Index: content/browser/tab_contents/navigation_controller.cc |
diff --git a/content/browser/tab_contents/navigation_controller.cc b/content/browser/tab_contents/navigation_controller.cc |
index 4483d669dafe5ed787cf32021101ebab46529135..bc29a359472050ae9abb0814350138716fc873b3 100644 |
--- a/content/browser/tab_contents/navigation_controller.cc |
+++ b/content/browser/tab_contents/navigation_controller.cc |
@@ -290,8 +290,14 @@ NavigationEntry* NavigationController::GetActiveEntry() const { |
NavigationEntry* NavigationController::GetVisibleEntry() const { |
if (transient_entry_index_ != -1) |
return entries_[transient_entry_index_].get(); |
- // Only return pending_entry for new navigations. |
- if (pending_entry_ && pending_entry_->page_id() == -1) |
+ // Only return pending_entry for new browser-initiated navigations, and not |
+ // during link clicks (which might allow URL spoof attacks). |
+ // Ideally we would also show the pending entry's URL if there is no last |
+ // committed entry (e.g., a link opening in a new tab), but the opener window |
+ // can insert content into that about:blank page while the pending URL loads. |
+ if (pending_entry_ && |
+ pending_entry_->page_id() == -1 && |
+ pending_entry_->transition_type() != PageTransition::LINK) |
brettw
2011/10/11 18:11:29
I'm kind of freaked out by this condition. Is this
Charlie Reis
2011/10/11 19:40:42
There's two conditions here:
1) page_id == -1 mea
brettw
2011/10/11 19:51:09
I don't think we ever expected page transition typ
Charlie Reis
2011/10/11 20:14:29
Well, if we wanted to approach this another way, w
|
return pending_entry_; |
return GetLastCommittedEntry(); |
} |