Pass along the referrer policy (renderer side)

BUG=105028
TEST=none (browser side still missing, does nothing yet)


Review URL: http://codereview.chromium.org/8774050

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@112898 0039d316-1c4b-4281-b951-d872f2087c98

19 files changed, 127 insertions, 46 deletions

diff --git a/chrome/browser/external_tab_container_win.cc b/chrome/browser/external_tab_container_win.cc
index 991ba6c..c595519 100644
--- a/chrome/browser/external_tab_container_win.cc
+++ b/chrome/browser/external_tab_container_win.cc
@@ -356,7 +356,9 @@ TabContents* ExternalTabContainer::OpenURLFromTab(TabContents* source,
         // ViewHostMsg_FrameNavigate_Params structure. Another option could be
         // to refactor the UpdateHistoryForNavigation function in TabContents.
         content::FrameNavigateParams nav_params;
-        nav_params.referrer = params.referrer;
+        nav_params.referrer = content::Referrer(
+            params.referrer,
+            WebKit::WebReferrerPolicyDefault);
         nav_params.url = params.url;
         nav_params.page_id = -1;
         nav_params.transition = content::PAGE_TRANSITION_LINK;
diff --git a/chrome/browser/history/history_tab_helper.cc b/chrome/browser/history/history_tab_helper.cc
index ee04f6c..8564749 100644
--- a/chrome/browser/history/history_tab_helper.cc
+++ b/chrome/browser/history/history_tab_helper.cc
@@ -50,7 +50,7 @@ HistoryTabHelper::CreateHistoryAddPageArgs(
   scoped_refptr<history::HistoryAddPageArgs> add_page_args(
       new history::HistoryAddPageArgs(
           params.url, base::Time::Now(), tab_contents(), params.page_id,
-          params.referrer, params.redirects, params.transition,
+          params.referrer.url, params.redirects, params.transition,
           history::SOURCE_BROWSED, details.did_replace_entry));
   if (content::PageTransitionIsMainFrame(params.transition) &&
       virtual_url != params.url) {
diff --git a/chrome/browser/safe_browsing/browser_feature_extractor_unittest.cc b/chrome/browser/safe_browsing/browser_feature_extractor_unittest.cc
index 7e79af2..bf5d623 100644
--- a/chrome/browser/safe_browsing/browser_feature_extractor_unittest.cc
+++ b/chrome/browser/safe_browsing/browser_feature_extractor_unittest.cc
@@ -97,7 +97,8 @@ class BrowserFeatureExtractorTest : public ChromeRenderViewHostTestHarness {
     static int page_id = 0;
     ViewHostMsg_FrameNavigate_Params params;
     InitNavigateParams(&params, ++page_id, url, type);
-    params.referrer = referrer;
+    params.referrer =
+        content::Referrer(referrer, WebKit::WebReferrerPolicyDefault);
 
     RenderViewHost* rvh = contents()->pending_rvh();
     if (!rvh) {
diff --git a/chrome/browser/ui/search_engines/search_engine_tab_helper.cc b/chrome/browser/ui/search_engines/search_engine_tab_helper.cc
index 73d32bc..278008c 100644
--- a/chrome/browser/ui/search_engines/search_engine_tab_helper.cc
+++ b/chrome/browser/ui/search_engines/search_engine_tab_helper.cc
@@ -198,7 +198,8 @@ void SearchEngineTabHelper::GenerateKeywordIfNecessary(
     // the later.
     // TODO(sky): Need a way to set the favicon that doesn't involve generating
     // its url.
-    new_url->SetFaviconURL(TemplateURL::GenerateFaviconURL(params.referrer));
+    new_url->SetFaviconURL(
+        TemplateURL::GenerateFaviconURL(params.referrer.url));
   }
   new_url->set_safe_for_autoreplace(true);
   url_service->Add(new_url);
diff --git a/content/browser/renderer_host/render_view_host.cc b/content/browser/renderer_host/render_view_host.cc
index e03b6fa..3b539a3 100644
--- a/content/browser/renderer_host/render_view_host.cc
+++ b/content/browser/renderer_host/render_view_host.cc
@@ -896,7 +896,7 @@ void RenderViewHost::OnMsgNavigate(const IPC::Message& msg) {
   // the URL.  To prevent this attack, we block the renderer from inserting
   // banned URLs into the navigation controller in the first place.
   FilterURL(policy, renderer_id, &validated_params.url);
-  FilterURL(policy, renderer_id, &validated_params.referrer);
+  FilterURL(policy, renderer_id, &validated_params.referrer.url);
   for (std::vector<GURL>::iterator it(validated_params.redirects.begin());
       it != validated_params.redirects.end(); ++it) {
     FilterURL(policy, renderer_id, &(*it));
@@ -1007,7 +1007,7 @@ void RenderViewHost::OnMsgToggleFullscreen(bool enter_fullscreen) {
 }
 
