Topic 11477 - Whitelisting doesn`t deal with frames correctly

webrequest.js

Index: webrequest.js
===================================================================
--- a/webrequest.js
+++ b/webrequest.js
@@ -176,20 +176,24 @@ function checkRequest(type, tabId, url, 
   var documentHost = extractHostFromURL(documentUrl);
   var thirdParty = isThirdParty(requestHost, documentHost);
   return defaultMatcher.matchesAny(url, type, documentHost, thirdParty);
 }
 
 function isFrameWhitelisted(tabId, frameId, type)
 {
   var parent = frameId;
-  while (parent != -1)
+  var parentData = getFrameData(tabId, parent);

[Felix Dahlke, 2012/11/06 10:20:59]

Can the supplied frameId be -1? The previous version handled this case.

[Wladimir Palant, 2012/11/06 11:02:02]

Yes, it could be -1. getFrameData() will return null then and the function will
immediately return false.

+  while (parentData)
   {
-    var parentData = getFrameData(tabId, parent);
-    if (!parentData)
-      break;
+    var frame = parent;
+    var frameData = parentData;
 
-    if (isWhitelisted(parentData.url, type) || "keyException" in parentData)
+    parent = frameData.parent;
+    parentData = (parent != -1 ? getFrameData(tabId, parent) : null);
+
+    var frameUrl = frameData.url;
+    var parentUrl = (parentData ? parentData.url : frameUrl);

[Felix Dahlke, 2012/11/06 10:20:59]

Shouldn't parentUrl be null if there is no parent? isWhitelisted() can handle a
null parentUrl. 

[Wladimir Palant, 2012/11/06 11:02:02]

I considered this but decided that it would be better to define all parameters
explicitly rather than rely on implicit behavior of isWhitelisted(). In the top
frame we are our own parent.

+    if ("keyException" in frameData || isWhitelisted(frameUrl, parentUrl, type))
       return true;
-    parent = parentData.parent;
   }
   return false;
 }