From 4407087b8829dc0dca96f1d8c957b00a2e7431b4 Mon Sep 17 00:00:00 2001
From: Chris Thompson <cthomp@chromium.org>
Date: Tue, 14 Jul 2026 15:49:40 -0700
Subject: [PATCH] Only HTTP-allowlist the initial host of exempted navigations

HttpsUpgradesInterceptor::MaybeCreateLoader() runs once per redirect
hop. For navigations exempted from upgrades (typed http:// URLs and
captive-portal login pages) it was adding the current hop's host to the
persistent HTTP_ALLOWED list on every invocation, so a server
controlling the first hop could allowlist arbitrary redirect-target
hosts for the lifetime of the entry.

Restrict the allowlist write to the initial request URL only; redirect
hops of an exempted navigation still load over HTTP but no longer add
their hosts to the persistent allowlist.

TAG=agy
CONV=a47522ad-72e5-4f49-9a02-96961f6324e5

Bug: 502344135
Change-Id: Ifb62ec8a705fce3e12ea266b607a4a9e1bd93962
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8094102
Commit-Queue: Chris Thompson <cthomp@chromium.org>
Reviewed-by: Mustafa Emre Acer <meacer@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1662228}
---

diff --git a/chrome/browser/ssl/https_upgrades_browsertest.cc b/chrome/browser/ssl/https_upgrades_browsertest.cc
index 2893345..11096ee 100644
--- a/chrome/browser/ssl/https_upgrades_browsertest.cc
+++ b/chrome/browser/ssl/https_upgrades_browsertest.cc
@@ -3656,6 +3656,56 @@
       contents->GetPrimaryMainFrame()->GetStoragePartition()));
 }
 
+// Tests that when a URL typed with an explicit http:// scheme is redirected by
+// the server to other hosts, only the host of the originally typed URL is
+// added to the allowlist. The exemption applies to the navigation as a whole,
+// but server-chosen redirect targets must not be persistently allowlisted.
+IN_PROC_BROWSER_TEST_P(HttpsUpgradesBrowserTest,
+                       URLsTypedWithHttpSchemeAllowlistOnlyInitialHost) {
+  if (IsHttpsFirstModeInterstitialEnabledAcrossSites()) {
+    return;
+  }
+  GURL final_url = http_server()->GetURL("baz.com", "/simple.html");
+  GURL hop_url = http_server()->GetURL(
+      "bar.com", "/server-redirect?" + final_url.spec());
+  GURL initial_url = http_server()->GetURL(
+      "foo.com", "/server-redirect?" + hop_url.spec());
+  auto* contents = GetBrowser()->tab_strip_model()->GetActiveWebContents();
+  OmniboxClient* omnibox_client = BrowserWindow::FromBrowser(GetBrowser())
+                                      ->GetLocationBar()
+                                      ->GetOmniboxController()
+                                      ->client();
+
+  Profile* profile = Profile::FromBrowserContext(contents->GetBrowserContext());
+  content::SSLHostStateDelegate* state = profile->GetSSLHostStateDelegate();
+  auto* storage_partition =
+      contents->GetPrimaryMainFrame()->GetStoragePartition();
+
+  // None of the hosts should be in the allowlist yet.
+  EXPECT_FALSE(state->IsHttpAllowedForHost("foo.com", storage_partition));
+  EXPECT_FALSE(state->IsHttpAllowedForHost("bar.com", storage_partition));
+  EXPECT_FALSE(state->IsHttpAllowedForHost("baz.com", storage_partition));
+
+  // Simulate the full URL was typed with an http scheme. The server redirects
+  // through bar.com and baz.com.
+  content::TestNavigationObserver nav_observer(contents, 1);
+  omnibox_client->OnAutocompleteAccept(
+      initial_url, nullptr, WindowOpenDisposition::CURRENT_TAB,
+      ui::PAGE_TRANSITION_TYPED, AutocompleteMatchType::URL_WHAT_YOU_TYPED,
+      base::TimeTicks(), false, true, std::u16string(), AutocompleteMatch(),
+      AutocompleteMatch());
+  nav_observer.Wait();
+
+  // None of the hops should have been upgraded.
+  EXPECT_EQ(final_url, contents->GetLastCommittedURL());
+
+  // The host the user typed should be in the allowlist, but the
+  // server-selected redirect targets should not.
+  EXPECT_TRUE(state->IsHttpAllowedForHost("foo.com", storage_partition));
+  EXPECT_FALSE(state->IsHttpAllowedForHost("bar.com", storage_partition));
+  EXPECT_FALSE(state->IsHttpAllowedForHost("baz.com", storage_partition));
+}
+
 // Returns a URL loader interceptor that responds to HTTPS URLs with a timeout
 // error.
 std::unique_ptr<content::URLLoaderInterceptor> MakeTimeoutInterceptor() {
diff --git a/chrome/browser/ssl/https_upgrades_interceptor.cc b/chrome/browser/ssl/https_upgrades_interceptor.cc
index 1cfb2b85..6922671 100644
--- a/chrome/browser/ssl/https_upgrades_interceptor.cc
+++ b/chrome/browser/ssl/https_upgrades_interceptor.cc
@@ -364,7 +364,11 @@
   // portal hostnames.
   if (!IsStrictInterstitialEnabled(*interstitial_state_) &&
       ShouldExcludeNavigationFromUpgrades(navigation_ui_data_, web_contents)) {
-    if (state) {
+    // Only allowlist the initial host of the navigation. Server-side redirect
+    // targets are not chosen by the user and shouldn't be persistently
+    // allowlisted.
+    if (state &&
+        tentative_resource_request.navigation_redirect_chain.size() <= 1) {
       state->AllowHttpForHost(tentative_resource_request.url.GetHost(),
                               storage_partition);
     }