 void RenderViewHost::OnMsgOpenURL(const GURL& url,
-                                  const GURL& referrer,
+                                  const content::Referrer& referrer,
                                   WindowOpenDisposition disposition,
                                   int64 source_frame_id) {
   GURL validated_url(url);
diff --git a/content/browser/renderer_host/render_view_host.h b/content/browser/renderer_host/render_view_host.h
index 8d62b8f..1375e67 100644
--- a/content/browser/renderer_host/render_view_host.h
+++ b/content/browser/renderer_host/render_view_host.h
@@ -52,8 +52,9 @@ class ListValue;
 }
 
 namespace content {
-class RenderViewHostObserver;
 struct FileChooserParams;
+struct Referrer;
+class RenderViewHostObserver;
 struct ShowDesktopNotificationHostMsgParams;
 }
 
@@ -533,7 +534,7 @@ class CONTENT_EXPORT RenderViewHost : public RenderWidgetHost {
   void OnMsgContextMenu(const ContextMenuParams& params);
   void OnMsgToggleFullscreen(bool enter_fullscreen);
   void OnMsgOpenURL(const GURL& url,
-                    const GURL& referrer,
+                    const content::Referrer& referrer,
                     WindowOpenDisposition disposition,
                     int64 source_frame_id);
   void OnMsgDidContentsPreferredSizeChange(const gfx::Size& new_size);
diff --git a/content/browser/renderer_host/render_view_host_delegate.h b/content/browser/renderer_host/render_view_host_delegate.h
index e0faaa3..2da5aa0 100644
--- a/content/browser/renderer_host/render_view_host_delegate.h
+++ b/content/browser/renderer_host/render_view_host_delegate.h
@@ -42,6 +42,7 @@ class ListValue;
 namespace content {
 class BrowserContext;
 struct FileChooserParams;
+struct Referrer;
 struct RendererPreferences;
 }
 
@@ -273,7 +274,7 @@ class CONTENT_EXPORT RenderViewHostDelegate : public IPC::Channel::Listener {
 
   // The page wants to open a URL with the specified disposition.
   virtual void RequestOpenURL(const GURL& url,
-                              const GURL& referrer,
+                              const content::Referrer& referrer,
                               WindowOpenDisposition disposition,
                               int64 source_frame_id) {}
 
diff --git a/content/browser/renderer_host/test_render_view_host.cc b/content/browser/renderer_host/test_render_view_host.cc
index 9647381..3eb8ebd 100644
--- a/content/browser/renderer_host/test_render_view_host.cc
+++ b/content/browser/renderer_host/test_render_view_host.cc
@@ -26,7 +26,7 @@ void InitNavigateParams(ViewHostMsg_FrameNavigate_Params* params,
                         content::PageTransition transition) {
   params->page_id = page_id;
   params->url = url;
-  params->referrer = GURL();
+  params->referrer = content::Referrer();
   params->transition = transition;
   params->redirects = std::vector<GURL>();
   params->should_update_history = false;
@@ -87,7 +87,7 @@ void TestRenderViewHost::SendNavigateWithTransition(
 
