From 33312408f3550ed5840bdbcf24cc1b92a988f383 Mon Sep 17 00:00:00 2001
From: Alexandra Pereira <[email protected]>
Date: Thu, 10 Sep 2026 14:19:01 -0700
Subject: [PATCH] [iOS] Upgrade HTTP redirect targets from POST navigations

HttpsOnlyModeUpgradeTabHelper caches whether a navigation is a POST in
DidStartNavigation() to exempt form submissions from HTTPS upgrades.
However, HTTP server redirects (e.g. 302/303) convert POST requests to
GETs. Because navigation_is_post_ was not updated, ShouldAllowRequest()
continued to treat the redirect as a POST, allowing cleartext HTTP to
load without an upgrade or interstitial.

Update navigation_is_post_ in ShouldAllowRequest() using the incoming
request's HTTPMethod so that redirected GET requests are properly
upgraded.

Fixed: 504227656
Change-Id: I939e1f018a614cca18988c70ec8f5bf86600beec
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/8382522
Reviewed-by: Mustafa Emre Acer <[email protected]>
Commit-Queue: Alexandra Pereira <[email protected]>
Cr-Commit-Position: refs/heads/main@{#1695669}
---
diff --git a/ios/chrome/browser/https_upgrades/model/https_only_mode_upgrade_tab_helper.h b/ios/chrome/browser/https_upgrades/model/https_only_mode_upgrade_tab_helper.h
index 1ed3bb4..1156440e 100644
--- a/ios/chrome/browser/https_upgrades/model/https_only_mode_upgrade_tab_helper.h
+++ b/ios/chrome/browser/https_upgrades/model/https_only_mode_upgrade_tab_helper.h
@@ -115,9 +115,10 @@
   ui::PageTransition navigation_transition_type_ = ui::PAGE_TRANSITION_FIRST;
   bool navigation_is_renderer_initiated_ = false;
   web::Referrer referrer_;
-  // Set to true when a new navigation with a POST method is started.
-  // Used to check if the navigation should be upgraded when a response is
-  // received. Cleared when the current navigation finishes.
+  // Set to true when a new navigation with a POST method is started
+  // and updated during redirects (e.g. when a 3xx redirect converts a
+  // POST to a GET). Used to check if the navigation should be upgraded
+  // when a response is received. Cleared when the current navigation finishes.
   bool navigation_is_post_ = false;
   // Set to true when a main frame navigation has started but not yet finished.
   // Used to distinguish ShouldAllowRequest calls for redirects within an
diff --git a/ios/chrome/browser/https_upgrades/model/https_only_mode_upgrade_tab_helper.mm b/ios/chrome/browser/https_upgrades/model/https_only_mode_upgrade_tab_helper.mm
index 98a1bd6..52d9107 100644
--- a/ios/chrome/browser/https_upgrades/model/https_only_mode_upgrade_tab_helper.mm
+++ b/ios/chrome/browser/https_upgrades/model/https_only_mode_upgrade_tab_helper.mm
@@ -159,6 +159,8 @@
     return;
   }
 
+  navigation_is_post_ = [request.HTTPMethod isEqualToString:@"POST"];
+
   if ((!base::FeatureList::IsEnabled(
            security_interstitials::features::kHttpsUpgrades) &&
        !(prefs_ && prefs_->GetBoolean(prefs::kHttpsOnlyModeEnabled))) ||
diff --git a/ios/chrome/browser/https_upgrades/model/https_only_mode_upgrade_tab_helper_unittest.mm b/ios/chrome/browser/https_upgrades/model/https_only_mode_upgrade_tab_helper_unittest.mm
index 5ffac52..7bd18a28 100644
--- a/ios/chrome/browser/https_upgrades/model/https_only_mode_upgrade_tab_helper_unittest.mm
+++ b/ios/chrome/browser/https_upgrades/model/https_only_mode_upgrade_tab_helper_unittest.mm
@@ -266,6 +266,36 @@
   }
 }
 
