When sanitizing serialized navigation entries also take iframes into account

content/public/common/page_state.cc

Index: content/public/common/page_state.cc
diff --git a/content/public/common/page_state.cc b/content/public/common/page_state.cc
index 9d100d31b626754d205874ebc42bcbd8754b8c38..1f3dd2ff72d54ae7e474d123bc408f158e46e1c7 100644
--- a/content/public/common/page_state.cc
+++ b/content/public/common/page_state.cc
@@ -7,6 +7,7 @@
 #include "base/files/file_path.h"
 #include "base/strings/utf_string_conversions.h"
 #include "content/common/page_state_serialization.h"
+#include "content/public/common/referrer.h"
 
 namespace content {
 namespace {
@@ -55,6 +56,25 @@ void RecursivelyRemoveReferrer(ExplodedFrameState* state) {
   }
 }
 
+bool RecursivelyCheckReferrer(ExplodedFrameState* state) {
+  Referrer referrer(GURL(state->referrer.string()), state->referrer_policy);
+  GURL url(state->url_string.string());
+  if (url.SchemeIsHTTPOrHTTPS() &&
+      Referrer::SanitizeForRequest(url, referrer).url != referrer.url) {
+    LOG(ERROR) << "Referrer for request to " << url << " is " << referrer.url
+               << " but should be "
+               << Referrer::SanitizeForRequest(url, referrer).url;
+    return false;
+  }
+  for (std::vector<ExplodedFrameState>::iterator it = state->children.begin();
+       it != state->children.end();
+       ++it) {
+    if (!RecursivelyCheckReferrer(&*it))
+      return false;
+  }
+  return true;
+}
+
 }  // namespace
 
 // static
@@ -108,7 +128,16 @@ PageState::PageState() {
 }
 
 bool PageState::IsValid() const {
-  return !data_.empty();
+  if (data_.empty())
+    return false;
+
+  ExplodedPageState state;
+  // This should return false, but tests create invalid page state.
+  if (!DecodePageState(data_, &state))

[marja, 2015/02/23 15:30:04]

What happens to data_ here? Should this branch set it to empty?

[jochen (gone - plz use gerrit), 2015/02/23 16:20:45]

IsValid() is not supposed to modify itself (it's const)

+    return true;
+
+  // TODO(jochen): Remove referrer check once http://crbug.com/450589 is fixed.
+  return RecursivelyCheckReferrer(&state.top);
 }
 
 bool PageState::Equals(const PageState& other) const {