Don't focus the location bar in a phishy situation.

content/browser/web_contents/web_contents_impl.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/web_contents/web_contents_impl.h"
 
 #include <stddef.h>
 
 #include <cmath>
 #include <utility>
@@ skipping 2914 matching lines @@
   // Resume blocked requests for both the RenderViewHost and RenderFrameHost.
   // TODO(brettw): It seems bogus to reach into here and initialize the host.
   if (is_resume_pending_) {
     is_resume_pending_ = false;
     GetRenderViewHost()->GetWidget()->Init();
     GetMainFrame()->Init();
   }
 }
 
 bool WebContentsImpl::FocusLocationBarByDefault() {
-  NavigationEntry* entry = controller_.GetVisibleEntry();
-  if (entry && entry->GetURL() == GURL(url::kAboutBlankURL))
+  // If we are starting at about:blank, give the omnibox focus to let the user
+  // easily edit it.  We intentionally check the pending entry rather than the
+  // visible one, since we don't want to be tricked by non-visible pending URLs.
+  // See https://crbug.com/567445.

[Peter Kasting, 2016/03/03 21:02:19]

Nit: I'd prefer to explain sufficiently inline that we don't need the bug
reference.  This way a reader doesn't need to go anywhere else to understand
this sufficiently.

Maybe something like this:

When the browser is started with about:blank as the startup URL, focus the
location bar (which will also select its contents) so users can simply begin
typing to navigate elsewhere.

We need to be careful not to trigger this for anything other than the startup
navigation.  In particular, if we allow an attacker to open a popup to
about:blank, then navigate, focusing the omnibox will cause the end of the new
URL to be scrolled into view instead of the start, allowing the attacker to
spoof other URLs.  The conditions checked here are all aimed at ensuring no such
attacker-controlled navigation can trigger this.

Note that we check the pending entry instead of the visible one; for the startup
URL case these are the same, but for the attacker-controlled navigation case the
visible entry is the committed "about:blank" URL and the pending entry is the
problematic navigation elsewhere.

[palmer, 2016/03/04 22:15:57]

Done.

+  NavigationEntryImpl* entry = controller_.GetPendingEntry();
+  if (controller_.IsInitialNavigation() && entry &&
+      !entry->is_renderer_initiated() &&
+      entry->GetURL() == GURL(url::kAboutBlankURL)) {
     return true;
+  }
   return delegate_ && delegate_->ShouldFocusLocationBarByDefault(this);
 }
 
 void WebContentsImpl::SetFocusToLocationBar(bool select_all) {
   if (delegate_)
     delegate_->SetFocusToLocationBar(select_all);
 }
 
 void WebContentsImpl::DidStartNavigation(NavigationHandle* navigation_handle) {
   FOR_EACH_OBSERVER(WebContentsObserver, observers_,
@@ skipping 1838 matching lines @@
     const WebContentsObserver::MediaPlayerId& id) {
   FOR_EACH_OBSERVER(WebContentsObserver, observers_, MediaStartedPlaying(id));
 }
 
 void WebContentsImpl::MediaStoppedPlaying(
     const WebContentsObserver::MediaPlayerId& id) {
   FOR_EACH_OBSERVER(WebContentsObserver, observers_, MediaStoppedPlaying(id));
 }
 
 }  // namespace content