Ensure that HistoryController's current entry is updated on inert commits.

content/browser/frame_host/navigation_controller_impl.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_controller_impl.h"
 
 #include "base/bind.h"
 #include "base/command_line.h"
 #include "base/logging.h"
 #include "base/metrics/histogram.h"
@@ skipping 1290 matching lines @@
       rfh->GetSiteInstance(),
       params.page_id);
   if (entry_index < 0 ||
       entry_index >= static_cast<int>(entries_.size())) {
     NOTREACHED();
     return false;
   }
 
   // Update the current navigation entry in case we're going back/forward.
   if (entry_index != last_committed_entry_index_) {
+    // Make sure that a subframe commit isn't changing the main frame URL.

[Avi (use Gerrit), 2015/04/30 15:25:28]

Wouldn't this check also apply for DidNavManualSubframe?

[Charlie Reis, 2015/04/30 16:28:28]

I like that idea, but it doesn't look like there's a good way to enforce it in
the NewSubframe case.  There's no existing entry in that case, and we just clone
the last committed entry.  That means the check would never fail if we compared
the URLs of the last committed and new entries.  params.url doesn't work either,
since that's the subframe URL.  And in the OOPIF case, the subframe RFH doesn't
even know the main frame's URL, so we wouldn't be able to report it from the
renderer.

I think I'm ok leaving the defense out of that one for the time being.

+    // Otherwise the renderer process may be confused, leading to a URL spoof.
+    if (GetLastCommittedEntry()->GetURL() !=
+        GetEntryAtIndex(entry_index)->GetURL()) {
+      bad_message::ReceivedBadMessage(rfh->GetProcess(),
+                                      bad_message::NC_AUTO_SUBFRAME);
+    }
     last_committed_entry_index_ = entry_index;
     DiscardNonCommittedEntriesInternal();
     return true;
   }
 
   if (base::CommandLine::ForCurrentProcess()->HasSwitch(
           switches::kSitePerProcess)) {
     // This may be a "new auto" case where we add a new FrameNavigationEntry, or
     // it may be a "history auto" case where we update an existing one.
     int64 frame_tree_node_id = rfh->frame_tree_node()->frame_tree_node_id();
@@ skipping 533 matching lines @@
     }
   }
 }
 
 void NavigationControllerImpl::SetGetTimestampCallbackForTest(
     const base::Callback<base::Time()>& get_timestamp_callback) {
   get_timestamp_callback_ = get_timestamp_callback;
 }
 
 }  // namespace content