Add SafeBrowsingNavigationObserver to listen to navigation events

chrome/browser/safe_browsing/safe_browsing_navigation_observer_browsertest.cc

+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+#include "chrome/browser/safe_browsing/safe_browsing_navigation_observer.h"
+
+#include "base/strings/stringprintf.h"
+#include "chrome/browser/chrome_notification_types.h"
+#include "chrome/browser/download/download_prefs.h"
+#include "chrome/browser/profiles/profile.h"
+#include "chrome/browser/sessions/session_tab_helper.h"
+#include "chrome/browser/ui/browser.h"
+#include "chrome/browser/ui/tabs/tab_strip_model.h"
+#include "chrome/common/pref_names.h"
+#include "chrome/test/base/in_process_browser_test.h"
+#include "chrome/test/base/ui_test_utils.h"
+#include "components/prefs/pref_service.h"
+#include "content/public/browser/browser_context.h"
+#include "content/public/browser/download_item.h"
+#include "content/public/browser/download_manager.h"
+#include "content/public/browser/notification_service.h"
+#include "content/public/test/browser_test_utils.h"
+#include "content/public/test/test_utils.h"
+#include "net/dns/mock_host_resolver.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
+#include "url/gurl.h"
+#include "url/url_canon.h"
+
+namespace safe_browsing {
+
+const char kSingleFrameTestURL[] =
+    "/safe_browsing/download_protection/navigation_observer/"
+    "navigation_observer_tests.html";
+const char kMultiFrameTestURL[] =
+    "/safe_browsing/download_protection/navigation_observer/"
+    "navigation_observer_multi_frame_tests.html";
+const char kRedirectURL[] =
+    "/safe_browsing/download_protection/navigation_observer/redirect.html";
+const char kDownloadDataURL[] =
+    "data:application/octet-stream;base64,a2poYWxrc2hkbGtoYXNka2xoYXNsa2RoYWxra"
+    "GtoYWxza2hka2xzamFoZGxramhhc2xka2hhc2xrZGgKYXNrZGpoa2FzZGpoYWtzaGRrYXNoZGt"
+    "oYXNrZGhhc2tkaGthc2hka2Foc2RraGFrc2hka2FzaGRraGFzCmFza2pkaGFrc2hkbSxjbmtza"
+    "mFoZGtoYXNrZGhhc2tka2hrYXNkCjg3MzQ2ODEyNzQ2OGtqc2hka2FoZHNrZGhraApha3NqZGt"
+    "hc2Roa3NkaGthc2hka2FzaGtkaAohISomXkAqJl4qYWhpZGFzeWRpeWlhc1xcb1wKa2Fqc2Roa"
+    "2FzaGRrYXNoZGsKYWtzamRoc2tkaAplbmQK";
+const char kIframeDirectDownloadURL[] =
+    "/safe_browsing/download_protection/navigation_observer/iframe.html";
+const char kIframeRetargetingURL[] =
+    "/safe_browsing/download_protection/navigation_observer/"
+    "iframe_retargeting.html";
+const char kDownloadItemURL[] = "/safe_browsing/download_protection/signed.exe";
+
+// Test class to help create SafeBrowsingNavigationObservers for each
+// WebContents before they are actually installed through AttachTabHelper.
+class TestNavigationObserverManager : public SBNavigationObserverManager {
+ public:
+  TestNavigationObserverManager() : SBNavigationObserverManager() {
+    registrar_.Add(this, chrome::NOTIFICATION_TAB_ADDED,
+                   content::NotificationService::AllSources());
+  }
+
+  void Observe(int type,
+               const content::NotificationSource& source,
+               const content::NotificationDetails& details) override {
+    if (type == chrome::NOTIFICATION_TAB_ADDED) {
+      content::WebContents* dest_content =
+          content::Details<content::WebContents>(details).ptr();
+      DCHECK(dest_content);
+      auto observer = new SafeBrowsingNavigationObserver(dest_content, this);
+      DCHECK(observer);
+    } else if (type == chrome::NOTIFICATION_RETARGETING) {
+      RecordRetargeting(details);
+    }
+  }
+
+ protected:
+  ~TestNavigationObserverManager() override {}
+};
+
+class SBNavigationObserverBrowserTest : public InProcessBrowserTest {
+ public:
+  SBNavigationObserverBrowserTest() {}
+
+  void SetUpOnMainThread() override {
+    ASSERT_TRUE(embedded_test_server()->Start());
+    host_resolver()->AddRule("*", "127.0.0.1");
+    // Navigate to test page.
