Add restriction to ViewHostMsg_GetRawCookies to block access from untrusted r...

chrome/browser/renderer_host/resource_message_filter.cc

Index: chrome/browser/renderer_host/resource_message_filter.cc
===================================================================
--- chrome/browser/renderer_host/resource_message_filter.cc	(revision 39084)
+++ chrome/browser/renderer_host/resource_message_filter.cc	(working copy)
@@ -632,6 +632,15 @@
     const GURL& url,
     const GURL& first_party_for_cookies,
     IPC::Message* reply_msg) {
+  // Only return raw cookies to trusted renderers.
+  if (!ChildProcessSecurityPolicy::GetInstance()->CanReadRawCookies(id())) {

[yurys, 2010/02/16 16:16:08]

lgtm, but I'd recommend you ask someone who better understands this stuff to
look at this change?

+    ViewHostMsg_GetRawCookies::WriteReplyParams(
+        reply_msg,
+        std::vector<webkit_glue::WebCookie>());
+    Send(reply_msg);
+    return;
+  }
+
   URLRequestContext* context = GetRequestContextForURL(url);
 
   GetRawCookiesCompletion* callback =