[M75 merge] Only honor base@target attributes for links and forms, as the spec requires
https://html.spec.whatwg.org/multipage/semantics.html#get-an-element's-target
(cherry picked from commit cb0fb84e7fd14a20ae9528ab0e3c8e8f9de33663)
Bug: 959973, 974197
Test: http/tests/navigation/location-navigate-iframe-with-base-target.html
Change-Id: Id49d355d41b75a9911365da6cb57e895d266fa72
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1599770
Reviewed-by: Dmitry Gozman <dgozman@chromium.org>
Commit-Queue: Nate Chapin <japhet@chromium.org>
Cr-Original-Commit-Position: refs/heads/master@{#657400}
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/1660967
Reviewed-by: Andrey Kosyakov <caseq@chromium.org>
Cr-Commit-Position: refs/branch-heads/3770@{#1016}
Cr-Branched-From: a9eee1c7c727ef42a15d86e9fa7b77ff0e63840a-refs/heads/master@{#652427}
diff --git a/third_party/blink/renderer/core/html/html_anchor_element.cc b/third_party/blink/renderer/core/html/html_anchor_element.cc
index 94733fe..786167c 100644
--- a/third_party/blink/renderer/core/html/html_anchor_element.cc
+++ b/third_party/blink/renderer/core/html/html_anchor_element.cc
@@ -429,8 +429,10 @@
}
request.SetRequestContext(mojom::RequestContextType::HYPERLINK);
- FrameLoadRequest frame_request(&GetDocument(), request,
- getAttribute(kTargetAttr));
+ const AtomicString& target = getAttribute(kTargetAttr);
+ FrameLoadRequest frame_request(
+ &GetDocument(), request,
+ target.IsEmpty() ? GetDocument().BaseTarget() : target);
frame_request.SetNavigationPolicy(NavigationPolicyFromEvent(&event));
if (HasRel(kRelationNoReferrer)) {
frame_request.SetShouldSendReferrer(kNeverSendReferrer);
diff --git a/third_party/blink/renderer/core/loader/form_submission.cc b/third_party/blink/renderer/core/loader/form_submission.cc
index 020052f..1ad45a7c 100644
--- a/third_party/blink/renderer/core/loader/form_submission.cc
+++ b/third_party/blink/renderer/core/loader/form_submission.cc
@@ -288,6 +288,8 @@
if (!target_.IsEmpty())
frame_request.SetFrameName(target_);
+ else
+ frame_request.SetFrameName(origin_document->BaseTarget());
ClientNavigationReason reason = ClientNavigationReason::kFormSubmissionGet;
if (method_ == FormSubmission::kPostMethod) {
diff --git a/third_party/blink/renderer/core/loader/frame_loader.cc b/third_party/blink/renderer/core/loader/frame_loader.cc
index d1cd43d..3f2dad0e 100644
--- a/third_party/blink/renderer/core/loader/frame_loader.cc
+++ b/third_party/blink/renderer/core/loader/frame_loader.cc
@@ -730,9 +730,6 @@
"Not allowed to load local resource: " + url.ElidedString()));
return false;
}
-
- if (request.FrameName().IsEmpty())
- request.SetFrameName(frame_->GetDocument()->BaseTarget());
return true;
}
diff --git a/third_party/blink/web_tests/http/tests/navigation/location-navigate-iframe-with-base-target-expected.txt b/third_party/blink/web_tests/http/tests/navigation/location-navigate-iframe-with-base-target-expected.txt
new file mode 100644
index 0000000..984ab80
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/navigation/location-navigate-iframe-with-base-target-expected.txt
@@ -0,0 +1 @@
+PASS
diff --git a/third_party/blink/web_tests/http/tests/navigation/location-navigate-iframe-with-base-target.html b/third_party/blink/web_tests/http/tests/navigation/location-navigate-iframe-with-base-target.html
new file mode 100644
index 0000000..8af1a29
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/navigation/location-navigate-iframe-with-base-target.html
@@ -0,0 +1,15 @@
+<body>
+PASS
+<iframe id="i" src="resources/location-navigate-iframe-with-base-target-iframe.html"></iframe>
+<script>
+if (window.testRunner)
+ testRunner.dumpAsText();
+
+var navigated = false;
+i. {
+ if (navigated)
+ return;
+ navigated = true;
+ i.contentWindow.location = "resources/blank.txt";
+}
+</script>
diff --git a/third_party/blink/web_tests/http/tests/navigation/resources/location-navigate-iframe-with-base-target-iframe.html b/third_party/blink/web_tests/http/tests/navigation/resources/location-navigate-iframe-with-base-target-iframe.html
new file mode 100644
index 0000000..bed4bc1
--- /dev/null
+++ b/third_party/blink/web_tests/http/tests/navigation/resources/location-navigate-iframe-with-base-target-iframe.html
@@ -0,0 +1 @@
+<head><base target="_top"></base></head>