Prevent the opening of a new Tor tab on every renderer initiated navigation.

browser/brave_content_browser_client_browsertest.cc

@@ -524,14 +524,8 @@ IN_PROC_BROWSER_TEST_F(BraveContentBrowserClientTest,
 IN_PROC_BROWSER_TEST_F(BraveContentBrowserClientTest, MixedContentForOnion) {
   net::ProxyConfigServiceTor::SetBypassTorProxyConfigForTesting(true);
   tor::TorNavigationThrottle::SetSkipWaitForTorConnectedForTesting(true);
-  base::RunLoop loop;
-  Browser* tor_browser = nullptr;
-  TorProfileManager::SwitchToTorProfile(
-      browser()->profile(), base::BindLambdaForTesting([&](Browser* browser) {
-        tor_browser = browser;
-        loop.Quit();
-      }));
-  loop.Run();
+  Browser* tor_browser =
+      TorProfileManager::SwitchToTorProfile(browser()->profile());
 
   const GURL onion_url =
       embedded_test_server()->GetURL("test.onion", "/onion.html");

browser/net/brave_site_hacks_network_delegate_helper_browsertest.cc

@@ -386,14 +386,8 @@ IN_PROC_BROWSER_TEST_F(BraveSiteHacksNetworkDelegateBrowserTest,
                        OnionReferrers) {
   net::ProxyConfigServiceTor::SetBypassTorProxyConfigForTesting(true);
   tor::TorNavigationThrottle::SetSkipWaitForTorConnectedForTesting(true);
-  base::RunLoop loop;
-  Browser* tor_browser = nullptr;
-  TorProfileManager::SwitchToTorProfile(
-      browser()->profile(), base::BindLambdaForTesting([&](Browser* browser) {
-        tor_browser = browser;
-        loop.Quit();
-      }));
-  loop.Run();
+  Browser* tor_browser =
+      TorProfileManager::SwitchToTorProfile(browser()->profile());
 
   // Same-origin navigations
   {

browser/search_engines/search_engine_provider_service_browsertest.cc

@@ -62,12 +62,6 @@ testing::AssertionResult VerifyTemplateURLServiceLoad(
   return testing::AssertionFailure() << "TemplateURLService isn't loaded";
 }
 
-// An observer that returns back to test code after a new profile is
-// initialized.
-void OnProfileCreation(base::RunLoop* run_loop, Browser* browser) {
-  run_loop->Quit();
-}
-
 TemplateURLData CreateTestSearchEngine() {
   TemplateURLData result;
   result.SetShortName(u"test1");
@@ -239,13 +233,14 @@ IN_PROC_BROWSER_TEST_F(SearchEngineProviderServiceTest,
             incognito_service->GetDefaultSearchProvider()->prepopulate_id());
 
 #if BUILDFLAG(ENABLE_TOR)
-  base::RunLoop run_loop;
-  TorProfileManager::SwitchToTorProfile(
-      browser()->profile(), base::BindOnce(&OnProfileCreation, &run_loop));
-  run_loop.Run();
-  Profile* tor_profile = BrowserList::GetInstance()->GetLastActive()->profile();
+  Browser* tor_browser =
+      TorProfileManager::SwitchToTorProfile(browser()->profile());
+  Profile* tor_profile = tor_browser->profile();
   EXPECT_TRUE(tor_profile->IsTor());
 
+  // Wait for the search provider to initialize.
+  base::RunLoop().RunUntilIdle();
+
   const int default_provider_id =
       TemplateURLPrepopulateData::PREPOPULATED_ENGINE_ID_BRAVE_TOR;
   auto* tor_service = TemplateURLServiceFactory::GetForProfile(tor_profile);

browser/tor/brave_tor_browsertest.cc

@@ -174,18 +174,9 @@ class BraveTorTest : public InProcessBrowserTest {
   }
 
   Profile* OpenTorWindow() {
-    base::RunLoop loop;
-    Profile* tor_profile = nullptr;
-    TorProfileManager::SwitchToTorProfile(
-        browser()->profile(), base::BindLambdaForTesting([&](Browser* browser) {
-          loop.Quit();
-
-          if (browser) {
-            tor_profile = browser->profile();
-          }
-        }));
-    loop.Run();
-    return tor_profile;
+    Browser* tor_browser =
+        TorProfileManager::SwitchToTorProfile(browser()->profile());
+    return tor_browser ? tor_browser->profile() : nullptr;
   }
 
