Requesting Review for BugFix Chromium:1935

chrome/browser/tab_contents/render_view_context_menu.cc

Index: chrome/browser/tab_contents/render_view_context_menu.cc
===================================================================
--- chrome/browser/tab_contents/render_view_context_menu.cc	(revision 75533)
+++ chrome/browser/tab_contents/render_view_context_menu.cc	(working copy)
@@ -52,13 +52,16 @@
 #include "net/url_request/url_request.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebContextMenuData.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebMediaPlayerAction.h"
-#include "third_party/WebKit/Source/WebKit/chromium/public/WebTextDirection.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebSecurityPolicy.h"
 #include "ui/base/l10n/l10n_util.h"
 #include "ui/gfx/favicon_size.h"
 #include "webkit/glue/webmenuitem.h"
 
 using WebKit::WebContextMenuData;
 using WebKit::WebMediaPlayerAction;
+using WebKit::WebSecurityPolicy;
+using WebKit::WebURL;
+using WebKit::WebString;
 
 namespace {
 
@@ -1174,19 +1177,24 @@
 
   switch (id) {
     case IDC_CONTENT_CONTEXT_OPENLINKNEWTAB:
-      OpenURL(params_.link_url,
-              source_tab_contents_->delegate() &&
+      OpenURL(
+          params_.link_url,
+          params_.frame_url.is_empty() ? params_.page_url : params_.frame_url,
+          source_tab_contents_->delegate() &&
               source_tab_contents_->delegate()->IsApplication() ?
                   NEW_FOREGROUND_TAB : NEW_BACKGROUND_TAB,
-              PageTransition::LINK);
+          PageTransition::LINK);
       break;
 
     case IDC_CONTENT_CONTEXT_OPENLINKNEWWINDOW:
-      OpenURL(params_.link_url, NEW_WINDOW, PageTransition::LINK);
+      OpenURL(
+          params_.link_url,
+          params_.frame_url.is_empty() ? params_.page_url : params_.frame_url,
+          NEW_WINDOW, PageTransition::LINK);
       break;
 
     case IDC_CONTENT_CONTEXT_OPENLINKOFFTHERECORD:
-      OpenURL(params_.link_url, OFF_THE_RECORD, PageTransition::LINK);
+      OpenURL(params_.link_url, GURL(), OFF_THE_RECORD, PageTransition::LINK);
       break;
 
     case IDC_CONTENT_CONTEXT_SAVEAVAS:
@@ -1218,7 +1226,10 @@
 
     case IDC_CONTENT_CONTEXT_OPENIMAGENEWTAB:
     case IDC_CONTENT_CONTEXT_OPENAVNEWTAB:
-      OpenURL(params_.src_url, NEW_BACKGROUND_TAB, PageTransition::LINK);
+      OpenURL(
+          params_.src_url,
+          params_.frame_url.is_empty() ? params_.page_url : params_.frame_url,
+          NEW_BACKGROUND_TAB, PageTransition::LINK);
       break;
 
     case IDC_CONTENT_CONTEXT_PLAYPAUSE: {
@@ -1339,7 +1350,8 @@
 
     case IDC_CONTENT_CONTEXT_VIEWFRAMESOURCE:
       OpenURL(GURL(chrome::kViewSourceScheme + std::string(":") +
-          params_.frame_url.spec()), NEW_FOREGROUND_TAB, PageTransition::LINK);
+          params_.frame_url.spec()), GURL(),
+          NEW_FOREGROUND_TAB, PageTransition::LINK);
       break;
 
     case IDC_CONTENT_CONTEXT_VIEWFRAMEINFO: {
@@ -1392,7 +1404,7 @@
 
     case IDC_CONTENT_CONTEXT_SEARCHWEBFOR:
     case IDC_CONTENT_CONTEXT_GOTOURL: {
-      OpenURL(selection_navigation_url_, NEW_FOREGROUND_TAB,
+      OpenURL(selection_navigation_url_, GURL(), NEW_FOREGROUND_TAB,
               PageTransition::LINK);
       break;
     }
@@ -1509,10 +1521,16 @@
 // Controller functions --------------------------------------------------------
 
 void RenderViewContextMenu::OpenURL(
-    const GURL& url,
+    const GURL& url, const GURL& referrer,
     WindowOpenDisposition disposition,
     PageTransition::Type transition) {
-  source_tab_contents_->OpenURL(url, GURL(), disposition, transition);
+  // Check security policy to prevent referrer being sent
+  // in https to http transition.
+  bool hide_referrer = WebSecurityPolicy::shouldHideReferrer(

[darin (slow to review), 2011/04/13 16:38:32]

we try to avoid using webkit on the main thread of the browser process.  can we
avoid doing so here as well?

won't webkit prune out the referrer automagically using the exact same
machinery?  maybe this code isn't necessary?

[brettw, 2011/04/13 17:43:20]

I don't see this getting called in the new tab case in my testing, so we need to
add this call somewhere. Do we need a WebKit patch to add that, or is this call
here OK?

+      WebURL::WebURL(url),
+      WebString::fromUTF8(WebURL::WebURL(referrer).spec()));
+  source_tab_contents_->OpenURL(url, hide_referrer ? GURL() : referrer,
+                                disposition, transition);
 }
 
 void RenderViewContextMenu::CopyImageAt(int x, int y) {