From 4e7387c0225a714c92d95301f4983d1c7c0d9abb Mon Sep 17 00:00:00 2001
From: Vladimir Levin <vmpstr@chromium.org>
Date: Tue, 25 Aug 2026 12:22:43 -0700
Subject: [PATCH] sttf: Bind the trusted initiator to the initiator creating the fragment

When we create a scroll to text fragment, we might delay processing it
until related page sets are finalized. Meanwhile, we may do a same
doc navigation. Ensure that when we check security restrictions, we
check whether the initiator is trusted using the initiator that created
the fragment, not the latest initiator which may be the wrong thing to
use.

R=bokan@chromium.org

Bug: 549911100
Change-Id: Iabf8796c38576c4bc17549e6c8a1509d5751b731
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8286565
Reviewed-by: David Bokan <bokan@chromium.org>
Reviewed-by: Dave Tapuska <dtapuska@chromium.org>
Commit-Queue: Vladimir Levin <vmpstr@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1685838}
---
diff --git a/third_party/blink/public/web/web_navigation_params.h b/third_party/blink/public/web/web_navigation_params.h
index e265f408e..cc146441 100644
--- a/third_party/blink/public/web/web_navigation_params.h
+++ b/third_party/blink/public/web/web_navigation_params.h
@@ -460,6 +460,9 @@
   // This is based on a user activation but is different from the above bit as
   // it can be propagated across redirects and is consumed on use.
   bool has_text_fragment_token = false;
+  // Whether the navigation that produced the text fragment token was initiated
+  // from the same-origin as the document or was browser-initiated.
+  bool text_fragment_token_had_trusted_initiator = false;
   // Whether this navigation was browser initiated.
   bool is_browser_initiated = false;
   // Whether the document should be able to access local file:// resources.
diff --git a/third_party/blink/renderer/core/fragment_directive/text_fragment_anchor.cc b/third_party/blink/renderer/core/fragment_directive/text_fragment_anchor.cc
index 0fb4b09d..7ca5ca91 100644
--- a/third_party/blink/renderer/core/fragment_directive/text_fragment_anchor.cc
+++ b/third_party/blink/renderer/core/fragment_directive/text_fragment_anchor.cc
@@ -76,7 +76,7 @@
   // cross origin iframes or window.open.
   if (!frame.Loader()
            .GetDocumentLoader()
-           ->LastNavigationHadTrustedInitiator()) {
+           ->TextFragmentTokenHadTrustedInitiator()) {
     if (frame.Tree().Parent()) {
       TRACE_EVENT_INSTANT("blink", "CheckSecurityRestrictions", "Result",
                           "Cross-Origin Subframe");
diff --git a/third_party/blink/renderer/core/loader/document_loader.cc b/third_party/blink/renderer/core/loader/document_loader.cc
index 6d2e5b9..83030274 100644
--- a/third_party/blink/renderer/core/loader/document_loader.cc
+++ b/third_party/blink/renderer/core/loader/document_loader.cc
@@ -417,6 +417,7 @@
   bool is_browser_initiated;
   bool is_prerendering;
   bool has_text_fragment_token;
+  bool text_fragment_token_had_trusted_initiator;
   std::optional<String> internal_scroll_to_text_fragment;
   bool was_discarded;
   bool loading_main_document_from_mhtml_archive;
@@ -655,6 +656,10 @@
   // consume its token.
   has_text_fragment_token_ = TextFragmentAnchor::GenerateNewToken(*this) ||
                              params_->has_text_fragment_token;
+  if (params_->has_text_fragment_token) {
+    text_fragment_token_had_trusted_initiator_ =
+        params_->text_fragment_token_had_trusted_initiator;
+  }
 
