GitLab

Check an url::Origin always survives the conversion through a
blink::SecurityOrigin. This is typically what is done during some
browser process <-> renderer process IPC.

For instance, in https://crbug.com/901489, the origin sent from the
browser process didn't survived the conversion. The host in url::Origin is
percent encoded, while in the blink::SecurityOrigin, it used not to.

SecurityOrigin::CreateFromString(...) is called with untrusted input by
several components.

This patch is mostly added by curiosity, to make me comfortable with:
https://chromium-review.googlesource.com/c/chromium/src/+/2464363

Fixed: 490074
Bug: None
Change-Id: Icec738475e888569ad99520f45afa5bcc6a7bbd0
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2491360Reviewed-by: Mike West <mkwst@chromium.org>
Commit-Queue: Arthur Sonzogni <arthursonzogni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#821170}