+    ui_test_utils::NavigateToURL(
+        browser(), embedded_test_server()->GetURL(kSingleFrameTestURL));
+    observer_manager_ = new TestNavigationObserverManager();
+    observer_ = new SafeBrowsingNavigationObserver(
+        browser()->tab_strip_model()->GetActiveWebContents(),
+        observer_manager_);
+    ASSERT_TRUE(observer_);
+    ASSERT_TRUE(InitialSetup());
+  }
+
+  bool InitialSetup() {
+    if (!browser())
+      return false;
+
+    if (!downloads_directory_.CreateUniqueTempDir())
+      return false;
+
+    // Set up default download path.
+    browser()->profile()->GetPrefs()->SetFilePath(
+        prefs::kDownloadDefaultDirectory, downloads_directory_.path());
+    browser()->profile()->GetPrefs()->SetFilePath(
+        prefs::kSaveFileDefaultDirectory, downloads_directory_.path());
+    browser()->profile()->GetPrefs()->SetBoolean(prefs::kPromptForDownload,
+                                                 false);
+    content::DownloadManager* manager =
+        content::BrowserContext::GetDownloadManager(browser()->profile());
+    DownloadPrefs::FromDownloadManager(manager)->ResetAutoOpen();
+    manager->RemoveAllDownloads();
+
+    return true;
+  }
+
+  void TearDownOnMainThread() override { delete observer_; }
+
+  // Most test cases will trigger downloads, though we don't really care if
+  // download completed or not. So we cancel downloads as soon as we record
+  // all the navigation event we need.
+  void CancelDownloads() {
+    std::vector<content::DownloadItem*> download_items;
+    content::DownloadManager* manager =
+        content::BrowserContext::GetDownloadManager(browser()->profile());
+    manager->GetAllDownloads(&download_items);
+    for (auto item : download_items)
+      item->Cancel(true);
+  }
+
+  // This function needs javascript support, only works on
+  // navigation_observer_tests.html and
+  // navigation_observer_multi_frame_tests.html.
+  void ClickTestLink(const char* test_name, int navigation_count) {
+    content::WebContents* main_web_contents =
+        browser()->tab_strip_model()->GetActiveWebContents();
+    std::string script = base::StringPrintf("clickLink('%s')", test_name);
+    EXPECT_TRUE(content::ExecuteScript(main_web_contents, script));
+    // Wait until all the navigation completes.
+    for (int i = 0; i < navigation_count; i++) {
+      content::WebContents* active_contents =
+          browser()->tab_strip_model()->GetActiveWebContents();
+      content::WaitForLoadStopWithoutSuccessCheck(active_contents);
+    }
+    CancelDownloads();
+  }
+
+  void VerifyNavigationEvent(const GURL& expected_source_url,
+                             const GURL& expected_target_url,
+                             const GURL& expected_main_frame_url,
+                             bool expected_is_user_initiated,
+                             bool expected_has_committed,
+                             bool expected_is_server_redirect,
+                             const GURL& expected_redirect_url,
+                             const NavigationEvent& actual_nav_event) {
+    EXPECT_EQ(expected_source_url, actual_nav_event.source_url);
+    EXPECT_EQ(expected_target_url, actual_nav_event.target_url);
+    EXPECT_EQ(expected_main_frame_url, actual_nav_event.main_frame_url);
+    EXPECT_EQ(expected_is_user_initiated, actual_nav_event.is_user_initiated);
+    EXPECT_EQ(expected_has_committed, actual_nav_event.has_committed);
+    EXPECT_EQ(expected_is_server_redirect, actual_nav_event.is_server_redirect);
+    EXPECT_EQ(expected_redirect_url, actual_nav_event.server_redirect_url);
+  }
+
+  SBNavigationObserverManager::NavigationMap* navigation_map() {
+    return observer_manager_->navigation_map();
+  }
+
+ protected:
+  SBNavigationObserverManager* observer_manager_;
+  SafeBrowsingNavigationObserver* observer_;
+
+ private:
+  base::ScopedTempDir downloads_directory_;
+};
+
+// Click on a link and start download on the same page.
