*navigator.frame()->page())->client()->unregisterProtocolHandler(scheme, baseURL, KURL(ParsedURLString, url));
+    NavigatorContentUtils::from(*navigator.frame()->page())->client()->unregisterProtocolHandler(scheme, document->baseURL(), KURL(ParsedURLString, url));
 }
 
 const char* NavigatorContentUtils::supplementName()
 {
     return "NavigatorContentUtils";
 }
 
 void provideNavigatorContentUtilsTo(Page& page, PassOwnPtr<NavigatorContentUtilsClient> client)
 {
     NavigatorContentUtils::provideTo(page, NavigatorContentUtils::supplementName(), NavigatorContentUtils::create(client));
 }
 
 } // namespace blink