0
Files
src/content/browser
Titouan Rigoudy facb13e7a2 [Private Network Access] Browser-created empty main frames are local.
This CL changes the handling of browser-created main frames to default
to the `local` address space instead of `unknown`, which relaxes their
security constraints. This relaxation allows code injected by e.g.
WebView APIs to fetch resources from the local network from within such
contexts. Because of its potential to allow bypassing Private Network
Access restrictions, this relaxation is circumscribed to only those main
frames in which we can definitively assert that no JS can be injected by
malicious websites.

Fixed: chromium:1191161
Change-Id: I10edc4743b96895c312546ad1302a9a8d1727c29
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2787427
Auto-Submit: Titouan Rigoudy <titouan@chromium.org>
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Reviewed-by: Łukasz Anforowicz <lukasza@chromium.org>
Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#868596}
2021-04-01 18:26:40 +00:00
..
2021-03-19 19:55:55 +00:00
2021-03-22 15:50:35 +00:00
2021-03-19 19:55:55 +00:00
2021-03-25 03:06:35 +00:00
2021-03-11 16:34:16 +00:00