[iOS] Add lookalike_url_egtest and update comments

Bug: 1058898
Change-Id: I80883ee1258493eb0ac56950d654606c393ee65e
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2284144
Commit-Queue: Livvie Lin <livvielin@chromium.org>
Reviewed-by: Eugene But <eugenebut@chromium.org>
Cr-Commit-Position: refs/heads/master@{#788917}

ios/chrome/browser/web/BUILD.gn

@@ -347,6 +347,14 @@ source_set("unit_tests_internal") {
   ]
 }
 
+source_set("constants") {
+  configs += [ "//build/config/compiler:enable_arc" ]
+  sources = [
+    "lookalike_url_constants.h",
+    "lookalike_url_constants.mm",
+  ]
+}
+
 source_set("eg_test_support+eg2") {
   defines = [ "CHROME_EARL_GREY_2" ]
   configs += [
@@ -355,7 +363,10 @@ source_set("eg_test_support+eg2") {
   ]
   testonly = true
 
-  sources = [ "progress_indicator_app_interface.h" ]
+  sources = [
+    "lookalike_url_app_interface.h",
+    "progress_indicator_app_interface.h",
+  ]
 
   deps = [
     "//ios/chrome/test/earl_grey:eg_test_support+eg2",
@@ -372,15 +383,23 @@ source_set("eg_app_support+eg2") {
   defines = [ "CHROME_EARL_GREY_2" ]
 
   sources = [
+    "lookalike_url_app_interface.h",
+    "lookalike_url_app_interface.mm",
     "progress_indicator_app_interface.h",
     "progress_indicator_app_interface.mm",
   ]
 
   deps = [
+    ":constants",
     "//base",
+    "//components/lookalikes/core",
+    "//ios/chrome/test/app:test_support",
+    "//ios/components/security_interstitials/lookalikes",
     "//ios/testing/earl_grey:eg_app_support+eg2",
     "//ios/third_party/earl_grey2:app_framework+link",
     "//ios/third_party/material_components_ios",
+    "//ios/web/public",
+    "//net",
   ]
 }
 
@@ -402,6 +421,7 @@ source_set("eg2_tests") {
     "forms_egtest.mm",
     "http_auth_egtest.mm",
     "js_print_egtest.mm",
+    "lookalike_url_egtest.mm",
     "navigation_egtest.mm",
     "progress_indicator_egtest.mm",
     "push_and_replace_state_navigation_egtest.mm",
@@ -414,6 +434,7 @@ source_set("eg2_tests") {
   ]
 
   deps = [
+    ":constants",
     ":eg_test_support+eg2",
     "//components/content_settings/core/common",
     "//components/strings",

ios/chrome/browser/web/lookalike_url_app_interface.h

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CHROME_BROWSER_WEB_LOOKALIKE_URL_APP_INTERFACE_H_
+#define IOS_CHROME_BROWSER_WEB_LOOKALIKE_URL_APP_INTERFACE_H_
+
+#import <Foundation/Foundation.h>
+
+// The app interface for lookalike URL blocking page tests. It sets
+// up LookalikeUrlDecider, which does the following:
+//   - Lets a navigation proceed if the domain is explicitly allowed
+//   - Cancels the navigation and shows error page with a suggested URL
+//      for the /lookalike.html path
+//   - Cancels the navigation and shows error page with no suggested URL
+//      for the /lookalike-empty.html path
+//   - Allows other navigations to proceed
+@interface LookalikeUrlAppInterface : NSObject
+
+// Sets up lookalike policy decider. Used for testing.
++ (void)setUpLookalikeUrlDeciderForWebState;
+
+// Tear down lookalike policy decider. Used for testing.
++ (void)tearDownLookalikeUrlDeciderForWebState;
+
+@end
+
+#endif  // IOS_CHROME_BROWSER_WEB_LOOKALIKE_URL_APP_INTERFACE_H_

