Get proper content settings client for iframes (#15917)

* Get proper content settings client for iframes

* remove debugging code

* tests

browser/farbling/brave_navigator_useragent_farbling_browsertest.cc

@@ -199,17 +199,6 @@ IN_PROC_BROWSER_TEST_F(BraveNavigatorUserAgentFarblingBrowserTest,
   auto max_ua_z = EvalJs(contents(), kUserAgentScript);
   EXPECT_EQ(default_ua_z + "  ", max_ua_z);
 
-  // test that iframes also inherit the farbled user agent
-  // (farbling level is still maximum)
-  NavigateToURLUntilLoadStop(
-      https_server()->GetURL(domain_b, "/navigator/ua-local-iframe.html"));
-  TitleWatcher watcher1(contents(), expected_title);
-  EXPECT_EQ(expected_title, watcher1.WaitAndGetTitle());
-  NavigateToURLUntilLoadStop(
-      https_server()->GetURL(domain_b, "/navigator/ua-remote-iframe.html"));
-  TitleWatcher watcher2(contents(), expected_title);
-  EXPECT_EQ(expected_title, watcher2.WaitAndGetTitle());
-
   // test that web workers also inherit the farbled user agent
   // (farbling level is still maximum)
   NavigateToURLUntilLoadStop(
@@ -239,6 +228,64 @@ IN_PROC_BROWSER_TEST_F(BraveNavigatorUserAgentFarblingBrowserTest,
   EXPECT_EQ(off_ua_b.ExtractString(), off_ua_b2);
 }
 
+// Tests results of farbling user agent in iframes
+IN_PROC_BROWSER_TEST_F(BraveNavigatorUserAgentFarblingBrowserTest,
+                       FarbleNavigatorUserAgentIframe) {
+  std::u16string expected_title(u"pass");
+  std::string domain_b = "b.com";
+  GURL url_b = https_server()->GetURL(domain_b, "/simple.html");
+  BlockFingerprinting(domain_b);
+
+  // test that local iframes inherit the farbled user agent
+  NavigateToURLUntilLoadStop(
+      https_server()->GetURL(domain_b, "/navigator/ua-local-iframe.html"));
+  TitleWatcher watcher1(contents(), expected_title);
+  EXPECT_EQ(expected_title, watcher1.WaitAndGetTitle());
+
+  // test that remote iframes inherit the farbled user agent
+  NavigateToURLUntilLoadStop(
+      https_server()->GetURL(domain_b, "/navigator/ua-remote-iframe.html"));
+  TitleWatcher watcher2(contents(), expected_title);
+  EXPECT_EQ(expected_title, watcher2.WaitAndGetTitle());
+
+  // test that dynamic iframes inherit the farbled user agent
+  // 7 variations based on https://arkenfox.github.io/TZP/tzp.html
+  NavigateToURLUntilLoadStop(
+      https_server()->GetURL(domain_b, "/navigator/ua-dynamic-iframe-1.html"));
+  TitleWatcher dynamic_iframe_1_watcher(contents(), expected_title);
+  EXPECT_EQ(expected_title, dynamic_iframe_1_watcher.WaitAndGetTitle());
+
+  NavigateToURLUntilLoadStop(
+      https_server()->GetURL(domain_b, "/navigator/ua-dynamic-iframe-2.html"));
+  TitleWatcher dynamic_iframe_2_watcher(contents(), expected_title);
+  EXPECT_EQ(expected_title, dynamic_iframe_2_watcher.WaitAndGetTitle());
+
+  NavigateToURLUntilLoadStop(
+      https_server()->GetURL(domain_b, "/navigator/ua-dynamic-iframe-3.html"));
+  TitleWatcher dynamic_iframe_3_watcher(contents(), expected_title);
+  EXPECT_EQ(expected_title, dynamic_iframe_3_watcher.WaitAndGetTitle());
+
+  NavigateToURLUntilLoadStop(
+      https_server()->GetURL(domain_b, "/navigator/ua-dynamic-iframe-4.html"));
+  TitleWatcher dynamic_iframe_4_watcher(contents(), expected_title);
+  EXPECT_EQ(expected_title, dynamic_iframe_4_watcher.WaitAndGetTitle());
+
+  NavigateToURLUntilLoadStop(
+      https_server()->GetURL(domain_b, "/navigator/ua-dynamic-iframe-5.html"));
+  TitleWatcher dynamic_iframe_5_watcher(contents(), expected_title);
+  EXPECT_EQ(expected_title, dynamic_iframe_5_watcher.WaitAndGetTitle());
+
+  NavigateToURLUntilLoadStop(
+      https_server()->GetURL(domain_b, "/navigator/ua-dynamic-iframe-6.html"));
+  TitleWatcher dynamic_iframe_6_watcher(contents(), expected_title);
+  EXPECT_EQ(expected_title, dynamic_iframe_6_watcher.WaitAndGetTitle());
+
+  NavigateToURLUntilLoadStop(
+      https_server()->GetURL(domain_b, "/navigator/ua-dynamic-iframe-7.html"));
+  TitleWatcher dynamic_iframe_7_watcher(contents(), expected_title);
+  EXPECT_EQ(expected_title, dynamic_iframe_7_watcher.WaitAndGetTitle());
+}
+
 // Tests results of farbling user agent metadata
 IN_PROC_BROWSER_TEST_F(BraveNavigatorUserAgentFarblingBrowserTest,
                        FarbleNavigatorUserAgentModel) {

