Allow showing pending URL for new tab navigations, but only if safe.

content/browser/renderer_host/render_view_host_manager_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/file_util.h"
 #include "base/json/json_reader.h"
 #include "base/memory/ref_counted.h"
 #include "base/path_service.h"
 #include "base/utf_string_conversions.h"
 #include "base/values.h"
@@ skipping 861 matching lines @@
   // Opens in same tab.
   EXPECT_EQ(1u, Shell::windows().size());
   EXPECT_EQ("/files/title2.html", shell()->web_contents()->GetURL().path());
 
   // Should have the same SiteInstance.
   scoped_refptr<SiteInstance> noref_site_instance(
       shell()->web_contents()->GetSiteInstance());
   EXPECT_EQ(orig_site_instance, noref_site_instance);
 }
 
+// Test for crbug.com/9682.  We should show the URL for a pending renderer-
+// initiated navigation in a new tab, until the content of the initial
+// about:blank page is modified by another window.  At that point, we should
+// revert to showing about:blank to prevent a URL spoof.
+IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest, ShowLoadingURLUntilSpoof) {
+  ASSERT_TRUE(test_server()->Start());
+
+  // Load a page that can open a URL that won't commit in a new window.
+  NavigateToURL(
+      shell(), test_server()->GetURL("files/click-nocontent-link.html"));
+  WebContents* orig_contents = shell()->web_contents();
+
+  // Click a /nocontent link that opens in a new window but never commits.
+  ShellAddedObserver new_shell_observer;
+  bool success = false;
+  EXPECT_TRUE(ExecuteScriptAndExtractBool(
+      orig_contents,
+      "window.domAutomationController.send(clickNoContentTargetedLink());",
+      &success));
+  EXPECT_TRUE(success);
+
+  // Wait for the window to open.
+  Shell* new_shell = new_shell_observer.GetShell();
+
+  // Ensure the destination URL is visible, because it is considered the
+  // initial navigation.
+  WebContents* contents = new_shell->web_contents();
+  EXPECT_TRUE(contents->GetController().IsInitialNavigation());
+  EXPECT_EQ("/nocontent",
+            contents->GetController().GetVisibleEntry()->GetURL().path());
+
+  // Now modify the contents of the new window from the opener.  This will also
+  // modify the title of the document to give us something to listen for.
+  WindowedNotificationObserver title_observer(
+      NOTIFICATION_WEB_CONTENTS_TITLE_UPDATED,
+      Source<WebContents>(contents));
+  success = false;
+  EXPECT_TRUE(ExecuteScriptAndExtractBool(
+      orig_contents,
+      "window.domAutomationController.send(modifyNewWindow());",
+      &success));
+  EXPECT_TRUE(success);
+  title_observer.Wait();
+  EXPECT_EQ(ASCIIToUTF16("Modified Title"), contents->GetTitle());
+
+  // At this point, we should no longer be showing the destination URL.
+  // The visible entry should be null, resulting in about:blank in the address
+  // bar.
+  EXPECT_FALSE(contents->GetController().GetVisibleEntry());
+}
+
+// Test for crbug.com/9682.  We should not show the URL for a pending renderer-
+// initiated navigation in a new tab if it is not the initial navigation.  In
+// this case, the renderer will not notify us of a modification, so we cannot
+// show the pending URL without allowing a spoof.
+IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest,
+                       DontShowLoadingURLIfNotInitialNav) {
+  ASSERT_TRUE(test_server()->Start());
+
+  // Load a page that can open a URL that won't commit in a new window.
+  NavigateToURL(
+      shell(), test_server()->GetURL("files/click-nocontent-link.html"));
+  WebContents* orig_contents = shell()->web_contents();
+
+  // Click a /nocontent link that opens in a new window but never commits.
+  // By using an onclick handler that first creates the window, the slow
+  // navigation is not considered an initial navigation.
+  ShellAddedObserver new_shell_observer;
+  bool success = false;
+  EXPECT_TRUE(ExecuteScriptAndExtractBool(
+      orig_contents,
+      "window.domAutomationController.send("
+      "clickNoContentScriptedTargetedLink());",
+      &success));
+  EXPECT_TRUE(success);
+
+  // Wait for the window to open.
+  Shell* new_shell = new_shell_observer.GetShell();
+
+  // Ensure the destination URL is not visible, because it is not the initial
+  // navigation.
+  WebContents* contents = new_shell->web_contents();
+  EXPECT_FALSE(contents->GetController().IsInitialNavigation());
+  EXPECT_FALSE(contents->GetController().GetVisibleEntry());
+}
+
 // Test for http://crbug.com/93427.  Ensure that cross-site navigations
 // do not cause back/forward navigations to be considered stale by the
 // renderer.
 IN_PROC_BROWSER_TEST_F(RenderViewHostManagerTest, BackForwardNotStale) {
   NavigateToURL(shell(), GURL(chrome::kAboutBlankURL));
 
   // Start two servers with different sites.
   ASSERT_TRUE(test_server()->Start());
   net::TestServer https_server(
       net::TestServer::TYPE_HTTPS,
@@ skipping 518 matching lines @@
   NavigateToURL(shell(), https_server.GetURL("files/title1.html"));
 
   // Make sure it ends up at the right page.
   WaitForLoadStop(shell()->web_contents());
   EXPECT_EQ(https_server.GetURL("files/title1.html"),
             shell()->web_contents()->GetURL());
   EXPECT_EQ(new_site_instance, shell()->web_contents()->GetSiteInstance());
 }
 
 }  // namespace content