OLD | NEW |
1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <string> | 5 #include <string> |
6 | 6 |
7 #include "base/basictypes.h" | 7 #include "base/basictypes.h" |
8 #include "chrome/browser/renderer_host/renderer_security_policy.h" | 8 #include "chrome/browser/renderer_host/renderer_security_policy.h" |
9 #include "chrome/common/url_constants.h" | 9 #include "chrome/common/url_constants.h" |
10 #include "net/url_request/url_request.h" | 10 #include "net/url_request/url_request.h" |
(...skipping 70 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
81 TEST_F(RendererSecurityPolicyTest, AboutTest) { | 81 TEST_F(RendererSecurityPolicyTest, AboutTest) { |
82 RendererSecurityPolicy* p = RendererSecurityPolicy::GetInstance(); | 82 RendererSecurityPolicy* p = RendererSecurityPolicy::GetInstance(); |
83 | 83 |
84 p->Add(kRendererID); | 84 p->Add(kRendererID); |
85 | 85 |
86 EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("about:blank"))); | 86 EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("about:blank"))); |
87 EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("about:BlAnK"))); | 87 EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("about:BlAnK"))); |
88 EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("aBouT:BlAnK"))); | 88 EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("aBouT:BlAnK"))); |
89 EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("aBouT:blank"))); | 89 EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("aBouT:blank"))); |
90 | 90 |
91 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutMemoryURL))); | 91 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:memory"))); |
92 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutCrashURL))); | 92 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:crash"))); |
93 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutCacheURL))); | 93 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:cache"))); |
94 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutHangURL))); | 94 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:hang"))); |
95 | 95 |
96 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("aBoUt:memory"))); | 96 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("aBoUt:memory"))); |
97 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:CrASh"))); | 97 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:CrASh"))); |
98 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("abOuT:cAChe"))); | 98 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("abOuT:cAChe"))); |
99 | 99 |
100 p->GrantRequestURL(kRendererID, GURL(chrome::kAboutMemoryURL)); | 100 p->GrantRequestURL(kRendererID, GURL("about:memory")); |
101 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutMemoryURL))); | 101 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:memory"))); |
102 | 102 |
103 p->GrantRequestURL(kRendererID, GURL(chrome::kAboutCrashURL)); | 103 p->GrantRequestURL(kRendererID, GURL("about:crash")); |
104 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutCrashURL))); | 104 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:crash"))); |
105 | 105 |
106 p->GrantRequestURL(kRendererID, GURL(chrome::kAboutCacheURL)); | 106 p->GrantRequestURL(kRendererID, GURL("about:cache")); |
107 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutCacheURL))); | 107 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:cache"))); |
108 | 108 |
109 p->GrantRequestURL(kRendererID, GURL(chrome::kAboutHangURL)); | 109 p->GrantRequestURL(kRendererID, GURL("about:hang")); |
110 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutHangURL))); | 110 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:hang"))); |
111 | 111 |
112 p->Remove(kRendererID); | 112 p->Remove(kRendererID); |
113 } | 113 } |
114 | 114 |
115 TEST_F(RendererSecurityPolicyTest, JavaScriptTest) { | 115 TEST_F(RendererSecurityPolicyTest, JavaScriptTest) { |
116 RendererSecurityPolicy* p = RendererSecurityPolicy::GetInstance(); | 116 RendererSecurityPolicy* p = RendererSecurityPolicy::GetInstance(); |
117 | 117 |
118 p->Add(kRendererID); | 118 p->Add(kRendererID); |
119 | 119 |
120 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("javascript:alert('xss')"))); | 120 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("javascript:alert('xss')"))); |
(...skipping 133 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
254 // Renderers are added and removed on the UI thread, but the policy can be | 254 // Renderers are added and removed on the UI thread, but the policy can be |
255 // queried on the IO thread. The RendererSecurityPolicy needs to be prepared | 255 // queried on the IO thread. The RendererSecurityPolicy needs to be prepared |
256 // to answer policy questions about renderers who no longer exist. | 256 // to answer policy questions about renderers who no longer exist. |
257 | 257 |
258 // In this case, we default to secure behavior. | 258 // In this case, we default to secure behavior. |
259 EXPECT_FALSE(p->CanRequestURL(kRendererID, url)); | 259 EXPECT_FALSE(p->CanRequestURL(kRendererID, url)); |
260 EXPECT_FALSE(p->CanUploadFile(kRendererID, file)); | 260 EXPECT_FALSE(p->CanUploadFile(kRendererID, file)); |
261 EXPECT_FALSE(p->HasDOMUIBindings(kRendererID)); | 261 EXPECT_FALSE(p->HasDOMUIBindings(kRendererID)); |
262 } | 262 } |
263 | 263 |
OLD | NEW |