GitLab

Thanks to an earlier CL (https://crrev.com/c/2274591), this CL can
modify CorsURLLoaderFactory::IsValidRequest to enforce the presence of
|request_initiator_site_lock| (see the mojo::ReportBadMessage call in
the InitiatorLockCompatibility::kNoLock case).  This is a big security
win - it means that the |request_initiator| can no longer be spoofed on
the Android platform (the CL modifies
//docs/security/compromised-renderers.md accordingly).

Bug: 1114906
Change-Id: I9e52ea33d8e929e31c1b4bfaf8fc85e5d2e185f8
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2347195
Commit-Queue: Łukasz Anforowicz <lukasza@chromium.org>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#799116}