Ignore the target attribute if the download attribute is present

BUG=823050 R=mkwst@chromium.org Change-Id: I50a6d1efb605c8eff538a0f157203812d0ba5f1b Reviewed-on: https://chromium-review.googlesource.com/970701Reviewed-by: Mike West <mkwst@chromium.org> Commit-Queue: Jochen Eisinger <jochen@chromium.org> Cr-Commit-Position: refs/heads/master@{#544449}

Ignore the target attribute if the download attribute is present
BUG=823050 R=mkwst@chromium.org Change-Id: I50a6d1efb605c8eff538a0f157203812d0ba5f1b Reviewed-on: https://chromium-review.googlesource.com/970701Reviewed-by: Mike West <mkwst@chromium.org> Commit-Queue: Jochen Eisinger <jochen@chromium.org> Cr-Commit-Position: refs/heads/master@{#544449}
23d03126 · Jochen Eisinger · Commit Bot · e0b331d6 · 23d03126 · 23d03126
Commit 23d03126 authored Mar 20, 2018 by Jochen Eisinger Committed by Commit Bot Mar 20, 2018
3 changed files
--- a/content/browser/download/download_browsertest.cc
+++ b/content/browser/download/download_browsertest.cc
@@ -2873,6 +2873,33 @@ IN_PROC_BROWSER_TEST_F(DownloadContentTest, DownloadAttributeDataUrl) {
  ASSERT_TRUE(server.ShutdownAndWaitUntilComplete());
 }

+// Test that the target attribute is ignored on anchors with a download
+// attribute.
+IN_PROC_BROWSER_TEST_F(DownloadContentTest,
+                       DownloadAttributeIgnoresTargetAttribute) {
+  net::EmbeddedTestServer server;
+  ASSERT_TRUE(server.InitializeAndListen());
+
+  GURL url = server.GetURL(std::string("/download-attribute-with-target.html"));
+  server.ServeFilesFromDirectory(GetTestFilePath("download", ""));
+  server.StartAcceptingConnections();
+
+  NavigateToURLAndWaitForDownload(shell(), url,
+                                  download::DownloadItem::COMPLETE);
+
+  std::vector<download::DownloadItem*> downloads;
+  DownloadManagerForShell(shell())->GetAllDownloads(&downloads);
+  ASSERT_EQ(1u, downloads.size());
+
+  // The target="_blank" should have been ignored, and so no additional window
+  // was created.
+  ASSERT_EQ(1u, Shell::windows().size());
+
+  EXPECT_EQ(FILE_PATH_LITERAL("suggested-filename"),
+            downloads[0]->GetTargetFilePath().BaseName().value());
+  ASSERT_TRUE(server.ShutdownAndWaitUntilComplete());
+}
+
 // A request for a non-existent resource should result in an aborted navigation,
 // and the old site staying current.
 IN_PROC_BROWSER_TEST_F(DownloadContentTest, DownloadAttributeServerError) {

--- a/content/test/data/download/download-attribute-with-target.html
+++ b/content/test/data/download/download-attribute-with-target.html
+<!doctype html>
+<html>
+<body>
+<a download="suggested-filename" href="data:application/octet-stream, ..." target="_blank">link</a>
+<script>
+  var anchorElement = document.querySelector('a[download]');
+  anchorElement.click();
+</script>
+</body>
+</html>
--- a/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
+++ b/third_party/WebKit/Source/core/html/HTMLAnchorElement.cpp
@@ -392,8 +392,9 @@ void HTMLAnchorElement::HandleClick(Event* event) {
        static_cast<String>(FastGetAttribute(downloadAttr)));
  }
  request.SetRequestContext(WebURLRequest::kRequestContextHyperlink);
-  FrameLoadRequest frame_request(&GetDocument(), request,
-                                 getAttribute(targetAttr));
+  FrameLoadRequest frame_request(
+      &GetDocument(), request,
+      hasAttribute(downloadAttr) ? g_null_atom : getAttribute(targetAttr));
  frame_request.SetTriggeringEvent(event);
  if (HasRel(kRelationNoReferrer)) {
    frame_request.SetShouldSendReferrer(kNeverSendReferrer);