   if (params_->internal_scroll_to_text_fragment) {
     // We store this in a separate member because params_ is cleared after
@@ -789,6 +794,8 @@
   params->should_have_sticky_user_activation =
       frame_->HasStickyUserActivation() && !frame_->IsMainFrame();
   params->has_text_fragment_token = has_text_fragment_token_;
+  params->text_fragment_token_had_trusted_initiator =
+      text_fragment_token_had_trusted_initiator_;
   if (internal_scroll_to_text_fragment_) {
     params->internal_scroll_to_text_fragment =
         WebString(*internal_scroll_to_text_fragment_);
@@ -1143,6 +1150,10 @@
     has_text_fragment_token_ =
         TextFragmentAnchor::GenerateNewTokenForSameDocument(
             *this, type, same_document_navigation_type);
+    if (has_text_fragment_token_) {
+      text_fragment_token_had_trusted_initiator_ =
+          last_navigation_had_trusted_initiator_;
+    }
   }
 
   SetHistoryItemStateForCommit(history_item_.Get(), type,
@@ -3316,6 +3327,10 @@
   // API).
   last_navigation_had_trusted_initiator_ =
       !requestor_origin_ || is_same_origin_initiator;
+  if (has_text_fragment_token_) {
+    text_fragment_token_had_trusted_initiator_ =
+        last_navigation_had_trusted_initiator_;
+  }
 
   // The PaintHolding feature defers compositor commits until content has been
   // painted or 500ms have passed, whichever comes first. We require that this
diff --git a/third_party/blink/renderer/core/loader/document_loader.h b/third_party/blink/renderer/core/loader/document_loader.h
index 97360e7..145c25a 100644
--- a/third_party/blink/renderer/core/loader/document_loader.h
+++ b/third_party/blink/renderer/core/loader/document_loader.h
@@ -389,6 +389,10 @@
     return last_navigation_had_trusted_initiator_;
   }
 
+  bool TextFragmentTokenHadTrustedInitiator() const {
+    return text_fragment_token_had_trusted_initiator_;
+  }
+
   // Called when the URL needs to be updated due to a document.open() call.
   void DidOpenDocumentInputStream(const KURL& url);
 
@@ -818,6 +822,10 @@
   // through a redirect.
   bool has_text_fragment_token_ = false;
 
+  // If true, the navigation that produced the text fragment token was initiated
+  // from the same-origin as the document or was browser-initiated.
+  bool text_fragment_token_had_trusted_initiator_ = false;
+
   // If set, the document should attempt to scroll this text fragment into view
   // upon load, without highlighting it.
   std::optional<String> internal_scroll_to_text_fragment_;
diff --git a/third_party/blink/renderer/core/loader/frame_loader.cc b/third_party/blink/renderer/core/loader/frame_loader.cc
index cd5f06b..83153fc 100644
--- a/third_party/blink/renderer/core/loader/frame_loader.cc
+++ b/third_party/blink/renderer/core/loader/frame_loader.cc
@@ -579,8 +579,21 @@
 
   // We need to scroll to the fragment whether or not a hash change occurred,
   // since the user might have scrolled since the previous navigation.
-  ProcessFragment(url, frame_load_type, kNavigationWithinSameDocument);
-  has_pending_cross_document_fragment_ = false;
+  if (url.HasFragmentIdentifier()) {
+    // If the same-document navigation explicitly navigates to a fragment, abort
+    // any pending cross-document text fragment and process the new fragment
+    // immediately.
+    has_pending_cross_document_fragment_ = false;
+    ProcessFragment(url, frame_load_type, kNavigationWithinSameDocument);
+  } else if (!has_pending_cross_document_fragment_ ||
+             (frame_->View() && frame_->GetPage() &&
+              frame_->GetPage()
+                  ->RelatedPagesMutationFromPreviousPageFinalized())) {
+    // Avoid prematurely processing a deferred cross-document text fragment
+    // until related pages state is finalized.
+    ProcessFragment(url, frame_load_type, kNavigationWithinSameDocument);
+    has_pending_cross_document_fragment_ = false;
+  }
 