   params.page_id = page_id;
   params.url = url;
-  params.referrer = GURL();
+  params.referrer = content::Referrer();
   params.transition = transition;
   params.redirects = std::vector<GURL>();
   params.should_update_history = true;
diff --git a/content/browser/tab_contents/navigation_controller.cc b/content/browser/tab_contents/navigation_controller.cc
index 21582ab..852b87f 100644
--- a/content/browser/tab_contents/navigation_controller.cc
+++ b/content/browser/tab_contents/navigation_controller.cc
@@ -802,7 +802,7 @@ void NavigationController::RendererDidNavigateToNewPage(
   new_entry->set_url(params.url);
   if (update_virtual_url)
     UpdateVirtualURLToURL(new_entry, params.url);
-  new_entry->set_referrer(params.referrer);
+  new_entry->set_referrer(params.referrer.url);
   new_entry->set_page_id(params.page_id);
   new_entry->set_transition_type(params.transition);
   new_entry->set_site_instance(tab_contents_->GetSiteInstance());
diff --git a/content/browser/tab_contents/tab_contents.cc b/content/browser/tab_contents/tab_contents.cc
index bfdbd979..3dae106 100644
--- a/content/browser/tab_contents/tab_contents.cc
+++ b/content/browser/tab_contents/tab_contents.cc
@@ -160,7 +160,8 @@ void MakeNavigateParams(const NavigationEntry& entry,
   params->current_history_list_offset = controller.last_committed_entry_index();
   params->current_history_list_length = controller.entry_count();
   params->url = entry.url();
-  params->referrer = entry.referrer();
+  params->referrer = content::Referrer(entry.referrer(),
+                                       WebKit::WebReferrerPolicyDefault);
   params->transition = entry.transition_type();
   params->state = entry.content_state();
   params->navigation_type =
@@ -1751,12 +1752,12 @@ void TabContents::DocumentOnLoadCompletedInMainFrame(
 }
 
 void TabContents::RequestOpenURL(const GURL& url,
-                                 const GURL& referrer,
+                                 const content::Referrer& referrer,
                                  WindowOpenDisposition disposition,
                                  int64 source_frame_id) {
   // Delegate to RequestTransferURL because this is just the generic
   // case where |old_request_id| is empty.
-  RequestTransferURL(url, referrer, disposition, source_frame_id,
+  RequestTransferURL(url, referrer.url, disposition, source_frame_id,
                      GlobalRequestID());
 }
 
diff --git a/content/browser/tab_contents/tab_contents.h b/content/browser/tab_contents/tab_contents.h
index 46120ed..734ad6c 100644
--- a/content/browser/tab_contents/tab_contents.h
+++ b/content/browser/tab_contents/tab_contents.h
@@ -510,7 +510,7 @@ class CONTENT_EXPORT TabContents : public PageNavigator,
       RenderViewHost* render_view_host,
       int32 page_id) OVERRIDE;
   virtual void RequestOpenURL(const GURL& url,
-                              const GURL& referrer,
+                              const content::Referrer& referrer,
                               WindowOpenDisposition disposition,
                               int64 source_frame_id) OVERRIDE;
   virtual void RequestTransferURL(
diff --git a/content/common/view_messages.h b/content/common/view_messages.h
index ff07616..d818295 100644
--- a/content/common/view_messages.h
+++ b/content/common/view_messages.h
@@ -16,6 +16,7 @@
 #include "content/public/common/file_chooser_params.h"
 #include "content/public/common/frame_navigate_params.h"
 #include "content/public/common/page_zoom.h"
+#include "content/public/common/referrer.h"
 #include "content/public/common/renderer_preferences.h"
 #include "content/public/common/stop_find_action.h"
 #include "content/public/common/webkit_param_traits.h"
@@ -30,6 +31,7 @@
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebFindOptions.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebMediaPlayerAction.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebPopupType.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebReferrerPolicy.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebScreenInfo.h"
 #include "ui/base/ime/text_input_type.h"
 #include "ui/base/range/range.h"
@@ -57,6 +59,7 @@ IPC_ENUM_TRAITS(ViewMsg_Navigate_Type::Value)
 IPC_ENUM_TRAITS(WebKit::WebContextMenuData::MediaType)
 IPC_ENUM_TRAITS(WebKit::WebMediaPlayerAction::Type)
 IPC_ENUM_TRAITS(WebKit::WebPopupType)
+IPC_ENUM_TRAITS(WebKit::WebReferrerPolicy)
 IPC_ENUM_TRAITS(WebKit::WebTextDirection)
 IPC_ENUM_TRAITS(WebMenuItem::Type)
 IPC_ENUM_TRAITS(WindowContainerType)
@@ -260,6 +263,11 @@ IPC_STRUCT_TRAITS_BEGIN(content::FrameNavigateParams)
   IPC_STRUCT_TRAITS_MEMBER(socket_address)
 IPC_STRUCT_TRAITS_END()
 