   TorInfo WaitForTorLaunched() {

browser/tor/onion_domain_throttle_browsertest.cc

@@ -77,15 +77,7 @@ class OnionDomainThrottleBrowserTest : public InProcessBrowserTest {
   }
 
   Browser* OpenTorWindow() {
-    base::RunLoop loop;
-    Browser* tor_browser = nullptr;
-    TorProfileManager::SwitchToTorProfile(
-        browser()->profile(), base::BindLambdaForTesting([&](Browser* browser) {
-          tor_browser = browser;
-          loop.Quit();
-        }));
-    loop.Run();
-    return tor_browser;
+    return TorProfileManager::SwitchToTorProfile(browser()->profile());
   }
 
  protected:

browser/tor/onion_location_navigation_throttle_browsertest.cc

@@ -144,15 +144,7 @@ class OnionLocationNavigationThrottleBrowserTest : public InProcessBrowserTest {
   }
 
   Browser* OpenTorWindow() {
-    base::RunLoop loop;
-    Browser* tor_browser = nullptr;
-    TorProfileManager::SwitchToTorProfile(
-        browser()->profile(), base::BindLambdaForTesting([&](Browser* browser) {
-          tor_browser = browser;
-          loop.Quit();
-        }));
-    loop.Run();
-    return tor_browser;
+    return TorProfileManager::SwitchToTorProfile(browser()->profile());
   }
 
  private:
@@ -289,10 +281,14 @@ IN_PROC_BROWSER_TEST_F(OnionLocationNavigationThrottleBrowserTest,
       nullptr, ui_test_utils::BrowserChangeObserver::ChangeType::kAdded);
 
   GURL url = test_server()->GetURL("/onion");
+  content::TestNavigationObserver nav_observer(
+      browser()->tab_strip_model()->GetActiveWebContents());
   ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), url));
   browser_creation_observer.Wait();
-  // We don't close the original tab
+  // We don't close the original tab but stop loading
   EXPECT_EQ(browser()->tab_strip_model()->count(), 1);
+  EXPECT_EQ(nav_observer.last_net_error_code(), net::ERR_BLOCKED_BY_RESPONSE);
+
   content::WebContents* web_contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   tor::OnionLocationTabHelper* helper =
@@ -453,3 +449,52 @@ IN_PROC_BROWSER_TEST_F(OnionLocationNavigationThrottleBrowserTest, HTTPHost) {
       browser_list->get(0)->tab_strip_model()->GetActiveWebContents();
   EXPECT_EQ(web_contents->GetVisibleURL(), url);
 }
+
+IN_PROC_BROWSER_TEST_F(OnionLocationNavigationThrottleBrowserTest,
+                       RenderInitiatedNavigations) {
+  browser()->profile()->GetPrefs()->SetBoolean(tor::prefs::kAutoOnionRedirect,
+                                               true);
+  ASSERT_TRUE(
+      ui_test_utils::NavigateToURL(browser(), GURL("https://brave.com")));
+
+  const char kScript[] = R"js(
+    // Spam user.
+    for (let i = 0; i < 5; i++) {
+      document.location.href = 'http://spam' + i + '.onion'
+    }
+  )js";
+
+  // Renderer initiated navigations.
+  ui_test_utils::BrowserChangeObserver browser_creation_observer(
+      nullptr, ui_test_utils::BrowserChangeObserver::ChangeType::kAdded);
+  content::ExecJs(browser()->tab_strip_model()->GetActiveWebContents(),
+                  kScript);
+  browser_creation_observer.Wait();
+
+  BrowserList* browser_list = BrowserList::GetInstance();
+  EXPECT_EQ(2U, browser_list->size());
+  EXPECT_TRUE(browser_list->get(1)->profile()->IsTor());
+  EXPECT_EQ(1, browser_list->get(1)->tab_strip_model()->count());
+  auto* tor_tab = browser_list->get(1)->tab_strip_model()->GetWebContentsAt(0);
+  EXPECT_EQ(GURL("http://spam4.onion"), tor_tab->GetVisibleURL());
+
+  // Browser initiated navigation.
+  content::TestNavigationObserver nav_observer(
+      browser()->tab_strip_model()->GetActiveWebContents());
+  browser()->tab_strip_model()->GetActiveWebContents()->GetController().LoadURL(
+      GURL("http://user.onion"), content::Referrer(), ui::PAGE_TRANSITION_TYPED,
+      {});
+  nav_observer.Wait();
+
+  EXPECT_EQ(2U, browser_list->size());
+  EXPECT_TRUE(browser_list->get(1)->profile()->IsTor());
+  EXPECT_EQ(2, browser_list->get(1)->tab_strip_model()->count());
+  EXPECT_EQ(GURL("http://spam4.onion"), browser_list->get(1)
+                                            ->tab_strip_model()
+                                            ->GetWebContentsAt(0)
+                                            ->GetVisibleURL());
+  EXPECT_EQ(GURL("http://user.onion"), browser_list->get(1)
+                                           ->tab_strip_model()
+                                           ->GetWebContentsAt(1)
+                                           ->GetVisibleURL());
+}

