1 files changed, 3 insertions, 1 deletions
diff --git a/src/3rdparty/webkit/WebCore/html/HTMLBaseElement.cpp b/src/3rdparty/webkit/WebCore/html/HTMLBaseElement.cpp
index a278908..84e359c 100644
--- a/src/3rdparty/webkit/WebCore/html/HTMLBaseElement.cpp
+++ b/src/3rdparty/webkit/WebCore/html/HTMLBaseElement.cpp
@@ -30,6 +30,7 @@
 #include "HTMLNames.h"
 #include "KURL.h"
 #include "MappedAttribute.h"
+#include "XSSAuditor.h"
 
 namespace WebCore {
 
@@ -48,6 +49,7 @@ HTMLBaseElement::~HTMLBaseElement()
 void HTMLBaseElement::parseMappedAttribute(MappedAttribute* attr)
 {
     if (attr->name() == hrefAttr) {
+        m_hrefAttrValue = attr->value();
         m_href = parseURL(attr->value());
         process();
     } else if (attr->name() == targetAttr) {
@@ -78,7 +80,7 @@ void HTMLBaseElement::process()
     if (!inDocument())
         return;
 
-    if (!m_href.isEmpty())
+    if (!m_href.isEmpty() && (!document()->frame() || document()->frame()->script()->xssAuditor()->canSetBaseElementURL(m_hrefAttrValue)))
         document()->setBaseElementURL(KURL(document()->url(), m_href));
 
     if (!m_target.isEmpty())