ios/chrome/browser/web/lookalike_url_app_interface.mm

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/chrome/browser/web/lookalike_url_app_interface.h"
+
+#include "components/lookalikes/core/lookalike_url_util.h"
+#import "ios/chrome/browser/web/lookalike_url_constants.h"
+#import "ios/chrome/test/app/chrome_test_util.h"
+#import "ios/chrome/test/app/tab_test_util.h"
+#include "ios/components/security_interstitials/lookalikes/lookalike_url_container.h"
+#include "ios/components/security_interstitials/lookalikes/lookalike_url_error.h"
+#include "ios/components/security_interstitials/lookalikes/lookalike_url_tab_allow_list.h"
+#import "ios/web/public/navigation/web_state_policy_decider.h"
+#import "ios/web/public/web_state_user_data.h"
+#import "net/base/mac/url_conversions.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+namespace {
+
+// This decider determines whether a URL is a lookalike. If so, it cancels
+// navigation and shows an error.
+class LookalikeUrlDecider : public web::WebStatePolicyDecider,
+                            public web::WebStateUserData<LookalikeUrlDecider> {
+ public:
+  LookalikeUrlDecider(web::WebState* web_state)
+      : web::WebStatePolicyDecider(web_state), web_state_(web_state) {}
+
+  void ShouldAllowResponse(
+      NSURLResponse* response,
+      bool for_main_frame,
+      web::WebStatePolicyDecider::PolicyDecisionCallback callback) override {
+    LookalikeUrlContainer* lookalike_container =
+        LookalikeUrlContainer::FromWebState(web_state_);
+    LookalikeUrlTabAllowList* allow_list =
+        LookalikeUrlTabAllowList::FromWebState(web_state_);
+
+    GURL response_url = net::GURLWithNSURL(response.URL);
+    if (allow_list->IsDomainAllowed(response_url.host())) {
+      return std::move(callback).Run(
+          web::WebStatePolicyDecider::PolicyDecision::Allow());
+    }
+    if (response_url.path() == kLookalikePagePathForTesting) {
+      GURL::Replacements safeReplacements;
+      safeReplacements.SetPathStr("echo");
+      lookalike_container->SetLookalikeUrlInfo(
+          response_url.ReplaceComponents(safeReplacements), response_url,
+          LookalikeUrlMatchType::kSkeletonMatchTop5k);
+      std::move(callback).Run(CreateLookalikeErrorDecision());
+      return;
+    }
+    if (response_url.path() == kLookalikePageEmptyUrlPathForTesting) {
+      lookalike_container->SetLookalikeUrlInfo(
+          GURL::EmptyGURL(), response_url,
+          LookalikeUrlMatchType::kSkeletonMatchTop5k);
+      std::move(callback).Run(CreateLookalikeErrorDecision());
+      return;
+    }
+    return std::move(callback).Run(
+        web::WebStatePolicyDecider::PolicyDecision::Allow());
+  }
+
+  WEB_STATE_USER_DATA_KEY_DECL();
+
+ private:
+  web::WebState* web_state_ = nullptr;
+
+  DISALLOW_COPY_AND_ASSIGN(LookalikeUrlDecider);
+};
+
+WEB_STATE_USER_DATA_KEY_IMPL(LookalikeUrlDecider)
+
+}  // namespace
+
+@implementation LookalikeUrlAppInterface
+
++ (void)setUpLookalikeUrlDeciderForWebState {
+  LookalikeUrlDecider::CreateForWebState(
+      chrome_test_util::GetCurrentWebState());
+}
+
++ (void)tearDownLookalikeUrlDeciderForWebState {
+  LookalikeUrlDecider::RemoveFromWebState(
+      chrome_test_util::GetCurrentWebState());
+}
+
+@end

ios/chrome/browser/web/lookalike_url_constants.h

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef IOS_CHROME_BROWSER_WEB_LOOKALIKE_URL_CONSTANTS_H_
+#define IOS_CHROME_BROWSER_WEB_LOOKALIKE_URL_CONSTANTS_H_
+
+// Constant used for testing a lookalike URL interstitial.
+extern const char kLookalikePagePathForTesting[];
+
+// Constant used for testing a lookalike URL interstitial with no suggested URL.
+extern const char kLookalikePageEmptyUrlPathForTesting[];
+
+#endif  // IOS_CHROME_BROWSER_WEB_LOOKALIKE_URL_CONSTANTS_H_

