Block redirects to renderer-debug urls.

content/browser/child_process_security_policy_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <set>
 #include <string>
 
 #include "base/files/file_path.h"
 #include "content/browser/child_process_security_policy_impl.h"
 #include "content/public/common/url_constants.h"
@@ skipping 139 matching lines @@
 
   EXPECT_FALSE(p->IsPseudoScheme(kChromeUIScheme));
 }
 
 TEST_F(ChildProcessSecurityPolicyTest, StandardSchemesTest) {
   ChildProcessSecurityPolicyImpl* p =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
   p->Add(kRendererID);
 
-  // Safe to request or commit.
+  // Safe to request, redirect or commit.
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("http://www.google.com/")));
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("https://www.paypal.com/")));
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("ftp://ftp.gnu.org/")));
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("data:text/html,<b>Hi</b>")));
   EXPECT_TRUE(p->CanRequestURL(
       kRendererID, GURL("filesystem:http://localhost/temporary/a.gif")));
+  EXPECT_TRUE(p->CanRedirectToURL(GURL("http://www.google.com/")));
+  EXPECT_TRUE(p->CanRedirectToURL(GURL("https://www.paypal.com/")));
+  EXPECT_TRUE(p->CanRedirectToURL(GURL("ftp://ftp.gnu.org/")));
+  EXPECT_TRUE(p->CanRedirectToURL(GURL("data:text/html,<b>Hi</b>")));

[Charlie Reis, 2017/07/07 17:12:59]

Hmm, this is surprising to me in the other direction, since we don't allow
redirects to data URLs.  Maybe we should eventually prevent that here as well?

[arthursonzogni, 2017/07/10 16:07:03]

Yes, eventually.
So, this is already enforced somewhere else in the code. Maybe we shouldn't
enforce the same thing twice (moving it here maybe?)

In the next patch, I will make CanRedirectToURL more permissive such that
CanRequestURL => CanRedirectToURL. Therefore, I can't make
CanRedirectToURL("data:xxx") returning false.

[Charlie Reis, 2017/07/10 21:16:21]

Acknowledged.

+  EXPECT_FALSE(
+      p->CanRedirectToURL(GURL("filesystem:http://localhost/temporary/a.gif")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("http://www.google.com/")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("https://www.paypal.com/")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("ftp://ftp.gnu.org/")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("data:text/html,<b>Hi</b>")));
   EXPECT_TRUE(p->CanCommitURL(
       kRendererID, GURL("filesystem:http://localhost/temporary/a.gif")));
   EXPECT_TRUE(
       p->CanSetAsOriginHeader(kRendererID, GURL("http://www.google.com/")));
   EXPECT_TRUE(
       p->CanSetAsOriginHeader(kRendererID, GURL("https://www.paypal.com/")));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("ftp://ftp.gnu.org/")));
   EXPECT_TRUE(
       p->CanSetAsOriginHeader(kRendererID, GURL("data:text/html,<b>Hi</b>")));
   EXPECT_TRUE(p->CanSetAsOriginHeader(
       kRendererID, GURL("filesystem:http://localhost/temporary/a.gif")));
 
   // Dangerous to request, commit, or set as origin header.
   EXPECT_FALSE(p->CanRequestURL(kRendererID,
                                 GURL("file:///etc/passwd")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID,
                                 GURL("chrome://foo/bar")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID,
                                 GURL("view-source:http://www.google.com/")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("file:///etc/passwd")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("chrome://foo/bar")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("view-source:http://www.google.com/")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID,
                                 GURL("file:///etc/passwd")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID,
                                 GURL("chrome://foo/bar")));
   EXPECT_FALSE(
       p->CanCommitURL(kRendererID, GURL("view-source:http://www.google.com/")));
   EXPECT_FALSE(
       p->CanSetAsOriginHeader(kRendererID, GURL("file:///etc/passwd")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("chrome://foo/bar")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(
@@ skipping 23 matching lines @@
       kRendererID, GURL("blob:http://username@localhost/some-guid")));
   EXPECT_FALSE(p->CanRequestURL(
       kRendererID, GURL("blob:http://username     @localhost/some-guid")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("blob:blob:some-guid")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("blob:some-guid")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID,
                                 GURL("blob:filesystem:http://localhost/path")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID,
                                 GURL("filesystem:blob:http://localhost/guid")));
 
+  // No redirect to a blob-url or a filesystem-url are allowed.

