Add UseCounter for Sandboxed download from navigation

Also skip recording HTMLAnchorElementDownload UseCounter if it ends up
navigating. In that case, NavigationDownload UseCounter will be recorded.

Bug:539938

Change-Id: I0908d7f98650e8601dd95ba9e52233bb4d1f7a48
Reviewed-on: https://chromium-review.googlesource.com/c/1318170
Commit-Queue: Yao Xiao <yaoxia@chromium.org>
Reviewed-by: Jochen Eisinger <jochen@chromium.org>
Reviewed-by: Luna Lu <loonybear@chromium.org>
Cr-Commit-Position: refs/heads/master@{#608591}

chrome/browser/page_load_metrics/observers/ads_page_load_metrics_observer.cc

@@ -10,6 +10,7 @@
 #include "base/feature_list.h"
 #include "base/logging.h"
 #include "base/strings/string_util.h"
+#include "chrome/browser/page_load_metrics/metrics_web_contents_observer.h"
 #include "chrome/browser/page_load_metrics/page_load_metrics_util.h"
 #include "chrome/common/chrome_features.h"
 #include "content/public/browser/navigation_handle.h"
@@ -232,16 +233,32 @@ void AdsPageLoadMetricsObserver::OnDidFinishSubFrameNavigation(
   content::RenderFrameHost* ad_host = FindFrameMaybeUnsafe(navigation_handle);
 
   if (navigation_handle->IsDownload()) {
+    bool sandboxed = ad_host->IsSandboxed(blink::WebSandboxFlags::kDownloads);
+    bool gesture = navigation_handle->HasUserGesture();
+
     unsigned value = 0;
-    if (ad_host->IsSandboxed(blink::WebSandboxFlags::kDownloads))
+    if (sandboxed)
       value |= blink::DownloadStats::kSandboxBit;
     if (!IsSubframeSameOriginToMainFrame(ad_host, /*use_parent_origin=*/false))
       value |= blink::DownloadStats::kCrossOriginBit;
     if (ad_types.any())
       value |= blink::DownloadStats::kAdBit;
-    if (navigation_handle->HasUserGesture())
+    if (gesture)
       value |= blink::DownloadStats::kGestureBit;
     blink::DownloadStats::RecordSubframeSandboxOriginAdGesture(value);
+
+    if (sandboxed) {
+      blink::mojom::WebFeature web_feature =
+          gesture ? blink::mojom::WebFeature::
+                        kNavigationDownloadInSandboxWithUserGesture
+                  : blink::mojom::WebFeature::
+                        kNavigationDownloadInSandboxWithoutUserGesture;
+      page_load_metrics::mojom::PageLoadFeatures page_load_features(
+          {web_feature}, {} /* css_properties */,
+          {} /* animated_css_properties */);
+      page_load_metrics::MetricsWebContentsObserver::RecordFeatureUsage(
+          ad_host, page_load_features);
+    }
   }
 
   RecordAdFrameData(frame_tree_node_id, ad_types, ad_host,

chrome/browser/page_load_metrics/observers/ads_page_load_metrics_observer_browsertest.cc

@@ -11,6 +11,7 @@
 #include "chrome/browser/browser_process.h"
 #include "chrome/browser/metrics/subprocess_metrics_provider.h"
 #include "chrome/browser/page_load_metrics/observers/ads_page_load_metrics_observer.h"
+#include "chrome/browser/page_load_metrics/observers/use_counter_page_load_metrics_observer.h"
 #include "chrome/browser/page_load_metrics/page_load_metrics_test_waiter.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/subresource_filter/subresource_filter_browser_test_harness.h"
@@ -684,6 +685,16 @@ IN_PROC_BROWSER_TEST_P(SubframeDownloadSandboxOriginAdGestureBrowserTest,
   histogram_tester.ExpectUniqueSample(
       "Download.Subframe.SandboxOriginAdGesture", expected_value,
       1 /* expected_count */);
+
+  if (sandbox && origin == Origin::kNavigation) {
+    blink::mojom::WebFeature feature =
+        gesture ? blink::mojom::WebFeature::
+                      kNavigationDownloadInSandboxWithUserGesture
+                : blink::mojom::WebFeature::
+                      kNavigationDownloadInSandboxWithoutUserGesture;
+    histogram_tester.ExpectBucketCount(internal::kFeaturesHistogramName,
+                                       feature, 1 /* expected_count */);
+  }
 }
 
