| OLD | NEW |
| 1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <string> | 5 #include <string> |
| 6 | 6 |
| 7 #include "base/basictypes.h" | 7 #include "base/basictypes.h" |
| 8 #include "base/file_path.h" | 8 #include "base/file_path.h" |
| 9 #include "chrome/browser/renderer_host/renderer_security_policy.h" | 9 #include "chrome/browser/renderer_host/renderer_security_policy.h" |
| 10 #include "chrome/common/url_constants.h" | 10 #include "chrome/common/url_constants.h" |
| 11 #include "net/url_request/url_request.h" | 11 #include "net/url_request/url_request.h" |
| 12 #include "net/url_request/url_request_test_job.h" | 12 #include "net/url_request/url_request_test_job.h" |
| 13 #include "testing/gtest/include/gtest/gtest.h" | 13 #include "testing/gtest/include/gtest/gtest.h" |
| 14 | 14 |
| 15 class RendererSecurityPolicyTest : public testing::Test { | 15 class RendererSecurityPolicyTest : public testing::Test { |
| 16 protected: | 16 protected: |
| 17 // testing::Test | 17 // testing::Test |
| 18 virtual void SetUp() { | 18 virtual void SetUp() { |
| 19 // In the real world, "chrome-ui" is a handled scheme. | 19 // In the real world, "chrome:" is a handled scheme. |
| 20 URLRequest::RegisterProtocolFactory("chrome-ui", | 20 URLRequest::RegisterProtocolFactory(chrome::kChromeUIScheme, |
| 21 &URLRequestTestJob::Factory); | 21 &URLRequestTestJob::Factory); |
| 22 } | 22 } |
| 23 virtual void TearDown() { | 23 virtual void TearDown() { |
| 24 URLRequest::RegisterProtocolFactory("chrome-ui", NULL); | 24 URLRequest::RegisterProtocolFactory(chrome::kChromeUIScheme, NULL); |
| 25 } | 25 } |
| 26 }; | 26 }; |
| 27 | 27 |
| 28 static int kRendererID = 42; | 28 static int kRendererID = 42; |
| 29 | 29 |
| 30 TEST_F(RendererSecurityPolicyTest, IsWebSafeSchemeTest) { | 30 TEST_F(RendererSecurityPolicyTest, IsWebSafeSchemeTest) { |
| 31 RendererSecurityPolicy* p = RendererSecurityPolicy::GetInstance(); | 31 RendererSecurityPolicy* p = RendererSecurityPolicy::GetInstance(); |
| 32 | 32 |
| 33 EXPECT_TRUE(p->IsWebSafeScheme("http")); | 33 EXPECT_TRUE(p->IsWebSafeScheme("http")); |
| 34 EXPECT_TRUE(p->IsWebSafeScheme("https")); | 34 EXPECT_TRUE(p->IsWebSafeScheme("https")); |
| (...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 67 EXPECT_TRUE(p->CanRequestURL(kRendererID, | 67 EXPECT_TRUE(p->CanRequestURL(kRendererID, |
| 68 GURL("view-source:http://www.google.com/"))); | 68 GURL("view-source:http://www.google.com/"))); |
| 69 EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("chrome-extension://xy/z"))); | 69 EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("chrome-extension://xy/z"))); |
| 70 | 70 |
| 71 // Dangerous | 71 // Dangerous |
| 72 EXPECT_FALSE(p->CanRequestURL(kRendererID, | 72 EXPECT_FALSE(p->CanRequestURL(kRendererID, |
| 73 GURL("file:///etc/passwd"))); | 73 GURL("file:///etc/passwd"))); |
| 74 EXPECT_FALSE(p->CanRequestURL(kRendererID, | 74 EXPECT_FALSE(p->CanRequestURL(kRendererID, |
| 75 GURL("view-cache:http://www.google.com/"))); | 75 GURL("view-cache:http://www.google.com/"))); |
| 76 EXPECT_FALSE(p->CanRequestURL(kRendererID, | 76 EXPECT_FALSE(p->CanRequestURL(kRendererID, |
| 77 GURL("chrome-ui://foo/bar"))); | 77 GURL("chrome://foo/bar"))); |
| 78 | 78 |
| 79 p->Remove(kRendererID); | 79 p->Remove(kRendererID); |
| 80 } | 80 } |
| 81 | 81 |
| 82 TEST_F(RendererSecurityPolicyTest, AboutTest) { | 82 TEST_F(RendererSecurityPolicyTest, AboutTest) { |
| 83 RendererSecurityPolicy* p = RendererSecurityPolicy::GetInstance(); | 83 RendererSecurityPolicy* p = RendererSecurityPolicy::GetInstance(); |
| 84 | 84 |
| 85 p->Add(kRendererID); | 85 p->Add(kRendererID); |
| 86 | 86 |
