Remove about:srcdoc url conversion.

content/browser/child_process_security_policy_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <set>
 #include <string>
 
 #include "base/files/file_path.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/public/common/url_constants.h"
@@ skipping 243 matching lines @@
   p->Remove(kRendererID);
 }
 
 TEST_F(ChildProcessSecurityPolicyTest, AboutTest) {
   ChildProcessSecurityPolicyImpl* p =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
   p->Add(kRendererID);
 
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("about:blank")));
-  EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("about:BlAnK")));
-  EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("aBouT:BlAnK")));
+  EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:BlAnK")));

[Charlie Reis, 2016/11/22 01:01:20]

Can you confirm that the renderer doesn't try to commit URLs like this if we ask
it to (e.g., in a link click)?  I just want to be sure the browser and renderer
agree on what URL we're on.

[arthursonzogni, 2016/11/22 16:43:27]

The answer is 'no' without PlzNavigate and 'yes' with it.

# With PlzNavigate

   Renderer                          Browser
      |   ------(BeginNavigation)-----> |  <- the URL is filtered here.
      | <------(CommitNavigation)----   |
      |   ----(DidCommitNavigation)---> |

about:blank is committed in the renderer and the browser agree on this.
                             
# Without Plznavigate

   Renderer                          Browser
      |   ----(DidCommitNavigation)---> |  <-the URL is filtered here.

about:BlAnK is committed on the renderer and the browser thinks it is
about:blank.


Nevertheless, because the behavior of filterURL is still the same (only
CanRequestURL has changed), if this is a problem, then the problem was already
present before this patch.

[Charlie Reis, 2016/11/23 08:25:20]

Thanks for checking.  It does seem unfortunate that the renderer and browser
disagree, but maybe you're right that it isn't a problem.

The one case I'm mildly concerned about is the CanSetAsOriginHeader call in
ResourceDispatcherHostImpl::ShouldServiceRequest, which (I think) operates on an
unfiltered URL from the renderer.  In theory, an about:BlAnK page committed in a
renderer would fail that check if it made an XmlHttpRequest, since CanCommitURL
is now case-sensitive and says it couldn't have committed it.  But then again,
an about:BlAnK URL would set null as its Origin header, not about:BlAnK, so we
should be fine.

There's a chance some other path will get an unfiltered URL into CanCommitURL or
CanRequestURL, but I suppose we can track that down if it happens.  Let's run
with it.

+  EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("aBouT:BlAnK")));
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("aBouT:blank")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("about:blank")));
-  EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("about:BlAnK")));
-  EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("aBouT:BlAnK")));
+  EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:BlAnK")));
+  EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("aBouT:BlAnK")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("aBouT:blank")));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("about:blank")));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("about:BlAnK")));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("aBouT:BlAnK")));
+  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:BlAnK")));
+  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("aBouT:BlAnK")));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("aBouT:blank")));
 
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:crash")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:cache")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:hang")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:version")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:crash")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:cache")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:hang")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:version")));
@@ skipping 596 matching lines @@
   EXPECT_TRUE(p->CanCommitURL(kRendererID, url_foo2));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, url_bar));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, url_foo1));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, url_foo2));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, url_bar));
 
   p->Remove(kRendererID);
 }
 
 }  // namespace content