diff options
| author | Tim Judkins <tjudkins@chromium.org> | 2020-01-31 01:45:22 +0000 |
|---|---|---|
| committer | Michal Klocek <michal.klocek@qt.io> | 2020-04-22 18:13:02 +0000 |
| commit | 39d2873778c5bcc237843216180b3a52ceb5b1f4 (patch) | |
| tree | 399035246dcbc6a1f4be9fdf88c9185b7b0f9e73 | |
| parent | 020de77cb354c097596bfde61b328aad37801d86 (diff) | |
| download | qtwebengine-chromium-39d2873778c5bcc237843216180b3a52ceb5b1f4.tar.gz | |
[Backport] CVE-2020-6433
Check for initiator origin in ExtensionNavigationThrottle.
Changes one of the checks in ExtensionNavigationThrottle to check if the
initiator origin of a navigation is empty, to more correctly handle
history.back() being used to navigate a window. Adds tests to cover this
case.
Also adds a test for a similar case which navigates a local frame, which
results in the navigation being blocked at the renderer level.
Bug: 1043965
Change-Id: Ic4cc99326ed2394b54e684044153cb3ddbdd37ed
Reviewed-by: Allan Sandfeld Jensen <allan.jensen@qt.io>
| -rw-r--r-- | chromium/extensions/browser/extension_navigation_throttle.cc | 7 |
1 files changed, 5 insertions, 2 deletions
diff --git a/chromium/extensions/browser/extension_navigation_throttle.cc b/chromium/extensions/browser/extension_navigation_throttle.cc index 8214f2ebc6f..8b046da23ad 100644 --- a/chromium/extensions/browser/extension_navigation_throttle.cc +++ b/chromium/extensions/browser/extension_navigation_throttle.cc @@ -123,12 +123,15 @@ ExtensionNavigationThrottle::WillStartOrRedirectRequest() { } } - // Browser-initiated requests are always considered trusted, and thus allowed. + // Navigations with no initiator (e.g. browser-initiated requests) are always + // considered trusted, and thus allowed. // // Note that GuestView navigations initiated by the embedder also count as a // browser-initiated navigation. - if (!navigation_handle()->IsRendererInitiated()) + if (!navigation_handle()->GetInitiatorOrigin().has_value()) { + DCHECK(!navigation_handle()->IsRendererInitiated()); return content::NavigationThrottle::PROCEED; + } // All renderer-initiated navigations must have an initiator. DCHECK(navigation_handle()->GetInitiatorOrigin().has_value()); |