test/data/navigator/ua-dynamic-iframe-1.html

@@ -0,0 +1,20 @@
+<!DOCTYPE HTML>
+<!-- navigator.userAgent dynamic iframe test 1 -->
+<!-- iframe, allow-same-origin -->
+<html>
+    <head>
+        <title></title>
+    </head>
+    <body>
+        <script>
+         const element = document.createElement("iframe");
+         document.body.appendChild(element);
+         element.setAttribute("sandbox", "allow-same-origin");
+         const iframeWindow = element.contentWindow;
+         var iframeNavigator = iframeWindow.navigator;
+         if (window.navigator.userAgent == iframeNavigator["userAgent"]) {
+             document.title = "pass";
+         }
+        </script>
+    </body>
+</html>

test/data/navigator/ua-dynamic-iframe-2.html

@@ -0,0 +1,21 @@
+<!DOCTYPE HTML>
+<!-- navigator.userAgent dynamic iframe test 2 -->
+<!-- iframe, allow-same-origin, non-empty src attribute -->
+<html>
+    <head>
+        <title></title>
+    </head>
+    <body>
+        <script>
+         const element = document.createElement("iframe");
+         document.body.appendChild(element);
+         element.setAttribute("sandbox", "allow-same-origin");
+         element.setAttribute("src", "?");
+         const iframeWindow = element.contentWindow;
+         var iframeNavigator = iframeWindow.navigator;
+         if (window.navigator.userAgent == iframeNavigator["userAgent"]) {
+             document.title = "pass";
+         }
+        </script>
+    </body>
+</html>

test/data/navigator/ua-dynamic-iframe-3.html

@@ -0,0 +1,20 @@
+<!DOCTYPE HTML>
+<!-- navigator.userAgent dynamic iframe test 3 -->
+<!-- iframe, allow-same-origin, accessed through window array -->
+<html>
+    <head>
+        <title></title>
+    </head>
+    <body>
+        <script>
+         const element = document.createElement("iframe");
+         document.body.appendChild(element);
+         element.setAttribute("sandbox", "allow-same-origin");
+         const iframeWindow = window[window.length-1];
+         var iframeNavigator = iframeWindow.navigator;
+         if (window.navigator.userAgent == iframeNavigator["userAgent"]) {
+             document.title = "pass";
+         }
+        </script>
+    </body>
+</html>