+IPC_STRUCT_TRAITS_BEGIN(content::Referrer)
+  IPC_STRUCT_TRAITS_MEMBER(url)
+  IPC_STRUCT_TRAITS_MEMBER(policy)
+IPC_STRUCT_TRAITS_END()
+
 IPC_STRUCT_TRAITS_BEGIN(content::RendererPreferences)
   IPC_STRUCT_TRAITS_MEMBER(can_accept_load_drops)
   IPC_STRUCT_TRAITS_MEMBER(should_antialias_text)
@@ -574,8 +582,7 @@ IPC_STRUCT_BEGIN(ViewMsg_Navigate_Params)
 
   // The URL to send in the "Referer" header field. Can be empty if there is
   // no referrer.
-  // TODO: consider folding this into extra_headers.
-  IPC_STRUCT_MEMBER(GURL, referrer)
+  IPC_STRUCT_MEMBER(content::Referrer, referrer)
 
   // The type of transition.
   IPC_STRUCT_MEMBER(content::PageTransition, transition)
@@ -1582,7 +1589,7 @@ IPC_SYNC_MESSAGE_ROUTED4_2(ViewHostMsg_RunJavaScriptMessage,
 // Requests that the given URL be opened in the specified manner.
 IPC_MESSAGE_ROUTED4(ViewHostMsg_OpenURL,
                     GURL /* url */,
-                    GURL /* referrer */,
+                    content::Referrer /* referrer */,
                     WindowOpenDisposition /* disposition */,
                     int64 /* frame id */)
 
diff --git a/content/content_common.gypi b/content/content_common.gypi
index 29f17a2..fdd4822 100644
--- a/content/content_common.gypi
+++ b/content/content_common.gypi
@@ -54,6 +54,7 @@
     'public/common/pepper_plugin_info.cc',
     'public/common/pepper_plugin_info.h',
     'public/common/process_type.h',
+    'public/common/referrer.h',
     'public/common/renderer_preferences.cc',
     'public/common/renderer_preferences.h',
     'public/common/resource_dispatcher_delegate.h',
diff --git a/content/public/common/frame_navigate_params.h b/content/public/common/frame_navigate_params.h
index ea08b26..e4442fd 100644
--- a/content/public/common/frame_navigate_params.h
+++ b/content/public/common/frame_navigate_params.h
@@ -11,6 +11,7 @@
 
 #include "content/common/content_export.h"
 #include "content/public/common/page_transition_types.h"
+#include "content/public/common/referrer.h"
 #include "googleurl/src/gurl.h"
 #include "net/base/host_port_pair.h"
 #include "webkit/glue/password_form.h"
@@ -40,7 +41,7 @@ struct CONTENT_EXPORT FrameNavigateParams {
 
   // URL of the referrer of this load. WebKit generates this based on the
   // source of the event that caused the load.
-  GURL referrer;
+  content::Referrer referrer;
 
   // The type of transition.
   PageTransition transition;
diff --git a/content/public/common/referrer.h b/content/public/common/referrer.h
new file mode 100644
index 0000000..a5a3639
--- /dev/null
+++ b/content/public/common/referrer.h
@@ -0,0 +1,31 @@
+// Copyright (c) 2011 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#ifndef CONTENT_PUBLIC_COMMON_REFERRER_H_
+#define CONTENT_PUBLIC_COMMON_REFERRER_H_
+#pragma once
+
+#include "content/common/content_export.h"
+#include "googleurl/src/gurl.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebReferrerPolicy.h"
+
+namespace content {
+
+// This struct holds a referrer URL, as well as the referrer policy to be
+// applied to this URL. When passing around referrers that will eventually end
+// up being used for URL requests, always use this struct.
+struct CONTENT_EXPORT Referrer {
+  Referrer(const GURL& url, WebKit::WebReferrerPolicy policy) : url(url),
+                                                                policy(policy) {
+  }
+  Referrer() : policy(WebKit::WebReferrerPolicyDefault) {
+  }
+
+  GURL url;
+  WebKit::WebReferrerPolicy policy;
+};
+
+}  // namespace content
+
+#endif  // CONTENT_PUBLIC_COMMON_REFERRER_H_
diff --git a/content/renderer/render_view_impl.cc b/content/renderer/render_view_impl.cc
index 12c7ead..a89b473 100644
--- a/content/renderer/render_view_impl.cc
+++ b/content/renderer/render_view_impl.cc
@@ -113,6 +113,7 @@
 #include "third_party/WebKit/Source/WebKit/chromium/public/platform/WebPoint.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebRange.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/platform/WebRect.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebReferrerPolicy.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebScriptSource.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebSearchableFormData.h"
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebSecurityOrigin.h"
@@ -213,6 +214,7 @@ using WebKit::WebPoint;
 using WebKit::WebPopupMenuInfo;
 using WebKit::WebRange;
 using WebKit::WebRect;
+using WebKit::WebReferrerPolicy;
 using WebKit::WebScriptSource;
 using WebKit::WebSearchableFormData;
 using WebKit::WebSecurityOrigin;
@@ -246,6 +248,7 @@ using content::NavigationState;
 using content::RenderThread;
 using content::RenderViewObserver;
 using content::RenderViewVisitor;
+using content::Referrer;
 using content::V8ValueConverter;
 using webkit_glue::AltErrorPageResourceFetcher;
 using webkit_glue::FormField;
@@ -302,6 +305,13 @@ static bool IsReload(const ViewMsg_Navigate_Params& params) {
       params.navigation_type == ViewMsg_Navigate_Type::RELOAD_IGNORING_CACHE;
 }
 
