Move logic out of CRWWebDelegate ShouldOpenURL in tab.mm

Move the logic from shouldOpenURL in tab.mm to ShouldOpenURL in crw_web_controller.mm
ShouldOpenURL method should be entirley removed from tab.mm and preload_controller.mm
once crbug.com/546402 is addressed.

Bug: 850760
Cq-Include-Trybots: luci.chromium.try:ios-simulator-full-configs;master.tryserver.chromium.mac:ios-simulator-cronet
Change-Id: Ia7f017942c2095e9ed12e58fe3a790aa53551d35
Reviewed-on: https://chromium-review.googlesource.com/1112646Reviewed-by: Eugene But <eugenebut@chromium.org>
Commit-Queue: Mohammad Refaat <mrefaat@chromium.org>
Cr-Commit-Position: refs/heads/master@{#571044}

ios/chrome/browser/tabs/tab.mm

@@ -500,16 +500,8 @@ NSString* const kTabUrlKey = @"url";
 - (BOOL)webController:(CRWWebController*)webController
         shouldOpenURL:(const GURL&)url
       mainDocumentURL:(const GURL&)mainDocumentURL {
-  // chrome:// URLs are only allowed if the mainDocumentURL is also a chrome://
-  // URL.
-  if (url.SchemeIs(kChromeUIScheme) &&
-      !mainDocumentURL.SchemeIs(kChromeUIScheme)) {
-    return NO;
-  }
-
   // Always allow frame loads.
-  BOOL isFrameLoad = (url != mainDocumentURL);
-  if (isFrameLoad)
+  if (url != mainDocumentURL)
     return YES;
 
   // TODO(crbug.com/546402): If this turns out to be useful, find a less hacky

ios/web/test/fakes/BUILD.gn

@@ -20,6 +20,8 @@ source_set("fakes") {
     "crw_fake_back_forward_list.mm",
     "crw_fake_nsurl_session_task.h",
     "crw_fake_nsurl_session_task.mm",
+    "crw_fake_wk_navigation_action.h",
+    "crw_fake_wk_navigation_action.mm",
     "crw_fake_wk_navigation_response.h",
     "crw_fake_wk_navigation_response.mm",
     "fake_navigation_manager_delegate.h",

ios/web/test/fakes/crw_fake_wk_navigation_action.h

+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_WEB_TEST_FAKES_CRW_FAKE_WK_NAVIGATION_ACTION_H_
+#define IOS_WEB_TEST_FAKES_CRW_FAKE_WK_NAVIGATION_ACTION_H_
+
+#import <WebKit/WebKit.h>
+
+// Fake WKNavigationAction class which can be used for testing.
+@interface CRWFakeWKNavigationAction : WKNavigationAction
+// Redefined WKNavigationAction properties as readwrite.
+@property(nullable, nonatomic, copy) WKFrameInfo* sourceFrame;
+@property(nullable, nonatomic, copy) WKFrameInfo* targetFrame;
+@property(nonatomic) WKNavigationType navigationType;
+@property(nullable, nonatomic, copy) NSURLRequest* request;
+@end
+
+#endif  // IOS_WEB_TEST_FAKES_CRW_FAKE_WK_NAVIGATION_ACTION_H_

ios/web/test/fakes/crw_fake_wk_navigation_action.mm

+// Copyright 2018 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/web/test/fakes/crw_fake_wk_navigation_action.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+@implementation CRWFakeWKNavigationAction
+@synthesize sourceFrame = _sourceFrame;
+@synthesize targetFrame = _targetFrame;
+@synthesize navigationType = _navigationType;
+@synthesize request = _request;
+@end

ios/web/web_state/ui/crw_web_controller.mm

@@ -3674,6 +3674,18 @@ registerLoadRequestForURL:(const GURL&)requestURL
 
 - (BOOL)shouldOpenURL:(const GURL&)url
       mainDocumentURL:(const GURL&)mainDocumentURL {
+  // App specific pages have elevated privileges and WKWebView uses the same
+  // renderer process for all page frames. With that Chromium does not allow
+  // running App specific pages in the same process as a web site from the
+  // internet.
+  if (web::GetWebClient()->IsAppSpecificURL(url) &&
+      !web::GetWebClient()->IsAppSpecificURL(mainDocumentURL)) {
+    return NO;
+  }
+
+  // TODO(crbug.com/546402): Remove the call to CRWWebDelegate's method once
+  // kTabUrlMayStartLoadingNotificationForCrashReporting is reported from
+  // different place.
   if (![_delegate respondsToSelector:@selector
                   (webController:shouldOpenURL:mainDocumentURL:)]) {
     return YES;

ios/web/web_state/ui/crw_web_controller_unittest.mm

@@ -40,6 +40,7 @@
 #include "ios/web/public/web_state/url_verification_constants.h"
 #include "ios/web/public/web_state/web_state_observer.h"
 #import "ios/web/test/fakes/crw_fake_back_forward_list.h"
+#import "ios/web/test/fakes/crw_fake_wk_navigation_action.h"
 #import "ios/web/test/fakes/crw_fake_wk_navigation_response.h"
 #include "ios/web/test/test_url_constants.h"
 #import "ios/web/test/web_test_with_web_controller.h"
@@ -562,7 +563,8 @@ class CRWWebControllerDownloadTest : public CRWWebControllerTest {
     navigation_response.response = response;
     navigation_response.forMainFrame = for_main_frame;
 