   TakeObjectSnapshot();
 }
diff --git a/third_party/blink/web_tests/external/wpt/scroll-to-text-fragment/scroll-to-text-fragment-security-replacestate-target.html b/third_party/blink/web_tests/external/wpt/scroll-to-text-fragment/scroll-to-text-fragment-security-replacestate-target.html
new file mode 100644
index 0000000..ba1609c
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/scroll-to-text-fragment/scroll-to-text-fragment-security-replacestate-target.html
@@ -0,0 +1,79 @@
+<!doctype html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Scroll to text fragment security replaceState target</title>
+  <script src="stash.js"></script>
+  <style>
+    body {
+      margin: 0;
+    }
+    .spacer {
+      height: 3000px;
+    }
+    #text {
+      font-size: 24px;
+      background-color: yellow;
+    }
+  </style>
+  <script>
+    const params = new URLSearchParams(location.search);
+    const action = params.get("action");
+    const key = params.get("key");
+
+    if (action === "replaceState-head") {
+      history.replaceState(null, "", location.pathname + "?cleaned=1");
+    }
+
+    document.addEventListener("DOMContentLoaded", () => {
+      if (action === "replaceState-domcontentloaded") {
+        history.replaceState(null, "", location.pathname + "?cleaned=1");
+      }
+    });
+
+    function isInView(element) {
+      const rect = element.getBoundingClientRect();
+      return rect.top >= 0 && rect.top <= window.innerHeight
+          && rect.left >= 0 && rect.left <= window.innerWidth;
+    }
+
+    function checkScroll() {
+      let position = 'unknown';
+      if (window.scrollY === 0) {
+        position = 'top';
+      } else if (isInView(document.getElementById('text'))) {
+        position = 'text';
+      }
+
+      const results = {
+        action: action,
+        scrollPosition: position,
+        scrollY: window.scrollY,
+        href: window.location.href
+      };
+      stashResultsThenClose(key, results);
+    }
+
+    window.addEventListener("load", () => {
+      window.requestAnimationFrame(() => {
+        window.requestAnimationFrame(checkScroll);
+      });
+    });
+  </script>
+</head>
+<body>
+  <script>
+    if (action === "replaceState-body-start") {
+      history.replaceState(null, "", location.pathname + "?cleaned=1");
+    }
+  </script>
+  <div class="spacer"></div>
+  <p id="text">target text to match</p>
+  <div class="spacer"></div>
+  <script>
+    if (action === "replaceState-body-end") {
+      history.replaceState(null, "", location.pathname + "?cleaned=1");
+    }
+  </script>
+</body>
+</html>
diff --git a/third_party/blink/web_tests/external/wpt/scroll-to-text-fragment/scroll-to-text-fragment-security-replacestate.sub.html b/third_party/blink/web_tests/external/wpt/scroll-to-text-fragment/scroll-to-text-fragment-security-replacestate.sub.html
new file mode 100644
index 0000000..0f2d6cf
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/scroll-to-text-fragment/scroll-to-text-fragment-security-replacestate.sub.html
@@ -0,0 +1,57 @@
+<!doctype html>
+<title>Scroll to text fragment security with history.replaceState()</title>
+<meta charset=utf-8>
+<link rel="help" href="https://wicg.github.io/ScrollToTextFragment/#check-if-a-text-directive-can-be-scrolled">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="/common/utils.js"></script>
+<script src="stash.js"></script>
+<script>
+const crossOriginTarget = "http://{{hosts[alt][www]}}:{{ports[http][0]}}/scroll-to-text-fragment/scroll-to-text-fragment-security-replacestate-target.html";
+
+// Sanity checks: when noopener is provided, scrolling to text fragment should work as expected.
+for (const testCase of [
+  { action: "none", description: "Sanity check: noopener with no replaceState scrolls to text fragment" },
+  { action: "replaceState-head", description: "Sanity check: noopener with replaceState in head scrolls to text fragment" },
+]) {
+  promise_test(t => new Promise((resolve, reject) => {
+    const key = token();
+    const url = `${crossOriginTarget}?action=${testCase.action}&key=${key}#:~:text=target%20text`;
+
+    test_driver.bless('Open a URL with a text fragment directive with noopener', () => {
+      window.open(url, '_blank', 'noopener');
+    });
+
+    fetchResults(key, resolve, reject);
+  }).then(data => {
+    assert_equals(data.scrollPosition, 'text',
+      `Expected text fragment directive to activate with noopener, but got scrollPosition=${data.scrollPosition} (scrollY=${data.scrollY})`);
+  }), testCase.description);
+}
+
+// Security restrictions: when opened without noopener (opener retained), text fragment directive
+// MUST NOT activate, even if the target document performs same-document navigations like replaceState().
+for (const testCase of [
+  { action: "none", description: "Control: no replaceState, text fragment directive must not activate when opened with window opener" },
+  { action: "replaceState-head", description: "replaceState in head must not bypass security restriction when opened with window opener" },
+  { action: "replaceState-body-start", description: "replaceState at start of body must not bypass security restriction when opened with window opener" },
+  { action: "replaceState-body-end", description: "replaceState at end of body must not bypass security restriction when opened with window opener" },
+  { action: "replaceState-domcontentloaded", description: "replaceState in DOMContentLoaded must not bypass security restriction when opened with window opener" },
+]) {
+  promise_test(t => new Promise((resolve, reject) => {
+    const key = token();
+    const url = `${crossOriginTarget}?action=${testCase.action}&key=${key}#:~:text=target%20text`;
+
+    test_driver.bless('Open a URL with a text fragment directive with opener', () => {
+      window.open(url, '_blank');
+    });
+
+    fetchResults(key, resolve, reject);
+  }).then(data => {
+    assert_equals(data.scrollPosition, 'top',
+      `Expected text fragment directive to not activate when opened with an opener, but got scrollPosition=${data.scrollPosition} (scrollY=${data.scrollY})`);
+  }), testCase.description);
+}
+</script>

