PlzNavigate: fix issue preventing navigations to WebUIs

content/browser/webui/url_data_manager_backend.cc

Index: content/browser/webui/url_data_manager_backend.cc
diff --git a/content/browser/webui/url_data_manager_backend.cc b/content/browser/webui/url_data_manager_backend.cc
index fe1015f87e445c77ae396386df9182b94fc81cd0..866560760d7ce891c10dc72126e07232df42c96d 100644
--- a/content/browser/webui/url_data_manager_backend.cc
+++ b/content/browser/webui/url_data_manager_backend.cc
@@ -35,6 +35,7 @@
 #include "content/public/browser/content_browser_client.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/resource_request_info.h"
+#include "content/public/common/browser_side_navigation_policy.h"
 #include "content/public/common/url_constants.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
@@ -272,7 +273,9 @@ void URLRequestChromeJob::Start() {
   bool is_renderer_request = ResourceRequestInfo::GetRenderFrameForRequest(
       request_, &render_process_id, &unused);
 
-  if (!is_renderer_request) {
+  if (!is_renderer_request ||
+      (render_process_id == -1 && IsBrowserSideNavigationEnabled())) {
+    // PlzNavigate: no navigation to a WebUI is coming from a renderer.

[Charlie Reis, 2016/05/20 18:50:32]

Hmm.  This is only a safe change for PlzNavigate if the
CheckStoragePartitionMatches code isn't needed at all, right?

It looks like dbeam's bug fix in https://codereview.chromium.org/1985983002
(i.e., actually checking against the host whitelist and not allowing all
chrome:// URLs) exposed that StoragePartition check doesn't work for
PlzNavigate.

Is there some way to find out what StoragePartition a PlzNavigate request is
being made from?  Or can we show that CheckStoragePartitionMatches is
unnecessary (per dbeam's TODO below) and remove it for everyone?  I'm a bit
hesitant to turn it off just for PlzNavigate if it might matter in some cases.

(Worst case, we can temporarily do something like this to skip the check for
PlzNavigate, but that's a potential security bug until we determine that the
check is unnecessary.)

[clamy, 2016/05/23 14:21:21]

There's one place in the NavigationRequest where we do get a StoragePartition to
initialize ServiceWorkers for the navigation. I've cleaned up the code to get
it, and made it available to check in 
URLRequestChromeJob::CheckStoragePartitionMatches on the UI thread.

     StartAsync(true);
     return;
   }