+IN_PROC_BROWSER_TEST_F(SBNavigationObserverBrowserTest, DirectDownload) {
+  ClickTestLink("direct_download", 1);
+  GURL initial_url = embedded_test_server()->GetURL(kSingleFrameTestURL);
+  GURL download_url = embedded_test_server()->GetURL(kDownloadItemURL);
+  SBNavigationObserverManager::NavigationMap* nav_map = navigation_map();
+  ASSERT_TRUE(nav_map);
+  ASSERT_EQ(std::size_t(1), nav_map->size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(download_url).size());
+  // Since this test uses java script to mimic clicking on a link, there is no
+  // actual user gesture, therefore is_user_initiated is false.
+  VerifyNavigationEvent(initial_url,   // source_url
+                        download_url,  // target_url
+                        initial_url,   // source's main_frame_url
+                        false,         // is_user_initiated,
+                        false,         // has_committed
+                        false,         // is_server_redirect
+                        GURL(),        // redirect_url
+                        nav_map->at(download_url).at(0));
+}
+
+// Click on a link with rel="noreferrer" attribute, and start download on the
+// same page.
+IN_PROC_BROWSER_TEST_F(SBNavigationObserverBrowserTest,
+                       DirectDownloadNoReferrer) {
+  ClickTestLink("direct_download_noreferrer", 1);
+  GURL initial_url = embedded_test_server()->GetURL(kSingleFrameTestURL);
+  GURL download_url = embedded_test_server()->GetURL(kDownloadItemURL);
+  SBNavigationObserverManager::NavigationMap* nav_map = navigation_map();
+  ASSERT_TRUE(nav_map);
+  ASSERT_EQ(std::size_t(1), nav_map->size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(download_url).size());
+  VerifyNavigationEvent(initial_url, download_url, initial_url, false, false,
+                        false, GURL(), nav_map->at(download_url).at(0));
+}
+
+// Click on a link with rel="noreferrer" attribute, and start download in a
+// new tab using target=_blank.
+IN_PROC_BROWSER_TEST_F(SBNavigationObserverBrowserTest,
+                       DirectDownloadNoReferrerTargetBlank) {
+  ClickTestLink("direct_download_noreferrer_target_blank", 2);
+  GURL initial_url = embedded_test_server()->GetURL(kSingleFrameTestURL);
+  GURL download_url = embedded_test_server()->GetURL(kDownloadItemURL);
+  SBNavigationObserverManager::NavigationMap* nav_map = navigation_map();
+  ASSERT_TRUE(nav_map);
+  ASSERT_EQ(std::size_t(1), nav_map->size());
+  ASSERT_EQ(std::size_t(2), nav_map->at(download_url).size());
+  VerifyNavigationEvent(initial_url, download_url, initial_url, false, false,
+                        false, GURL(), nav_map->at(download_url).at(0));
+  VerifyNavigationEvent(download_url, download_url, download_url, false, false,
+                        false, GURL(), nav_map->at(download_url).at(1));
+}
+
+// Click on a link which navigates to a page then redirect to download using
+// META HTTP-EQUIV="refresh". All transitions happen in the same tab.