+static WebReferrerPolicy getReferrerPolicyFromRequest(
+    const WebURLRequest& request) {
+  return request.extraData() ?
+      static_cast<RequestExtraData*>(request.extraData())->referrer_policy() :
+      WebKit::WebReferrerPolicyDefault;
+}
+
 ///////////////////////////////////////////////////////////////////////////////
 
 int32 RenderViewImpl::next_page_id_ = 1;
@@ -771,13 +781,13 @@ void RenderViewImpl::OnNavigate(const ViewMsg_Navigate_Params& params) {
     if (main_frame->isViewSourceModeEnabled())
       request.setCachePolicy(WebURLRequest::ReturnCacheDataElseLoad);
 
-    if (params.referrer.is_valid()) {
-      if (!WebSecurityPolicy::shouldHideReferrer(
-              params.url,
-              WebString::fromUTF8(params.referrer.spec()))) {
-        request.setHTTPHeaderField(WebString::fromUTF8("Referer"),
-                                   WebString::fromUTF8(params.referrer.spec()));
-      }
+    if (params.referrer.url.is_valid()) {
+      WebString referrer = WebSecurityPolicy::generateReferrerHeader(
+          params.referrer.policy,
+          params.url,
+          WebString::fromUTF8(params.referrer.url.spec()));
+      if (!referrer.isEmpty())
+        request.setHTTPHeaderField(WebString::fromUTF8("Referer"), referrer);
     }
 
     if (!params.extra_headers.empty()) {
@@ -1143,16 +1153,17 @@ void RenderViewImpl::UpdateURL(WebFrame* frame) {
     // If we have a valid consumed client redirect source,
     // the page contained a client redirect (meta refresh, document.loc...),
     // so we set the referrer and transition to match.
-    if (completed_client_redirect_src_.is_valid()) {
-      DCHECK(completed_client_redirect_src_ == params.redirects[0]);
+    if (completed_client_redirect_src_.url.is_valid()) {
+      DCHECK(completed_client_redirect_src_.url == params.redirects[0]);
       params.referrer = completed_client_redirect_src_;
       params.transition = static_cast<content::PageTransition>(
           params.transition | content::PAGE_TRANSITION_CLIENT_REDIRECT);
     } else {
       // Bug 654101: the referrer will be empty on https->http transitions. It
       // would be nice if we could get the real referrer from somewhere.
-      params.referrer = GURL(
-          original_request.httpHeaderField(WebString::fromUTF8("Referer")));
+      params.referrer = Referrer(GURL(
+          original_request.httpHeaderField(WebString::fromUTF8("Referer"))),
+          getReferrerPolicyFromRequest(original_request));
     }
 
     string16 method = request.httpMethod();
@@ -1237,7 +1248,7 @@ void RenderViewImpl::UpdateSessionHistory(WebFrame* frame) {
 
 void RenderViewImpl::OpenURL(WebFrame* frame,
                              const GURL& url,
-                             const GURL& referrer,
+                             const Referrer& referrer,
                              WebNavigationPolicy policy) {
   Send(new ViewHostMsg_OpenURL(
       routing_id_,
@@ -1981,7 +1992,8 @@ void RenderViewImpl::loadURLExternally(
     Send(new ViewHostMsg_DownloadUrl(routing_id_, request.url(), referrer,
                                      suggested_name));
   } else {
-    OpenURL(frame, request.url(), referrer, policy);
+    OpenURL(frame, request.url(),
+            Referrer(referrer, getReferrerPolicyFromRequest(request)), policy);
   }
 }
 