browser/tor/onion_location_navigation_throttle_delegate.cc

@@ -10,20 +10,76 @@
 #include "brave/browser/tor/tor_profile_manager.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/ui/browser.h"
-#include "chrome/browser/ui/browser_finder.h"
+#include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/browser/web_contents_user_data.h"
 
 namespace tor {
 
 namespace {
 
-void OnTorProfileCreated(GURL onion_location, Browser* browser) {
-  if (!browser)
+class TorNavigationInitiator
+    : public content::WebContentsUserData<TorNavigationInitiator> {
+ public:
+  TorNavigationInitiator(content::WebContents* tor_web_contents,
+                         content::WebContents* initiator_web_contents)
+      : content::WebContentsUserData<TorNavigationInitiator>(*tor_web_contents),
+        initiator_web_contents_(initiator_web_contents) {
+    DCHECK(initiator_web_contents_);
+  }
+
+  bool IsInitiatedBy(content::WebContents* initiator_web_contents) const {
+    return initiator_web_contents_ == initiator_web_contents;
+  }
+
+ private:
+  friend class WebContentsUserData;
+
+  // Used only for pointer comparasion.
+  const raw_ptr<content::WebContents> initiator_web_contents_ = nullptr;
+
+  WEB_CONTENTS_USER_DATA_KEY_DECL();
+};
+
+WEB_CONTENTS_USER_DATA_KEY_IMPL(TorNavigationInitiator);
+
+void OpenURLInTor(Browser* browser,
+                  const GURL& onion_location,
+                  content::WebContents* initiator) {
+  if (!browser) {
     return;
-  content::OpenURLParams open_tor(onion_location, content::Referrer(),
-                                  WindowOpenDisposition::SWITCH_TO_TAB,
-                                  ui::PAGE_TRANSITION_TYPED, false);
-  browser->OpenURL(open_tor);
+  }
+
+  TorNavigationInitiator* nav_initiator = nullptr;
+  if (initiator) {
+    for (int i = 0; i < browser->tab_strip_model()->count(); ++i) {
+      auto* ni = TorNavigationInitiator::FromWebContents(
+          browser->tab_strip_model()->GetWebContentsAt(i));
+      if (ni && ni->IsInitiatedBy(initiator)) {
+        nav_initiator = ni;
+        break;
+      }
+    }
+  }
+
+  if (!nav_initiator) {
+    // New tab.
+    content::OpenURLParams open_tor(onion_location, content::Referrer(),
+                                    WindowOpenDisposition::SWITCH_TO_TAB,
+                                    ui::PAGE_TRANSITION_TYPED, false);
+    auto* tor_web_contents = browser->OpenURL(open_tor);
+    if (initiator) {
+      TorNavigationInitiator::CreateForWebContents(tor_web_contents, initiator);
+    } else {
+      tor_web_contents->RemoveUserData(TorNavigationInitiator::UserDataKey());
+    }
+  } else {
+    // Redirect navigation to an existing tab.
+    nav_initiator->GetWebContents().GetController().LoadURL(
+        onion_location, content::Referrer(), ui::PAGE_TRANSITION_TYPED, {});
+    nav_initiator->GetWebContents().NotifyNavigationStateChanged(
+        content::INVALIDATE_TYPE_URL);
+  }
 }
 
 }  // namespace
@@ -36,11 +92,16 @@ OnionLocationNavigationThrottleDelegate::
 
 void OnionLocationNavigationThrottleDelegate::OpenInTorWindow(
     content::WebContents* web_contents,
-    GURL onion_location) {
+    const GURL& onion_location,
+    bool renderer_initiated) {
   Profile* profile =
       Profile::FromBrowserContext(web_contents->GetBrowserContext());
-  TorProfileManager::SwitchToTorProfile(profile,
-      base::BindRepeating(&OnTorProfileCreated, std::move(onion_location)));
+  Browser* tor_browser = TorProfileManager::SwitchToTorProfile(profile);
+  if (renderer_initiated) {
+    OpenURLInTor(tor_browser, onion_location, web_contents);
+  } else {
+    OpenURLInTor(tor_browser, onion_location, nullptr);
+  }
 }
 