+IN_PROC_BROWSER_TEST_F(SBNavigationObserverBrowserTest,
+                       SingleMetaRefreshRedirect) {
+  ClickTestLink("single_meta_refresh_redirect", 2);
+  GURL initial_url = embedded_test_server()->GetURL(kSingleFrameTestURL);
+  GURL redirect_url = embedded_test_server()->GetURL(kRedirectURL);
+  GURL download_url = embedded_test_server()->GetURL(kDownloadItemURL);
+  SBNavigationObserverManager::NavigationMap* nav_map = navigation_map();
+  ASSERT_TRUE(nav_map);
+  ASSERT_EQ(std::size_t(2), nav_map->size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(redirect_url).size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(download_url).size());
+  VerifyNavigationEvent(initial_url, redirect_url, initial_url, false, true,
+                        false, GURL(), nav_map->at(redirect_url).at(0));
+  VerifyNavigationEvent(redirect_url, download_url, redirect_url, false, false,
+                        false, GURL(), nav_map->at(download_url).at(0));
+}
+
+// Click on a link which navigates to a page then redirect to download using
+// META HTTP-EQUIV="refresh". First navigation happens in target blank.
+IN_PROC_BROWSER_TEST_F(SBNavigationObserverBrowserTest,
+                       SingleMetaRefreshRedirectTargetBlank) {
+  ClickTestLink("single_meta_refresh_redirect_target_blank", 3);
+  GURL initial_url = embedded_test_server()->GetURL(kSingleFrameTestURL);
+  GURL redirect_url = embedded_test_server()->GetURL(kRedirectURL);
+  GURL download_url = embedded_test_server()->GetURL(kDownloadItemURL);
+  SBNavigationObserverManager::NavigationMap* nav_map = navigation_map();
+  ASSERT_TRUE(nav_map);
+  ASSERT_EQ(std::size_t(2), nav_map->size());
+  ASSERT_EQ(std::size_t(2), nav_map->at(redirect_url).size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(download_url).size());
+  VerifyNavigationEvent(initial_url, redirect_url, initial_url, false, false,
+                        false, GURL(), nav_map->at(redirect_url).at(0));
+  VerifyNavigationEvent(redirect_url, redirect_url, redirect_url, false, true,
+                        false, GURL(), nav_map->at(redirect_url).at(1));
+  VerifyNavigationEvent(redirect_url, download_url, redirect_url, false, false,
+                        false, GURL(), nav_map->at(download_url).at(0));
+}
+
+// Click on a link which redirects twice before reaching download using
+// META HTTP-EQUIV="refresh". All transitions happen in the same tab.
+IN_PROC_BROWSER_TEST_F(SBNavigationObserverBrowserTest,
+                       MultiMetaRefreshRedirects) {
+  ClickTestLink("multiple_meta_refresh_redirects", 3);
+  GURL initial_url = embedded_test_server()->GetURL(kSingleFrameTestURL);
+  GURL first_redirect_url = embedded_test_server()->GetURL(
+      "/safe_browsing/download_protection/navigation_observer/"
+      "double_redirect.html");
+  GURL second_redirect_url = embedded_test_server()->GetURL(kRedirectURL);
+  GURL download_url = embedded_test_server()->GetURL(kDownloadItemURL);
+  SBNavigationObserverManager::NavigationMap* nav_map = navigation_map();
+  ASSERT_TRUE(nav_map);
+  ASSERT_EQ(std::size_t(3), nav_map->size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(first_redirect_url).size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(second_redirect_url).size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(download_url).size());
+  VerifyNavigationEvent(initial_url, first_redirect_url, initial_url, false,
+                        true, false, GURL(),
+                        nav_map->at(first_redirect_url).at(0));
+  VerifyNavigationEvent(first_redirect_url, second_redirect_url,
+                        first_redirect_url, false, true, false, GURL(),
+                        nav_map->at(second_redirect_url).at(0));
+  VerifyNavigationEvent(second_redirect_url, download_url, second_redirect_url,
+                        false, false, false, GURL(),
+                        nav_map->at(download_url).at(0));
+}
+
+// Click on a link which redirects to download using window.location.href.
+// All transitions happen in the same tab.
