OLD | NEW |
1 // Copyright (c) 2009 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2009 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/browser/browser.h" | 5 #include "chrome/browser/browser.h" |
6 #include "chrome/browser/profile.h" | 6 #include "chrome/browser/profile.h" |
7 #include "chrome/browser/tab_contents/interstitial_page.h" | 7 #include "chrome/browser/tab_contents/interstitial_page.h" |
8 #include "chrome/browser/tab_contents/navigation_entry.h" | 8 #include "chrome/browser/tab_contents/navigation_entry.h" |
9 #include "chrome/browser/tab_contents/tab_contents.h" | 9 #include "chrome/browser/tab_contents/tab_contents.h" |
10 #include "chrome/common/pref_names.h" | 10 #include "chrome/common/pref_names.h" |
(...skipping 214 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
225 | 225 |
226 // Because of cross-frame scripting restrictions, we cannot access the iframe | 226 // Because of cross-frame scripting restrictions, we cannot access the iframe |
227 // content. So to know if the frame was loaded, we just check if a popup was | 227 // content. So to know if the frame was loaded, we just check if a popup was |
228 // opened (the iframe content opens one). | 228 // opened (the iframe content opens one). |
229 // Note: because of bug 1115868, no constrained window is opened right now. | 229 // Note: because of bug 1115868, no constrained window is opened right now. |
230 // Once the bug is fixed, this will do the real check. | 230 // Once the bug is fixed, this will do the real check. |
231 EXPECT_EQ(0, static_cast<int>(tab->constrained_window_count())); | 231 EXPECT_EQ(0, static_cast<int>(tab->constrained_window_count())); |
232 | 232 |
233 int img_width; | 233 int img_width; |
234 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractInt( | 234 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractInt( |
235 tab, L"", L"window.domAutomationController.send(ImageWidth());", | 235 tab->render_view_host(), L"", |
236 &img_width)); | 236 L"window.domAutomationController.send(ImageWidth());", &img_width)); |
237 // In order to check that the image was not loaded, we check its width. | 237 // In order to check that the image was not loaded, we check its width. |
238 // The actual image (Google logo) is 114 pixels wide, we assume the broken | 238 // The actual image (Google logo) is 114 pixels wide, we assume the broken |
239 // image is less than 100. | 239 // image is less than 100. |
240 EXPECT_GT(100, img_width); | 240 EXPECT_GT(100, img_width); |
241 | 241 |
242 bool js_result = false; | 242 bool js_result = false; |
243 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool( | 243 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool( |
244 tab, L"", L"window.domAutomationController.send(IsFooSet());", | 244 tab->render_view_host(), L"", |
245 &js_result)); | 245 L"window.domAutomationController.send(IsFooSet());", &js_result)); |
246 EXPECT_FALSE(js_result); | 246 EXPECT_FALSE(js_result); |
247 } | 247 } |
248 | 248 |
249 // Visits a page with mixed content loaded by JS (after the initial page load). | 249 // Visits a page with mixed content loaded by JS (after the initial page load). |
250 IN_PROC_BROWSER_TEST_F(SSLUITest, TestMixedContentsLoadedFromJS) { | 250 IN_PROC_BROWSER_TEST_F(SSLUITest, TestMixedContentsLoadedFromJS) { |
251 scoped_refptr<HTTPSTestServer> https_server = GoodCertServer(); | 251 scoped_refptr<HTTPSTestServer> https_server = GoodCertServer(); |
252 scoped_refptr<HTTPTestServer> http_server = PlainServer(); | 252 scoped_refptr<HTTPTestServer> http_server = PlainServer(); |
253 | 253 |
254 ui_test_utils::NavigateToURL(browser(), https_server->TestServerPageW( | 254 ui_test_utils::NavigateToURL(browser(), https_server->TestServerPageW( |
255 L"files/ssl/page_with_dynamic_mixed_contents.html")); | 255 L"files/ssl/page_with_dynamic_mixed_contents.html")); |
256 | 256 |
257 TabContents* tab = browser()->GetSelectedTabContents(); | 257 TabContents* tab = browser()->GetSelectedTabContents(); |
258 CheckAuthenticatedState(tab, false, false); | 258 CheckAuthenticatedState(tab, false, false); |
