| OLD | NEW |
| 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <string> | 5 #include <string> |
| 6 | 6 |
| 7 #include "base/basictypes.h" | 7 #include "base/basictypes.h" |
| 8 #include "base/file_path.h" | 8 #include "base/file_path.h" |
| 9 #include "base/platform_file.h" | 9 #include "base/platform_file.h" |
| 10 #include "chrome/common/url_constants.h" | |
| 11 #include "content/browser/child_process_security_policy.h" | 10 #include "content/browser/child_process_security_policy.h" |
| 11 #include "content/common/test_url_constants.h" |
| 12 #include "content/common/url_constants.h" |
| 12 #include "net/url_request/url_request.h" | 13 #include "net/url_request/url_request.h" |
| 13 #include "net/url_request/url_request_test_job.h" | 14 #include "net/url_request/url_request_test_job.h" |
| 14 #include "testing/gtest/include/gtest/gtest.h" | 15 #include "testing/gtest/include/gtest/gtest.h" |
| 15 | 16 |
| 16 class ChildProcessSecurityPolicyTest : public testing::Test { | 17 class ChildProcessSecurityPolicyTest : public testing::Test { |
| 17 protected: | 18 protected: |
| 18 // testing::Test | 19 // testing::Test |
| 19 virtual void SetUp() { | 20 virtual void SetUp() { |
| 20 // In the real world, "chrome:" is a handled scheme. | 21 // In the real world, "chrome:" is a handled scheme. |
| 21 net::URLRequest::RegisterProtocolFactory(chrome::kChromeUIScheme, | 22 net::URLRequest::RegisterProtocolFactory(chrome::kChromeUIScheme, |
| (...skipping 89 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 111 | 112 |
| 112 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:memory"))); | 113 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:memory"))); |
| 113 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:crash"))); | 114 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:crash"))); |
| 114 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:cache"))); | 115 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:cache"))); |
| 115 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:hang"))); | 116 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:hang"))); |
| 116 | 117 |
| 117 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("aBoUt:memory"))); | 118 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("aBoUt:memory"))); |
| 118 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:CrASh"))); | 119 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:CrASh"))); |
| 119 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("abOuT:cAChe"))); | 120 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("abOuT:cAChe"))); |
| 120 | 121 |
| 121 p->GrantRequestURL(kRendererID, GURL(chrome::kAboutMemoryURL)); | 122 p->GrantRequestURL(kRendererID, GURL(chrome::kTestMemoryURL)); |
| 122 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutMemoryURL))); | 123 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kTestMemoryURL))); |
| 123 | 124 |
| 124 p->GrantRequestURL(kRendererID, GURL(chrome::kAboutCrashURL)); | 125 p->GrantRequestURL(kRendererID, GURL(chrome::kAboutCrashURL)); |
| 125 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutCrashURL))); | 126 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutCrashURL))); |
| 126 | 127 |
| 127 p->GrantRequestURL(kRendererID, GURL(chrome::kAboutCacheURL)); | 128 p->GrantRequestURL(kRendererID, GURL(chrome::kTestCacheURL)); |
| 128 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutCacheURL))); | 129 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kTestCacheURL))); |
| 129 | 130 |
| 130 p->GrantRequestURL(kRendererID, GURL(chrome::kAboutHangURL)); | 131 p->GrantRequestURL(kRendererID, GURL(chrome::kTestHangURL)); |
| 131 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutHangURL))); | 132 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kTestHangURL))); |
| 132 | 133 |
| 133 p->Remove(kRendererID); | 134 p->Remove(kRendererID); |
| 134 } | 135 } |
| 135 | 136 |
| 136 TEST_F(ChildProcessSecurityPolicyTest, JavaScriptTest) { | 137 TEST_F(ChildProcessSecurityPolicyTest, JavaScriptTest) { |
| 137 ChildProcessSecurityPolicy* p = ChildProcessSecurityPolicy::GetInstance(); | 138 ChildProcessSecurityPolicy* p = ChildProcessSecurityPolicy::GetInstance(); |
| 138 | 139 |
| 139 p->Add(kRendererID); | 140 p->Add(kRendererID); |
| 140 | 141 |
| 141 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("javascript:alert('xss')"))); | 142 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("javascript:alert('xss')"))); |
| (...skipping 268 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 410 | 411 |
| 411 // Renderers are added and removed on the UI thread, but the policy can be | 412 // Renderers are added and removed on the UI thread, but the policy can be |
| 412 // queried on the IO thread. The ChildProcessSecurityPolicy needs to be | 413 // queried on the IO thread. The ChildProcessSecurityPolicy needs to be |
| 413 // prepared to answer policy questions about renderers who no longer exist. | 414 // prepared to answer policy questions about renderers who no longer exist. |
| 414 | 415 |
| 415 // In this case, we default to secure behavior. | 416 // In this case, we default to secure behavior. |
| 416 EXPECT_FALSE(p->CanRequestURL(kRendererID, url)); | 417 EXPECT_FALSE(p->CanRequestURL(kRendererID, url)); |
| 417 EXPECT_FALSE(p->CanReadFile(kRendererID, file)); | 418 EXPECT_FALSE(p->CanReadFile(kRendererID, file)); |
| 418 EXPECT_FALSE(p->HasWebUIBindings(kRendererID)); | 419 EXPECT_FALSE(p->HasWebUIBindings(kRendererID)); |
| 419 } | 420 } |
| OLD | NEW |