+IN_PROC_BROWSER_TEST_F(SBNavigationObserverBrowserTest,
+                       WindowLocationHrefRedirect) {
+  ClickTestLink("window_location_href_redirect", 2);
+  GURL initial_url = embedded_test_server()->GetURL(kSingleFrameTestURL);
+  GURL download_url = embedded_test_server()->GetURL(kDownloadItemURL);
+  SBNavigationObserverManager::NavigationMap* nav_map = navigation_map();
+  ASSERT_TRUE(nav_map);
+  ASSERT_EQ(std::size_t(2), nav_map->size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(initial_url).size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(download_url).size());
+  VerifyNavigationEvent(initial_url, initial_url, initial_url, false, true,
+                        false, GURL(), nav_map->at(initial_url).at(0));
+  VerifyNavigationEvent(initial_url, download_url, initial_url, false, false,
+                        false, GURL(), nav_map->at(download_url).at(0));
+}
+
+// Click on a link which redirect twice until reaches download using a mixture
+// of meta refresh and window.location.href. All transitions happen in the same
+// tab.
+IN_PROC_BROWSER_TEST_F(SBNavigationObserverBrowserTest, MixRedirects) {
+  ClickTestLink("mix_redirects", 3);
+  GURL redirect_url = embedded_test_server()->GetURL(kRedirectURL);
+  GURL initial_url = embedded_test_server()->GetURL(kSingleFrameTestURL);
+  GURL download_url = embedded_test_server()->GetURL(kDownloadItemURL);
+  SBNavigationObserverManager::NavigationMap* nav_map = navigation_map();
+  ASSERT_TRUE(nav_map);
+  ASSERT_EQ(std::size_t(3), nav_map->size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(initial_url).size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(redirect_url).size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(download_url).size());
+  VerifyNavigationEvent(initial_url, initial_url, initial_url, false, true,
+                        false, GURL(), nav_map->at(initial_url).at(0));
+  VerifyNavigationEvent(initial_url, redirect_url, initial_url, false, true,
+                        false, GURL(), nav_map->at(redirect_url).at(0));
+  VerifyNavigationEvent(redirect_url, download_url, redirect_url, false, false,
+                        false, GURL(), nav_map->at(download_url).at(0));
+}
+
+// Use javascript to open download in a new tab.
+IN_PROC_BROWSER_TEST_F(SBNavigationObserverBrowserTest, NewTabDownload) {
+  ClickTestLink("new_tab_download", 4);
+  GURL initial_url = embedded_test_server()->GetURL(kSingleFrameTestURL);
+  GURL download_url = embedded_test_server()->GetURL(kDownloadItemURL);
+  GURL blank_url = GURL("about:blank");
+  SBNavigationObserverManager::NavigationMap* nav_map = navigation_map();
+  ASSERT_TRUE(nav_map);
+  ASSERT_EQ(std::size_t(3), nav_map->size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(initial_url).size());
+  ASSERT_EQ(std::size_t(2), nav_map->at(blank_url).size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(download_url).size());
+  VerifyNavigationEvent(initial_url, initial_url, initial_url, false, true,
+                        false, GURL(), nav_map->at(initial_url).at(0));
+  VerifyNavigationEvent(initial_url, blank_url, initial_url, false, false,
+                        false, GURL(), nav_map->at(blank_url).at(0));
+  // Source and target are at different tabs.
+  EXPECT_FALSE(nav_map->at(blank_url).at(0).source_tab_id ==
+               nav_map->at(blank_url).at(0).target_tab_id);
+  VerifyNavigationEvent(blank_url, blank_url, blank_url, false, false, false,
+                        GURL(), nav_map->at(blank_url).at(1));
+  EXPECT_TRUE(nav_map->at(blank_url).at(1).source_tab_id ==
+              nav_map->at(blank_url).at(1).target_tab_id);
+  VerifyNavigationEvent(blank_url, download_url, blank_url, false, false, false,
+                        GURL(), nav_map->at(download_url).at(0));
+  EXPECT_TRUE(nav_map->at(download_url).at(0).source_tab_id ==
+              nav_map->at(download_url).at(0).target_tab_id);
+}
+
+// Use javascript to open download in a new tab and download has a data url.