@@ -2018,7 +2030,9 @@ WebNavigationPolicy RenderViewImpl::decidePolicyForNavigation(
     // TODO(cevans): revisit whether this origin check is still necessary once
     // crbug.com/101395 is fixed.
     if (frame_url.GetOrigin() != url.GetOrigin()) {
-      GURL referrer(request.httpHeaderField(WebString::fromUTF8("Referer")));
+      Referrer referrer(
+          GURL(request.httpHeaderField(WebString::fromUTF8("Referer"))),
+          getReferrerPolicyFromRequest(request));
       OpenURL(frame, url, referrer, default_policy);
       return WebKit::WebNavigationPolicyIgnore;
     }
@@ -2029,7 +2043,9 @@ WebNavigationPolicy RenderViewImpl::decidePolicyForNavigation(
   if (is_content_initiated &&
       renderer_preferences_.browser_handles_top_level_requests &&
       IsNonLocalTopLevelNavigation(url, frame, type)) {
-    GURL referrer(request.httpHeaderField(WebString::fromUTF8("Referer")));
+    Referrer referrer(
+        GURL(request.httpHeaderField(WebString::fromUTF8("Referer"))),
+        getReferrerPolicyFromRequest(request));
     // Reset these counters as the RenderView could be reused for the next
     // navigation.
     page_id_ = -1;
@@ -2072,8 +2088,11 @@ WebNavigationPolicy RenderViewImpl::decidePolicyForNavigation(
     }
 
     if (should_fork) {
-      GURL referrer(request.httpHeaderField(WebString::fromUTF8("Referer")));
-      OpenURL(frame, url, send_referrer ? referrer : GURL(), default_policy);
+      Referrer referrer(
+          GURL(request.httpHeaderField(WebString::fromUTF8("Referer"))),
+          getReferrerPolicyFromRequest(request));
+      OpenURL(
+          frame, url, send_referrer ? referrer : Referrer(), default_policy);
       return WebKit::WebNavigationPolicyIgnore;  // Suppress the load here.
     }
   }
@@ -2143,7 +2162,7 @@ WebNavigationPolicy RenderViewImpl::decidePolicyForNavigation(
 
   if (is_fork || is_noreferrer_and_blank_target) {
     // Open the URL via the browser, not via WebKit.
-    OpenURL(frame, url, GURL(), default_policy);
+    OpenURL(frame, url, Referrer(), default_policy);
     return WebKit::WebNavigationPolicyIgnore;
   }
 
@@ -2241,8 +2260,14 @@ void RenderViewImpl::didCancelClientRedirect(WebFrame* frame) {
 
 void RenderViewImpl::didCompleteClientRedirect(
     WebFrame* frame, const WebURL& from) {
-  if (!frame->parent())
-    completed_client_redirect_src_ = from;
+  if (!frame->parent()) {
+    WebDataSource* ds = frame->provisionalDataSource();
+    // If there's no provisional data source, it's a reference fragment
+    // navigation.
+    completed_client_redirect_src_ = Referrer(
+        from, ds ? getReferrerPolicyFromRequest(ds->request()) :
+        frame->referrerPolicy());
+  }
   FOR_EACH_OBSERVER(
       RenderViewObserver, observers_, DidCompleteClientRedirect(frame, from));
 }
@@ -2376,7 +2401,7 @@ void RenderViewImpl::didStartProvisionalLoad(WebFrame* frame) {
         NavigationGestureUser : NavigationGestureAuto;
 
     // Make sure redirect tracking state is clear for the new load.
-    completed_client_redirect_src_ = GURL();
+    completed_client_redirect_src_ = Referrer();
   } else if (frame->parent()->isLoading()) {
     // Take note of AUTO_SUBFRAME loads here, so that we can know how to
     // load an error page.  See didFailProvisionalLoad.
@@ -2566,7 +2591,7 @@ void RenderViewImpl::didCommitProvisionalLoad(WebFrame* frame,
 