 }  // namespace tor

browser/tor/onion_location_navigation_throttle_delegate.h

@@ -23,7 +23,8 @@ class OnionLocationNavigationThrottleDelegate
   ~OnionLocationNavigationThrottleDelegate() override;
 
   void OpenInTorWindow(content::WebContents* web_contents,
-                       GURL onion_location) override;
+                       const GURL& onion_location,
+                       bool renderer_initiated) override;
 
  private:
   OnionLocationNavigationThrottleDelegate(

browser/tor/tor_profile_manager.cc

@@ -10,15 +10,16 @@
 
 #include "base/feature_list.h"
 #include "brave/browser/tor/tor_profile_service_factory.h"
-#include "brave/components/brave_shields/browser/brave_shields_util.h"
 #include "brave/components/brave_webtorrent/browser/buildflags/buildflags.h"
 #include "brave/components/constants/pref_names.h"
 #include "brave/components/tor/tor_constants.h"
 #include "brave/components/tor/tor_profile_service.h"
-#include "chrome/browser/content_settings/host_content_settings_map_factory.h"
 #include "chrome/browser/profiles/profile.h"
-#include "chrome/browser/profiles/profile_window.h"
+#include "chrome/browser/ui/browser.h"
+#include "chrome/browser/ui/browser_commands.h"
+#include "chrome/browser/ui/browser_finder.h"
 #include "chrome/browser/ui/browser_list.h"
+#include "chrome/browser/ui/browser_window.h"
 #include "chrome/common/pref_names.h"
 #include "components/prefs/pref_service.h"
 #include "components/safe_browsing/core/common/safe_browsing_prefs.h"
@@ -42,17 +43,26 @@ TorProfileManager& TorProfileManager::GetInstance() {
 }
 
 // static
-void TorProfileManager::SwitchToTorProfile(
-    Profile* original_profile,
-    base::OnceCallback<void(Browser*)> callback) {
+Browser* TorProfileManager::SwitchToTorProfile(Profile* original_profile) {
   Profile* tor_profile =
       TorProfileManager::GetInstance().GetTorProfile(original_profile);
   if (!tor_profile) {
-    return std::move(callback).Run(nullptr);
+    return nullptr;
+  }
+
+  // Find an existing Tor Browser, making a new one if no such Browser is
+  // located.
+  Browser* browser = chrome::FindTabbedBrowser(tor_profile, false);
+  if (!browser && Browser::GetCreationStatusForProfile(tor_profile) ==
+                      Browser::CreationStatus::kOk) {
+    browser = Browser::Create(Browser::CreateParams(tor_profile, true));
+    chrome::NewTab(browser);
+    browser->window()->Show();
+  }
+  if (browser) {
+    browser->window()->Activate();
   }
-  profiles::OpenBrowserWindowForProfile(
-      std::move(callback), /*always_create=*/false,
-      /*is_new_profile=*/false, /*unblock_extensions=*/false, tor_profile);
+  return browser;
 }
 
 // static
@@ -82,8 +92,9 @@ Profile* TorProfileManager::GetTorProfile(Profile* profile) {
 
   const std::string context_id = tor_profile->UniqueId();
   auto it = tor_profiles_.find(context_id);
-  if (it != tor_profiles_.end())
+  if (it != tor_profiles_.end()) {
     return it->second;
+  }
 
   InitTorProfileUserPrefs(tor_profile);
 
@@ -101,13 +112,15 @@ Profile* TorProfileManager::GetTorProfile(Profile* profile) {
 }
 
 void TorProfileManager::CloseAllTorWindows() {
-  for (const auto& it : tor_profiles_)
+  for (const auto& it : tor_profiles_) {
     CloseTorProfileWindows(it.second);
+  }
 }
 
 void TorProfileManager::OnBrowserRemoved(Browser* browser) {
-  if (!browser || !browser->profile()->IsTor())
+  if (!browser || !browser->profile()->IsTor()) {
     return;
+  }
 
   if (!GetTorBrowserCount()) {
     tor::TorProfileService* service =