[Charlie Reis, 2017/07/07 17:12:59]

nit: redirects

[arthursonzogni, 2017/07/10 16:07:04]

Line removed.

+  EXPECT_FALSE(p->CanRedirectToURL(GURL("blob:http://localhost/some-guid")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("blob:null/some-guid")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("blob:http://localhost/some-guid")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("blob:NulL/some-guid")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("blob:NulL/some-guid#fragment")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("blob:NulL/some-guid?query")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("blob:blobinternal://some-guid")));
+  EXPECT_FALSE(
+      p->CanRedirectToURL(GURL("blob:http://username@localhost/some-guid")));
+  EXPECT_FALSE(p->CanRedirectToURL(
+      GURL("blob:http://username     @localhost/some-guid")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("blob:blob:some-guid")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("blob:some-guid")));
+  EXPECT_FALSE(
+      p->CanRedirectToURL(GURL("blob:filesystem:http://localhost/path")));
+  EXPECT_FALSE(
+      p->CanRedirectToURL(GURL("filesystem:blob:http://localhost/guid")));
+
   EXPECT_TRUE(
       p->CanCommitURL(kRendererID, GURL("blob:http://localhost/some-guid")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("blob:null/some-guid")));
   EXPECT_TRUE(
       p->CanCommitURL(kRendererID, GURL("blob:http://localhost/some-guid")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("blob:NulL/some-guid")));
   EXPECT_TRUE(
       p->CanCommitURL(kRendererID, GURL("blob:NulL/some-guid#fragment")));
   EXPECT_TRUE(
       p->CanCommitURL(kRendererID, GURL("blob:blobinternal://some-guid")));
@@ skipping 14 matching lines @@
 TEST_F(ChildProcessSecurityPolicyTest, AboutTest) {
   ChildProcessSecurityPolicyImpl* p =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
   p->Add(kRendererID);
 
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("about:blank")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:BlAnK")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("aBouT:BlAnK")));
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("aBouT:blank")));
+  EXPECT_TRUE(p->CanRedirectToURL(GURL("about:blank")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("about:BlAnK")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("aBouT:BlAnK")));
+  EXPECT_TRUE(p->CanRedirectToURL(GURL("aBouT:blank")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("about:blank")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:BlAnK")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("aBouT:BlAnK")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("aBouT:blank")));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("about:blank")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:BlAnK")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("aBouT:BlAnK")));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("aBouT:blank")));
 
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("about:srcdoc")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("about:srcdoc")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("about:srcdoc")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:srcdoc")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:SRCDOC")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:SRCDOC")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:SRCDOC")));
 
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:crash")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:cache")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:hang")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:version")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("about:crash")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("about:cache")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("about:hang")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("about:version")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:crash")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:cache")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:hang")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:version")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:crash")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:cache")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:hang")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:version")));
 
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("aBoUt:version")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:CrASh")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("abOuT:cAChe")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("aBoUt:version")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("about:CrASh")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("abOuT:cAChe")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("aBoUt:version")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:CrASh")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("abOuT:cAChe")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("aBoUt:version")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("aBoUt:version")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:CrASh")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("abOuT:cAChe")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("aBoUt:version")));
 
   // Requests for about: pages should be denied.
   p->GrantRequestURL(kRendererID, GURL("about:crash"));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:crash")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("about:crash")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("about:crash")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("about:crash")));
 
-  // These requests for chrome:// pages should be granted.
+  // These requests for chrome:// pages should be granted if there is no

[Charlie Reis, 2017/07/07 17:12:59]

nit: s/is/are/

[arthursonzogni, 2017/07/10 16:07:04]

Undoing my change on this line.

+  // redirects.
   GURL chrome_url("chrome://foo");
   p->GrantRequestURL(kRendererID, chrome_url);
   EXPECT_TRUE(p->CanRequestURL(kRendererID, chrome_url));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL(chrome_url)));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, chrome_url));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, chrome_url));
 
   p->Remove(kRendererID);
 }
 
 TEST_F(ChildProcessSecurityPolicyTest, JavaScriptTest) {
   ChildProcessSecurityPolicyImpl* p =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
   p->Add(kRendererID);
 