ios/chrome/browser/web/lookalike_url_constants.mm

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#import "ios/chrome/browser/web/lookalike_url_constants.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+const char kLookalikePagePathForTesting[] = "/lookalike.html";
+const char kLookalikePageEmptyUrlPathForTesting[] = "/lookalike-empty.html";

ios/chrome/browser/web/lookalike_url_egtest.mm

+// Copyright 2020 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include <string>
+
+#include "base/bind.h"
+#include "base/strings/stringprintf.h"
+#include "components/strings/grit/components_strings.h"
+#import "ios/chrome/browser/web/lookalike_url_app_interface.h"
+#import "ios/chrome/browser/web/lookalike_url_constants.h"
+#import "ios/chrome/test/earl_grey/chrome_earl_grey.h"
+#import "ios/chrome/test/earl_grey/chrome_matchers.h"
+#import "ios/chrome/test/earl_grey/chrome_test_case.h"
+#import "ios/testing/earl_grey/earl_grey_test.h"
+#include "ios/testing/embedded_test_server_handlers.h"
+#include "ios/web/common/features.h"
+#include "ios/web/public/test/element_selector.h"
+#include "net/test/embedded_test_server/default_handlers.h"
+#include "net/test/embedded_test_server/http_request.h"
+#include "net/test/embedded_test_server/http_response.h"
+#include "net/test/embedded_test_server/request_handler_util.h"
+#include "ui/base/l10n/l10n_util.h"
+
+#if !defined(__has_feature) || !__has_feature(objc_arc)
+#error "This file requires ARC support."
+#endif
+
+#if defined(CHROME_EARL_GREY_2)
+#pragma clang diagnostic push
+#pragma clang diagnostic ignored "-Wc++98-compat-extra-semi"
+GREY_STUB_CLASS_IN_APP_MAIN_QUEUE(LookalikeUrlAppInterface);
+#pragma clang diagnostic pop
+#endif  // defined(CHROME_EARL_GREY_2)
+
+using chrome_test_util::BackButton;
+using chrome_test_util::ForwardButton;
+
+namespace {
+// Relative paths used for a page that opens a lookalike in a new tab.
+const char kLookalikeInNewTab[] = "/lookalike-newtab.html";
+
+// Text that is found on the lookalike page.
+const char kLookalikeContent[] = "Lookalike - Safety warning bypassed";
+// Text that is found on a page that opens a lookalike in a new tab.
+const char kLookalikeInNewTabContent[] = "New tab";
+}  // namespace
+
+// Tests lookalike URL blocking.
+@interface LookalikeUrlTestCase : ChromeTestCase {
+  // A URL that is treated as a lookalike.
+  GURL _lookalikeURL;
+  // A URL that is treated as a safe page.
+  GURL _safeURL;
+  // Text that is found on the safe page.
+  std::string _safeContent;
+  // Text that is found on the lookalike interstitial.
+  std::string _lookalikeBlockingPageContent;
+}
+@end
+
+@implementation LookalikeUrlTestCase
+
+- (AppLaunchConfiguration)appConfigurationForTestCase {
+  AppLaunchConfiguration config;
+  config.features_enabled.push_back(
+      web::features::kIOSLookalikeUrlNavigationSuggestionsUI);
+  config.features_enabled.push_back(web::features::kSSLCommittedInterstitials);
+  config.relaunch_policy = NoForceRelaunchAndResetState;
+  return config;
+}
+
+- (void)setUp {
+  [super setUp];
+  [LookalikeUrlAppInterface setUpLookalikeUrlDeciderForWebState];
+  std::string lookalikeHTML =
+      base::StringPrintf("<html><body>%s</body></html>", kLookalikeContent);
+  self.testServer->RegisterRequestHandler(base::BindRepeating(
+      &net::test_server::HandlePrefixedRequest, kLookalikePagePathForTesting,
+      base::BindRepeating(&testing::HandlePageWithHtml, lookalikeHTML)));
