Check for equality of the URL's origin in replaceState/pushState

third_party/WebKit/LayoutTests/http/tests/navigation/pushstate-whitelisted-auth-denied.html

Index: third_party/WebKit/LayoutTests/http/tests/navigation/pushstate-whitelisted-auth-denied.html
diff --git a/third_party/WebKit/LayoutTests/http/tests/navigation/pushstate-whitelisted-auth-denied.html b/third_party/WebKit/LayoutTests/http/tests/navigation/pushstate-whitelisted-auth-denied.html
new file mode 100644
index 0000000000000000000000000000000000000000..208a9478dd467515fa14928e87749256374bf1b9
--- /dev/null
+++ b/third_party/WebKit/LayoutTests/http/tests/navigation/pushstate-whitelisted-auth-denied.html
@@ -0,0 +1,20 @@
+<script>
+if (window.testRunner) {
+    testRunner.dumpAsText();
+    // pushState should always be blocked, even if the target is whitelisted.
+    testRunner.addOriginAccessWhitelistEntry(location.origin, location.protocol, '', false);
+}
+
+// http://username@password:localhost:8000/... should be blocked.
+var originWithAuth = new URL(document.URL);
+originWithAuth.username += 'username';
+originWithAuth.password += 'password';
+originWithAuth = originWithAuth.href;
+
+try {
+    history.pushState(null, null, originWithAuth);
+    document.write("FAIL: pushState with different auth succeeded.");
+} catch(e) {
+    document.write("PASS: pushState with different auth was blocked.");
+}
+</script>