diff --git a/chrome/browser/ssl/https_upgrades_browsertest.cc b/chrome/browser/ssl/https_upgrades_browsertest.cc
index 2893345..11096ee 100644
--- a/chrome/browser/ssl/https_upgrades_browsertest.cc
+++ b/chrome/browser/ssl/https_upgrades_browsertest.cc
@@ -3656,6 +3656,56 @@
       contents->GetPrimaryMainFrame()->GetStoragePartition()));
 }
 
+// Tests that when a URL typed with an explicit http:// scheme is redirected by
+// the server to other hosts, only the host of the originally typed URL is
+// added to the allowlist. The exemption applies to the navigation as a whole,
+// but server-chosen redirect targets must not be persistently allowlisted.
+IN_PROC_BROWSER_TEST_P(HttpsUpgradesBrowserTest,
+                       URLsTypedWithHttpSchemeAllowlistOnlyInitialHost) {
+  if (IsHttpsFirstModeInterstitialEnabledAcrossSites()) {
+    return;
+  }
+  GURL final_url = http_server()->GetURL("baz.com", "/simple.html");
+  GURL hop_url = http_server()->GetURL(
+      "bar.com", "/server-redirect?" + final_url.spec());
+  GURL initial_url = http_server()->GetURL(
+      "foo.com", "/server-redirect?" + hop_url.spec());
+  auto* contents = GetBrowser()->tab_strip_model()->GetActiveWebContents();
+  OmniboxClient* omnibox_client = BrowserWindow::FromBrowser(GetBrowser())
+                                      ->GetLocationBar()
+                                      ->GetOmniboxController()
+                                      ->client();
+
+  Profile* profile = Profile::FromBrowserContext(contents->GetBrowserContext());
+  content::SSLHostStateDelegate* state = profile->GetSSLHostStateDelegate();
+  auto* storage_partition =
+      contents->GetPrimaryMainFrame()->GetStoragePartition();
+
+  // None of the hosts should be in the allowlist yet.
+  EXPECT_FALSE(state->IsHttpAllowedForHost("foo.com", storage_partition));
+  EXPECT_FALSE(state->IsHttpAllowedForHost("bar.com", storage_partition));
+  EXPECT_FALSE(state->IsHttpAllowedForHost("baz.com", storage_partition));
+
+  // Simulate the full URL was typed with an http scheme. The server redirects
+  // through bar.com and baz.com.
+  content::TestNavigationObserver nav_observer(contents, 1);
+  omnibox_client->OnAutocompleteAccept(
+      initial_url, nullptr, WindowOpenDisposition::CURRENT_TAB,
+      ui::PAGE_TRANSITION_TYPED, AutocompleteMatchType::URL_WHAT_YOU_TYPED,
+      base::TimeTicks(), false, true, std::u16string(), AutocompleteMatch(),
+      AutocompleteMatch());
+  nav_observer.Wait();
+
+  // None of the hops should have been upgraded.
+  EXPECT_EQ(final_url, contents->GetLastCommittedURL());
+
+  // The host the user typed should be in the allowlist, but the
+  // server-selected redirect targets should not.
+  EXPECT_TRUE(state->IsHttpAllowedForHost("foo.com", storage_partition));
+  EXPECT_FALSE(state->IsHttpAllowedForHost("bar.com", storage_partition));
+  EXPECT_FALSE(state->IsHttpAllowedForHost("baz.com", storage_partition));
+}
+
 // Returns a URL loader interceptor that responds to HTTPS URLs with a timeout
 // error.
 std::unique_ptr<content::URLLoaderInterceptor> MakeTimeoutInterceptor() {