[Critical CH] Test redirects

We need to verify behavior of critical-ch when it comes to redirects.
We need to know that the critical hints are included in the final
page except in the case of a same-origin redirect where the intermediate
and final page both have critical-hints. Any given load only restarts
once per origin so two differing critical hint sets in a single chain
won't both be respected (only the first will be).

Bug: 1428593
Change-Id: Ic0f3469e26828f1196a6f7066acc5eabaea110d2
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/4377410
Reviewed-by: Mike Taylor <[email protected]>
Commit-Queue: Ari Chivukula <[email protected]>
Auto-Submit: Ari Chivukula <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1125414}

client-hints/critical-ch/iframe.https.window.js

@@ -1,15 +1,15 @@
 // META: script=resources/util.js
 
 async_test((t) => {
+  window.addEventListener('message', message_listener(t, "FAIL"));
   var iframe = document.createElement("iframe");
   iframe.src = ECHO_URL;
   document.body.appendChild(iframe);
-  iframe.contentWindow.addEventListener('message', message_listener(t, "FAIL"));
 }, "Critical-CH iframe");
 
 async_test((t) => {
+  window.addEventListener('message', message_listener(t, "FAIL"));
   var iframe = document.createElement("iframe");
   iframe.src = ECHO_URL+"?multiple=true";
   document.body.appendChild(iframe);
-  iframe.contentWindow.addEventListener('message', message_listener(t, "FAIL"));
 }, "Critical-CH w/ multiple headers and iframe");

client-hints/critical-ch/navigation.cross-origin.https.window.js

@@ -0,0 +1,4 @@
+// META: script=resources/util.js
+// META: script=/common/get-host-info.sub.js
+
+async_test(make_message_test(get_host_info().HTTPS_REMOTE_ORIGIN+"/client-hints/critical-ch/"+ECHO_URL, "PASS"), "Critical-CH cross-origin navigation")

client-hints/critical-ch/navigation.cross-origin.multiple.https.window.js

@@ -0,0 +1,4 @@
+// META: script=resources/util.js
+// META: script=/common/get-host-info.sub.js
+
+async_test(make_message_test(get_host_info().HTTPS_REMOTE_ORIGIN+"/client-hints/critical-ch/"+ECHO_URL+"?multiple=true", "PASS"), "Critical-CH w/ multiple headers and cross-origin navigation")

client-hints/critical-ch/redirect.critical.cross-origin.https.window.js

@@ -0,0 +1,4 @@
+// META: script=resources/util.js
+// META: script=/common/get-host-info.sub.js
+
+async_test(make_message_test(REDIRECT_URL+"?critical=true&location="+get_host_info().HTTPS_REMOTE_ORIGIN+"/client-hints/critical-ch/"+ECHO_URL, "PASS"), "Critical-CH cross-origin critical redirect")

client-hints/critical-ch/redirect.critical.cross-origin.multiple.https.window.js

@@ -0,0 +1,4 @@
+// META: script=resources/util.js
+// META: script=/common/get-host-info.sub.js
+
+async_test(make_message_test(REDIRECT_URL+"?critical=true&location="+get_host_info().HTTPS_REMOTE_ORIGIN+"/client-hints/critical-ch/"+ECHO_URL+"?multiple=true", "PASS"), "Critical-CH w/ multiple headers cross-origin critical redirect")

client-hints/critical-ch/redirect.critical.same-origin.https.window.js

@@ -0,0 +1,3 @@
+// META: script=resources/util.js
+
+async_test(make_message_test(REDIRECT_URL+"?critical=true&location=/client-hints/critical-ch/"+ECHO_URL, "FAIL"), "Critical-CH critical redirect")

client-hints/critical-ch/redirect.critical.same-origin.multiple.https.window.js

@@ -0,0 +1,3 @@
+// META: script=resources/util.js
+
+async_test(make_message_test(REDIRECT_URL+"?critical=true&location=/client-hints/critical-ch/"+ECHO_URL+"?multiple=true", "FAIL"), "Critical-CH w/ multiple headers and critical redirect")

client-hints/critical-ch/redirect.cross-origin.https.window.js

@@ -0,0 +1,4 @@
+// META: script=resources/util.js
+// META: script=/common/get-host-info.sub.js
+
+async_test(make_message_test(REDIRECT_URL+"?location="+get_host_info().HTTPS_REMOTE_ORIGIN+"/client-hints/critical-ch/"+ECHO_URL, "PASS"), "Critical-CH cross-origin redirect")

client-hints/critical-ch/redirect.cross-origin.multiple.https.window.js

@@ -0,0 +1,4 @@
+// META: script=resources/util.js
+// META: script=/common/get-host-info.sub.js
+
+async_test(make_message_test(REDIRECT_URL+"?location="+get_host_info().HTTPS_REMOTE_ORIGIN+"/client-hints/critical-ch/"+ECHO_URL+"?multiple=true", "PASS"), "Critical-CH w/ multiple headers cross-origin redirect")