| 87 EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("about:blank"))); | 87 EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("about:blank"))); |
| (...skipping 117 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 205 FilePath(FILE_PATH_LITERAL("/etc/passwd")))); | 205 FilePath(FILE_PATH_LITERAL("/etc/passwd")))); |
| 206 EXPECT_FALSE(p->CanUploadFile(kRendererID, | 206 EXPECT_FALSE(p->CanUploadFile(kRendererID, |
| 207 FilePath(FILE_PATH_LITERAL("/etc/shadow")))); | 207 FilePath(FILE_PATH_LITERAL("/etc/shadow")))); |
| 208 | 208 |
| 209 p->Remove(kRendererID); | 209 p->Remove(kRendererID); |
| 210 } | 210 } |
| 211 | 211 |
| 212 TEST_F(RendererSecurityPolicyTest, CanServiceInspectElement) { | 212 TEST_F(RendererSecurityPolicyTest, CanServiceInspectElement) { |
| 213 RendererSecurityPolicy* p = RendererSecurityPolicy::GetInstance(); | 213 RendererSecurityPolicy* p = RendererSecurityPolicy::GetInstance(); |
| 214 | 214 |
| 215 GURL url("chrome-ui://inspector/inspector.html"); | 215 GURL url("chrome://inspector/inspector.html"); |
| 216 | 216 |
| 217 p->Add(kRendererID); | 217 p->Add(kRendererID); |
| 218 | 218 |
| 219 EXPECT_FALSE(p->CanRequestURL(kRendererID, url)); | 219 EXPECT_FALSE(p->CanRequestURL(kRendererID, url)); |
| 220 p->GrantInspectElement(kRendererID); | 220 p->GrantInspectElement(kRendererID); |
| 221 EXPECT_TRUE(p->CanRequestURL(kRendererID, url)); | 221 EXPECT_TRUE(p->CanRequestURL(kRendererID, url)); |
| 222 | 222 |
| 223 p->Remove(kRendererID); | 223 p->Remove(kRendererID); |
| 224 } | 224 } |
| 225 | 225 |
| 226 TEST_F(RendererSecurityPolicyTest, CanServiceDOMUIBindings) { | 226 TEST_F(RendererSecurityPolicyTest, CanServiceDOMUIBindings) { |
| 227 RendererSecurityPolicy* p = RendererSecurityPolicy::GetInstance(); | 227 RendererSecurityPolicy* p = RendererSecurityPolicy::GetInstance(); |
| 228 | 228 |
| 229 GURL url("chrome-ui://thumb/http://www.google.com/"); | 229 GURL url("chrome://thumb/http://www.google.com/"); |
| 230 | 230 |
| 231 p->Add(kRendererID); | 231 p->Add(kRendererID); |
| 232 | 232 |
| 233 EXPECT_FALSE(p->HasDOMUIBindings(kRendererID)); | 233 EXPECT_FALSE(p->HasDOMUIBindings(kRendererID)); |
| 234 EXPECT_FALSE(p->CanRequestURL(kRendererID, url)); | 234 EXPECT_FALSE(p->CanRequestURL(kRendererID, url)); |
| 235 p->GrantDOMUIBindings(kRendererID); | 235 p->GrantDOMUIBindings(kRendererID); |
| 236 EXPECT_TRUE(p->HasDOMUIBindings(kRendererID)); | 236 EXPECT_TRUE(p->HasDOMUIBindings(kRendererID)); |
| 237 EXPECT_TRUE(p->CanRequestURL(kRendererID, url)); | 237 EXPECT_TRUE(p->CanRequestURL(kRendererID, url)); |
| 238 | 238 |
| 239 p->Remove(kRendererID); | 239 p->Remove(kRendererID); |
| (...skipping 19 matching lines...) Expand all Loading... |
| 259 | 259 |
| 260 // Renderers are added and removed on the UI thread, but the policy can be | 260 // Renderers are added and removed on the UI thread, but the policy can be |
| 261 // queried on the IO thread. The RendererSecurityPolicy needs to be prepared | 261 // queried on the IO thread. The RendererSecurityPolicy needs to be prepared |
| 262 // to answer policy questions about renderers who no longer exist. | 262 // to answer policy questions about renderers who no longer exist. |
| 263 | 263 |
| 264 // In this case, we default to secure behavior. | 264 // In this case, we default to secure behavior. |
| 265 EXPECT_FALSE(p->CanRequestURL(kRendererID, url)); | 265 EXPECT_FALSE(p->CanRequestURL(kRendererID, url)); |
| 266 EXPECT_FALSE(p->CanUploadFile(kRendererID, file)); | 266 EXPECT_FALSE(p->CanUploadFile(kRendererID, file)); |
| 267 EXPECT_FALSE(p->HasDOMUIBindings(kRendererID)); | 267 EXPECT_FALSE(p->HasDOMUIBindings(kRendererID)); |
| 268 } | 268 } |
| OLD | NEW |