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("javascript:alert('xss')")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("javascript:alert('xss')")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("javascript:alert('xss')")));
   EXPECT_FALSE(
       p->CanSetAsOriginHeader(kRendererID, GURL("javascript:alert('xss')")));
   p->GrantRequestURL(kRendererID, GURL("javascript:alert('xss')"));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("javascript:alert('xss')")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("javascript:alert('xss')")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("javascript:alert('xss')")));
   EXPECT_FALSE(
       p->CanSetAsOriginHeader(kRendererID, GURL("javascript:alert('xss')")));
 
   p->Remove(kRendererID);
 }
 
 TEST_F(ChildProcessSecurityPolicyTest, SuboriginTest) {
   ChildProcessSecurityPolicyImpl* p =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
   p->Add(kRendererID);
 
   // Suborigin URLs are not requestable or committable.
   EXPECT_FALSE(
       p->CanRequestURL(kRendererID, GURL("http-so://foobar.example.com")));
   EXPECT_FALSE(
       p->CanRequestURL(kRendererID, GURL("https-so://foobar.example.com")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("http-so://foobar.example.com")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("https-so://foobar.example.com")));
   EXPECT_FALSE(
       p->CanCommitURL(kRendererID, GURL("http-so://foobar.example.com")));
   EXPECT_FALSE(
       p->CanCommitURL(kRendererID, GURL("https-so://foobar.example.com")));
 
   // It's not possible to grant suborigins requestable status.
   p->GrantRequestURL(kRendererID, GURL("https-so://foobar.example.com"));
   EXPECT_FALSE(
       p->CanCommitURL(kRendererID, GURL("https-so://foobar.example.com")));
 
   // Suborigin URLs are valid origin headers.
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID,
                                       GURL("http-so://foobar.example.com")));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID,
                                       GURL("https-so://foobar.example.com")));
 
   p->Remove(kRendererID);
 }
 
 TEST_F(ChildProcessSecurityPolicyTest, RegisterWebSafeSchemeTest) {
   ChildProcessSecurityPolicyImpl* p =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
   p->Add(kRendererID);
 
   // Currently, "asdf" is destined for ShellExecute, so it is allowed to be
   // requested but not committed.
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("asdf:rockers")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("asdf:rockers")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("asdf:rockers")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("asdf:rockers")));
 
   // Once we register "asdf", we default to deny.
   RegisterTestScheme("asdf");
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("asdf:rockers")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("asdf:rockers")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("asdf:rockers")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, GURL("asdf:rockers")));
 
   // We can allow new schemes by adding them to the whitelist.
   p->RegisterWebSafeScheme("asdf");
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("asdf:rockers")));
+  EXPECT_TRUE(p->CanRedirectToURL(GURL("asdf:rockers")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("asdf:rockers")));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("asdf:rockers")));
 
   // Cleanup.
   p->Remove(kRendererID);
 }
 
 TEST_F(ChildProcessSecurityPolicyTest, CanServiceCommandsTest) {
   ChildProcessSecurityPolicyImpl* p =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
   p->Add(kRendererID);
 
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("file:///etc/passwd")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("file:///etc/passwd")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("file:///etc/passwd")));
   EXPECT_FALSE(
       p->CanSetAsOriginHeader(kRendererID, GURL("file:///etc/passwd")));
   p->GrantRequestURL(kRendererID, GURL("file:///etc/passwd"));
   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("file:///etc/passwd")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("file:///etc/passwd")));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("file:///etc/passwd")));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, GURL("file:///etc/passwd")));
 
   // We should forget our state if we repeat a renderer id.
   p->Remove(kRendererID);
   p->Add(kRendererID);
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("file:///etc/passwd")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("file:///etc/passwd")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("file:///etc/passwd")));
   EXPECT_FALSE(
       p->CanSetAsOriginHeader(kRendererID, GURL("file:///etc/passwd")));
   p->Remove(kRendererID);
 }
 
 TEST_F(ChildProcessSecurityPolicyTest, ViewSource) {
   ChildProcessSecurityPolicyImpl* p =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
   p->Add(kRendererID);
 
   // Child processes cannot request view source URLs.
   EXPECT_FALSE(p->CanRequestURL(kRendererID,
                                 GURL("view-source:http://www.google.com/")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID,
                                 GURL("view-source:file:///etc/passwd")));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("file:///etc/passwd")));
   EXPECT_FALSE(p->CanRequestURL(
       kRendererID, GURL("view-source:view-source:http://www.google.com/")));
 
