From 202324afa3f42ed4c5480eca5c0ea94a08935ec1 Mon Sep 17 00:00:00 2001
From: Charlie Reis <creis@chromium.org>
Date: Thu, 03 Sep 2026 14:00:37 -0700
Subject: [PATCH] Ensure Confirm Form Resubmission dialog works after an error page.

POST data should only be cleared in cases where it may incorrectly be
given to the renderer process of the current page or a blocked error
page, not on a failed navigation that may be retried.

This CL was partly written by Gemini.

Bug: 553614977, 531165110
Change-Id: Ic6f42f2db8e0ca36e231f56f7c7b49efe935a9bd
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8341516
Reviewed-by: Avi Drissman <avi@chromium.org>
Reviewed-by: Alex Moshchuk <alexmos@chromium.org>
Commit-Queue: Avi Drissman <avi@chromium.org>
Auto-Submit: Charlie Reis <creis@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1691913}
---

diff --git a/chrome/browser/repost_form_warning_browsertest.cc b/chrome/browser/repost_form_warning_browsertest.cc
index d7ce5b7..425e2300 100644
--- a/chrome/browser/repost_form_warning_browsertest.cc
+++ b/chrome/browser/repost_form_warning_browsertest.cc
@@ -11,14 +11,22 @@
 #include "chrome/common/url_constants.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
+#include "components/strings/grit/components_strings.h"
 #include "components/web_modal/web_contents_modal_dialog_manager.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/test/browser_test.h"
+#include "content/public/test/browser_test_utils.h"
 #include "content/public/test/test_navigation_observer.h"
+#include "net/base/net_errors.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "ui/base/l10n/l10n_util.h"
 #include "ui/base/page_transition_types.h"
 #include "ui/base/window_open_disposition.h"
+#include "ui/views/test/dialog_test.h"
+#include "ui/views/test/widget_test.h"
+#include "ui/views/widget/widget.h"
 
 using web_modal::WebContentsModalDialogManager;
 
@@ -121,3 +129,98 @@
   ShowAndVerifyUi();
 }
 #endif
+
+// Verifies that confirming form resubmission after navigating back to an
+// uncacheable POST page resubmits the POST data (https://crbug.com/553614977).
+IN_PROC_BROWSER_TEST_F(RepostFormWarningTest,
+                       ConfirmResubmissionAfterBackNavigation) {
+  content::WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+
+  // Submit a form to an uncacheable URL (/echoall/nocache) with POST data.
+  GURL echo_url = embedded_test_server()->GetURL("/echoall/nocache");
+  {
+    content::TestNavigationObserver observer(web_contents);
+    ASSERT_TRUE(content::ExecJs(
+        web_contents, content::JsReplace(
+                          R"(let form = document.createElement('form');
+               form.method = 'POST';
+               form.action = $1;
+               let input = document.createElement('input');
+               input.name = 'text';
+               input.value = 'val';
+               form.appendChild(input);
+               document.body.appendChild(form);
+               form.submit();)",
+                          echo_url)));
+    observer.Wait();
+    EXPECT_TRUE(observer.last_navigation_succeeded());
+  }
+  EXPECT_EQ(echo_url, web_contents->GetLastCommittedURL());
+
+  // Verify that the initial POST was successful and body was echoed.
+  EXPECT_EQ(
+      "text=val\n",
+      content::EvalJs(web_contents,
+                      "document.getElementsByTagName('pre')[0].innerText;"));
+
+  // Navigate forward to another page.
+  GURL other_url = embedded_test_server()->GetURL("/title2.html");
+  ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), other_url));
+  EXPECT_EQ(other_url, web_contents->GetLastCommittedURL());
+
+  // Navigate back to the POST page. Because it is uncacheable, this results in
+  // net::ERR_CACHE_MISS and displays the "Confirm Form Resubmission" error
+  // page.
+  {
+    content::TestNavigationObserver back_observer(web_contents);
+    web_contents->GetController().GoBack();
+    back_observer.Wait();
+    EXPECT_FALSE(back_observer.last_navigation_succeeded());
+    EXPECT_EQ(net::ERR_CACHE_MISS, back_observer.last_net_error_code());
+  }
+  EXPECT_EQ(echo_url, web_contents->GetLastCommittedURL());
+
+  // Reload the page, checking for repost.
+  web_contents->GetController().Reload(content::ReloadType::NORMAL,
+                                       /*check_for_repost=*/true);
+
+  // Wait for the repost warning dialog to become active.
+  WebContentsModalDialogManager* modal_dialog_manager =
+      WebContentsModalDialogManager::FromWebContents(web_contents);
+  ASSERT_TRUE(base::test::RunUntil(
+      [&]() { return modal_dialog_manager->IsDialogActive(); }));
+
+  // Find the dialog widget.
+  views::Widget* dialog_widget = nullptr;
+  for (views::Widget* widget : views::test::WidgetTest::GetAllWidgets()) {
+    if (widget->widget_delegate() &&
+        widget->widget_delegate()->AsDialogDelegate() &&
+        widget->widget_delegate()->GetWindowTitle() ==
+            l10n_util::GetStringUTF16(IDS_HTTP_POST_WARNING_TITLE)) {
+      dialog_widget = widget;
+      break;
+    }
+  }
+  ASSERT_TRUE(dialog_widget);
+
+  // Accept the dialog ("Continue") and wait for the reload to finish.
+  content::TestNavigationObserver reload_observer(web_contents);
+  views::test::AcceptDialog(dialog_widget);
+  reload_observer.Wait();
+  EXPECT_TRUE(reload_observer.last_navigation_succeeded());
+  EXPECT_EQ(echo_url, web_contents->GetLastCommittedURL());
+
+  // Verify that the reload was a POST request.
+  std::string request_headers =
+      content::EvalJs(web_contents,
+                      "document.getElementById('request-headers').innerText;")
+          .ExtractString();
+  EXPECT_THAT(request_headers, ::testing::HasSubstr("POST /echoall/nocache"));
+
+  // Verify that the POST body was resubmitted and echoed in the page body.
+  EXPECT_EQ(
+      "text=val\n",
+      content::EvalJs(web_contents,
+                      "document.getElementsByTagName('pre')[0].innerText;"));
+}
diff --git a/content/browser/renderer_host/navigation_request.cc b/content/browser/renderer_host/navigation_request.cc
index b7e23d3..74daa15 100644
--- a/content/browser/renderer_host/navigation_request.cc
+++ b/content/browser/renderer_host/navigation_request.cc
@@ -3544,10 +3544,21 @@
   origin_related_state_.reset();
 
