Add plumbing for allowing the renderer to intercept and cancel redirects before

they are sent.

A good portion of this CL is to support the new UI test.

The IPC to notify the renderer of a redirect now includes a ResponseInfo struct
allowing WebURLLoaderImpl to provide detailed response info (including response
headers) to WebKit.  This isn't strictly necessary, but I thought I'd include
this to make the code more future proof.

A cross origin restriction is added to SyncResourceHandler::OnRequestRedirected
that mimics the code in WebCore/platform/network/cf/ResourceHandleCFNet.cpp.
This is most unfortunate, and I filed a bug at bugs.webkit.org about the
similar duplication of logic in WebCore.

There seemed to be enough code paths leading to request cancellation at the
ResourceDispatcher level that I couldn't easily ensure that a request only gets
cancelled once.  So, I added an is_cancelled flag to record if it is not
necessary to send a ViewHostMsg_CancelRequest IPC.  This avoids some warnings
in the ResourceDispatcherHost.

To support my UI test, I needed to change URLRequestMockHttpJob to know how to
serve redirects.  I moved URLRequestHttpJob::IsRedirectResponse to its base
class, URLRequestJob so that the implementation could be shared.  This revealed
a minor bug in URLRequest.  We were never resetting response_info_ upon
following a redirect.  I added this code consolidated similar code from
URLRequest::Redirect and URLRequest::RestartWithJob into a new PrepareToRestart
method.

To support my UI test, I added a "hit count" field to URLRequestFilter, and I
added an associated automation IPC to query the value.  The test was a bit
challenging to write because there is no way to tell the difference from JS.
Before and after, it appears to JS as though the cross-origin redirect failed.
However, the server can see the extra redirect request.  So, I simply record
the number of hits against URLs of the form http://mock.http/foo, and use that
to observe if any extra requests were made.  I implemented the new IPC message
by extending the AutomationResourceMessageFilter.  This allowed me to trap the
IPC message on the IO thread where it is safe to probe the URLRequestFilter.  I
then changed the implementation of AutomationMsg_SetFilteredInet to work
similarly.

I revised URLRequestMockHTTPJob::GetOnDiskPath to support ports.  This actually
allowed me to reuse URLRequestMockHTTPJob to service URLs in different security
origins.  My test redirects from http://mock.http/ to http://mock.http:4000/.

Please see the comments in cross-origin-redirect-blocked.html for details about
how the test functions.

R=brettw,wtc
BUG=16413
TEST=covered by resource_dispatcher_host_uitest.cc

Review URL: http://codereview.chromium.org/159370

git-svn-id: svn://svn.chromium.org/chrome/trunk/src@22067 0039d316-1c4b-4281-b951-d872f2087c98

6 files changed, 73 insertions, 0 deletions

diff --git a/chrome/test/automation/automation_messages_internal.h b/chrome/test/automation/automation_messages_internal.h
index 9d67065..b2b3f02 100644
--- a/chrome/test/automation/automation_messages_internal.h
+++ b/chrome/test/automation/automation_messages_internal.h
@@ -982,4 +982,10 @@ IPC_BEGIN_MESSAGES(Automation)
 
   IPC_MESSAGE_ROUTED1(AutomationMsg_StopAsync,
                       int /* tab handle */)
+
+  // Returns the number of times a filter was used to service an URL request.
+  // See AutomationMsg_SetFilteredInet.
+  IPC_SYNC_MESSAGE_ROUTED0_1(AutomationMsg_GetFilteredInetHitCount,
+                             int /* hit_count */)
+
 IPC_END_MESSAGES(Automation)
diff --git a/chrome/test/automation/automation_proxy.cc b/chrome/test/automation/automation_proxy.cc
index dc94c18..70e4b33 100644
--- a/chrome/test/automation/automation_proxy.cc
+++ b/chrome/test/automation/automation_proxy.cc
@@ -371,6 +371,13 @@ bool AutomationProxy::SetFilteredInet(bool enabled) {
   return Send(new AutomationMsg_SetFilteredInet(0, enabled));
 }
 