diff --git a/third_party/blink/web_tests/external/wpt/scroll-to-text-fragment/scroll-to-text-fragment-security-replacestate-target.html b/third_party/blink/web_tests/external/wpt/scroll-to-text-fragment/scroll-to-text-fragment-security-replacestate-target.html
new file mode 100644
index 0000000..ba1609c
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/scroll-to-text-fragment/scroll-to-text-fragment-security-replacestate-target.html
@@ -0,0 +1,79 @@
+<!doctype html>
+<html>
+<head>
+  <meta charset="utf-8">
+  <title>Scroll to text fragment security replaceState target</title>
+  <script src="stash.js"></script>
+  <style>
+    body {
+      margin: 0;
+    }
+    .spacer {
+      height: 3000px;
+    }
+    #text {
+      font-size: 24px;
+      background-color: yellow;
+    }
+  </style>
+  <script>
+    const params = new URLSearchParams(location.search);
+    const action = params.get("action");
+    const key = params.get("key");
+
+    if (action === "replaceState-head") {
+      history.replaceState(null, "", location.pathname + "?cleaned=1");
+    }
+
+    document.addEventListener("DOMContentLoaded", () => {
+      if (action === "replaceState-domcontentloaded") {
+        history.replaceState(null, "", location.pathname + "?cleaned=1");
+      }
+    });
+
+    function isInView(element) {
+      const rect = element.getBoundingClientRect();
+      return rect.top >= 0 && rect.top <= window.innerHeight
+          && rect.left >= 0 && rect.left <= window.innerWidth;
+    }
+
+    function checkScroll() {
+      let position = 'unknown';
+      if (window.scrollY === 0) {
+        position = 'top';
+      } else if (isInView(document.getElementById('text'))) {
+        position = 'text';
+      }
+
+      const results = {
+        action: action,
+        scrollPosition: position,
+        scrollY: window.scrollY,
+        href: window.location.href
+      };
+      stashResultsThenClose(key, results);
+    }
+
+    window.addEventListener("load", () => {
+      window.requestAnimationFrame(() => {
+        window.requestAnimationFrame(checkScroll);
+      });
+    });
+  </script>
+</head>
+<body>
+  <script>
+    if (action === "replaceState-body-start") {
+      history.replaceState(null, "", location.pathname + "?cleaned=1");
+    }
+  </script>
+  <div class="spacer"></div>
+  <p id="text">target text to match</p>
+  <div class="spacer"></div>
+  <script>
+    if (action === "replaceState-body-end") {
+      history.replaceState(null, "", location.pathname + "?cleaned=1");
+    }
+  </script>
+</body>
+</html>
diff --git a/third_party/blink/web_tests/external/wpt/scroll-to-text-fragment/scroll-to-text-fragment-security-replacestate.sub.html b/third_party/blink/web_tests/external/wpt/scroll-to-text-fragment/scroll-to-text-fragment-security-replacestate.sub.html
new file mode 100644
index 0000000..0f2d6cf
--- /dev/null
+++ b/third_party/blink/web_tests/external/wpt/scroll-to-text-fragment/scroll-to-text-fragment-security-replacestate.sub.html
@@ -0,0 +1,57 @@
+<!doctype html>
+<title>Scroll to text fragment security with history.replaceState()</title>
+<meta charset=utf-8>
