From 6496895b16aacd32bceb02d6e19cb354e53471fb Mon Sep 17 00:00:00 2001
From: Andreas Kling <kling@serenityos.org>
Date: Tue, 8 Dec 2020 17:47:47 +0100
Subject: [PATCH] LibWeb: <iframe src> same-origin check should be based on
 host document

We were basing the src attribute's cross-origin check on whatever was
currently loaded in the iframe, instead of the surrounding document.

Fixes #4236.
---
 Libraries/LibWeb/HTML/HTMLIFrameElement.cpp | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Libraries/LibWeb/HTML/HTMLIFrameElement.cpp b/Libraries/LibWeb/HTML/HTMLIFrameElement.cpp
index 2f58be732d..b2488620c2 100644
--- a/Libraries/LibWeb/HTML/HTMLIFrameElement.cpp
+++ b/Libraries/LibWeb/HTML/HTMLIFrameElement.cpp
@@ -79,8 +79,8 @@ void HTMLIFrameElement::load_src(const String& value)
         dbg() << "iframe failed to load URL: Invalid URL: " << value;
         return;
     }
-    if (url.protocol() == "file" && content_origin().protocol() != "file") {
-        dbg() << "iframe failed to load URL: Security violation: " << document().url() << " may not load " << value;
+    if (url.protocol() == "file" && document().origin().protocol() != "file") {
+        dbg() << "iframe failed to load URL: Security violation: " << document().url() << " may not load " << url;
         return;
     }