+IN_PROC_BROWSER_TEST_F(SBNavigationObserverBrowserTest,
+                       NewTabDownloadWithDataURL) {
+  ClickTestLink("new_tab_download_with_data_url", 4);
+  GURL initial_url = embedded_test_server()->GetURL(kSingleFrameTestURL);
+  GURL download_url = GURL(kDownloadDataURL);
+  GURL blank_url = GURL("about:blank");
+  SBNavigationObserverManager::NavigationMap* nav_map = navigation_map();
+  ASSERT_TRUE(nav_map);
+  ASSERT_EQ(std::size_t(3), nav_map->size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(initial_url).size());
+  ASSERT_EQ(std::size_t(2), nav_map->at(blank_url).size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(download_url).size());
+  VerifyNavigationEvent(initial_url, initial_url, initial_url, false, true,
+                        false, GURL(), nav_map->at(initial_url).at(0));
+  VerifyNavigationEvent(initial_url, blank_url, initial_url, false, false,
+                        false, GURL(), nav_map->at(blank_url).at(0));
+  // Source and target are at different tabs.
+  EXPECT_FALSE(nav_map->at(blank_url).at(0).source_tab_id ==
+               nav_map->at(blank_url).at(0).target_tab_id);
+  VerifyNavigationEvent(blank_url, blank_url, blank_url, false, false, false,
+                        GURL(), nav_map->at(blank_url).at(1));
+  EXPECT_TRUE(nav_map->at(blank_url).at(1).source_tab_id ==
+              nav_map->at(blank_url).at(1).target_tab_id);
+  VerifyNavigationEvent(blank_url, download_url, blank_url, false, false, false,
+                        GURL(), nav_map->at(download_url).at(0));
+  EXPECT_TRUE(nav_map->at(download_url).at(0).source_tab_id ==
+              nav_map->at(download_url).at(0).target_tab_id);
+}
+
+// TODO(jialiul): Need to figure out why this test is failing on Windows and
+// flacky on other platforms.
+#define MAYBE_DownloadViaHTML5FileApi DISABLED_DownloadViaHTML5FileApi
+// Download via html5 file API.
+IN_PROC_BROWSER_TEST_F(SBNavigationObserverBrowserTest,
+                       MAYBE_DownloadViaHTML5FileApi) {
+  ClickTestLink("html5_file_api", 2);
+  GURL initial_url = embedded_test_server()->GetURL(kSingleFrameTestURL);
+  std::string download_url_str =
+      base::StringPrintf("filesystem:%stemporary/test.exe",
+                         embedded_test_server()->base_url().spec().c_str());
+  GURL download_url = GURL(download_url_str);
+  SBNavigationObserverManager::NavigationMap* nav_map = navigation_map();
+  ASSERT_TRUE(nav_map);
+  ASSERT_EQ(std::size_t(2), nav_map->size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(initial_url).size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(download_url).size());
+  VerifyNavigationEvent(initial_url, initial_url, initial_url, false, true,
+                        false, GURL(), nav_map->at(initial_url).at(0));
+  VerifyNavigationEvent(initial_url, download_url, initial_url, false, false,
+                        false, GURL(), nav_map->at(download_url).at(0));
+}
+
+// Click a link in a subframe and start download.
+IN_PROC_BROWSER_TEST_F(SBNavigationObserverBrowserTest,
+                       SubFrameDirectDownload) {
+  ui_test_utils::NavigateToURL(
+      browser(), embedded_test_server()->GetURL(kMultiFrameTestURL));
+  EXPECT_TRUE(content::WaitForLoadStop(
+      browser()->tab_strip_model()->GetActiveWebContents()));
+  std::string test_name =
+      base::StringPrintf("%s', '%s", "iframe1", "iframe_direct_download");
+  ClickTestLink(test_name.c_str(), 1);
+  GURL initial_url = embedded_test_server()->GetURL(kSingleFrameTestURL);
+  GURL multi_frame_test_url =
+      embedded_test_server()->GetURL(kMultiFrameTestURL);
+  GURL iframe_url = embedded_test_server()->GetURL(kIframeDirectDownloadURL);
+  GURL iframe_retargeting_url =
+      embedded_test_server()->GetURL(kIframeRetargetingURL);
+  GURL download_url = embedded_test_server()->GetURL(kDownloadItemURL);
+  SBNavigationObserverManager::NavigationMap* nav_map = navigation_map();
+  ASSERT_TRUE(nav_map);
+  ASSERT_EQ(std::size_t(4), nav_map->size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(multi_frame_test_url).size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(iframe_url).size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(iframe_retargeting_url).size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(download_url).size());
+  VerifyNavigationEvent(initial_url, multi_frame_test_url, initial_url, true,
+                        true, false, GURL(),
+                        nav_map->at(multi_frame_test_url).at(0));
+  VerifyNavigationEvent(iframe_url, iframe_url, multi_frame_test_url, false,
+                        true, false, GURL(), nav_map->at(iframe_url).at(0));
+  VerifyNavigationEvent(iframe_retargeting_url, iframe_retargeting_url,
+                        multi_frame_test_url, false, true, false, GURL(),
+                        nav_map->at(iframe_retargeting_url).at(0));
+  VerifyNavigationEvent(iframe_url, download_url, multi_frame_test_url, false,
+                        false, false, GURL(), nav_map->at(download_url).at(0));
+}
+
+// Click a link in a subframe and open download in a new tab.