259 | 259 |
260 // Load the insecure image. | 260 // Load the insecure image. |
261 bool js_result = false; | 261 bool js_result = false; |
262 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool( | 262 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool( |
263 tab, L"", L"loadBadImage();", &js_result)); | 263 tab->render_view_host(), L"", L"loadBadImage();", &js_result)); |
264 EXPECT_TRUE(js_result); | 264 EXPECT_TRUE(js_result); |
265 | 265 |
266 // We should now have mixed-contents. | 266 // We should now have mixed-contents. |
267 CheckAuthenticatedState(tab, true /* mixed-content */, false); | 267 CheckAuthenticatedState(tab, true /* mixed-content */, false); |
268 } | 268 } |
269 | 269 |
270 // Visits two pages from the same origin: one with mixed content and one | 270 // Visits two pages from the same origin: one with mixed content and one |
271 // without. The test checks that we propagate the mixed content state from one | 271 // without. The test checks that we propagate the mixed content state from one |
272 // to the other. | 272 // to the other. |
273 // TODO(jcampan): http://crbug.com/15072 this test fails. | 273 // TODO(jcampan): http://crbug.com/15072 this test fails. |
(...skipping 297 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
571 | 571 |
572 TabContents* tab = browser()->GetSelectedTabContents(); | 572 TabContents* tab = browser()->GetSelectedTabContents(); |
573 ui_test_utils::NavigateToURL( | 573 ui_test_utils::NavigateToURL( |
574 browser(), | 574 browser(), |
575 good_https_server->TestServerPageW(L"files/ssl/top_frame.html")); | 575 good_https_server->TestServerPageW(L"files/ssl/top_frame.html")); |
576 | 576 |
577 CheckAuthenticatedState(tab, false, false); | 577 CheckAuthenticatedState(tab, false, false); |
578 | 578 |
579 bool success = false; | 579 bool success = false; |
580 // Now navigate inside the frame. | 580 // Now navigate inside the frame. |
581 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool(tab, | 581 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool( |
582 L"", | 582 tab->render_view_host(), L"", |
583 L"window.domAutomationController.send(clickLink('goodHTTPSLink'));", | 583 L"window.domAutomationController.send(clickLink('goodHTTPSLink'));", |
584 &success)); | 584 &success)); |
585 EXPECT_TRUE(success); | 585 EXPECT_TRUE(success); |
586 ui_test_utils::WaitForNavigation(&tab->controller()); | 586 ui_test_utils::WaitForNavigation(&tab->controller()); |
587 | 587 |
588 // We should still be fine. | 588 // We should still be fine. |
589 CheckAuthenticatedState(tab, false, false); | 589 CheckAuthenticatedState(tab, false, false); |
590 | 590 |
591 // Now let's hit a bad page. | 591 // Now let's hit a bad page. |
592 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool(tab, | 592 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool( |
593 L"", | 593 tab->render_view_host(), L"", |
594 L"window.domAutomationController.send(clickLink('badHTTPSLink'));", | 594 L"window.domAutomationController.send(clickLink('badHTTPSLink'));", |
595 &success)); | 595 &success)); |
596 EXPECT_TRUE(success); | 596 EXPECT_TRUE(success); |
597 ui_test_utils::WaitForNavigation(&tab->controller()); | 597 ui_test_utils::WaitForNavigation(&tab->controller()); |
598 | 598 |
599 // The security style should still be secure. | 599 // The security style should still be secure. |
600 CheckAuthenticatedState(tab, false, false); | 600 CheckAuthenticatedState(tab, false, false); |
601 | 601 |
602 // And the frame should be blocked. | 602 // And the frame should be blocked. |
603 bool is_content_evil = true; | 603 bool is_content_evil = true; |
604 std::wstring content_frame_xpath(L"html/frameset/frame[2]"); | 604 std::wstring content_frame_xpath(L"html/frameset/frame[2]"); |
605 std::wstring is_frame_evil_js( | 605 std::wstring is_frame_evil_js( |
606 L"window.domAutomationController" | 606 L"window.domAutomationController" |
607 L".send(document.getElementById('evilDiv') != null);"); | 607 L".send(document.getElementById('evilDiv') != null);"); |
