Block redirects to renderer-debug urls.

content/browser/frame_host/navigation_handle_impl_browsertest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/command_line.h"
 #include "base/memory/weak_ptr.h"
+#include "content/browser/frame_host/debug_urls.h"
 #include "content/browser/frame_host/navigation_handle_impl.h"
 #include "content/browser/web_contents/web_contents_impl.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/bindings_policy.h"
 #include "content/public/common/browser_side_navigation_policy.h"
 #include "content/public/common/content_switches.h"
 #include "content/public/common/request_context_type.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/browser_test_utils.h"
@@ skipping 1222 matching lines @@
 // Record and list the navigations that are started and finished.
 class NavigationLogger : public WebContentsObserver {
  public:
   NavigationLogger(WebContents* web_contents)
       : WebContentsObserver(web_contents) {}
 
   void DidStartNavigation(NavigationHandle* navigation_handle) override {
     started_navigation_urls_.push_back(navigation_handle->GetURL());
   }
 
+  void DidRedirectNavigation(NavigationHandle* navigation_handle) override {
+    redirected_navigation_urls_.push_back(navigation_handle->GetURL());
+  }
+
   void DidFinishNavigation(NavigationHandle* navigation_handle) override {
     finished_navigation_urls_.push_back(navigation_handle->GetURL());
   }
 
   const std::vector<GURL>& started_navigation_urls() const {
     return started_navigation_urls_;
   }
+  const std::vector<GURL>& redirected_navigation_urls() const {
+    return redirected_navigation_urls_;
+  }
   const std::vector<GURL>& finished_navigation_urls() const {
     return finished_navigation_urls_;
   }
 
  private:
   std::vector<GURL> started_navigation_urls_;
+  std::vector<GURL> redirected_navigation_urls_;
   std::vector<GURL> finished_navigation_urls_;
 };
 
 // There was a bug without PlzNavigate that happened when a navigation was
 // blocked after a redirect. Blink didn't know about the redirect and tried
 // to commit an error page to the pre-redirect URL. The result was that the
 // NavigationHandle was not found on the browser-side and a new NavigationHandle
 // created for committing the error page. This test makes sure that only one
 // NavigationHandle is used for committing the error page.
 // See https://crbug.com/695421
@@ skipping 232 matching lines @@
       web_contents->GetController().GetLastCommittedEntry();
   EXPECT_TRUE(last_committed);
   EXPECT_EQ(blocked_url, last_committed->GetVirtualURL());
   EXPECT_EQ(PAGE_TYPE_ERROR, last_committed->GetPageType());
   EXPECT_NE(web_ui_process.get(), web_contents->GetSiteInstance());
   EXPECT_TRUE(commit_observer.has_committed());
   EXPECT_TRUE(commit_observer.is_error());
   EXPECT_FALSE(commit_observer.is_renderer_initiated());
 }
 
+// Redirects to a renderer debug URLs caused problems.

[Charlie Reis, 2017/07/07 17:12:59]

nit: Drop "a"

[arthursonzogni, 2017/07/10 16:07:04]

Done.

+// See https://crbug.com/728398.

[Charlie Reis, 2017/07/07 17:12:59]

Should this bug be listed in the CL description as well?

[arthursonzogni, 2017/07/10 16:07:04]

Yes, this is the main bug. I didn't used the correct ones in my first CL
description. Thanks!

+IN_PROC_BROWSER_TEST_F(NavigationHandleImplBrowserTest,
+                       RedirectToRendererDebugUrl) {
+  GURL url(embedded_test_server()->GetURL("/title1.html"));
+  EXPECT_TRUE(NavigateToURL(shell(), url));
+
+  const struct {
+    const GURL renderer_debug_url;
+    const net::Error error_code;
+  } kTestCases[] = {
+      {GURL("javascript:window.alert('hello')"), net::ERR_ABORTED},
+      {GURL(kChromeUIBadCastCrashURL), net::ERR_UNSAFE_REDIRECT},
+      {GURL(kChromeUICrashURL), net::ERR_UNSAFE_REDIRECT},
+      {GURL(kChromeUIDumpURL), net::ERR_UNSAFE_REDIRECT},
+      {GURL(kChromeUIKillURL), net::ERR_UNSAFE_REDIRECT},
+      {GURL(kChromeUIHangURL), net::ERR_UNSAFE_REDIRECT},
+      {GURL(kChromeUIShorthangURL), net::ERR_UNSAFE_REDIRECT},
+      {GURL(kChromeUIMemoryExhaustURL), net::ERR_UNSAFE_REDIRECT},
+  };
+
+  for (const auto& test_case : kTestCases) {
+    SCOPED_TRACE(testing::Message()
+                 << "renderer_debug_url = " << test_case.renderer_debug_url);
+
+    GURL redirecting_url = embedded_test_server()->GetURL(
+        "/server-redirect?" + test_case.renderer_debug_url.spec());
+
+    NavigationHandleObserver observer(shell()->web_contents(), redirecting_url);
+    NavigationLogger logger(shell()->web_contents());
+
+    // Try to navigate to the url. The navigation should be canceled and the
+    // NavigationHandle should have the right error code.
+    EXPECT_FALSE(NavigateToURL(shell(), redirecting_url));
+    EXPECT_EQ(test_case.error_code, observer.net_error_code());
+
+    // Both WebContentsObserver::{DidStartNavigation, DidFinishNavigation}
+    // are called, but no WebContentsObserver::DidRedirectNavigation.
+    std::vector<GURL> started_navigation = {redirecting_url};
+    std::vector<GURL> redirected_navigation = {};
+    std::vector<GURL> finished_navigation = {redirecting_url};
+    EXPECT_EQ(started_navigation, logger.started_navigation_urls());
+    EXPECT_EQ(redirected_navigation, logger.redirected_navigation_urls());
+    EXPECT_EQ(finished_navigation, logger.finished_navigation_urls());
+  }
+}
+
 }  // namespace content