OLD | NEW |
1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2011 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <string> | 5 #include <string> |
6 | 6 |
7 #include "base/basictypes.h" | 7 #include "base/basictypes.h" |
8 #include "base/file_path.h" | 8 #include "base/file_path.h" |
9 #include "base/platform_file.h" | 9 #include "base/platform_file.h" |
10 #include "chrome/common/url_constants.h" | |
11 #include "content/browser/child_process_security_policy.h" | 10 #include "content/browser/child_process_security_policy.h" |
| 11 #include "content/common/url_constants.h" |
12 #include "net/url_request/url_request.h" | 12 #include "net/url_request/url_request.h" |
13 #include "net/url_request/url_request_test_job.h" | 13 #include "net/url_request/url_request_test_job.h" |
14 #include "testing/gtest/include/gtest/gtest.h" | 14 #include "testing/gtest/include/gtest/gtest.h" |
15 | 15 |
16 class ChildProcessSecurityPolicyTest : public testing::Test { | 16 class ChildProcessSecurityPolicyTest : public testing::Test { |
17 protected: | 17 protected: |
18 // testing::Test | 18 // testing::Test |
19 virtual void SetUp() { | 19 virtual void SetUp() { |
20 // In the real world, "chrome:" is a handled scheme. | 20 // In the real world, "chrome:" is a handled scheme. |
21 net::URLRequest::RegisterProtocolFactory(chrome::kChromeUIScheme, | 21 net::URLRequest::RegisterProtocolFactory(chrome::kChromeUIScheme, |
(...skipping 89 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
111 | 111 |
112 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:memory"))); | 112 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:memory"))); |
113 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:crash"))); | 113 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:crash"))); |
114 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:cache"))); | 114 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:cache"))); |
115 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:hang"))); | 115 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:hang"))); |
116 | 116 |
117 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("aBoUt:memory"))); | 117 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("aBoUt:memory"))); |
118 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:CrASh"))); | 118 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:CrASh"))); |
119 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("abOuT:cAChe"))); | 119 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("abOuT:cAChe"))); |
120 | 120 |
121 p->GrantRequestURL(kRendererID, GURL(chrome::kAboutMemoryURL)); | 121 p->GrantRequestURL(kRendererID, GURL("about:memory")); |
122 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutMemoryURL))); | 122 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:memory"))); |
123 | 123 |
124 p->GrantRequestURL(kRendererID, GURL(chrome::kAboutCrashURL)); | 124 p->GrantRequestURL(kRendererID, GURL(chrome::kAboutCrashURL)); |
125 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutCrashURL))); | 125 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutCrashURL))); |
126 | 126 |
127 p->GrantRequestURL(kRendererID, GURL(chrome::kAboutCacheURL)); | 127 p->GrantRequestURL(kRendererID, GURL("about:cache")); |
128 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutCacheURL))); | 128 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:cache"))); |
129 | 129 |
130 p->GrantRequestURL(kRendererID, GURL(chrome::kAboutHangURL)); | 130 p->GrantRequestURL(kRendererID, GURL("about:hang")); |
131 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL(chrome::kAboutHangURL))); | 131 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:hang"))); |
132 | 132 |
133 p->Remove(kRendererID); | 133 p->Remove(kRendererID); |
134 } | 134 } |
135 | 135 |
136 TEST_F(ChildProcessSecurityPolicyTest, JavaScriptTest) { | 136 TEST_F(ChildProcessSecurityPolicyTest, JavaScriptTest) { |
137 ChildProcessSecurityPolicy* p = ChildProcessSecurityPolicy::GetInstance(); | 137 ChildProcessSecurityPolicy* p = ChildProcessSecurityPolicy::GetInstance(); |
138 | 138 |
139 p->Add(kRendererID); | 139 p->Add(kRendererID); |
140 | 140 |
141 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("javascript:alert('xss')"))); | 141 EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("javascript:alert('xss')"))); |
(...skipping 268 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
410 | 410 |
411 // Renderers are added and removed on the UI thread, but the policy can be | 411 // Renderers are added and removed on the UI thread, but the policy can be |
412 // queried on the IO thread. The ChildProcessSecurityPolicy needs to be | 412 // queried on the IO thread. The ChildProcessSecurityPolicy needs to be |
413 // prepared to answer policy questions about renderers who no longer exist. | 413 // prepared to answer policy questions about renderers who no longer exist. |
414 | 414 |
415 // In this case, we default to secure behavior. | 415 // In this case, we default to secure behavior. |
416 EXPECT_FALSE(p->CanRequestURL(kRendererID, url)); | 416 EXPECT_FALSE(p->CanRequestURL(kRendererID, url)); |
417 EXPECT_FALSE(p->CanReadFile(kRendererID, file)); | 417 EXPECT_FALSE(p->CanReadFile(kRendererID, file)); |
418 EXPECT_FALSE(p->HasWebUIBindings(kRendererID)); | 418 EXPECT_FALSE(p->HasWebUIBindings(kRendererID)); |
419 } | 419 } |
OLD | NEW |