   // If this was not a redirect that preserves POST submissions (e.g., 307), or
-  // if this will be an error page that may end up in another process, then
-  // clear the post_data as well to prevent leaking file references to a
-  // different SiteInstance.
-  if (!IsPost() || DidEncounterError()) {
+  // if this will be a blocked error page or otherwise ends up in the current
+  // process, then clear the post_data as well to prevent leaking file
+  // references to a different SiteInstance.
+  //
+  // It is not necessary to reset POST data for error pages in the isolated
+  // error page process, and it is important not to reset it for failed cases
+  // that end up in kDestinationProcess (e.g. "Confirm Form Resubmission"
+  // pages with ERR_CACHE_MISS), when it might later be used successfully.
+  //
+  // TODO(crbug.com/40134629): Remove the error page exception if subframe error
+  // page isolation is enabled.
+  if (!IsPost() ||
+      (DidEncounterError() &&
+       (ComputeErrorPageProcess() == ErrorPageProcess::kCurrentProcess ||
+        net::IsRequestBlockedError(net_error_)))) {
     common_params_->post_data.reset();
   }
 }

diff --git a/chrome/browser/repost_form_warning_browsertest.cc b/chrome/browser/repost_form_warning_browsertest.cc
index d7ce5b7..425e2300 100644
--- a/chrome/browser/repost_form_warning_browsertest.cc
+++ b/chrome/browser/repost_form_warning_browsertest.cc
@@ -11,14 +11,22 @@
 #include "chrome/common/url_constants.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
+#include "components/strings/grit/components_strings.h"
 #include "components/web_modal/web_contents_modal_dialog_manager.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/test/browser_test.h"
+#include "content/public/test/browser_test_utils.h"
 #include "content/public/test/test_navigation_observer.h"
+#include "net/base/net_errors.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "ui/base/l10n/l10n_util.h"
 #include "ui/base/page_transition_types.h"
 #include "ui/base/window_open_disposition.h"
+#include "ui/views/test/dialog_test.h"
+#include "ui/views/test/widget_test.h"
+#include "ui/views/widget/widget.h"
 
 using web_modal::WebContentsModalDialogManager;
 