-    // Wait for decidePolicyForNavigationResponse: callback.
+    // Call decidePolicyForNavigationResponse and wait for decisionHandler's
+    // callback.
     __block bool callback_called = false;
     if (for_main_frame) {
       // webView:didStartProvisionalNavigation: is not called for iframes.
@@ -751,6 +753,75 @@ TEST_F(CRWWebControllerTest, AbortNativeUrlNavigation) {
   EXPECT_FALSE(observer.did_finish_navigation_info());
 }
 
+// Test fixture to test decidePolicyForNavigationAction:decisionHandler:
+// decisionHandler's callback result.
+class CRWWebControllerPolicyDeciderTest : public CRWWebControllerTest {
+ protected:
+  void SetUp() override {
+    CRWWebControllerTest::SetUp();
+    mock_delegate_ = OCMProtocolMock(@protocol(CRWWebDelegate));
+    GURL test_gurl;
+    [[[[static_cast<id>(mock_delegate_) stub] ignoringNonObjectArgs]
+        andReturnBool:YES] webController:[OCMArg any]
+                           shouldOpenURL:test_gurl
+                         mainDocumentURL:test_gurl];
+    [web_controller() setDelegate:mock_delegate_];
+  }
+  // Calls webView:decidePolicyForNavigationAction:decisionHandler: callback
+  // and waits for decision handler call. Returns false if decision handler
+  // policy parameter didn't match |expected_policy| or if the call timed out.
+  bool VerifyDecidePolicyForNavigationAction(
+      NSURLRequest* request,
+      WKNavigationActionPolicy expected_policy) WARN_UNUSED_RESULT {
+    CRWFakeWKNavigationAction* navigation_action =
+        [[CRWFakeWKNavigationAction alloc] init];
+    navigation_action.request = request;
+
+    // Call decidePolicyForNavigationResponse and wait for decisionHandler's
+    // callback.
+    __block bool policy_match = false;
+    __block bool callback_called = false;
+    [navigation_delegate_ webView:mock_web_view_
+        decidePolicyForNavigationAction:navigation_action
+                        decisionHandler:^(WKNavigationActionPolicy policy) {
+                          policy_match = expected_policy == policy;
+                          callback_called = true;
+                        }];
+    callback_called = WaitUntilConditionOrTimeout(kWaitForPageLoadTimeout, ^{
+      return callback_called;
+    });
+    return policy_match;
+  }
+
+  id<CRWWebDelegate> mock_delegate_;
+};
+
+// Tests that App specific URLs in iframes are allowed if the main frame is App
+// specific URL. App specific pages have elevated privileges and WKWebView uses
+// the same renderer process for all page frames. With that running App specific
+// pages are not allowed in the same process as a web site from the internet.
+TEST_F(CRWWebControllerPolicyDeciderTest,
+       AllowAppSpecificIFrameFromAppSpecificPage) {
+  NSURL* app_url = [NSURL URLWithString:@(kTestAppSpecificURL)];
+  NSMutableURLRequest* app_url_request =
+      [NSMutableURLRequest requestWithURL:app_url];
+  app_url_request.mainDocumentURL = app_url;
+  EXPECT_TRUE(VerifyDecidePolicyForNavigationAction(
+      app_url_request, WKNavigationActionPolicyAllow));
+}
+
+// Tests that App specific URLs in iframes are not allowed if the main frame is
+// not App specific URL.
+TEST_F(CRWWebControllerPolicyDeciderTest,
+       DisallowAppSpecificIFrameFromRegularPage) {
+  NSURL* app_url = [NSURL URLWithString:@(kTestAppSpecificURL)];
+  NSMutableURLRequest* app_url_request =
+      [NSMutableURLRequest requestWithURL:app_url];
+  app_url_request.mainDocumentURL = [NSURL URLWithString:@(kTestURLString)];
+  EXPECT_TRUE(VerifyDecidePolicyForNavigationAction(
+      app_url_request, WKNavigationActionPolicyCancel));
+}
+
 // Test fixture for testing CRWWebController presenting native content.
 class CRWWebControllerNativeContentTest : public WebTestWithWebController {
  protected: