Reset previous WKBackForwardListeItem when navigating to WebUI pages.

ios/web/web_state/ui/crw_web_controller.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/web_state/ui/crw_web_controller.h"
 
 #import <WebKit/WebKit.h>
 
 #import <objc/runtime.h>
 #include <stddef.h>
@@ skipping 2300 matching lines @@
   _webStateImpl->GetRequestTracker()->FinishPageLoad(currentURL, loadSuccess);
   // Reset the navigation type to the default value.
   // Note: it is possible that the web view has already started loading the
   // next page when this is called. In that case the cache mode can leak to
   // (some of) the requests of the next page. It's expected to be an edge case,
   // but if it becomes a problem it should be possible to notice it afterwards
   // and react to it (by warning the user or reloading the page for example).
   _webStateImpl->GetRequestTracker()->SetCacheModeFromUIThread(
       net::RequestTracker::CACHE_NORMAL);
 
+  // Rather than creating a new WKBackForwardListItem when loading WebUI pages,
+  // WKWebView will cache the WebUI HTML in the previous WKBackForwardListItem
+  // since it's loaded via |-loadHTML:forURL:| instead of an NSURLRequest.  As a
+  // result, the WebUI's HTML and URL will be loaded when navigating to that
+  // WKBackForwardListItem, causing a mismatch between the visible content and
+  // the visible URL (WebUI page will be visible, but URL will be the previous
+  // page's URL).  To prevent this potential URL spoofing vulnerability, reset
+  // the previous NavigationItem's WKBackForwardListItem to force loading via
+  // NSURLRequest.
+  if (_webUIManager) {
+    web::NavigationItem* lastNavigationItem =
+        self.sessionController.previousEntry.navigationItem;
+    if (lastNavigationItem) {
+      web::WKBackForwardListItemHolder* holder =
+          web::WKBackForwardListItemHolder::FromNavigationItem(
+              lastNavigationItem);
+      DCHECK(holder);
+      holder->set_back_forward_list_item(nil);
+    }
+  }
+
   [self restoreStateFromHistory];
   _webStateImpl->OnPageLoaded(currentURL, loadSuccess);
   _webStateImpl->SetIsLoading(false);
   // Inform the embedder the load completed.
   [_delegate webDidFinishWithURL:currentURL loadSuccess:loadSuccess];
 }
 
 - (void)finishHistoryNavigationFromEntry:(CRWSessionEntry*)fromEntry {
   [_delegate webWillFinishHistoryNavigationFromEntry:fromEntry];
 
@@ skipping 3313 matching lines @@
   }
 
   return web::WEB_VIEW_DOCUMENT_TYPE_GENERIC;
 }
 
 - (NSString*)refererFromNavigationAction:(WKNavigationAction*)action {
   return [action.request valueForHTTPHeaderField:@"Referer"];
 }
 
 @end