Issue 1977 - Consider content location instead element attributes when detecting anonymous frames

include.preload.js

Index: include.preload.js
===================================================================
--- a/include.preload.js
+++ b/include.preload.js
@@ -76,25 +76,22 @@
     ext.backgroundPage.sendMessage({type: "add-sitekey", token: attr});
 }
 
-function hasInlineURL(element, attribute)
-{
-  var value = element.getAttribute(attribute);
-  return value == null || /^\s*(javascript:|about:|$)/i.test(value);
-}
-
 function isInlineFrame(element)
 {
-  switch (element.localName)
+  var contentDocument;
+  try
   {
-    case "iframe":
-      return hasInlineURL(element, "src") || element.hasAttribute("srcdoc");
-    case "frame":
-      return hasInlineURL(element, "src");
-    case "object":
-      return hasInlineURL(element, "data") && element.contentDocument;
-    default:
-      return false;
+    contentDocument = element.contentDocument;
   }
+  catch (e)
+  {
+    return false;  // third-party
+  }
+
+  if (!contentDocument)
+    return false;  // not a frame
+
+  return contentDocument.location.protocol == "about:";

[kzar, 2015/02/09 16:52:11]

Previously we would return true if the URL started with "javascript:" or
"about:" but now we're only checking if the protocol is about. What about
Javascript URLs?

[Sebastian Noack, 2015/02/09 17:10:00]

Previously, we checked against the raw attribute value and had to consider
javascript: URLs explicitly. However, this isn't necessary anymore, since actual
URL of a page loaded from a javascript: URL is "about:blank".

 }
 
 function resolveURL(url)