Remove about:srcdoc url conversion.

content/browser/child_process_security_policy_unittest.cc

Index: content/browser/child_process_security_policy_unittest.cc
diff --git a/content/browser/child_process_security_policy_unittest.cc b/content/browser/child_process_security_policy_unittest.cc
index 00138f23483e23492b3a9dcc5f2dfba4176e481d..fb171a8112d219c8f24c54697ba24d87b535e976 100644
--- a/content/browser/child_process_security_policy_unittest.cc
+++ b/content/browser/child_process_security_policy_unittest.cc
@@ -261,16 +261,16 @@ TEST_F(ChildProcessSecurityPolicyTest, AboutTest) {
   p->Add(kRendererID);
 
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("about:blank")));
-  EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("about:BlAnK")));
-  EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("aBouT:BlAnK")));
+  EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:BlAnK")));

[Charlie Reis, 2016/11/22 01:01:20]

Can you confirm that the renderer doesn't try to commit URLs like this if we ask
it to (e.g., in a link click)?  I just want to be sure the browser and renderer
agree on what URL we're on.

[arthursonzogni, 2016/11/22 16:43:27]

The answer is 'no' without PlzNavigate and 'yes' with it.

# With PlzNavigate

   Renderer                          Browser
      |   ------(BeginNavigation)-----> |  <- the URL is filtered here.
      | <------(CommitNavigation)----   |
      |   ----(DidCommitNavigation)---> |

about:blank is committed in the renderer and the browser agree on this.
                             
# Without Plznavigate

   Renderer                          Browser
      |   ----(DidCommitNavigation)---> |  <-the URL is filtered here.

about:BlAnK is committed on the renderer and the browser thinks it is
about:blank.


Nevertheless, because the behavior of filterURL is still the same (only
CanRequestURL has changed), if this is a problem, then the problem was already
present before this patch.

[Charlie Reis, 2016/11/23 08:25:20]

Thanks for checking.  It does seem unfortunate that the renderer and browser
disagree, but maybe you're right that it isn't a problem.

The one case I'm mildly concerned about is the CanSetAsOriginHeader call in
ResourceDispatcherHostImpl::ShouldServiceRequest, which (I think) operates on an
unfiltered URL from the renderer.  In theory, an about:BlAnK page committed in a
renderer would fail that check if it made an XmlHttpRequest, since CanCommitURL
is now case-sensitive and says it couldn't have committed it.  But then again,
an about:BlAnK URL would set null as its Origin header, not about:BlAnK, so we
should be fine.

There's a chance some other path will get an unfiltered URL into CanCommitURL or
CanRequestURL, but I suppose we can track that down if it happens.  Let's run
with it.

+  EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("aBouT:BlAnK")));
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("aBouT:blank")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("about:blank")));
-  EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("about:BlAnK")));
-  EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("aBouT:BlAnK")));
+  EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:BlAnK")));
+  EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("aBouT:BlAnK")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("aBouT:blank")));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("about:blank")));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("about:BlAnK")));
-  EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("aBouT:BlAnK")));
+  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:BlAnK")));
+  EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("aBouT:BlAnK")));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("aBouT:blank")));
 
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:crash")));