Remove URL fragment from referrer HTTP header when opening link using "Open Link in New Tab" option.

chrome/browser/tab_contents/render_view_context_menu_browsertest.cc

Index: chrome/browser/tab_contents/render_view_context_menu_browsertest.cc
diff --git a/chrome/browser/tab_contents/render_view_context_menu_browsertest.cc b/chrome/browser/tab_contents/render_view_context_menu_browsertest.cc
index a3db8e8c27572fdc49f78e87fb71ebb5b75eb62e..a0bcb8fc8eebb4b1ccdaac8eb1450e73d48a9b5b 100644
--- a/chrome/browser/tab_contents/render_view_context_menu_browsertest.cc
+++ b/chrome/browser/tab_contents/render_view_context_menu_browsertest.cc
@@ -166,4 +166,48 @@ IN_PROC_BROWSER_TEST_F(ContextMenuBrowserTest, CopyLinkFromIncognito) {
       ui::Clipboard::GetPlainTextFormatType(), ui::Clipboard::BUFFER_STANDARD));
 }
 
+// Verify that "Open Link in New Tab" doesn't send URL fragment as referrer.
+IN_PROC_BROWSER_TEST_F(ContextMenuBrowserTest, OpenInNewTabReferrer) {
+  ui_test_utils::WindowedTabAddedNotificationObserver tab_observer(
+      content::NotificationService::AllSources());
+
+  ASSERT_TRUE(test_server()->Start());
+  GURL echoheader(test_server()->GetURL("echoheader?Referer"));
+  GURL page("data:text/html,<a href='" + echoheader.spec() + "'>link</a>");
+
+  // Go to a page with a link to echoheader URL.

[pauljensen, 2013/03/15 21:50:00]

Can you move the definition of |page| down here?

[mef, 2013/03/18 16:42:07]

Done.

+  ui_test_utils::NavigateToURL(browser(), page);
+
+  // Set up referrer URL with fragment.
+  GURL referrer_with_fragment("http://foo.com/test#fragment");
+  std::string correct_referrer("http://foo.com/test");
+
+  // Copy link URL.
+  content::ContextMenuParams context_menu_params;
+  context_menu_params.page_url = referrer_with_fragment;
+  context_menu_params.link_url = echoheader;
+
+  // The menu_observer will select "Open Link in New Tab"

[pauljensen, 2013/03/15 21:50:00]

Can you move more words onto this line to bring it closer to 80 columns?

[mef, 2013/03/18 16:42:07]

Done.

+  // and wait for the new tab to be added.
+  TestRenderViewContextMenu menu(
+      browser()->tab_strip_model()->GetActiveWebContents(),
+      context_menu_params);
+  menu.Init();
+  menu.ExecuteCommand(IDC_CONTENT_CONTEXT_OPENLINKNEWTAB, 0);
+
+  tab_observer.Wait();
+  content::WebContents* tab = tab_observer.GetTab();
+  content::WaitForLoadStop(tab);
+
+  // Verify that it's the correct tab.
+  ASSERT_EQ(echoheader, tab->GetURL());
+  // Verify that the referrer on the page matches |correct_referrer|.
+  std::string actual_referrer;
+  ASSERT_TRUE(content::ExecuteScriptAndExtractString(
+      tab,
+      "window.domAutomationController.send(window.document.referrer);",

[pauljensen, 2013/03/15 21:50:00]

Can we add another ASSERT_TRUE(ExecuteScriptAndExtractString(...)) to check that
the contents of the page match |correct_referrer|?  My concern is two-fold:
1. window.document.referrer could be sanitizing the referrer
2. why are we browsing to the echoheader URL if we aren't checking the contents
of the page

[pauljensen, 2013/03/18 20:16:19]

I didn't see a response to this comment but it looks like you instead changed
the test to not check window.document.referrer.  I guess this is okay.  I was
recommending we have both tests.  The way you have it now is fine too.  In the
future please always respond individually to all comments or send a message
indicating that you've addressed all comments.  Sometimes the one message is
nicer than tons of "Done." responses.

+      &actual_referrer));
+  ASSERT_EQ(correct_referrer, actual_referrer);
+}
+
 }  // namespace