Allow about:blank to be considered in-page if origin matches.

content/browser/frame_host/navigation_controller_impl_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/navigation_controller_impl.h"
 
 #include <stddef.h>
 #include <stdint.h>
 
 #include <memory>
@@ skipping 3753 matching lines @@
   NavigationControllerImpl& controller = controller_impl();
   const GURL url("http://www.google.com/home.html");
 
   // If the renderer claims it performed an in-page navigation from
   // about:blank, trust the renderer.
   // This can happen when an iframe is created and populated via
   // document.write(), then tries to perform a fragment navigation.
   // TODO(japhet): We should only trust the renderer if the about:blank
   // was the first document in the given frame, but we don't have enough
   // information to identify that case currently.
+  // TODO(creis): Update this to verify that the origin of the about:blank page
+  // matches if the URL doesn't look same-origin.
   const GURL blank_url(url::kAboutBlankURL);
+  const url::Origin blank_origin;
   main_test_rfh()->NavigateAndCommitRendererInitiated(0, true, blank_url);
-  EXPECT_TRUE(controller.IsURLInPageNavigation(url, true,
-      main_test_rfh()));
+  EXPECT_TRUE(controller.IsURLInPageNavigation(url, url::Origin(url), true,
+                                               main_test_rfh()));
 
   // Navigate to URL with no refs.
   main_test_rfh()->NavigateAndCommitRendererInitiated(0, false, url);
 
   // Reloading the page is not an in-page navigation.
-  EXPECT_FALSE(controller.IsURLInPageNavigation(url, false, main_test_rfh()));
+  EXPECT_FALSE(controller.IsURLInPageNavigation(url, url::Origin(url), false,
+                                                main_test_rfh()));
   const GURL other_url("http://www.google.com/add.html");
-  EXPECT_FALSE(controller.IsURLInPageNavigation(other_url, false,
-      main_test_rfh()));
+  EXPECT_FALSE(controller.IsURLInPageNavigation(
+      other_url, url::Origin(other_url), false, main_test_rfh()));
   const GURL url_with_ref("http://www.google.com/home.html#my_ref");
-  EXPECT_TRUE(controller.IsURLInPageNavigation(url_with_ref, true,
-      main_test_rfh()));
+  EXPECT_TRUE(controller.IsURLInPageNavigation(
+      url_with_ref, url::Origin(url_with_ref), true, main_test_rfh()));
 
   // Navigate to URL with refs.
   main_test_rfh()->NavigateAndCommitRendererInitiated(1, true, url_with_ref);
 
   // Reloading the page is not an in-page navigation.
-  EXPECT_FALSE(controller.IsURLInPageNavigation(url_with_ref, false,
-      main_test_rfh()));
-  EXPECT_FALSE(controller.IsURLInPageNavigation(url, false,
-      main_test_rfh()));
-  EXPECT_FALSE(controller.IsURLInPageNavigation(other_url, false,
-      main_test_rfh()));
+  EXPECT_FALSE(controller.IsURLInPageNavigation(
+      url_with_ref, url::Origin(url_with_ref), false, main_test_rfh()));
+  EXPECT_FALSE(controller.IsURLInPageNavigation(url, url::Origin(url), false,
+                                                main_test_rfh()));
+  EXPECT_FALSE(controller.IsURLInPageNavigation(
+      other_url, url::Origin(other_url), false, main_test_rfh()));
   const GURL other_url_with_ref("http://www.google.com/home.html#my_other_ref");
-  EXPECT_TRUE(controller.IsURLInPageNavigation(other_url_with_ref, true,
-      main_test_rfh()));
+  EXPECT_TRUE(controller.IsURLInPageNavigation(other_url_with_ref,
+                                               url::Origin(other_url_with_ref),
+                                               true, main_test_rfh()));
 
   // Going to the same url again will be considered in-page
   // if the renderer says it is even if the navigation type isn't IN_PAGE.
-  EXPECT_TRUE(controller.IsURLInPageNavigation(url_with_ref, true,
-      main_test_rfh()));
+  EXPECT_TRUE(controller.IsURLInPageNavigation(
+      url_with_ref, url::Origin(url_with_ref), true, main_test_rfh()));
 
   // Going back to the non ref url will be considered in-page if the navigation
   // type is IN_PAGE.
-  EXPECT_TRUE(controller.IsURLInPageNavigation(url, true,
-      main_test_rfh()));
+  EXPECT_TRUE(controller.IsURLInPageNavigation(url, url::Origin(url), true,
+                                               main_test_rfh()));
 
   // If the renderer says this is a same-origin in-page navigation, believe it.
   // This is the pushState/replaceState case.
-  EXPECT_TRUE(controller.IsURLInPageNavigation(other_url, true,
-      main_test_rfh()));
+  EXPECT_TRUE(controller.IsURLInPageNavigation(
+      other_url, url::Origin(other_url), true, main_test_rfh()));
 