608 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool(tab, | 608 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool( |
| 609 tab->render_view_host(), |
609 content_frame_xpath, | 610 content_frame_xpath, |
610 is_frame_evil_js, | 611 is_frame_evil_js, |
611 &is_content_evil)); | 612 &is_content_evil)); |
612 EXPECT_FALSE(is_content_evil); | 613 EXPECT_FALSE(is_content_evil); |
613 | 614 |
614 // Now go back, our state should still be OK. | 615 // Now go back, our state should still be OK. |
615 tab->controller().GoBack(); | 616 tab->controller().GoBack(); |
616 ui_test_utils::WaitForNavigation(&tab->controller()); | 617 ui_test_utils::WaitForNavigation(&tab->controller()); |
617 CheckAuthenticatedState(tab, false, false); | 618 CheckAuthenticatedState(tab, false, false); |
618 | 619 |
619 // Navigate to a page served over HTTP. | 620 // Navigate to a page served over HTTP. |
620 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool(tab, | 621 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool( |
| 622 tab->render_view_host(), |
621 L"", | 623 L"", |
622 L"window.domAutomationController.send(clickLink('HTTPLink'));", | 624 L"window.domAutomationController.send(clickLink('HTTPLink'));", |
623 &success)); | 625 &success)); |
624 EXPECT_TRUE(success); | 626 EXPECT_TRUE(success); |
625 ui_test_utils::WaitForNavigation(&tab->controller()); | 627 ui_test_utils::WaitForNavigation(&tab->controller()); |
626 | 628 |
627 // Our state should be mixed-content. | 629 // Our state should be mixed-content. |
628 CheckAuthenticatedState(tab, true, false); | 630 CheckAuthenticatedState(tab, true, false); |
629 | 631 |
630 // Go back, our state should be unchanged. | 632 // Go back, our state should be unchanged. |
(...skipping 16 matching lines...) Expand all Loading... |
647 true); // Interstitial showing | 649 true); // Interstitial showing |
648 | 650 |
649 // Continue on the interstitial. | 651 // Continue on the interstitial. |
650 InterstitialPage* interstitial_page = tab->interstitial_page(); | 652 InterstitialPage* interstitial_page = tab->interstitial_page(); |
651 ASSERT_TRUE(interstitial_page); | 653 ASSERT_TRUE(interstitial_page); |
652 interstitial_page->Proceed(); | 654 interstitial_page->Proceed(); |
653 ui_test_utils::WaitForNavigation(&(tab->controller())); | 655 ui_test_utils::WaitForNavigation(&(tab->controller())); |
654 | 656 |
655 // Navigate to a good frame. | 657 // Navigate to a good frame. |
656 bool success = false; | 658 bool success = false; |
657 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool(tab, | 659 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool( |
| 660 tab->render_view_host(), |
658 L"", | 661 L"", |
659 L"window.domAutomationController.send(clickLink('goodHTTPSLink'));", | 662 L"window.domAutomationController.send(clickLink('goodHTTPSLink'));", |
660 &success)); | 663 &success)); |
661 EXPECT_TRUE(success); | 664 EXPECT_TRUE(success); |
662 ui_test_utils::WaitForNavigation(&tab->controller()); | 665 ui_test_utils::WaitForNavigation(&tab->controller()); |
663 | 666 |
664 // We should still be authentication broken. | 667 // We should still be authentication broken. |
665 CheckAuthenticationBrokenState(tab, net::CERT_STATUS_DATE_INVALID, false); | 668 CheckAuthenticationBrokenState(tab, net::CERT_STATUS_DATE_INVALID, false); |
666 } | 669 } |
667 | 670 |
668 // From an HTTP top frame, navigate to good and bad HTTPS (security state should | 671 // From an HTTP top frame, navigate to good and bad HTTPS (security state should |
669 // stay unauthenticated). | 672 // stay unauthenticated). |
670 IN_PROC_BROWSER_TEST_F(SSLUITest, TestUnauthenticatedFrameNavigation) { | 673 IN_PROC_BROWSER_TEST_F(SSLUITest, TestUnauthenticatedFrameNavigation) { |
671 scoped_refptr<HTTPTestServer> http_server = PlainServer(); | 674 scoped_refptr<HTTPTestServer> http_server = PlainServer(); |
672 scoped_refptr<HTTPSTestServer> good_https_server = GoodCertServer(); | 675 scoped_refptr<HTTPSTestServer> good_https_server = GoodCertServer(); |
