Merge 96826 - Add check for JavaScript URLs in HTMLPlugInImageElement::allowedToLoadFrameURL

Source/WebCore/html/HTMLPlugInImageElement.cpp

 /*
  * Copyright (C) 2008, 2011 Apple Inc. All rights reserved.
  *
  * This library is free software; you can redistribute it and/or
  * modify it under the terms of the GNU Library General Public
  * License as published by the Free Software Foundation; either
  * version 2 of the License, or (at your option) any later version.
  *
  * This library is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 12 matching lines @@
 
 #include "Frame.h"
 #include "FrameLoader.h"
 #include "FrameLoaderClient.h"
 #include "HTMLImageLoader.h"
 #include "HTMLNames.h"
 #include "Image.h"
 #include "Page.h"
 #include "RenderEmbeddedObject.h"
 #include "RenderImage.h"
+#include "SecurityOrigin.h"
 
 namespace WebCore {
 
 HTMLPlugInImageElement::HTMLPlugInImageElement(const QualifiedName& tagName, Document* document, bool createdByParser, PreferPlugInsForImagesOption preferPlugInsForImagesOption)
     : HTMLPlugInElement(tagName, document)
     // m_needsWidgetUpdate(!createdByParser) allows HTMLObjectElement to delay
     // widget updates until after all children are parsed.  For HTMLEmbedElement
     // this delay is unnecessary, but it is simpler to make both classes share
     // the same codepath in this class.
     , m_needsWidgetUpdate(!createdByParser)
@@ skipping 26 matching lines @@
 
 // We don't use m_url, as it may not be the final URL that the object loads,
 // depending on <param> values. 
 bool HTMLPlugInImageElement::allowedToLoadFrameURL(const String& url)
 {
     ASSERT(document());
     ASSERT(document()->frame());
     if (document()->frame()->page()->frameCount() >= Page::maxNumberOfFrames)
         return false;
 
+    KURL completeURL = document()->completeURL(url);
+    
+    if (contentFrame() && protocolIsJavaScript(completeURL)
+        && !document()->securityOrigin()->canAccess(contentDocument()->securityOrigin()))
+        return false;
+    
     // We allow one level of self-reference because some sites depend on that.
     // But we don't allow more than one.
-    KURL completeURL = document()->completeURL(url);
     bool foundSelfReference = false;
     for (Frame* frame = document()->frame(); frame; frame = frame->tree()->parent()) {
         if (equalIgnoringFragmentIdentifier(frame->document()->url(), completeURL)) {
             if (foundSelfReference)
                 return false;
             foundSelfReference = true;
         }
     }
     return true;
 }
@@ skipping 95 matching lines @@
         m_imageLoader->elementWillMoveToNewOwnerDocument();
     HTMLPlugInElement::willMoveToNewOwnerDocument();
 }
 
 void HTMLPlugInImageElement::updateWidgetCallback(Node* n, unsigned)
 {
     static_cast<HTMLPlugInImageElement*>(n)->updateWidgetIfNecessary();
 }
 
 } // namespace WebCore