test/data/navigator/ua-dynamic-iframe-4.html

@@ -0,0 +1,21 @@
+<!DOCTYPE HTML>
+<!-- navigator.userAgent dynamic iframe test 4 -->
+<!-- iframe, allow-same-origin, non-empty src attribute, accessed through window array -->
+<html>
+    <head>
+        <title></title>
+    </head>
+    <body>
+        <script>
+         const element = document.createElement("iframe");
+         document.body.appendChild(element);
+         element.setAttribute("sandbox", "allow-same-origin");
+         element.setAttribute("src", "?");
+         const iframeWindow = window[window.length-1];
+         var iframeNavigator = iframeWindow.navigator;
+         if (window.navigator.userAgent == iframeNavigator["userAgent"]) {
+             document.title = "pass";
+         }
+        </script>
+    </body>
+</html>

test/data/navigator/ua-dynamic-iframe-5.html

@@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<!-- navigator.userAgent dynamic iframe test 5 -->
+<!-- iframe, accessed through frames array -->
+<html>
+    <head>
+        <title></title>
+    </head>
+    <body>
+        <script>
+         const element = document.createElement("iframe");
+         document.body.appendChild(element);
+         const iframeWindow = frames[frames.length-1];
+         var iframeNavigator = iframeWindow.navigator;
+         if (window.navigator.userAgent == iframeNavigator["userAgent"]) {
+             document.title = "pass";
+         }
+        </script>
+    </body>
+</html>

test/data/navigator/ua-dynamic-iframe-6.html

@@ -0,0 +1,19 @@
+<!DOCTYPE HTML>
+<!-- navigator.userAgent dynamic iframe test 6 -->
+<!-- iframe, accessed through window array -->
+<html>
+    <head>
+        <title></title>
+    </head>
+    <body>
+        <script>
+         const element = document.createElement("iframe");
+         document.body.appendChild(element);
+         const iframeWindow = window[window.length-1];
+         var iframeNavigator = iframeWindow.navigator;
+         if (window.navigator.userAgent == iframeNavigator["userAgent"]) {
+             document.title = "pass";
+         }
+        </script>
+    </body>
+</html>

test/data/navigator/ua-dynamic-iframe-7.html

@@ -0,0 +1,20 @@
+<!DOCTYPE HTML>
+<!-- navigator.userAgent dynamic iframe test 7 -->
+<!-- iframe, nested in div, created via innerHTML, accessed through window array -->
+<html>
+    <head>
+        <title></title>
+    </head>
+    <body>
+        <script>
+         const element = document.createElement("div");
+         document.body.appendChild(element);
+         element.innerHTML = "<iframe></iframe>";
+         const iframeWindow = window[window.length-1];
+         var iframeNavigator = iframeWindow.navigator;
+         if (window.navigator.userAgent == iframeNavigator["userAgent"]) {
+             document.title = "pass";
+         }
+        </script>
+    </body>
+</html>

third_party/blink/renderer/core/farbling/brave_session_cache.cc

@@ -88,11 +88,17 @@ blink::WebContentSettingsClient* GetContentSettingsClientFor(
     return settings;
   }
   if (auto* window = blink::DynamicTo<blink::LocalDOMWindow>(context)) {
-    auto* frame = window->GetFrame();
-    if (!frame)
-      frame = window->GetDisconnectedFrame();
-    if (frame)
-      settings = frame->GetContentSettingsClient();
+    auto* local_frame = window->GetFrame();
+    if (!local_frame)
+      local_frame = window->GetDisconnectedFrame();
+    if (local_frame) {
+      if (auto* top_local_frame =
+              blink::DynamicTo<blink::LocalFrame>(&local_frame->Tree().Top())) {
+        settings = top_local_frame->GetContentSettingsClient();
+      } else {
+        settings = local_frame->GetContentSettingsClient();
+      }
+    }
   } else if (context->IsWorkerGlobalScope()) {
     settings =
         blink::To<blink::WorkerGlobalScope>(context)->ContentSettingsClient();