   // Don't believe the renderer if it claims a cross-origin navigation is
   // in-page.
   const GURL different_origin_url("http://www.example.com");
   MockRenderProcessHost* rph = main_test_rfh()->GetProcess();
   EXPECT_EQ(0, rph->bad_msg_count());
-  EXPECT_FALSE(controller.IsURLInPageNavigation(different_origin_url, true,
-                                                main_test_rfh()));
+  EXPECT_FALSE(controller.IsURLInPageNavigation(
+      different_origin_url, url::Origin(different_origin_url), true,
+      main_test_rfh()));
   EXPECT_EQ(1, rph->bad_msg_count());
 }
 
 // Tests that IsInPageNavigation behaves properly with the
 // allow_universal_access_from_file_urls flag.
 TEST_F(NavigationControllerTest, IsInPageNavigationWithUniversalFileAccess) {
   NavigationControllerImpl& controller = controller_impl();
 
   // Test allow_universal_access_from_file_urls flag.
   const GURL different_origin_url("http://www.example.com");
   MockRenderProcessHost* rph = main_test_rfh()->GetProcess();
   WebPreferences prefs = test_rvh()->GetWebkitPreferences();
   prefs.allow_universal_access_from_file_urls = true;
   test_rvh()->UpdateWebkitPreferences(prefs);
   prefs = test_rvh()->GetWebkitPreferences();
   EXPECT_TRUE(prefs.allow_universal_access_from_file_urls);
 
   // Allow in page navigation to be cross-origin if existing URL is file scheme.
   const GURL file_url("file:///foo/index.html");
   const url::Origin file_origin(file_url);
   main_test_rfh()->NavigateAndCommitRendererInitiated(0, true, file_url);
   EXPECT_TRUE(file_origin.IsSameOriginWith(
       main_test_rfh()->frame_tree_node()->current_origin()));
   EXPECT_EQ(0, rph->bad_msg_count());
-  EXPECT_TRUE(controller.IsURLInPageNavigation(different_origin_url, true,
+  EXPECT_TRUE(controller.IsURLInPageNavigation(
+      different_origin_url, url::Origin(different_origin_url), true,
       main_test_rfh()));
   EXPECT_EQ(0, rph->bad_msg_count());
 
   // Doing a replaceState to a cross-origin URL is thus allowed.
   FrameHostMsg_DidCommitProvisionalLoad_Params params;
   params.page_id = 1;
   params.nav_entry_id = 1;
   params.did_create_new_entry = false;
   params.url = different_origin_url;
   params.origin = file_origin;
   params.transition = ui::PAGE_TRANSITION_LINK;
   params.gesture = NavigationGestureUser;
   params.page_state = PageState::CreateFromURL(different_origin_url);
   params.was_within_same_page = true;
   params.method = "GET";
   params.post_id = -1;
   main_test_rfh()->SendRendererInitiatedNavigationRequest(different_origin_url,
                                                           false);
   main_test_rfh()->PrepareForCommit();
   contents()->GetMainFrame()->SendNavigateWithParams(&params);
 
   // At this point, we should still consider the current origin to be file://,
   // so that a file URL would still be in-page.  See https://crbug.com/553418.
   EXPECT_TRUE(file_origin.IsSameOriginWith(
       main_test_rfh()->frame_tree_node()->current_origin()));
-  EXPECT_TRUE(
-      controller.IsURLInPageNavigation(file_url, true, main_test_rfh()));
+  EXPECT_TRUE(controller.IsURLInPageNavigation(file_url, url::Origin(file_url),
+                                               true, main_test_rfh()));
   EXPECT_EQ(0, rph->bad_msg_count());
 
   // Don't honor allow_universal_access_from_file_urls if actual URL is
   // not file scheme.
   const GURL url("http://www.google.com/home.html");
   main_test_rfh()->NavigateAndCommitRendererInitiated(2, true, url);
-  EXPECT_FALSE(controller.IsURLInPageNavigation(different_origin_url, true,
+  EXPECT_FALSE(controller.IsURLInPageNavigation(
+      different_origin_url, url::Origin(different_origin_url), true,
       main_test_rfh()));
   EXPECT_EQ(1, rph->bad_msg_count());
 }
 
 // Some pages can have subframes with the same base URL (minus the reference) as
 // the main page. Even though this is hard, it can happen, and we don't want
 // these subframe navigations to affect the toplevel document. They should
 // instead be ignored.  http://crbug.com/5585
 TEST_F(NavigationControllerTest, SameSubframe) {
   NavigationControllerImpl& controller = controller_impl();
@@ skipping 1431 matching lines @@
             observer.details().ssl_status.num_unknown_scts);
   EXPECT_EQ(default_ssl_status.num_invalid_scts,
             observer.details().ssl_status.num_invalid_scts);
   EXPECT_EQ(default_ssl_status.num_valid_scts,
             observer.details().ssl_status.num_valid_scts);
 
   EXPECT_EQ(1, main_test_rfh()->GetProcess()->bad_msg_count());
 }
 
 }  // namespace content