+int AutomationProxy::GetFilteredInetHitCount() {
+  int hit_count;
+  if (!Send(new AutomationMsg_GetFilteredInetHitCount(0, &hit_count)))
+    return -1;
+  return hit_count;
+}
+
 bool AutomationProxy::SendProxyConfig(const std::string& new_proxy_config) {
   return Send(new AutomationMsg_SetProxyConfig(0, new_proxy_config));
 }
diff --git a/chrome/test/automation/automation_proxy.h b/chrome/test/automation/automation_proxy.h
index 186d7bf..5bb5ebf 100644
--- a/chrome/test/automation/automation_proxy.h
+++ b/chrome/test/automation/automation_proxy.h
@@ -150,6 +150,10 @@ class AutomationProxy : public IPC::Channel::Listener,
   // false if the message fails to send to the browser.
   bool SetFilteredInet(bool enabled);
 
+  // Returns the number of times a network request filter was used to service a
+  // network request.  Returns -1 on error.
+  int GetFilteredInetHitCount();
+
   // Sends the browser a new proxy configuration to start using. Returns true
   // if the proxy config was successfully sent, false otherwise.
   bool SendProxyConfig(const std::string& new_proxy_config);
diff --git a/chrome/test/data/cross-origin-redirect-blocked.html b/chrome/test/data/cross-origin-redirect-blocked.html
new file mode 100644
index 0000000..3e9cdd4
--- /dev/null
+++ b/chrome/test/data/cross-origin-redirect-blocked.html
@@ -0,0 +1,53 @@
+<html>
+<head>
+<!-- avoid an automatically generated favicon reqeuest -->
+<link rel="icon" type="image/vnd.microsoft.icon" href="data:,">
+</head>
+<body>
+<script>
+
+function NewXHR(url) {
+  var r = new XMLHttpRequest
+  r.open("GET", url);
+  return r;
+}
+
+function SignalDone() {
+  document.title = "done";
+}
+
+function CreateDummyRequest() {
+  dummy_request = NewXHR("http://mock.http/title2.html");
+  dummy_request.onload = SignalDone;
+  dummy_request.send(null);
+}
+
+function RedirectFailed() {
+  // Good, the redirect was blocked by WebKit.
+  //
+  // We also care that the underlying network stack does not send the redirect.
+  // We cannot detect that from JS, but our test harness is designed to detect
+  // that (see ResourceDispatcherTest::CrossOriginRedirectBlocked).  Before
+  // calling SignalDone, we want to allow the browser time to notice a request
+  // to follow the redirect if one should exist.  To do that, we just need to
+  // make another network request.
+  //
+  // The setTimeout call is intended to delay CreateDummyRequest so that any
+  // processing associated with the current "error" handler completes.
+  setTimeout(CreateDummyRequest, 0);
+}
+
+function RedirectSucceeded() {
+  // Oops, the redirect should have been denied!
+  SignalDone();
+}
+
+// Kick off a request that will attempt a cross-origin redirect.
+request = NewXHR("http://mock.http/redirect-to-title2.html");
+request.onerror = RedirectFailed;
+request.onload = RedirectSucceeded;
+request.send(null);
+
+</script>
+</body>
+</html>
diff --git a/chrome/test/data/redirect-to-title2.html b/chrome/test/data/redirect-to-title2.html
new file mode 100644
index 0000000..7898192
--- /dev/null
+++ b/chrome/test/data/redirect-to-title2.html
@@ -0,0 +1 @@
+a
diff --git a/chrome/test/data/redirect-to-title2.html.mock-http-headers b/chrome/test/data/redirect-to-title2.html.mock-http-headers
new file mode 100644
index 0000000..43a377c
--- /dev/null
+++ b/chrome/test/data/redirect-to-title2.html.mock-http-headers
@@ -0,0 +1,2 @@
+HTTP/1.1 302 Moved
+Location: http://mock.http:4000/title2.html