673 scoped_refptr<HTTPSTestServer> bad_https_server = BadCertServer(); | 676 scoped_refptr<HTTPSTestServer> bad_https_server = BadCertServer(); |
674 | 677 |
675 TabContents* tab = browser()->GetSelectedTabContents(); | 678 TabContents* tab = browser()->GetSelectedTabContents(); |
676 ui_test_utils::NavigateToURL( | 679 ui_test_utils::NavigateToURL( |
677 browser(), | 680 browser(), |
678 http_server->TestServerPageW(L"files/ssl/top_frame.html")); | 681 http_server->TestServerPageW(L"files/ssl/top_frame.html")); |
679 CheckUnauthenticatedState(tab); | 682 CheckUnauthenticatedState(tab); |
680 | 683 |
681 // Now navigate inside the frame to a secure HTTPS frame. | 684 // Now navigate inside the frame to a secure HTTPS frame. |
682 bool success = false; | 685 bool success = false; |
683 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool(tab, | 686 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool( |
684 L"", | 687 tab->render_view_host(), L"", |
685 L"window.domAutomationController.send(clickLink('goodHTTPSLink'));", | 688 L"window.domAutomationController.send(clickLink('goodHTTPSLink'));", |
686 &success)); | 689 &success)); |
687 EXPECT_TRUE(success); | 690 EXPECT_TRUE(success); |
688 ui_test_utils::WaitForNavigation(&tab->controller()); | 691 ui_test_utils::WaitForNavigation(&tab->controller()); |
689 | 692 |
690 // We should still be unauthenticated. | 693 // We should still be unauthenticated. |
691 CheckUnauthenticatedState(tab); | 694 CheckUnauthenticatedState(tab); |
692 | 695 |
693 // Now navigate to a bad HTTPS frame. | 696 // Now navigate to a bad HTTPS frame. |
694 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool(tab, | 697 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool( |
| 698 tab->render_view_host(), |
695 L"", | 699 L"", |
696 L"window.domAutomationController.send(clickLink('badHTTPSLink'));", | 700 L"window.domAutomationController.send(clickLink('badHTTPSLink'));", |
697 &success)); | 701 &success)); |
698 EXPECT_TRUE(success); | 702 EXPECT_TRUE(success); |
699 ui_test_utils::WaitForNavigation(&tab->controller()); | 703 ui_test_utils::WaitForNavigation(&tab->controller()); |
700 | 704 |
701 // State should not have changed. | 705 // State should not have changed. |
702 CheckUnauthenticatedState(tab); | 706 CheckUnauthenticatedState(tab); |
703 | 707 |
704 // And the frame should have been blocked (see bug #2316). | 708 // And the frame should have been blocked (see bug #2316). |
705 bool is_content_evil = true; | 709 bool is_content_evil = true; |
706 std::wstring content_frame_xpath(L"html/frameset/frame[2]"); | 710 std::wstring content_frame_xpath(L"html/frameset/frame[2]"); |
707 std::wstring is_frame_evil_js( | 711 std::wstring is_frame_evil_js( |
708 L"window.domAutomationController" | 712 L"window.domAutomationController" |
709 L".send(document.getElementById('evilDiv') != null);"); | 713 L".send(document.getElementById('evilDiv') != null);"); |
710 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool(tab, | 714 EXPECT_TRUE(ui_test_utils::ExecuteJavaScriptAndExtractBool( |
711 content_frame_xpath, is_frame_evil_js, &is_content_evil)); | 715 tab->render_view_host(), content_frame_xpath, is_frame_evil_js, |
| 716 &is_content_evil)); |
712 EXPECT_FALSE(is_content_evil); | 717 EXPECT_FALSE(is_content_evil); |
713 } | 718 } |
714 | 719 |
715 // TODO(jcampan): more tests to do below. | 720 // TODO(jcampan): more tests to do below. |
716 | 721 |
717 // Visit a page over https that contains a frame with a redirect. | 722 // Visit a page over https that contains a frame with a redirect. |
718 | 723 |
719 // XMLHttpRequest mixed in synchronous mode. | 724 // XMLHttpRequest mixed in synchronous mode. |
720 | 725 |
721 // XMLHttpRequest mixed in asynchronous mode. | 726 // XMLHttpRequest mixed in asynchronous mode. |
722 | 727 |
723 // XMLHttpRequest over bad ssl in synchronous mode. | 728 // XMLHttpRequest over bad ssl in synchronous mode. |
724 | 729 |
725 // XMLHttpRequest over OK ssl in synchronous mode. | 730 // XMLHttpRequest over OK ssl in synchronous mode. |
OLD | NEW |