+  self.testServer->RegisterRequestHandler(base::BindRepeating(
+      &net::test_server::HandlePrefixedRequest,
+      kLookalikePageEmptyUrlPathForTesting,
+      base::BindRepeating(&testing::HandlePageWithHtml, lookalikeHTML)));
+  std::string lookalikeNewTabHTML = base::StringPrintf(
+      "<html><body><a target=\"_blank\" href=\"%s\" "
+      "id=\"lookalike-newtab\">%s</a></body></html>",
+      kLookalikePageEmptyUrlPathForTesting, kLookalikeInNewTabContent);
+  self.testServer->RegisterRequestHandler(base::BindRepeating(
+      &net::test_server::HandlePrefixedRequest, kLookalikeInNewTab,
+      base::BindRepeating(&testing::HandlePageWithHtml, lookalikeNewTabHTML)));
+  GREYAssertTrue(self.testServer->Start(), @"Test server failed to start.");
+  _safeURL = self.testServer->GetURL("/echo");
+  _safeContent = "Echo";
+  _lookalikeURL = self.testServer->GetURL(kLookalikePagePathForTesting);
+  _lookalikeBlockingPageContent =
+      l10n_util::GetStringUTF8(IDS_LOOKALIKE_URL_PRIMARY_PARAGRAPH);
+}
+
+- (void)tearDown {
+  [LookalikeUrlAppInterface tearDownLookalikeUrlDeciderForWebState];
+  [super tearDown];
+}
+
+// Tests that non-lookalike URLs are not blocked.
+- (void)testSafePage {
+  [ChromeEarlGrey loadURL:_safeURL];
+  [ChromeEarlGrey waitForWebStateContainingText:_safeContent];
+}
+
+// Tests that a lookalike URL navigation is blocked, and the Go to suggested
+// site button works. Also tests that navigating back to the site shows the
+// interstitial and that navigating forward again works.
+- (void)testLookalikeUrlPage {
+  // Load the lookalike page and verify a warning is shown.
+  [ChromeEarlGrey loadURL:_lookalikeURL];
+  [ChromeEarlGrey waitForWebStateContainingText:_lookalikeBlockingPageContent];
+
+  // Tap on the "Go to" button and verify that the suggested page
+  // contents are loaded.
+  [ChromeEarlGrey tapWebStateElementWithID:@"primary-button"];
+  [ChromeEarlGrey waitForWebStateContainingText:_safeContent];
+
+  // Verify that the warning is shown when navigating back and that safe
+  // content is shown when navigating forward again.
+  [[EarlGrey selectElementWithMatcher:BackButton()] performAction:grey_tap()];
+  [ChromeEarlGrey waitForWebStateContainingText:_lookalikeBlockingPageContent];
+  [[EarlGrey selectElementWithMatcher:ForwardButton()]
+      performAction:grey_tap()];
+  [ChromeEarlGrey waitForWebStateContainingText:_safeContent];
+}
+
+// Tests that a lookalike URL navigation is blocked, and the text link for
+// suggested site works. Also tests that navigating back to the site shows
+// the interstitial and that navigating forward again works.
+- (void)testLookalikeUrlPageSiteLink {
+  // Load the lookalike page and verify a warning is shown.
+  [ChromeEarlGrey loadURL:_lookalikeURL];
+  [ChromeEarlGrey waitForWebStateContainingText:_lookalikeBlockingPageContent];
+
+  // Tap on the site suggestion link and verify that the suggested page
+  // contents are loaded.
+  [ChromeEarlGrey tapWebStateElementWithID:@"dont-proceed-link"];
+  [ChromeEarlGrey waitForWebStateContainingText:_safeContent];
+
+  // Verify that the warning is shown when navigating back and that safe
+  // content is shown when navigating forward again.
+  [[EarlGrey selectElementWithMatcher:BackButton()] performAction:grey_tap()];
+  [ChromeEarlGrey waitForWebStateContainingText:_lookalikeBlockingPageContent];
+  [[EarlGrey selectElementWithMatcher:ForwardButton()]
