Use frame url for scripts without sources

[spylogsster]

Resolves brave/brave-browser#29585

Submitter Checklist:

• I confirm that no security/privacy review is needed, or that I have requested one
• There is a ticket for my issue
• Used Github auto-closing keywords in the PR description above
• Wrote a good PR/commit description
• Squashed any review feedback or "fixup" commits before merge, so that history is a record of what happened in the repo, not your PR
• Added appropriate labels (QA/Yes or QA/No; release-notes/include or release-notes/exclude; OS/...) to the associated issue
• Checked the PR locally:
  • npm run test -- brave_browser_tests, npm run test -- brave_unit_tests wiki
  • npm run lint, npm run presubmit wiki, npm run gn_check, npm run tslint
• Ran git rebase master (if needed)

Reviewer Checklist:

• A security review is not needed, or a link to one is included in the PR description
• New files have MPL-2.0 license header
• Adequate test coverage exists to prevent regressions
• Major classes, functions and non-trivial code blocks are well-commented
• Changes in component dependencies are properly reflected in gn
• Code follows the style guide
• Test plan is specified in PR before merging

After-merge Checklist:

• The associated issue milestone is set to the smallest version that the
  changes has landed on
• All relevant documentation has been updated, for instance:
  • https://github.com/brave/brave-browser/wiki/Deviations-from-Chromium-(features-we-disable-or-remove)
  • https://github.com/brave/brave-browser/wiki/Proxy-redirected-URLs
  • https://github.com/brave/brave-browser/wiki/Fingerprinting-Protections
  • https://github.com/brave/brave-browser/wiki/Brave%E2%80%99s-Use-of-Referral-Codes
  • https://github.com/brave/brave-browser/wiki/Custom-Headers
  • https://github.com/brave/brave-browser/wiki/Web-Compatibility-Exceptions-in-Brave
  • https://github.com/brave/brave-browser/wiki/QA-Guide
  • https://github.com/brave/brave-browser/wiki/P3A

Test Plan:

• Steps from issue

[pes10k]

    secondary_url = render_frame()->GetWebFrame()->GetDocument().Url();
  }

What happens if the script is being executed in an iframe with URL of about:blank? Will this report about:blank or the URL of the first non-about:blank parent frame?

[spylogsster]

    secondary_url = render_frame()->GetWebFrame()->GetDocument().Url();
  }

What happens if the script is being executed in an iframe with URL of about:blank? Will this report about:blank or the URL of the first non-about:blank parent frame?

should report about:blank

[pes10k]

I dont think thats correct then. I will double check, but (I believe) a script in the example I gave should count as executing in the first non-about:blank parent frame

[pes10k]

yes, I think im correct, you want to base things off of whatever document.domain reports, which, in the case of a nested about:blank iframe, will be the domain of the first non-about:blank parent frame

[pes10k]

this doesn't look complete to me. I think what you want is SchemeIsLocal, or maybe just always GetSecurityOrigin()

[spylogsster]

SchemeIsLocal looks good, thanks, updated

[pes10k]

Are there tests for the following cases? If so, then I think this is good:

1. when scripts are blocked for example.com, that scripts blocking in a local iframe embedded in example.com are also blocked
2. 1. when scripts are not blocked for example.com, that scripts blocking in a local iframe embedded in example.com are not blocked

[spylogsster]

Are there tests for the following cases? If so, then I think this is good:

1. when scripts are blocked for example.com, that scripts blocking in a local iframe embedded in example.com are also blocked
2. 1. when scripts are not blocked for example.com, that scripts blocking in a local iframe embedded in example.com are not blocked

yes, they are using a.com with a script without source and with load_js_dataurls.js script which creates about:blank iframe with additional script without source and checks they are blocked or not:

a.com
   <script>without source</script>
   load_js_dataurls.js
      <iframe src=about:blank>
          <script>without source</script>             

[pes10k]

Lgtm with the additional tests

[stephendonner]

Uber-nit, here: you forgot the closing ) in the source comment, after // document.location)

[stephendonner]

Verified PASSED using

Brave	1.52.39 Chromium: 112.0.5615.49 (Official Build) nightly (64-bit)
Revision	bd2a7bcb881c11e8cfe3078709382934e3916914-refs/branch-heads/5615@{#936}
OS	Windows 10 Version 22H2 (Build 19045.2846)

Steps:

Followed those from brave/brave-browser#29585 (comment)

Confirmed the scripts which previously showed from null are now showing from https://apps.facebook.com

example	example	example	example	example

[stephendonner]

@spylogsster mind getting an uplift going to 1.51.x, for the above? Thanks!