@@ -121,3 +129,98 @@
   ShowAndVerifyUi();
 }
 #endif
+
+// Verifies that confirming form resubmission after navigating back to an
+// uncacheable POST page resubmits the POST data (https://crbug.com/553614977).
+IN_PROC_BROWSER_TEST_F(RepostFormWarningTest,
+                       ConfirmResubmissionAfterBackNavigation) {
+  content::WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+
+  // Submit a form to an uncacheable URL (/echoall/nocache) with POST data.
+  GURL echo_url = embedded_test_server()->GetURL("/echoall/nocache");
+  {
+    content::TestNavigationObserver observer(web_contents);
+    ASSERT_TRUE(content::ExecJs(
+        web_contents, content::JsReplace(
+                          R"(let form = document.createElement('form');
+               form.method = 'POST';
+               form.action = $1;
+               let input = document.createElement('input');
+               input.name = 'text';
+               input.value = 'val';
+               form.appendChild(input);
+               document.body.appendChild(form);
+               form.submit();)",
+                          echo_url)));
+    observer.Wait();
+    EXPECT_TRUE(observer.last_navigation_succeeded());
+  }
+  EXPECT_EQ(echo_url, web_contents->GetLastCommittedURL());
+
+  // Verify that the initial POST was successful and body was echoed.
+  EXPECT_EQ(
+      "text=val\n",
+      content::EvalJs(web_contents,
+                      "document.getElementsByTagName('pre')[0].innerText;"));
+
+  // Navigate forward to another page.
+  GURL other_url = embedded_test_server()->GetURL("/title2.html");
+  ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), other_url));
+  EXPECT_EQ(other_url, web_contents->GetLastCommittedURL());
+
+  // Navigate back to the POST page. Because it is uncacheable, this results in
+  // net::ERR_CACHE_MISS and displays the "Confirm Form Resubmission" error
+  // page.
+  {
+    content::TestNavigationObserver back_observer(web_contents);
+    web_contents->GetController().GoBack();
+    back_observer.Wait();
+    EXPECT_FALSE(back_observer.last_navigation_succeeded());
+    EXPECT_EQ(net::ERR_CACHE_MISS, back_observer.last_net_error_code());
+  }
+  EXPECT_EQ(echo_url, web_contents->GetLastCommittedURL());
+
+  // Reload the page, checking for repost.
+  web_contents->GetController().Reload(content::ReloadType::NORMAL,
+                                       /*check_for_repost=*/true);
+
+  // Wait for the repost warning dialog to become active.
+  WebContentsModalDialogManager* modal_dialog_manager =
+      WebContentsModalDialogManager::FromWebContents(web_contents);
+  ASSERT_TRUE(base::test::RunUntil(
+      [&]() { return modal_dialog_manager->IsDialogActive(); }));
+
+  // Find the dialog widget.
+  views::Widget* dialog_widget = nullptr;
+  for (views::Widget* widget : views::test::WidgetTest::GetAllWidgets()) {
+    if (widget->widget_delegate() &&
+        widget->widget_delegate()->AsDialogDelegate() &&
+        widget->widget_delegate()->GetWindowTitle() ==
+            l10n_util::GetStringUTF16(IDS_HTTP_POST_WARNING_TITLE)) {
+      dialog_widget = widget;
+      break;
+    }
+  }
+  ASSERT_TRUE(dialog_widget);
+
+  // Accept the dialog ("Continue") and wait for the reload to finish.
+  content::TestNavigationObserver reload_observer(web_contents);
+  views::test::AcceptDialog(dialog_widget);
+  reload_observer.Wait();
+  EXPECT_TRUE(reload_observer.last_navigation_succeeded());
+  EXPECT_EQ(echo_url, web_contents->GetLastCommittedURL());
+
+  // Verify that the reload was a POST request.
+  std::string request_headers =
+      content::EvalJs(web_contents,
+                      "document.getElementById('request-headers').innerText;")
+          .ExtractString();
+  EXPECT_THAT(request_headers, ::testing::HasSubstr("POST /echoall/nocache"));
+
+  // Verify that the POST body was resubmitted and echoed in the page body.
+  EXPECT_EQ(
+      "text=val\n",
+      content::EvalJs(web_contents,
+                      "document.getElementsByTagName('pre')[0].innerText;"));
+}