+// Tests that when a POST navigation redirects to HTTP, ShouldAllowRequest
+// cancels the HTTP redirect when HTTPS-Only Mode or HTTPS-Upgrades is enabled.
+TEST_P(HttpsOnlyModeUpgradeTabHelperTest,
+       ShouldAllowRequestPostRedirectToHttp) {
+  auto fake_navigation_manager = std::make_unique<web::FakeNavigationManager>();
+  std::unique_ptr<web::NavigationItem> pending_item =
+      web::NavigationItem::Create();
+  fake_navigation_manager->SetPendingItem(pending_item.release());
+  web_state_.SetNavigationManager(std::move(fake_navigation_manager));
+
+  GURL https_url("https://example.com/");
+  GURL http_url("http://example.com/");
+
+  // Start an HTTPS POST navigation.
+  web::FakeNavigationContext context;
+  context.SetUrl(https_url);
+  context.SetIsPost(true);
+  web_state_.OnNavigationStarted(&context);
+
+  // If either HTTPS-Only Mode or HTTPS-Upgrades is enabled, redirects to HTTP
+  // in the main frame should be cancelled before the request is sent.
+  if (GetParam() != HttpsUpgradesTestType::kNone) {
+    EXPECT_FALSE(ShouldAllowRequestUrl(http_url, /*main_frame=*/true)
+                     .ShouldAllowNavigation());
+  } else {
+    EXPECT_TRUE(ShouldAllowRequestUrl(http_url, /*main_frame=*/true)
+                    .ShouldAllowNavigation());
+  }
+}
+
 TEST_P(HttpsOnlyModeUpgradeTabHelperTest, GetUpgradedHttpsUrl) {
   ProfileIOS* profile =
       ProfileIOS::FromBrowserState(web_state_.GetBrowserState());

diff --git a/ios/chrome/browser/https_upgrades/model/https_only_mode_upgrade_tab_helper_unittest.mm b/ios/chrome/browser/https_upgrades/model/https_only_mode_upgrade_tab_helper_unittest.mm
index 5ffac52..7bd18a28 100644
--- a/ios/chrome/browser/https_upgrades/model/https_only_mode_upgrade_tab_helper_unittest.mm
+++ b/ios/chrome/browser/https_upgrades/model/https_only_mode_upgrade_tab_helper_unittest.mm
@@ -266,6 +266,36 @@
   }
 }
 
+// Tests that when a POST navigation redirects to HTTP, ShouldAllowRequest
+// cancels the HTTP redirect when HTTPS-Only Mode or HTTPS-Upgrades is enabled.
+TEST_P(HttpsOnlyModeUpgradeTabHelperTest,
+       ShouldAllowRequestPostRedirectToHttp) {
+  auto fake_navigation_manager = std::make_unique<web::FakeNavigationManager>();
+  std::unique_ptr<web::NavigationItem> pending_item =
+      web::NavigationItem::Create();
+  fake_navigation_manager->SetPendingItem(pending_item.release());
+  web_state_.SetNavigationManager(std::move(fake_navigation_manager));
+
+  GURL https_url("https://example.com/");
+  GURL http_url("http://example.com/");
+
+  // Start an HTTPS POST navigation.
+  web::FakeNavigationContext context;
+  context.SetUrl(https_url);
+  context.SetIsPost(true);
+  web_state_.OnNavigationStarted(&context);
+
+  // If either HTTPS-Only Mode or HTTPS-Upgrades is enabled, redirects to HTTP
+  // in the main frame should be cancelled before the request is sent.
+  if (GetParam() != HttpsUpgradesTestType::kNone) {
+    EXPECT_FALSE(ShouldAllowRequestUrl(http_url, /*main_frame=*/true)
+                     .ShouldAllowNavigation());
+  } else {
+    EXPECT_TRUE(ShouldAllowRequestUrl(http_url, /*main_frame=*/true)
+                    .ShouldAllowNavigation());
+  }
+}
+
 TEST_P(HttpsOnlyModeUpgradeTabHelperTest, GetUpgradedHttpsUrl) {
   ProfileIOS* profile =
       ProfileIOS::FromBrowserState(web_state_.GetBrowserState());