+  // Child processes cannot be redirected to view source URLs.
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("view-source:http://www.google.com/")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("view-source:file:///etc/passwd")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("file:///etc/passwd")));
+  EXPECT_FALSE(p->CanRedirectToURL(
+      GURL("view-source:view-source:http://www.google.com/")));
+
   // View source URLs don't actually commit; the renderer is put into view
   // source mode, and the inner URL commits.
   EXPECT_FALSE(p->CanCommitURL(kRendererID,
                                GURL("view-source:http://www.google.com/")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID,
                                GURL("view-source:file:///etc/passwd")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("file:///etc/passwd")));
   EXPECT_FALSE(p->CanCommitURL(
       kRendererID, GURL("view-source:view-source:http://www.google.com/")));
 
   // View source URLs should not be setable as origin headers
   EXPECT_FALSE(p->CanSetAsOriginHeader(
       kRendererID, GURL("view-source:http://www.google.com/")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID,
                                        GURL("view-source:file:///etc/passwd")));
   EXPECT_FALSE(
       p->CanSetAsOriginHeader(kRendererID, GURL("file:///etc/passwd")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(
       kRendererID, GURL("view-source:view-source:http://www.google.com/")));
 
   p->GrantRequestURL(kRendererID, GURL("view-source:file:///etc/passwd"));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("file:///etc/passwd")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("file:///etc/passwd")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("file:///etc/passwd")));
   EXPECT_FALSE(
       p->CanSetAsOriginHeader(kRendererID, GURL("file:///etc/passwd")));
   EXPECT_FALSE(
       p->CanRequestURL(kRendererID, GURL("view-source:file:///etc/passwd")));
+  EXPECT_FALSE(p->CanRedirectToURL(GURL("view-source:file:///etc/passwd")));
   EXPECT_FALSE(p->CanCommitURL(kRendererID,
                                GURL("view-source:file:///etc/passwd")));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID,
                                        GURL("view-source:file:///etc/passwd")));
   p->Remove(kRendererID);
 }
 
 TEST_F(ChildProcessSecurityPolicyTest, SpecificFile) {
   ChildProcessSecurityPolicyImpl* p =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
   p->Add(kRendererID);
 
   GURL icon_url("file:///tmp/foo.png");
   GURL sensitive_url("file:///etc/passwd");
   EXPECT_FALSE(p->CanRequestURL(kRendererID, icon_url));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, sensitive_url));
+  EXPECT_FALSE(p->CanRedirectToURL(icon_url));
+  EXPECT_FALSE(p->CanRedirectToURL(sensitive_url));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, icon_url));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, sensitive_url));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, icon_url));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, sensitive_url));
 
   p->GrantRequestSpecificFileURL(kRendererID, icon_url);
   EXPECT_TRUE(p->CanRequestURL(kRendererID, icon_url));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, sensitive_url));
+  EXPECT_FALSE(p->CanRedirectToURL(icon_url));
+  EXPECT_FALSE(p->CanRedirectToURL(sensitive_url));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, icon_url));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, sensitive_url));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, icon_url));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, sensitive_url));
 
   p->GrantRequestURL(kRendererID, icon_url);
   EXPECT_TRUE(p->CanRequestURL(kRendererID, icon_url));
   EXPECT_TRUE(p->CanRequestURL(kRendererID, sensitive_url));
+  EXPECT_FALSE(p->CanRedirectToURL(icon_url));
+  EXPECT_FALSE(p->CanRedirectToURL(sensitive_url));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, icon_url));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, sensitive_url));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, icon_url));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, sensitive_url));
 
   p->Remove(kRendererID);
 }
 
 TEST_F(ChildProcessSecurityPolicyTest, FileSystemGrantsTest) {
   ChildProcessSecurityPolicyImpl* p =
@@ skipping 290 matching lines @@
 TEST_F(ChildProcessSecurityPolicyTest, CanServiceWebUIBindings) {
   ChildProcessSecurityPolicyImpl* p =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
   GURL url("chrome://thumb/http://www.google.com/");
 
   p->Add(kRendererID);
 
   EXPECT_FALSE(p->HasWebUIBindings(kRendererID));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, url));
+  EXPECT_FALSE(p->CanRedirectToURL(url));
   p->GrantWebUIBindings(kRendererID);
   EXPECT_TRUE(p->HasWebUIBindings(kRendererID));
   EXPECT_TRUE(p->CanRequestURL(kRendererID, url));
+  EXPECT_FALSE(p->CanRedirectToURL(url));
 
   p->Remove(kRendererID);
 }
 
 TEST_F(ChildProcessSecurityPolicyTest, RemoveRace) {
   ChildProcessSecurityPolicyImpl* p =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
   GURL url("file:///etc/passwd");
   base::FilePath file(TEST_PATH("/etc/passwd"));
 
   p->Add(kRendererID);
 
   p->GrantRequestURL(kRendererID, url);
   p->GrantReadFile(kRendererID, file);
   p->GrantWebUIBindings(kRendererID);
 
