electron/patches/common/chromium/can_create_window.patch

diff --git a/content/browser/frame_host/render_frame_host_impl.cc b/content/browser/frame_host/render_frame_host_impl.cc
index 25841d376bcd..df41213f4c49 100644
--- a/content/browser/frame_host/render_frame_host_impl.cc
+++ b/content/browser/frame_host/render_frame_host_impl.cc
@@ -2874,6 +2874,38 @@ void RenderFrameHostImpl::CreateNewWindow(
                "frame_tree_node", frame_tree_node_->frame_tree_node_id(), "url",
                params->target_url.possibly_invalid_spec());
 
+  scoped_refptr<network::ResourceRequestBody> body;
+  if (params->body->has_object) {
+    body = new network::ResourceRequestBody;
+    std::vector<network::DataElement> elements;
+    for (const auto& iter : params->body->elements) {
+      network::DataElement element;
+      switch (iter->type) {
+        case network::DataElement::TYPE_BYTES: {
+          element.SetToBytes(iter->bytes.data(), iter->bytes.length());
+          break;
+        }
+        case network::DataElement::TYPE_FILE: {
+          element.SetToFilePathRange(iter->path, iter->offset, iter->length,
+                                     iter->expected_modification_time);
+          break;
+        }
+        case network::DataElement::TYPE_BLOB: {
+          element.SetToBlobRange(iter->blob_uuid, iter->offset, iter->length);
+          break;
+        }
+        case network::DataElement::TYPE_DATA_PIPE:
+        default:
+          NOTREACHED();
+          break;
+      }
+      elements.push_back(std::move(element));
+    }
+    body->swap_elements(&elements);
+    body->set_identifier(params->body->identifier);
+    body->set_contains_sensitive_info(params->body->contains_sensitive_info);
+  }
+
   bool no_javascript_access = false;
 
   // Filter out URLs to which navigation is disallowed from this context.
@@ -2896,8 +2928,9 @@ void RenderFrameHostImpl::CreateNewWindow(
           frame_tree_node_->frame_tree()->GetMainFrame()->GetLastCommittedURL(),
           last_committed_origin_.GetURL(), params->window_container_type,
           params->target_url, params->referrer, params->frame_name,
-          params->disposition, *params->features, params->user_gesture,
-          params->opener_suppressed, &no_javascript_access);
+          params->disposition, *params->features, params->additional_features,
+          body, params->user_gesture, params->opener_suppressed,
+          &no_javascript_access);
 
   if (!can_create_window) {
     std::move(callback).Run(mojom::CreateNewWindowStatus::kIgnore, nullptr);
diff --git a/content/common/frame.mojom b/content/common/frame.mojom
index 99ec7e8d7995..26a4040fba97 100644
--- a/content/common/frame.mojom
+++ b/content/common/frame.mojom
@@ -11,6 +11,8 @@ import "content/public/common/resource_type.mojom";
 import "content/public/common/resource_load_info.mojom";
 import "content/public/common/transferrable_url_loader.mojom";
 import "content/public/common/window_container_type.mojom";
+import "mojo/public/mojom/base/file_path.mojom";
+import "mojo/public/mojom/base/time.mojom";
 import "mojo/public/mojom/base/string16.mojom";
 import "mojo/public/mojom/base/unguessable_token.mojom";
 import "services/network/public/mojom/url_loader.mojom";
@@ -146,6 +148,24 @@ interface FrameFactory {
   CreateFrame(int32 frame_routing_id, Frame& frame);
 };
 
+struct DataElement {
+  int32 type;
+  int64 length;
+  string bytes;
+  mojo_base.mojom.FilePath path;
+  int64 offset;
+  mojo_base.mojom.Time expected_modification_time;
+  url.mojom.Url filesystem_url;
+  string blob_uuid;
+};
+
+struct ResourceRequestBody {
+  bool has_object;
+  int64 identifier;
+  bool contains_sensitive_info;
+  array<DataElement> elements;
+};
+
 struct CreateNewWindowParams {
   // True if this open request came in the context of a user gesture.
   bool user_gesture;
@@ -182,6 +202,10 @@ struct CreateNewWindowParams {
 
   // The window features to use for the new window.
   blink.mojom.WindowFeatures features;
+
+  // Extra fields added by Electron.
+  array<string> additional_features;
+  ResourceRequestBody body;
 };
 
