Allow webview guests to skip WAR checks in ShouldAllowOpenURL.

chrome/browser/apps/guest_view/web_view_browsertest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <queue>
 #include <set>
 #include <utility>
 
 #include "base/callback_helpers.h"
 #include "base/files/file_util.h"
@@ skipping 3274 matching lines @@
   TestHelper("testBlobURL", "web_view/shim", NEEDS_TEST_SERVER);
 }
 
 // Tests that a WebView accessible resource can actually be loaded from a
 // webpage in a WebView.
 IN_PROC_BROWSER_TEST_P(WebViewTest, LoadWebviewAccessibleResource) {
   TestHelper("testLoadWebviewAccessibleResource",
              "web_view/load_webview_accessible_resource", NEEDS_TEST_SERVER);
 }
 
+// Tests that a WebView can reload a WebView accessible resource. See
+// https://crbug.com/691941.
+IN_PROC_BROWSER_TEST_P(WebViewTest, ReloadWebviewAccessibleResource) {
+  TestHelper("testReloadWebviewAccessibleResource",
+             "web_view/load_webview_accessible_resource", NEEDS_TEST_SERVER);
+
+  content::WebContents* embedder_contents = GetEmbedderWebContents();
+  content::WebContents* web_view_contents =
+      GetGuestViewManager()->GetLastGuestCreated();
+  ASSERT_TRUE(embedder_contents);
+  ASSERT_TRUE(web_view_contents);
+
+  GURL embedder_url(embedder_contents->GetLastCommittedURL());
+  GURL::Replacements replace_path;
+  replace_path.SetPathStr("/assets/foo.html");

[Devlin, 2017/03/22 21:58:56]

GURL::Replacements always drive me crazy... there's some bizarre ownership of
strings involved.  My recollection is that they don't actually own the strings
passed to them, and thus using them like this can result in UAF.  But maybe I'm
misremembering, or things have changed?

[alexmos, 2017/03/22 23:56:39]

I'm not a big fan of replacements either, so I just changed this to avoid the
replacements altogether, which also saved a couple of lines. :)  Thanks for
mentioning this, I wasn't aware of it - looks like you're right about SetPathStr
not owning the string passed to it, though we might be ok here since string
literals should have static storage duration.  Certainly lots of other tests
seem to use this. :)

+  GURL webview_url(embedder_url.ReplaceComponents(replace_path));
+
+  EXPECT_EQ(webview_url, web_view_contents->GetLastCommittedURL());
+}
+
 // Tests that a webview inside an iframe can load and that it is destroyed when
 // the iframe is detached.
 IN_PROC_BROWSER_TEST_P(WebViewTest, LoadWebviewInsideIframe) {
   TestHelper("testLoadWebviewInsideIframe",
              "web_view/load_webview_inside_iframe", NEEDS_TEST_SERVER);
 
   // WebContents is leaked when using BrowserPlugin.
   if (!base::FeatureList::IsEnabled(::features::kGuestViewCrossProcessFrames))
     return;
 
@@ skipping 657 matching lines @@
                        ClosingChromeSignInShouldNotCrash) {
   GURL signin_url{"chrome://chrome-signin"};
 
   AddTabAtIndex(0, signin_url, ui::PAGE_TRANSITION_TYPED);
   AddTabAtIndex(1, signin_url, ui::PAGE_TRANSITION_TYPED);
   WaitForWebViewInDom();
 
   chrome::CloseTab(browser());
 }
 #endif