Disallow WKBackForwardListItem navigations for pushState pages.

ios/web/web_state/ui/crw_web_controller.mm

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import "ios/web/web_state/ui/crw_web_controller.h"
 
 #import <WebKit/WebKit.h>
 
 #import <objc/runtime.h>
 #include <stddef.h>
@@ skipping 1835 matching lines @@
   DCHECK(holder);
   return holder;
 }
 
 - (void)updateCurrentBackForwardListItemHolder {
   // WebUI pages (which are loaded via loadHTMLString:baseURL:) have no entry
   // in the back/forward list, so the current item will still be the previous
   // page, and should not be associated.
   if (_webUIManager)
     return;
+  // When navigating to a page created with window.history.pushState using a
+  // WKBackForwardListItem, the WKWebViewConfiguration's user scripts are not
+  // injected.  As a result, the WKBackForwardList will become out of sync with

[Eugene But (OOO till 7-30), 2016/08/30 00:48:57]

Sounds like if scripts are not injected than spoofing may happen. Is it really
the case?

[kkhorimoto, 2016/08/30 00:54:41]

Sorry, the URL spoofing issue was the result of one of my speculative fixes.  In
ToT before this CL, the URL will match the displayed page, it's just not the URL
we expected to load because the wrong BFLI was used.

+  // the NavigationManager, allowing for URL spoofing attacks.
+  web::NavigationItemImpl* currentItem =
+      [self currentSessionEntry].navigationItemImpl;
+  if (currentItem->IsCreatedFromPushState())
+    return;
 
   web::WKBackForwardListItemHolder* holder =
       [self currentBackForwardListItemHolder];
 
   WKNavigationType navigationType =
       _pendingNavigationInfo ? [_pendingNavigationInfo navigationType]
                              : WKNavigationTypeOther;
   holder->set_back_forward_list_item([_webView backForwardList].currentItem);
   holder->set_navigation_type(navigationType);
   holder->set_http_method([_pendingNavigationInfo HTTPMethod]);
@@ skipping 3764 matching lines @@
   }
 
   return web::WEB_VIEW_DOCUMENT_TYPE_GENERIC;
 }
 
 - (NSString*)refererFromNavigationAction:(WKNavigationAction*)action {
   return [action.request valueForHTTPHeaderField:@"Referer"];
 }
 
 @end