Remove origin parameter from web socket mojo
IPCs communicating their Origin to the browser in requests should be updated to
remove their origin from such requests. The browser knows the Origin of the web
frame / worker making the request; it does not need the renderer to tell it the
Origin, nor should the browser believe them (renderers are untrusted, accepting
their idea of Origin is insecure). Update WebSockets, make them join the party,
remove Origin from their requests to the browser.
Bug: 779444
Change-Id: I000d23520f498f445b89f197d833fa335fa3de04
Reviewed-on: https://chromium-review.googlesource.com/788011
Reviewed-by: Yutaka Hirano <[email protected]>
Reviewed-by: Sam McNally <[email protected]>
Reviewed-by: Kinuko Yasuda <[email protected]>
Commit-Queue: Noel Gordon <[email protected]>
Cr-Commit-Position: refs/heads/master@{#537178}diff --git a/content/browser/renderer_interface_binders.cc b/content/browser/renderer_interface_binders.cc
index f7be717..ff1b210 100644
--- a/content/browser/renderer_interface_binders.cc
+++ b/content/browser/renderer_interface_binders.cc
@@ -128,8 +128,8 @@
parameterized_binder_registry_.AddInterface(
base::Bind([](blink::mojom::WebSocketRequest request,
RenderProcessHost* host, const url::Origin& origin) {
- WebSocketManager::CreateWebSocket(host->GetID(), MSG_ROUTING_NONE,
- std::move(request));
+ WebSocketManager::CreateWebSocketWithOrigin(
+ host->GetID(), origin, std::move(request), MSG_ROUTING_NONE);
}));
parameterized_binder_registry_.AddInterface(
base::Bind([](payments::mojom::PaymentManagerRequest request,