   EXPECT_TRUE(p->CanRequestURL(kRendererID, url));
+  EXPECT_FALSE(p->CanRedirectToURL(url));
   EXPECT_TRUE(p->CanReadFile(kRendererID, file));
   EXPECT_TRUE(p->HasWebUIBindings(kRendererID));
 
   p->Remove(kRendererID);
 
   // Renderers are added and removed on the UI thread, but the policy can be
   // queried on the IO thread.  The ChildProcessSecurityPolicy needs to be
   // prepared to answer policy questions about renderers who no longer exist.
 
   // In this case, we default to secure behavior.
   EXPECT_FALSE(p->CanRequestURL(kRendererID, url));
+  EXPECT_FALSE(p->CanRedirectToURL(url));
   EXPECT_FALSE(p->CanReadFile(kRendererID, file));
   EXPECT_FALSE(p->HasWebUIBindings(kRendererID));
 }
 
 // Test the granting of origin permissions, and their interactions with
 // granting scheme permissions.
 TEST_F(ChildProcessSecurityPolicyTest, OriginGranting) {
   ChildProcessSecurityPolicyImpl* p =
       ChildProcessSecurityPolicyImpl::GetInstance();
 
   p->Add(kRendererID);
 
   GURL url_foo1("chrome://foo/resource1");
   GURL url_foo2("chrome://foo/resource2");
   GURL url_bar("chrome://bar/resource3");
 
   EXPECT_FALSE(p->CanRequestURL(kRendererID, url_foo1));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, url_foo2));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, url_bar));
+  EXPECT_FALSE(p->CanRedirectToURL(url_foo1));
+  EXPECT_FALSE(p->CanRedirectToURL(url_foo2));
+  EXPECT_FALSE(p->CanRedirectToURL(url_bar));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, url_foo1));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, url_foo2));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, url_bar));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, url_foo1));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, url_foo2));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, url_bar));
 
   p->GrantOrigin(kRendererID, url::Origin(url_foo1));
 
   EXPECT_TRUE(p->CanRequestURL(kRendererID, url_foo1));
   EXPECT_TRUE(p->CanRequestURL(kRendererID, url_foo2));
   EXPECT_FALSE(p->CanRequestURL(kRendererID, url_bar));
+  EXPECT_FALSE(p->CanRedirectToURL(url_foo1));
+  EXPECT_FALSE(p->CanRedirectToURL(url_foo2));
+  EXPECT_FALSE(p->CanRedirectToURL(url_bar));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, url_foo1));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, url_foo2));
   EXPECT_FALSE(p->CanCommitURL(kRendererID, url_bar));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, url_foo1));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, url_foo2));
   EXPECT_FALSE(p->CanSetAsOriginHeader(kRendererID, url_bar));
 
   p->GrantScheme(kRendererID, kChromeUIScheme);
 
   EXPECT_TRUE(p->CanRequestURL(kRendererID, url_foo1));
   EXPECT_TRUE(p->CanRequestURL(kRendererID, url_foo2));
   EXPECT_TRUE(p->CanRequestURL(kRendererID, url_bar));
+  EXPECT_FALSE(p->CanRedirectToURL(url_foo1));
+  EXPECT_FALSE(p->CanRedirectToURL(url_foo2));
+  EXPECT_FALSE(p->CanRedirectToURL(url_bar));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, url_foo1));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, url_foo2));
   EXPECT_TRUE(p->CanCommitURL(kRendererID, url_bar));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, url_foo1));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, url_foo2));
   EXPECT_TRUE(p->CanSetAsOriginHeader(kRendererID, url_bar));
 
   p->Remove(kRendererID);
 }
 
@@ skipping 16 matching lines @@
   EXPECT_EQ(4U, policy->isolated_origins_.size());
   EXPECT_TRUE(
       policy->IsIsolatedOrigin(url::Origin(GURL("http://isolated.foo.com"))));
   EXPECT_TRUE(policy->IsIsolatedOrigin(url::Origin(GURL("http://a.com"))));
   EXPECT_TRUE(policy->IsIsolatedOrigin(url::Origin(GURL("https://b.com"))));
   EXPECT_TRUE(
       policy->IsIsolatedOrigin(url::Origin(GURL("https://c.com:8000"))));
 }
 
 }  // namespace content