client-hints/critical-ch/redirect.same-origin.https.window.js

@@ -0,0 +1,3 @@
+// META: script=resources/util.js
+
+async_test(make_message_test(REDIRECT_URL+"?location=/client-hints/critical-ch/"+ECHO_URL, "PASS"), "Critical-CH redirect")

client-hints/critical-ch/redirect.same-origin.multiple.https.window.js

@@ -0,0 +1,3 @@
+// META: script=resources/util.js
+
+async_test(make_message_test(REDIRECT_URL+"?location=/client-hints/critical-ch/"+ECHO_URL+"?multiple=true", "PASS"), "Critical-CH w/ multiple headers and redirect")

client-hints/critical-ch/resources/echo-critical-hint.py

@@ -49,4 +49,4 @@ def main(request, response):
     if b"sec-ch-viewport-width" in request.headers and b"viewport-width" in request.headers:
       result = "MISMATCH"
 
-    response.content = "<script>window.postMessage('{0}', '*')</script>".format(result)
+    response.content = "<script>(window.opener || window.top).postMessage('{0}', '*')</script>".format(result)

client-hints/critical-ch/resources/redirect-critical-hint.py

@@ -0,0 +1,14 @@
+def main(request, response):
+    """
+    Simple handler that redirects to echo-critical-hint.py.
+    """
+
+    response.status = 302
+    location = request.GET.first(b"location")
+    response.headers.set(b"Location", location)
+    response.headers.set(b"Access-Control-Allow-Origin", b"*")
+    if(request.GET.first(b"critical", None) is not None):
+        hints = b"sec-ch-dpr,dpr"
+        response.headers.append(b"Accept-CH", hints)
+        response.headers.append(b"Critical-CH", hints)
+

client-hints/critical-ch/resources/util.js

@@ -1,4 +1,5 @@
 ECHO_URL = "resources/echo-critical-hint.py"
+REDIRECT_URL = "resources/redirect-critical-hint.py"
 
 message_listener = (t, message) =>
   (e) => {
@@ -10,6 +11,6 @@ make_message_test = (url, message) =>
   (t) => {
     popup_window = window.open("/common/blank.html");
     assert_not_equals(popup_window, null, "Popup windows not allowed?");
-    popup_window.addEventListener('message', message_listener(t, message));
+    window.addEventListener('message', message_listener(t, message));
     popup_window.location = url;
   }

client-hints/critical-ch/unsafe-method.https.window.js

@@ -1,3 +1,5 @@
+// META: script=resources/util.js
+
 async_test((t) => {
   // This test requires a navigation with a non-safe (i.e. non-GET) HTTP
   // response, which the Critical-CH spec says to ignore. The most
@@ -7,18 +9,18 @@ async_test((t) => {
   // Build the form DOM element
   var form = document.createElement("form");
   form.setAttribute("method", "post");
-  form.setAttribute("action", "resources/echo-critical-hint.py");
+  form.setAttribute("action", ECHO_URL);
   form.setAttribute("target", "popup"); //don't navigate away from the page running the test...
   document.body.appendChild(form);
 
-  var popup_window = window.open("/common/blank.html", "popup");
-  assert_not_equals(popup_window, null, "Popup windows not allowed?");
-
-  popup_window.addEventListener('message', (e) => {
+  window.addEventListener('message', (e) => {
     t.step(()=>{assert_equals(e.data, "FAIL")});
     t.done();
   });
 
+  var popup_window = window.open("/common/blank.html", "popup");
+  assert_not_equals(popup_window, null, "Popup windows not allowed?");
+
   form.submit();
 }, "Critical-CH unsafe method")
 
@@ -31,17 +33,17 @@ async_test((t) => {
   // Build the form DOM element
   var form = document.createElement("form");
   form.setAttribute("method", "post");
-  form.setAttribute("action", "resources/echo-critical-hint.py?multiple=true");
+  form.setAttribute("action", ECHO_URL+"?multiple=true");
   form.setAttribute("target", "popup"); //don't navigate away from the page running the test...
   document.body.appendChild(form);
 
-  var popup_window = window.open("/common/blank.html", "popup");
-  assert_not_equals(popup_window, null, "Popup windows not allowed?");
-
-  popup_window.addEventListener('message', (e) => {
+  window.addEventListener('message', (e) => {
     t.step(()=>{assert_equals(e.data, "FAIL")});
     t.done();
   });
 
+  var popup_window = window.open("/common/blank.html", "popup");
+  assert_not_equals(popup_window, null, "Popup windows not allowed?");
+
   form.submit();
 }, "Critical-CH w/ multiple headers and unsafe method")