+      performAction:grey_tap()];
+  [ChromeEarlGrey waitForWebStateContainingText:_safeContent];
+}
+
+// Tests that Back to safety works when there is no suggested URL. Also tests
+// that navigating forward to the site shows the interstitial and that
+// navigating back again works.
+- (void)testLookalikeUrlPageNoSuggestion {
+  // Navigate to safe page first to enable later verification of
+  // back/forward navigation.
+  [ChromeEarlGrey loadURL:_safeURL];
+  [ChromeEarlGrey waitForWebStateContainingText:_safeContent];
+
+  // Navigate to a lookalike page with no suggestion and verify that a warning
+  // and the correct button is shown.
+  [ChromeEarlGrey
+      loadURL:self.testServer->GetURL(kLookalikePageEmptyUrlPathForTesting)];
+  [ChromeEarlGrey waitForWebStateContainingText:_lookalikeBlockingPageContent];
+  [ChromeEarlGrey
+      waitForWebStateContainingText:l10n_util::GetStringUTF8(
+                                        IDS_LOOKALIKE_URL_BACK_TO_SAFETY)];
+
+  // Tap on the "Back to safety" button and verify that the safe content
+  // is loaded.
+  [ChromeEarlGrey tapWebStateElementWithID:@"primary-button"];
+  [ChromeEarlGrey waitForWebStateContainingText:_safeContent];
+
+  // Verify that the warning is shown when navigating forward and that safe
+  // content is shown when navigating back again.
+  [[EarlGrey selectElementWithMatcher:ForwardButton()]
+      performAction:grey_tap()];
+  [ChromeEarlGrey waitForWebStateContainingText:_lookalikeBlockingPageContent];
+  [[EarlGrey selectElementWithMatcher:BackButton()] performAction:grey_tap()];
+  [ChromeEarlGrey waitForWebStateContainingText:_safeContent];
+}
+
+// Tests that Close page works when there is no suggested URL and unable
+// to go back.
+- (void)testLookalikeUrlPageNoSuggestionClosePage {
+  // First navigate to a page that will open the lookalike URL in a new tab,
+  // then open the lookalike page.
+  [ChromeEarlGrey loadURL:self.testServer->GetURL(kLookalikeInNewTab)];
+  [ChromeEarlGrey tapWebStateElementWithID:@"lookalike-newtab"];
+
+  // Verify that the new tab has loaded before setting up the policy decider
+  // for the new web state. Then reload to make sure the interstitial is
+  // displayed.
+  [ChromeEarlGrey waitForWebStateContainingText:kLookalikeContent];
+  [LookalikeUrlAppInterface setUpLookalikeUrlDeciderForWebState];
+  [ChromeEarlGrey reload];
+
+  // Verify that a warning and the correct button is shown.
+  [ChromeEarlGrey waitForWebStateContainingText:_lookalikeBlockingPageContent];
+  [ChromeEarlGrey
+      waitForWebStateContainingText:l10n_util::GetStringUTF8(
+                                        IDS_LOOKALIKE_URL_CLOSE_PAGE)];
+
+  // Tap on the "Close" button and verify that the page closes.
+  [ChromeEarlGrey tapWebStateElementWithID:@"primary-button"];
+  [ChromeEarlGrey waitForWebStateContainingText:kLookalikeInNewTabContent];
+}
+
+// Tests proceeding past the lookalike warning and that opening the page in
+// a new tab will bypass the warning.
+- (void)testProceedingPastLookalikeUrlWarning {
+  // Load the lookalike page and verify a warning is shown.
+  [ChromeEarlGrey loadURL:_lookalikeURL];
+  [ChromeEarlGrey waitForWebStateContainingText:_lookalikeBlockingPageContent];
+
+  // Tap on the link to ignore the warning, and verify that the page is loaded.
+  [ChromeEarlGrey tapWebStateElementWithID:@"proceed-button"];
+  [ChromeEarlGrey waitForWebStateContainingText:kLookalikeContent];