+IN_PROC_BROWSER_TEST_F(SBNavigationObserverBrowserTest,
+                       SubFrameNewTabDownload) {
+  ui_test_utils::NavigateToURL(
+      browser(), embedded_test_server()->GetURL(kMultiFrameTestURL));
+  EXPECT_TRUE(content::WaitForLoadStop(
+      browser()->tab_strip_model()->GetActiveWebContents()));
+  std::string test_name =
+      base::StringPrintf("%s', '%s", "iframe2", "iframe_new_tab_download");
+  ClickTestLink(test_name.c_str(), 4);
+  GURL initial_url = embedded_test_server()->GetURL(kSingleFrameTestURL);
+  GURL multi_frame_test_url =
+      embedded_test_server()->GetURL(kMultiFrameTestURL);
+  GURL iframe_url = embedded_test_server()->GetURL(kIframeDirectDownloadURL);
+  GURL iframe_retargeting_url =
+      embedded_test_server()->GetURL(kIframeRetargetingURL);
+  GURL download_url = embedded_test_server()->GetURL(kDownloadItemURL);
+  GURL blank_url = GURL("about:blank");
+  SBNavigationObserverManager::NavigationMap* nav_map = navigation_map();
+  ASSERT_TRUE(nav_map);
+  ASSERT_EQ(std::size_t(5), nav_map->size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(multi_frame_test_url).size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(iframe_url).size());
+  ASSERT_EQ(std::size_t(2), nav_map->at(iframe_retargeting_url).size());
+  ASSERT_EQ(std::size_t(2), nav_map->at(blank_url).size());
+  ASSERT_EQ(std::size_t(1), nav_map->at(download_url).size());
+  VerifyNavigationEvent(initial_url, multi_frame_test_url, initial_url, true,
+                        true, false, GURL(),
+                        nav_map->at(multi_frame_test_url).at(0));
+  VerifyNavigationEvent(iframe_url, iframe_url, multi_frame_test_url, false,
+                        true, false, GURL(), nav_map->at(iframe_url).at(0));
+  VerifyNavigationEvent(iframe_retargeting_url, iframe_retargeting_url,
+                        multi_frame_test_url, false, true, false, GURL(),
+                        nav_map->at(iframe_retargeting_url).at(0));
+  VerifyNavigationEvent(iframe_retargeting_url, iframe_retargeting_url,
+                        multi_frame_test_url, false, true, false, GURL(),
+                        nav_map->at(iframe_retargeting_url).at(1));
+  VerifyNavigationEvent(iframe_retargeting_url, blank_url, multi_frame_test_url,
+                        false, false, false, GURL(),
+                        nav_map->at(blank_url).at(0));
+  VerifyNavigationEvent(blank_url, blank_url, blank_url, false, false, false,
+                        GURL(), nav_map->at(blank_url).at(1));
+  VerifyNavigationEvent(blank_url, download_url, blank_url, false, false, false,
+                        GURL(), nav_map->at(download_url).at(0));
+}
+
+}  // namespace safe_browsing