Fix Origin header for custom-standard-scheme navigation POSTs

Chromium 491783215 (https://crrev.com/c/7617635, cherry-picked to the
M148.40 branch) removed Blink's SetHTTPOriginToMatchReferrerPolicyIfNeeded
call on navigation requests, on the premise that the browser process
would add the Origin header in AddAdditionalRequestHeaders() in
content/browser/renderer_host/navigation_request.cc. That premise holds
for http(s) but not for embedder-registered schemes, because the
function early-returns on !SchemeIsHTTPOrHTTPS(). As a result, form
POSTs from custom standard schemes (SECURE/CORS_ENABLED) no longer had
an Origin header, and POSTs from non-standard schemes no longer had
Origin: null. CorsTest.RedirectPost* was failing in 30 configurations.

Drop the early-return so the Origin / User-Agent / referrer-policy
logic runs uniformly; each inner block is already guarded by its own
condition (enable_do_not_track, SetHeaderIfMissing, NeedsHTTPOrigin,
feature flags, prerender/preview state) and is a no-op for schemes
that don't need it.

Update the CorsTest.RedirectPost* expectations to stop treating
CUSTOM_STANDARD_SCHEME as an always-null-origin scheme; its actual
origin is now sent (matching http(s)), while truly non-standard
schemes still serialize to "null" via their opaque origin.

patch/patch.cfg

@@ -569,6 +569,12 @@ patches = [
     # Fix crash in NavigationRequest::GetOriginForURLLoaderFactory() when
     # navigating to an unregistered (e.g. non-standard) scheme.
     # https://github.com/chromiumembedded/cef/issues/3105
+    #
+    # Run AddAdditionalRequestHeaders() for non-HTTP(S) URLs so that custom
+    # standard schemes registered as SECURE/CORS_ENABLED get the same Origin
+    # header treatment as HTTP(S). Restores behavior lost when Blink's
+    # SetHTTPOriginToMatchReferrerPolicyIfNeeded was removed in
+    # https://crrev.com/c/7617635 (Chromium 491783215).
     'name': 'browser_security_policy_1081397',
   },
   {

patch/patches/browser_security_policy_1081397.patch

@@ -21,10 +21,26 @@ index a033e108aa970aee467dceb71ee8033e02fab1ea..fc85e89de0e0e06be50263a8f6da1b92
  
        // Make an exception to allow most visited tiles to commit in third-party
 diff --git content/browser/renderer_host/navigation_request.cc content/browser/renderer_host/navigation_request.cc
-index e321b9acde92b212dd9591a2e72868a2ad64406b..759a7cac116860b8ed3d8182169513e601be13b7 100644
+index e321b9acde92b212dd9591a2e72868a2ad64406b..64ba75e3fe8a81a6ad0b76f21f39827113a5f870 100644
 --- content/browser/renderer_host/navigation_request.cc
 +++ content/browser/renderer_host/navigation_request.cc
-@@ -9232,7 +9232,8 @@ std::optional<url::Origin> NavigationRequest::GetOriginToCommit() {
+@@ -377,8 +377,13 @@ void AddAdditionalRequestHeaders(
+     blink::mojom::Referrer* referrer,
+     FrameTreeNode* frame_tree_node,
+     bool is_browser_initiated) {
+-  if (!url.SchemeIsHTTPOrHTTPS())
+-    return;
++  // The upstream early-return for non-HTTP(S) URLs is removed so that
++  // embedder-registered custom standard schemes (CEF schemes declared as
++  // SECURE and CORS_ENABLED) get the same Origin, User-Agent and referrer
++  // treatment as HTTP(S). Prior to https://crrev.com/c/7617635 this was
++  // partly handled in Blink via SetHTTPOriginToMatchReferrerPolicyIfNeeded,
++  // removed on the premise that the browser process would add the Origin
++  // header here -- which only held true if this function actually ran.
+ 
+   bool is_reload = NavigationTypeUtils::IsReload(navigation_type);
+   RenderViewHostImpl* render_view_host =
+@@ -9232,7 +9237,8 @@ std::optional<url::Origin> NavigationRequest::GetOriginToCommit() {
  }
  
  url::Origin NavigationRequest::GetOriginForURLLoaderFactoryBeforeResponse(
@@ -34,7 +50,7 @@ index e321b9acde92b212dd9591a2e72868a2ad64406b..759a7cac116860b8ed3d8182169513e6
    // Calculate an approximation of the origin. The sandbox/csp are ignored.
    url::Origin origin = GetOriginForURLLoaderFactoryUnchecked();
  
-@@ -9249,6 +9250,17 @@ url::Origin NavigationRequest::GetOriginForURLLoaderFactoryBeforeResponse(
+@@ -9249,6 +9255,17 @@ url::Origin NavigationRequest::GetOriginForURLLoaderFactoryBeforeResponse(
    bool use_opaque_origin =
        (sandbox_flags & network::mojom::WebSandboxFlags::kOrigin) ==
        network::mojom::WebSandboxFlags::kOrigin;
@@ -52,7 +68,7 @@ index e321b9acde92b212dd9591a2e72868a2ad64406b..759a7cac116860b8ed3d8182169513e6
    if (use_opaque_origin) {
      origin = origin.DeriveNewOpaqueOrigin();
    }
-@@ -9309,8 +9321,9 @@ NavigationRequest::GetOriginForURLLoaderFactoryAfterResponse() {
+@@ -9309,8 +9326,9 @@ NavigationRequest::GetOriginForURLLoaderFactoryAfterResponse() {
      return GetRenderFrameHost()->GetLastCommittedOrigin();
    }
  
@@ -64,7 +80,7 @@ index e321b9acde92b212dd9591a2e72868a2ad64406b..759a7cac116860b8ed3d8182169513e6
  
    SCOPED_CRASH_KEY_BOOL("Bug1454273", "is_in_main_frame", IsInMainFrame());
    SCOPED_CRASH_KEY_STRING256(
-@@ -9345,10 +9358,17 @@ NavigationRequest::GetOriginForURLLoaderFactoryAfterResponse() {
+@@ -9345,10 +9363,17 @@ NavigationRequest::GetOriginForURLLoaderFactoryAfterResponse() {
        DetermineInitiatorRelationship(initiator_rfh,
                                       frame_tree_node_->current_frame_host()));
  

tests/ceftests/cors_unittest.cc

@@ -1675,13 +1675,11 @@ struct PostResource : CookieResource {
   bool is_cross_origin;
 
   void InitOrigin(HandlerType main_handler) {
-    // Origin is always "null" for non-HTTP(S) schemes.
-    // This should only be "null" for non-standard schemes, but Blink is likely
-    // using SchemeIsHTTPOrHTTPS() when submitting the form request.
-    main_origin = IsNonStandardType(main_handler) ||
-                          main_handler == HandlerType::CUSTOM_STANDARD_SCHEME
-                      ? "null"
-                      : GetOrigin(main_handler);
+    // Non-standard schemes have opaque origins, which serialize as "null".
+    // Registered standard schemes (HTTP(S), SERVER, CUSTOM_STANDARD_SCHEME)
+    // use their actual origin URL.
+    main_origin =
+        IsNonStandardType(main_handler) ? "null" : GetOrigin(main_handler);
 
     // True if the request is considered cross-origin. Any requests between
     // non-standard schemes are considered cross-origin (due to the "null"