[Security] Add a cross origin redirect test for crossOriginIsolated

This test verifies that the candidate SiteInstance is not used for a
cross origin redirect, that would lead to have a SiteInstance hosting
a crossOriginIsolated page with an incorrect top level origin as
initially registered.

Bug: 1107814
Change-Id: If52fef13528ca8d2f8dcf8af04b6510462072f43
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2396379
Commit-Queue: Arthur Hemery <ahemery@chromium.org>
Reviewed-by: Arthur Sonzogni <arthursonzogni@chromium.org>
Cr-Commit-Position: refs/heads/master@{#804894}

content/browser/cross_origin_opener_policy_browsertest.cc

@@ -18,8 +18,12 @@
 #include "content/shell/browser/shell.h"
 #include "content/test/content_browser_test_utils_internal.h"
 #include "content/test/render_document_feature.h"
+#include "net/base/escape.h"
 #include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/default_handlers.h"
+#include "net/test/embedded_test_server/http_request.h"
+#include "net/test/embedded_test_server/http_response.h"
+#include "net/test/embedded_test_server/request_handler_util.h"
 #include "services/network/public/cpp/cross_origin_opener_policy.h"
 #include "services/network/public/cpp/features.h"
 #include "testing/gmock/include/gmock/gmock.h"
@@ -56,6 +60,24 @@ network::CrossOriginOpenerPolicy CoopUnsafeNone() {
   return coop;
 }
 
+std::unique_ptr<net::test_server::HttpResponse>
+CrossOriginIsolatedCrossOriginRedirectHandler(
+    const net::test_server::HttpRequest& request) {
+  GURL request_url = request.GetURL();
+  std::string dest =
+      base::UnescapeBinaryURLComponent(request_url.query_piece());
+  net::test_server::RequestQuery query =
+      net::test_server::ParseQuery(request_url);
+
+  auto http_response = std::make_unique<net::test_server::BasicHttpResponse>();
+  http_response->set_code(net::HttpStatusCode::HTTP_FOUND);
+  http_response->AddCustomHeader("Location", dest);
+  http_response->AddCustomHeader("Cross-Origin-Opener-Policy", "same-origin");
+  http_response->AddCustomHeader("Cross-Origin-Embedder-Policy",
+                                 "require-corp");
+  return http_response;
+}
+
 class CrossOriginOpenerPolicyBrowserTest
     : public ContentBrowserTest,
       public ::testing::WithParamInterface<std::tuple<std::string, bool>> {
@@ -96,6 +118,11 @@ class CrossOriginOpenerPolicyBrowserTest
     https_server()->ServeFilesFromSourceDirectory(GetTestDataFilePath());
     SetupCrossSiteRedirector(https_server());
     net::test_server::RegisterDefaultHandlers(&https_server_);
+    https_server_.RegisterDefaultHandler(base::BindRepeating(
+        &net::test_server::HandlePrefixedRequest,
+        "/redirect-with-coop-coep-headers",
+        base::BindRepeating(CrossOriginIsolatedCrossOriginRedirectHandler)));
+
     ASSERT_TRUE(https_server()->Start());
   }
 
@@ -2315,6 +2342,31 @@ IN_PROC_BROWSER_TEST_P(CrossOriginOpenerPolicyBrowserTest,
   }
 }
 
+IN_PROC_BROWSER_TEST_P(CrossOriginOpenerPolicyBrowserTest,
+                       CrossOriginRedirectHasProperCrossOriginIsolatedState) {
+  GURL non_isolated_page(
+      embedded_test_server()->GetURL("a.com", "/title1.html"));
+
+  GURL isolated_page(
+      https_server()->GetURL("c.com",
+                             "/set-header?"
+                             "Cross-Origin-Opener-Policy: same-origin&"
+                             "Cross-Origin-Embedder-Policy: require-corp"));
+
+  GURL redirect_isolated_page(https_server()->GetURL(
+      "b.com", "/redirect-with-coop-coep-headers?" + isolated_page.spec()));
+
+  EXPECT_TRUE(NavigateToURL(shell(), non_isolated_page));
+  SiteInstanceImpl* current_si = current_frame_host()->GetSiteInstance();
+  EXPECT_FALSE(current_si->IsCoopCoepCrossOriginIsolated());
+
+  EXPECT_TRUE(NavigateToURL(shell(), redirect_isolated_page, isolated_page));
+  current_si = current_frame_host()->GetSiteInstance();
+  EXPECT_TRUE(current_si->IsCoopCoepCrossOriginIsolated());
+  EXPECT_TRUE(current_si->CoopCoepCrossOriginIsolatedOrigin()->IsSameOriginWith(
+      url::Origin::Create(isolated_page)));
+}
+
 // TODO(https://crbug.com/1101339). Test inheritance of the virtual browsing
 // context group when using window.open from an iframe, same-origin and
 // cross-origin.