From 04ad20732516edd03b98f0181c9e9f17a40f1f2f Mon Sep 17 00:00:00 2001 From: Ben Murdoch Date: Tue, 30 Sep 2014 15:43:34 +0100 Subject: Cherry pick r96826. Add check for JavaScript URLs in HTMLPlugInImageElement::allowedToLoadFrameURL Bug: 17658625 Change-Id: Icb7249526aa5f38dd6f93ad67fe7a21ad713d31b --- Source/WebCore/html/HTMLPlugInImageElement.cpp | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/Source/WebCore/html/HTMLPlugInImageElement.cpp b/Source/WebCore/html/HTMLPlugInImageElement.cpp index f3a99dd..0cc5c58 100644 --- a/Source/WebCore/html/HTMLPlugInImageElement.cpp +++ b/Source/WebCore/html/HTMLPlugInImageElement.cpp @@ -30,6 +30,7 @@ #include "Page.h" #include "RenderEmbeddedObject.h" #include "RenderImage.h" +#include "SecurityOrigin.h" namespace WebCore { @@ -75,9 +76,14 @@ bool HTMLPlugInImageElement::allowedToLoadFrameURL(const String& url) if (document()->frame()->page()->frameCount() >= Page::maxNumberOfFrames) return false; + KURL completeURL = document()->completeURL(url); + + if (contentFrame() && protocolIsJavaScript(completeURL) + && !document()->securityOrigin()->canAccess(contentDocument()->securityOrigin())) + return false; + // We allow one level of self-reference because some sites depend on that. // But we don't allow more than one. - KURL completeURL = document()->completeURL(url); bool foundSelfReference = false; for (Frame* frame = document()->frame(); frame; frame = frame->tree()->parent()) { if (equalIgnoringFragmentIdentifier(frame->document()->url(), completeURL)) { -- cgit v1.1