Merge pull request #5211 from brave/fix/navigation-title

only set frame title when navigation is not renderer initiated
brave · Oct 29, 2016 · b9f2853 · b9f2853
2 parents bec9128 + 889c627
commit b9f2853
Show file tree

Hide file tree

Showing 4 changed files with 68 additions and 5 deletions.
diff --git a/js/components/frame.js b/js/components/frame.js
@@ -1007,10 +1007,13 @@ class Frame extends ImmutableComponent {
       // force temporary url display for tabnapping protection
       windowActions.setMouseInTitlebar(true)
 
-      // After navigating to the URL, set correct frame title
-      let webContents = this.webview.getWebContents()
-      let title = webContents.getTitleAtIndex(webContents.getCurrentEntryIndex())
-      windowActions.setFrameTitle(this.frame, title)
+      // After navigating to the URL via back/forward buttons, set correct frame title
+      if (!e.isRendererInitiated) {
+        let webContents = this.webview.getWebContents()
+        let index = webContents.getCurrentEntryIndex()
+        let title = webContents.getTitleAtIndex(index)
+        windowActions.setFrameTitle(this.frame, title)
+      }
     })
     this.webview.addEventListener('crashed', (e) => {
       windowActions.setFrameError(this.frame, {

diff --git a/test/components/navigationBarTest.js b/test/components/navigationBarTest.js
@@ -5,7 +5,7 @@ const config = require('../../js/constants/config')
 const {urlBarSuggestions, urlInput, activeWebview, activeTabFavicon, activeTab, navigatorLoadTime,
   navigator, titleBar, urlbarIcon, bookmarksToolbar, navigatorNotBookmarked, navigatorBookmarked,
   saveButton, allowRunInsecureContentButton, dismissAllowRunInsecureContentButton,
-  denyRunInsecureContentButton, dismissDenyRunInsecureContentButton} = require('../lib/selectors')
+  denyRunInsecureContentButton, dismissDenyRunInsecureContentButton, activeTabTitle} = require('../lib/selectors')
 const urlParse = require('url').parse
 const assert = require('assert')
 const settings = require('../../js/constants/settings')
@@ -106,6 +106,41 @@ describe('navigationBar', function () {
       })
     })
 
+    describe('window.open spoofing', function () {
+      Brave.beforeAll(this)
+
+      before(function * () {
+        var page1 = Brave.server.url('spoof_opener.html')
+        yield setup(this.app.client)
+        yield this.app.client
+          .tabByUrl(Brave.newTabUrl)
+          .url(page1)
+          .waitForUrl(page1)
+          .waitForExist('a')
+          .leftClick('a')
+          .windowByIndex(0)
+          .waitUntil(function () {
+            return this.getWindowCount().then((count) => {
+              return count === 2
+            })
+          })
+      })
+
+      it('does not show faked page title', function * () {
+        yield this.app.client
+          .windowByIndex(1)
+          .moveToObject(navigator)
+          .waitForExist(urlInput)
+          .waitUntil(function () {
+            return this.getValue(urlInput).then((val) => {
+              return val.startsWith('https://www.google.com/')
+            })
+          })
+          .getText(activeTabTitle)
+          .then((title) => assert(title !== 'fake page'))
+      })
+    })
+
     describe('iframe navigation', function () {
       Brave.beforeAll(this)
 

diff --git a/test/fixtures/spoof_content.html b/test/fixtures/spoof_content.html
@@ -0,0 +1,3 @@
+<title>fake page</title>
+<h1>fake page</h1>
+<script>location="http://google.com/";</script>
diff --git a/test/fixtures/spoof_opener.html b/test/fixtures/spoof_opener.html
@@ -0,0 +1,22 @@
+<script>
+function next()
+{
+	w.location.replace('http://google.com/?'+n);n++;
+	setTimeout("next();",15);
+	setTimeout("next();",25);
+}
+function f()
+{
+	w=window.open("spoof_content.html","_blank","width=500 height=500");
+    i=setInterval(() => {
+      try {
+        x=w.location.href;
+      } catch (e) {
+        clearInterval(i);
+        n=0;
+        next();
+      }
+    }, 5);
+}
+</script>
+<a href="#" onclick="f()">Google</a><br>