GitLab

The current lookalike check allows redirects from an IDN site to its non IDN
version if the redirect is to the root of the non-IDN domain. It disallows
any redirect chains longer than 2 URLs including the initial URL.

This is too strict and causes problems when the IDN domain first redirects to
another URL on the same site. As an example, this redirect is blocked:
http://québec[.]ca -> https://québec[.]ca -> https://quebec[.]ca

This CL relaxes the safe redirect check and allows redirect chains longer than 2
as long as the first IDN to non-IDN redirect happens to the root of the non-IDN
domain. In practice, two changes were made:

1. The initial IDN URL can now redirect to arbitrary URLs on the same domain an
   unlimited number of times. This is now OK:
   http://sub1[.]québec[.]ca/path1 -> http://sub2[.]québec[.]ca/path2 ->
   https://sub3[.]québec[.]ca/path3 -> http://quebec[.]ca

2. There can now be an unlimited number of redirects to arbitrary URLs after the
   first redirect from the IDN URL to the root of the non-IDN URL. This is now
   OK:
   http://québec[.]ca/path -> http://quebec[.]ca -> http://somerandomdomain[.]com

We don't necessarily need to implement (2) to fix bug 1015084, but there doesn't
seem to be a good reason to impose that artificial restriction either.

Bug: 1015084
Change-Id: Icc760cb171c7e314609e214b9ee8563e4f320014
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1881354Reviewed-by: Joe DeBlasio <jdeblasio@chromium.org>
Commit-Queue: Mustafa Emre Acer <meacer@chromium.org>
Auto-Submit: Mustafa Emre Acer <meacer@chromium.org>
Cr-Commit-Position: refs/heads/master@{#710535}