Don't set FileURLLoaderFactory while loading bundled exchanges files

Loading local files from bundled exchanges file is prohibited. So no
need to set FileURLLoaderFactory while loading bundled exchanges files.

Bug: 995177
Change-Id: Ia3ce8a20d331be3a94cad89d3283e6b30b4975fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1847604
Commit-Queue: Tsuyoshi Horo <horo@chromium.org>
Reviewed-by: Kunihiko Sakamoto <ksakamoto@chromium.org>
Reviewed-by: Kinuko Yasuda <kinuko@chromium.org>
Cr-Commit-Position: refs/heads/master@{#704131}

content/browser/frame_host/render_frame_host_impl.cc

@@ -5233,8 +5233,11 @@ void RenderFrameHostImpl::CommitNavigation(
           bypass_redirect_checks);
     }
 
+    bool navigation_to_bundled_exchanges = false;
+
     if (bundled_exchanges_handle_ &&
         bundled_exchanges_handle_->IsReadyForLoading()) {
+      navigation_to_bundled_exchanges = true;
       mojo::Remote<network::mojom::URLLoaderFactory> fallback_factory(
           std::move(pending_default_factory));
       bundled_exchanges_handle_->CreateURLLoaderFactory(
@@ -5255,7 +5258,10 @@ void RenderFrameHostImpl::CommitNavigation(
     // Other URLs like about:srcdoc or about:blank might be able load files, but
     // only because they will inherit loaders from their parents instead of the
     // ones provided by the browser process here.
-    if (common_params->url.SchemeIsFile()) {
+    //
+    // For loading bundled exchanges files, we don't set FileURLLoaderFactory.
+    // Because loading local files from bundled exchanges file is prohibited.
+    if (common_params->url.SchemeIsFile() && !navigation_to_bundled_exchanges) {
       auto file_factory = std::make_unique<FileURLLoaderFactory>(
           browser_context->GetPath(),
           browser_context->GetSharedCorsOriginAccessList(),

content/browser/web_package/bundled_exchanges_browsertest.cc

@@ -487,6 +487,31 @@ IN_PROC_BROWSER_TEST_P(BundledExchangesFileBrowserTest,
             *finish_navigation_observer.error_code());
 }
 
+IN_PROC_BROWSER_TEST_P(BundledExchangesFileBrowserTest, NoLocalFileScheme) {
+  const GURL test_data_url =
+      GetTestUrlForFile(GetTestDataPath("bundled_exchanges_browsertest.wbn"));
+  NavigateToBundleAndWaitForReady(
+      test_data_url,
+      bundled_exchanges_utils::GetSynthesizedUrlForBundledExchanges(
+          test_data_url, GURL(kTestPageUrl)));
+
+  auto expected_title = base::ASCIIToUTF16("load failed");
+  TitleWatcher title_watcher(shell()->web_contents(), expected_title);
+  title_watcher.AlsoWaitForTitle(base::ASCIIToUTF16("Local Script"));
+
+  const GURL script_file_url =
+      net::FilePathToFileURL(GetTestDataPath("local_script.js"));
+  const std::string script = base::StringPrintf(R"(
+    const script = document.createElement("script");
+    script.onerror = () => { document.title = "load failed";};
+    script.src = "%s";
+    document.body.appendChild(script);)",
+                                                script_file_url.spec().c_str());
+  EXPECT_TRUE(ExecuteScript(shell()->web_contents(), script));
+
+  EXPECT_EQ(expected_title, title_watcher.WaitAndGetTitle());
+}
+
 INSTANTIATE_TEST_SUITE_P(BundledExchangesFileBrowserTest,
                          BundledExchangesFileBrowserTest,
                          testing::Values(TestFilePathMode::kNormalFilePath

content/test/data/bundled_exchanges/local_script.js

+// Copyright 2019 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+document.title = 'Local Script';