Don't show URL for pending new navigations initiated by the renderer.

content/browser/tab_contents/navigation_controller_unittest.cc

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/file_util.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/path_service.h"
 #include "base/stl_util.h"
 #include "base/string_util.h"
 #include "base/utf_string_conversions.h"
@@ skipping 1750 matching lines @@
 
   // Ensure the URLS are correct.
   EXPECT_EQ(controller().entry_count(), 5);
   EXPECT_EQ(controller().GetEntryAtIndex(0)->url(), url0);
   EXPECT_EQ(controller().GetEntryAtIndex(1)->url(), url1);
   EXPECT_EQ(controller().GetEntryAtIndex(2)->url(), url2);
   EXPECT_EQ(controller().GetEntryAtIndex(3)->url(), url3);
   EXPECT_EQ(controller().GetEntryAtIndex(4)->url(), url4);
 }
 
+// Tests that the URLs for renderer-initiated navigations are not displayed to
+// the user until the navigation commits, to prevent URL spoof attacks.
+// See http://crbug.com/99016.
+TEST_F(NavigationControllerTest, DontShowRendererURLUntilCommit) {
+  TestNotificationTracker notifications;
+  RegisterForAllNavNotifications(&notifications, &controller());
+
+  const GURL url0("http://foo/0");
+  const GURL url1("http://foo/1");
+
+  // For typed navigations (browser-initiated), both active and visible entries
+  // should update before commit.
+  controller().LoadURL(url0, GURL(), PageTransition::TYPED, std::string());
+  EXPECT_EQ(url0, controller().GetActiveEntry()->url());
+  EXPECT_EQ(url0, controller().GetVisibleEntry()->url());
+  rvh()->SendNavigate(0, url0);
+
+  // For link clicks (renderer-initiated navigations), the active entry should
+  // update before commit but the visible should not.
+  controller().LoadURL(url1, GURL(), PageTransition::LINK, std::string());
+  EXPECT_EQ(url1, controller().GetActiveEntry()->url());
+  EXPECT_EQ(url0, controller().GetVisibleEntry()->url());
+  rvh()->SendNavigate(1, url1);
+  // After commit, both should be updated.
+  EXPECT_EQ(url1, controller().GetActiveEntry()->url());
+  EXPECT_EQ(url1, controller().GetVisibleEntry()->url());
+
+  notifications.Reset();
+}
+
 // Tests that IsInPageNavigation returns appropriate results.  Prevents
 // regression for bug 1126349.
 TEST_F(NavigationControllerTest, IsInPageNavigation) {
   // Navigate to URL with no refs.
   const GURL url("http://www.google.com/home.html");
   rvh()->SendNavigate(0, url);
 
   // Reloading the page is not an in-page navigation.
   EXPECT_FALSE(controller().IsURLInPageNavigation(url));
   const GURL other_url("http://www.google.com/add.html");
@@ skipping 524 matching lines @@
   TabNavigation nav(0, url0, GURL(), string16(),
                     webkit_glue::CreateHistoryStateForURL(url0),
                     PageTransition::LINK);
   session_helper_.AssertNavigationEquals(nav,
                                          windows_[0]->tabs[0]->navigations[0]);
   nav.set_url(url2);
   session_helper_.AssertNavigationEquals(nav,
                                          windows_[0]->tabs[0]->navigations[1]);
 }
 */