+
+  // In a new tab, the warning should not be shown.
+  [ChromeEarlGrey openNewTab];
+  [ChromeEarlGrey loadURL:_lookalikeURL];
+  [ChromeEarlGrey waitForWebStateContainingText:kLookalikeContent];
+}
+
+// Tests displaying a warning for an lookalike URL, proceeding past the warning,
+// and navigating back/forward, in incognito.
+- (void)testProceedingPastLookalikeWarningInIncognito {
+  [ChromeEarlGrey openNewIncognitoTab];
+  [LookalikeUrlAppInterface setUpLookalikeUrlDeciderForWebState];
+
+  // Navigate to safe page first to enable later verification of
+  // back/forward navigation.
+  [ChromeEarlGrey loadURL:_safeURL];
+  [ChromeEarlGrey waitForWebStateContainingText:_safeContent];
+
+  // Load the lookalike page and verify a warning is shown.
+  [ChromeEarlGrey loadURL:_lookalikeURL];
+  [ChromeEarlGrey waitForWebStateContainingText:_lookalikeBlockingPageContent];
+
+  // Tap on the link to ignore the warning, and verify that the page is loaded.
+  [ChromeEarlGrey tapWebStateElementWithID:@"proceed-button"];
+  [ChromeEarlGrey waitForWebStateContainingText:kLookalikeContent];
+
+  // Verify that no warning is shown when navigating back and then forward to
+  // the unsafe page.
+  [[EarlGrey selectElementWithMatcher:BackButton()] performAction:grey_tap()];
+  [ChromeEarlGrey waitForWebStateContainingText:_safeContent];
+  [[EarlGrey selectElementWithMatcher:ForwardButton()]
+      performAction:grey_tap()];
+  [ChromeEarlGrey waitForWebStateContainingText:kLookalikeContent];
+}
+
+// Tests that performing session restoration to a lookalike URL warning page
+// preserves navigation history.
+- (void)testRestoreToWarningPagePreservesHistory {
+  // Build up navigation history that consists of a safe URL, a warning page,
+  // and the suggested safe URL.
+  [ChromeEarlGrey loadURL:self.testServer->GetURL("/echoall")];
+  std::string safeContent2 = "Request Body";
+  [ChromeEarlGrey waitForWebStateContainingText:safeContent2];
+
+  // Load the lookalike URL page and verify a warning is shown.
+  [ChromeEarlGrey loadURL:_lookalikeURL];
+  [ChromeEarlGrey waitForWebStateContainingText:_lookalikeBlockingPageContent];
+
+  // Tap on the "Go to" button and verify that the suggested page contents
+  // are loaded.
+  [ChromeEarlGrey tapWebStateElementWithID:@"primary-button"];
+  [ChromeEarlGrey waitForWebStateContainingText:_safeContent];
+
+  // Navigate back to the interstitial. Now both the back list and the forward
+  // list are non-empty.
+  [ChromeEarlGrey goBack];
+  [ChromeEarlGrey waitForWebStateContainingText:_lookalikeBlockingPageContent];
+
+  // Do a session restoration and verify that all navigation history is
+  // preserved. For this test, the policy decider doesn't get installed for
+  // the first page load, so expect the page content instead of the warning.
+  [ChromeEarlGrey triggerRestoreViaTabGridRemoveAllUndo];
+  [ChromeEarlGrey waitForWebStateContainingText:kLookalikeContent];
+  [LookalikeUrlAppInterface setUpLookalikeUrlDeciderForWebState];
+
+  [ChromeEarlGrey goBack];
+  [ChromeEarlGrey waitForWebStateContainingText:safeContent2];
+
+  // The policy decider will trigger at this point, so the warning should
+  // be shown.
+  [ChromeEarlGrey goForward];
+  [ChromeEarlGrey waitForWebStateContainingText:_lookalikeBlockingPageContent];
+
+  [ChromeEarlGrey goForward];
+  [ChromeEarlGrey waitForWebStateContainingText:_safeContent];
+}
+
+@end