   // If this committed load was initiated by a client redirect, we're
   // at the last stop now, so clear it.
-  completed_client_redirect_src_ = GURL();
+  completed_client_redirect_src_ = Referrer();
 
   // Check whether we have new encoding name.
   UpdateEncoding(frame, frame->view()->pageEncoding().utf8());
@@ -3937,6 +3962,8 @@ void RenderViewImpl::OnGetAllSavableResourceLinksForCurrentPage(
                                              &referrers_list,
                                              &frames_list);
 
+  // FIXME(rdsmith): When GetAllSavableResourceLinksForCurrentPage starts to
+  // return referrers, it should also return the referrer policies.
   if (!webkit_glue::GetAllSavableResourceLinksForCurrentPage(
           webview(),
           page_url,
diff --git a/content/renderer/render_view_impl.h b/content/renderer/render_view_impl.h
index f0474906..0c1d8ca 100644
--- a/content/renderer/render_view_impl.h
+++ b/content/renderer/render_view_impl.h
@@ -27,6 +27,7 @@
 #include "content/common/edit_command.h"
 #include "content/common/navigation_gesture.h"
 #include "content/public/common/page_zoom.h"
+#include "content/public/common/referrer.h"
 #include "content/public/common/renderer_preferences.h"
 #include "content/public/common/stop_find_action.h"
 #include "content/public/renderer/render_view.h"
@@ -714,7 +715,7 @@ class RenderViewImpl : public RenderWidget,
 
   void OpenURL(WebKit::WebFrame* frame,
                const GURL& url,
-               const GURL& referrer,
+               const content::Referrer& referrer,
                WebKit::WebNavigationPolicy policy);
 
   bool RunJavaScriptMessage(int type,
@@ -1003,7 +1004,7 @@ class RenderViewImpl : public RenderWidget,
   // of the page that initiated it. Specifically, when a load is committed this
   // is used to determine if that load originated from a client-side redirect.
   // It is empty if there is no top-level client-side redirect.
-  GURL completed_client_redirect_src_;
+  content::Referrer completed_client_redirect_src_;
 
   // Holds state pertaining to a navigation that we initiated.  This is held by
   // the WebDataSource::ExtraData attribute.  We use pending_navigation_state_
diff --git a/webkit/glue/context_menu.cc b/webkit/glue/context_menu.cc
index 1d9c452..d4bad35 100644
--- a/webkit/glue/context_menu.cc
+++ b/webkit/glue/context_menu.cc
@@ -26,7 +26,8 @@ ContextMenuParams::ContextMenuParams()
       media_flags(0),
       spellcheck_enabled(false),
       is_editable(false),
-      edit_flags(0) {
+      edit_flags(0),
+      referrer_policy(WebKit::WebReferrerPolicyDefault) {
 }
 
 ContextMenuParams::ContextMenuParams(const WebKit::WebContextMenuData& data)
@@ -54,7 +55,8 @@ ContextMenuParams::ContextMenuParams(const WebKit::WebContextMenuData& data)
 #endif  // OS_MACOSX
       edit_flags(data.editFlags),
       security_info(data.securityInfo),
-      frame_charset(data.frameEncoding.utf8()) {
+      frame_charset(data.frameEncoding.utf8()),
+      referrer_policy(data.referrerPolicy) {
   for (size_t i = 0; i < data.dictionarySuggestions.size(); ++i)
     dictionary_suggestions.push_back(data.dictionarySuggestions[i]);
 
diff --git a/webkit/glue/context_menu.h b/webkit/glue/context_menu.h
index 128b47c..cbbec387 100644
--- a/webkit/glue/context_menu.h
+++ b/webkit/glue/context_menu.h
@@ -14,6 +14,7 @@
 #include "webkit/glue/webmenuitem.h"
 
 #include "third_party/WebKit/Source/WebKit/chromium/public/WebContextMenuData.h"
+#include "third_party/WebKit/Source/WebKit/chromium/public/WebReferrerPolicy.h"
 
 namespace webkit_glue {
 
@@ -126,6 +127,9 @@ struct WEBKIT_GLUE_EXPORT ContextMenuParams {
   // The character encoding of the frame on which the menu is invoked.
   std::string frame_charset;
 
+  // The referrer policy of the frame on which the menu is invoked.
+  WebKit::WebReferrerPolicy referrer_policy;
+
   webkit_glue::CustomContextMenuContext custom_context;
   std::vector<WebMenuItem> custom_items;