Preserving Content-Type header from http request in OpenURL path.

content/browser/frame_host/render_frame_host_manager.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/frame_host/render_frame_host_manager.h"
 
 #include <stddef.h>
 
 #include <algorithm>
 #include <utility>
@@ skipping 438 matching lines @@
   // new navigating RenderFrameHost.
   transferring_render_frame_host->set_is_loading(false);
 
   // Treat the last URL in the chain as the destination and the remainder as
   // the redirect chain.
   CHECK(transfer_url_chain.size());
   GURL transfer_url = transfer_url_chain.back();
   std::vector<GURL> rest_of_chain = transfer_url_chain;
   rest_of_chain.pop_back();
 
+  // |extra_headers| passed to RequestTransferURL below are always empty for
+  // now, because there are no known scenarios where headers (from POST request
+  // made from one renderer) need to be forwarded into the renderer where that
+  // request ends up being transfered to.  In particular, XSSAuditor doesn't
+  // look at the headers (e.g. the Content-Type header) when analyzing the body
+  // of the POST request.
+  std::string extra_headers;
+
   transferring_render_frame_host->frame_tree_node()
       ->navigator()
       ->RequestTransferURL(
           transferring_render_frame_host, transfer_url, nullptr, rest_of_chain,
           referrer, page_transition, global_request_id,
           should_replace_current_entry,
           transfer_navigation_handle_->IsPost() ? "POST" : "GET",
-          transfer_navigation_handle_->resource_request_body());
+          transfer_navigation_handle_->resource_request_body(), extra_headers);
 
   // If the navigation continued, the NavigationHandle should have been
   // transfered to a RenderFrameHost. In the other cases, it should be cleared.
   // If the NavigationHandle wasn't claimed, this will lead to the cancelation
   // of the request in the network stack.
   transfer_navigation_handle_.reset();
 
   // If the navigation in the new renderer did not start, inform the
   // FrameTreeNode that it stopped loading.
   if (!frame_tree_node_->IsLoading() && frame_tree_node_was_loading)
@@ skipping 2214 matching lines @@
                                              resolved_url)) {
     DCHECK(!dest_instance ||
            dest_instance == render_frame_host_->GetSiteInstance());
     return false;
   }
 
   return true;
 }
 
 }  // namespace content