ios/components/security_interstitials/lookalikes/lookalike_url_controller_client.mm

@@ -46,9 +46,10 @@ void LookalikeUrlControllerClient::GoBack() {
   if (!safe_url_.is_valid()) {
     IOSBlockingPageControllerClient::GoBack();
   } else {
-    // TODO(crbug.com/1058898): Replace the last committed navigation
-    // (the interstitial) with the safe URL navigation to prevent the
-    // back button from returning to the bad site.
+    // For simplicity and because replacement doesn't always work, the
+    // navigation to the safe URL does not replace the navigation to
+    // the interstitial. However, this is acceptable since if a user
+    // navigates back to the lookalike, the interstitial will be shown.
     OpenUrlInCurrentTab(safe_url_);
   }
 }

ios/components/security_interstitials/lookalikes/lookalike_url_error.h

@@ -7,10 +7,16 @@
 
 #import <Foundation/Foundation.h>
 
+#import "ios/web/public/navigation/web_state_policy_decider.h"
+
 // The error domain for lookalike URL errors.
 extern const NSErrorDomain kLookalikeUrlErrorDomain;
 
 // Error code for navigations to lookalike URLs.
 extern const NSInteger kLookalikeUrlErrorCode;
 
+// Creates a PolicyDecision that cancels a navigation to show a lookalike
+// error.
+web::WebStatePolicyDecider::PolicyDecision CreateLookalikeErrorDecision();
+
 #endif  // IOS_COMPONENTS_SECURITY_INTERSTITIALS_LOOKALIKES_LOOKALIKE_URL_ERROR_H_

ios/components/security_interstitials/lookalikes/lookalike_url_error.mm

@@ -11,3 +11,10 @@
 const NSErrorDomain kLookalikeUrlErrorDomain =
     @"com.google.chrome.lookalike_url";
 const NSInteger kLookalikeUrlErrorCode = -1003;
+
+web::WebStatePolicyDecider::PolicyDecision CreateLookalikeErrorDecision() {
+  return web::WebStatePolicyDecider::PolicyDecision::CancelAndDisplayError(
+      [NSError errorWithDomain:kLookalikeUrlErrorDomain
+                          code:kLookalikeUrlErrorCode
+                      userInfo:nil]);
+}

ios/components/security_interstitials/lookalikes/lookalike_url_tab_helper.mm

@@ -19,15 +19,6 @@
 #endif
 
 namespace {
-// Creates a PolicyDecision that cancels a navigation to show a lookalike
-// error.
-web::WebStatePolicyDecider::PolicyDecision CreateLookalikeErrorDecision() {
-  return web::WebStatePolicyDecider::PolicyDecision::CancelAndDisplayError(
-      [NSError errorWithDomain:kLookalikeUrlErrorDomain
-                          code:kLookalikeUrlErrorCode
-                      userInfo:nil]);
-}
-
 // Creates a PolicyDecision that allows the navigation.
 web::WebStatePolicyDecider::PolicyDecision CreateAllowDecision() {
   return web::WebStatePolicyDecider::PolicyDecision::Allow();
@@ -50,7 +41,7 @@ void LookalikeUrlTabHelper::ShouldAllowResponse(
     return;
   }
 
-  // TODO(crbug.com/1058898): Create container and ReleaseInterstitialParams.
+  // TODO(crbug.com/1104386): Create container and ReleaseInterstitialParams.
   // Get stored interstitial parameters early. Doing so ensures that a
   // navigation to an irrelevant (for this interstitial's purposes) URL such as
   // chrome://settings while the lookalike interstitial is being shown clears
@@ -78,7 +69,7 @@ void LookalikeUrlTabHelper::ShouldAllowResponse(
     return;
   }
 
-  // TODO(crbug.com/1058898): If this is a reload and if the current
+  // TODO(crbug.com/1104386): If this is a reload and if the current
   // URL is the last URL of the stored redirect chain, the interstitial
   // was probably reloaded. Stop the reload and navigate back to the
   // original lookalike URL so that the full checks are exercised again.
@@ -91,7 +82,7 @@ void LookalikeUrlTabHelper::ShouldAllowResponse(
     return;
   }
 
-  // TODO(crbug.com/1058898): After site engagement has been componentized,
+  // TODO(crbug.com/1104384): After site engagement has been componentized,
   // fetch and set |engaged_sites| here so that an interstitial won't be
   // shown on engaged sites, and so that the interstitial will be shown on
   // lookalikes of engaged sites.