Support whitelisting to handle insecure origins as trustworthy origins (blink)

Source/platform/weborigin/SecurityPolicyTest.cpp

 /*
  * Copyright (C) 2014 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 11 matching lines @@
  * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
  * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
  * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
  * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
  */
 
 #include "config.h"
+#include "platform/weborigin/SecurityOrigin.h"
 #include "platform/weborigin/SecurityPolicy.h"
 
 #include "platform/weborigin/KURL.h"
 #include <gtest/gtest.h>
 
 using blink::KURL;
+using blink::SecurityOrigin;
 using blink::SecurityPolicy;
 
 namespace {
 
 TEST(SecurityPolicyTest, ReferrerIsAlwaysAWebURL)
 {
     EXPECT_TRUE(String() == SecurityPolicy::generateReferrer(blink::ReferrerPolicyAlways, KURL(blink::ParsedURLString, "http://example.com/"), String::fromUTF8("chrome://somepage/")).referrer);
 }
 
 TEST(SecurityPolicyTest, GenerateReferrer)
@@ skipping 82 matching lines @@
                 << result.referrer.utf8().data() << "'.";
         } else {
             EXPECT_TRUE(result.referrer.isEmpty())
                 << "'" << test.referrer << "' to '" << test.destination
                 << "' should have been empty: was '" << result.referrer.utf8().data() << "'.";
         }
         EXPECT_EQ(test.policy, result.referrerPolicy);
     }
 }
 
+TEST(SecurityPolicyTest, TrustworthyWhiteList)
+{
+    const char* insecureURLs[] = {
+        "http://a.test/path/to/file.html",
+        "http://b.test/path/to/file.html",
+        "blob:http://c.test/b3aae9c8-7f90-440d-8d7c-43aa20d72fde",
+        "filesystem:http://d.test/path/t/file.html",

[Mike West, 2015/04/20 09:25:00]

I think we also need to verify that whitelisting `blob:[origin]` also whitelists
`[origin]`. That might not be clear to someone just skimming this test. It
probably means breaking out of the nice `for`-loop style, though. :(

[kinuko, 2015/04/20 15:43:18]

Good point, done.

+    };
+
+    for (const char* url : insecureURLs) {
+        String errorMessage;
+        RefPtr<SecurityOrigin> origin = SecurityOrigin::createFromString(url);
+        EXPECT_FALSE(origin->isPotentiallyTrustworthy(errorMessage));
+        SecurityPolicy::addOriginTrustworthyWhiteList(*origin);
+        EXPECT_TRUE(origin->isPotentiallyTrustworthy(errorMessage));
+    }
+}
+
 } // namespace
-