 INSTANTIATE_TEST_CASE_P(

third_party/blink/public/platform/web_feature.mojom

@@ -2081,6 +2081,8 @@ enum WebFeature {
   kHTMLAnchorElementHrefTranslateAttribute = 2629,
   kWebKitUserModifyEffective = 2630,
   kPlainTextEditingEffective = 2631,
+  kNavigationDownloadInSandboxWithUserGesture = 2632,
+  kNavigationDownloadInSandboxWithoutUserGesture = 2633,
 
   // Add new features immediately above this line. Don't change assigned
   // numbers of any item, and don't reuse removed slots.

third_party/blink/renderer/core/html/html_anchor_element.cc

@@ -398,9 +398,12 @@ void HTMLAnchorElement::HandleClick(Event& event) {
     request.SetReferrerPolicy(policy);
   }
 
-  if (hasAttribute(kDownloadAttr)) {
+  // Ignore the download attribute if we either can't read the content, or
+  // the event is an alt-click or similar.
+  if (hasAttribute(kDownloadAttr) &&
+      NavigationPolicyFromEvent(&event) != kNavigationPolicyDownload &&
+      GetDocument().GetSecurityOrigin()->CanReadContent(completed_url)) {
     if (GetDocument().IsSandboxed(kSandboxDownloads)) {
-      // TODO(jochen): Also measure navigations resulting in downloads.
       UseCounter::Count(
           GetDocument(),
           UserGestureIndicator::ProcessingUserGesture()
@@ -408,20 +411,16 @@ void HTMLAnchorElement::HandleClick(Event& event) {
               : WebFeature::
                     kHTMLAnchorElementDownloadInSandboxWithoutUserGesture);
     }
-    // Ignore the download attribute if we either can't read the content, or
-    // the event is an alt-click or similar.
-    if (NavigationPolicyFromEvent(&event) != kNavigationPolicyDownload &&
-        GetDocument().GetSecurityOrigin()->CanReadContent(completed_url)) {
-      RecordDownloadMetrics(frame);
-      request.SetSuggestedFilename(
-          static_cast<String>(FastGetAttribute(kDownloadAttr)));
-      request.SetRequestContext(mojom::RequestContextType::DOWNLOAD);
-      request.SetRequestorOrigin(SecurityOrigin::Create(GetDocument().Url()));
-      frame->Client()->DownloadURL(request,
-                                   DownloadCrossOriginRedirects::kNavigate);
-      return;
-    }
+    RecordDownloadMetrics(frame);
+    request.SetSuggestedFilename(
+        static_cast<String>(FastGetAttribute(kDownloadAttr)));
+    request.SetRequestContext(mojom::RequestContextType::DOWNLOAD);
+    request.SetRequestorOrigin(SecurityOrigin::Create(GetDocument().Url()));
+    frame->Client()->DownloadURL(request,
+                                 DownloadCrossOriginRedirects::kNavigate);
+    return;
   }
+
   request.SetRequestContext(mojom::RequestContextType::HYPERLINK);
   FrameLoadRequest frame_request(&GetDocument(), request,
                                  getAttribute(kTargetAttr));

tools/metrics/histograms/enums.xml

@@ -20767,6 +20767,8 @@ Called by update_net_error_codes.py.-->
   <int value="2629" label="HTMLAnchorElementHrefTranslateAttribute"/>
   <int value="2630" label="WebKitUserModifyEffective"/>
   <int value="2631" label="PlainTextEditingEffective"/>
+  <int value="2632" label="NavigationDownloadInSandboxWithUserGesture"/>
+  <int value="2633" label="NavigationDownloadInSandboxWithoutUserGesture"/>
 </enum>
 
 <enum name="FeaturePolicyFeature">