 // Operation result when the renderer asks the browser to create a new window.
diff --git a/content/public/browser/content_browser_client.cc b/content/public/browser/content_browser_client.cc
index 37e2d88e28e9..6c366435ddd8 100644
--- a/content/public/browser/content_browser_client.cc
+++ b/content/public/browser/content_browser_client.cc
@@ -382,6 +382,8 @@ bool ContentBrowserClient::CanCreateWindow(
     const std::string& frame_name,
     WindowOpenDisposition disposition,
     const blink::mojom::WindowFeatures& features,
+    const std::vector<std::string>& additional_features,
+    const scoped_refptr<network::ResourceRequestBody>& body,
     bool user_gesture,
     bool opener_suppressed,
     bool* no_javascript_access) {
diff --git a/content/public/browser/content_browser_client.h b/content/public/browser/content_browser_client.h
index 63cb3851db0a..4a96c8851df0 100644
--- a/content/public/browser/content_browser_client.h
+++ b/content/public/browser/content_browser_client.h
@@ -151,6 +151,7 @@ class RenderFrameHost;
 class RenderProcessHost;
 class RenderViewHost;
 class ResourceContext;
+class ResourceRequestBody;
 class SiteInstance;
 class SpeechRecognitionManagerDelegate;
 class StoragePartition;
@@ -625,6 +626,8 @@ class CONTENT_EXPORT ContentBrowserClient {
       const std::string& frame_name,
       WindowOpenDisposition disposition,
       const blink::mojom::WindowFeatures& features,
+      const std::vector<std::string>& additional_features,
+      const scoped_refptr<network::ResourceRequestBody>& body,
       bool user_gesture,
       bool opener_suppressed,
       bool* no_javascript_access);
diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
index 7a866ded50f1..f019ce3b24bb 100644
--- a/content/renderer/render_view_impl.cc
+++ b/content/renderer/render_view_impl.cc
@@ -79,6 +79,7 @@
 #include "content/renderer/input/input_handler_manager.h"
 #include "content/renderer/internal_document_state_data.h"
 #include "content/renderer/loader/request_extra_data.h"
+#include "content/renderer/loader/web_url_request_util.h"
 #include "content/renderer/media/audio_device_factory.h"
 #include "content/renderer/media/stream/media_stream_device_observer.h"
 #include "content/renderer/media/video_capture_impl_manager.h"
@@ -1258,6 +1259,46 @@ WebView* RenderViewImpl::CreateView(WebLocalFrame* creator,
   }
   params->features = ConvertWebWindowFeaturesToMojoWindowFeatures(features);
 
+  params->body = mojom::ResourceRequestBody::New();
+  auto body = GetRequestBodyForWebURLRequest(request);
+  if (body) {
+    params->body->has_object = true;
+    params->body->identifier = body->identifier();
+    params->body->contains_sensitive_info = body->contains_sensitive_info();
+    for (const auto& element : *body->elements()) {
+      content::mojom::DataElementPtr ptr = content::mojom::DataElement::New();
+      ptr->type = element.type();
+      switch (element.type()) {
+        case network::DataElement::TYPE_BYTES: {
+          ptr->bytes = std::string(element.bytes(), element.length());
+          break;
+        }
+        case network::DataElement::TYPE_FILE: {
+          ptr->path = element.path();
+          ptr->offset = element.offset();
+          ptr->length = element.length();
+          ptr->expected_modification_time = element.expected_modification_time();
+          break;
+        }
+        case network::DataElement::TYPE_BLOB: {
+          ptr->blob_uuid = element.blob_uuid();
+          ptr->offset = element.offset();
+          ptr->length = element.length();
+          break;
+        }
+        case network::DataElement::TYPE_CHUNKED_DATA_PIPE:
+        case network::DataElement::TYPE_RAW_FILE:
+        case network::DataElement::TYPE_DATA_PIPE:
+        case network::DataElement::TYPE_UNKNOWN:
+          NOTREACHED();
+          break;
+      }
+      params->body->elements.push_back(std::move(ptr));
+    }
+  } else {
+    params->body->has_object = false;
+  }
+
   // We preserve this information before sending the message since |params| is
   // moved on send.
   bool is_background_tab =
diff --git a/content/browser/security_exploit_browsertest.cc b/content/browser/security_exploit_browsertest.cc
index 0a1f363a673a..adcef6fca779 100644
--- a/content/browser/security_exploit_browsertest.cc
+++ b/content/browser/security_exploit_browsertest.cc
@@ -293,6 +293,7 @@ IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
 
   mojom::CreateNewWindowParamsPtr params = mojom::CreateNewWindowParams::New();
   params->target_url = GURL("about:blank");
+  params->body = mojom::ResourceRequestBody::New();
   pending_rfh->CreateNewWindow(
       std::move(params), base::BindOnce([](mojom::CreateNewWindowStatus,
                                            mojom::CreateNewWindowReplyPtr) {}));
diff --git a/content/shell/browser/layout_test/layout_test_content_browser_client.cc b/content/shell/browser/layout_test/layout_test_content_browser_client.cc
index 2eaee37ec780..9994df95a798 100644
--- a/content/shell/browser/layout_test/layout_test_content_browser_client.cc
+++ b/content/shell/browser/layout_test/layout_test_content_browser_client.cc
@@ -182,6 +182,8 @@ bool LayoutTestContentBrowserClient::CanCreateWindow(
     const std::string& frame_name,
     WindowOpenDisposition disposition,
     const blink::mojom::WindowFeatures& features,
+    const std::vector<std::string>& additional_features,
+    const scoped_refptr<network::ResourceRequestBody>& body,
     bool user_gesture,
     bool opener_suppressed,
     bool* no_javascript_access) {
diff --git a/content/shell/browser/layout_test/layout_test_content_browser_client.h b/content/shell/browser/layout_test/layout_test_content_browser_client.h
index 62b637bc80ce..1a9a06ce4bf6 100644
--- a/content/shell/browser/layout_test/layout_test_content_browser_client.h
+++ b/content/shell/browser/layout_test/layout_test_content_browser_client.h
@@ -58,6 +58,8 @@ class LayoutTestContentBrowserClient : public ShellContentBrowserClient {
                        const std::string& frame_name,
                        WindowOpenDisposition disposition,
                        const blink::mojom::WindowFeatures& features,
+                       const std::vector<std::string>& additional_features,
+                       const scoped_refptr<network::ResourceRequestBody>& body,
                        bool user_gesture,
                        bool opener_suppressed,
                        bool* no_javascript_access) override;