+<link rel="help" href="https://wicg.github.io/ScrollToTextFragment/#check-if-a-text-directive-can-be-scrolled">
+<script src="/resources/testharness.js"></script>
+<script src="/resources/testharnessreport.js"></script>
+<script src="/resources/testdriver.js"></script>
+<script src="/resources/testdriver-vendor.js"></script>
+<script src="/common/utils.js"></script>
+<script src="stash.js"></script>
+<script>
+const crossOriginTarget = "http://{{hosts[alt][www]}}:{{ports[http][0]}}/scroll-to-text-fragment/scroll-to-text-fragment-security-replacestate-target.html";
+
+// Sanity checks: when noopener is provided, scrolling to text fragment should work as expected.
+for (const testCase of [
+  { action: "none", description: "Sanity check: noopener with no replaceState scrolls to text fragment" },
+  { action: "replaceState-head", description: "Sanity check: noopener with replaceState in head scrolls to text fragment" },
+]) {
+  promise_test(t => new Promise((resolve, reject) => {
+    const key = token();
+    const url = `${crossOriginTarget}?action=${testCase.action}&key=${key}#:~:text=target%20text`;
+
+    test_driver.bless('Open a URL with a text fragment directive with noopener', () => {
+      window.open(url, '_blank', 'noopener');
+    });
+
+    fetchResults(key, resolve, reject);
+  }).then(data => {
+    assert_equals(data.scrollPosition, 'text',
+      `Expected text fragment directive to activate with noopener, but got scrollPosition=${data.scrollPosition} (scrollY=${data.scrollY})`);
+  }), testCase.description);
+}
+
+// Security restrictions: when opened without noopener (opener retained), text fragment directive
+// MUST NOT activate, even if the target document performs same-document navigations like replaceState().
+for (const testCase of [
+  { action: "none", description: "Control: no replaceState, text fragment directive must not activate when opened with window opener" },
+  { action: "replaceState-head", description: "replaceState in head must not bypass security restriction when opened with window opener" },
+  { action: "replaceState-body-start", description: "replaceState at start of body must not bypass security restriction when opened with window opener" },
+  { action: "replaceState-body-end", description: "replaceState at end of body must not bypass security restriction when opened with window opener" },
+  { action: "replaceState-domcontentloaded", description: "replaceState in DOMContentLoaded must not bypass security restriction when opened with window opener" },
+]) {
+  promise_test(t => new Promise((resolve, reject) => {
+    const key = token();
+    const url = `${crossOriginTarget}?action=${testCase.action}&key=${key}#:~:text=target%20text`;
+
+    test_driver.bless('Open a URL with a text fragment directive with opener', () => {
+      window.open(url, '_blank');
+    });
+
+    fetchResults(key, resolve, reject);
+  }).then(data => {
+    assert_equals(data.scrollPosition, 'top',
+      `Expected text fragment directive to not activate when opened with an opener, but got scrollPosition=${data.scrollPosition} (scrollY=${data.scrollY})`);
+  }), testCase.description);
+}
+</script>