OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "base/command_line.h" | 5 #include "base/command_line.h" |
6 #include "base/path_service.h" | 6 #include "base/path_service.h" |
7 #include "base/string_util.h" | 7 #include "base/string_util.h" |
8 #include "base/stringprintf.h" | 8 #include "base/stringprintf.h" |
9 #include "base/time.h" | 9 #include "base/time.h" |
10 #include "base/utf_string_conversions.h" | 10 #include "base/utf_string_conversions.h" |
(...skipping 163 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
174 // Workers are async and we don't have notifications for them passing | 174 // Workers are async and we don't have notifications for them passing |
175 // messages since they do it between renderer and worker processes. | 175 // messages since they do it between renderer and worker processes. |
176 // So have a polling loop, check every 200ms, timeout at 30s. | 176 // So have a polling loop, check every 200ms, timeout at 30s. |
177 const int timeout_ms = 200; | 177 const int timeout_ms = 200; |
178 base::Time timeToQuit = base::Time::Now() + | 178 base::Time timeToQuit = base::Time::Now() + |
179 base::TimeDelta::FromMilliseconds(30000); | 179 base::TimeDelta::FromMilliseconds(30000); |
180 | 180 |
181 while (base::Time::Now() < timeToQuit) { | 181 while (base::Time::Now() < timeToQuit) { |
182 bool workerFinished = false; | 182 bool workerFinished = false; |
183 ASSERT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 183 ASSERT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
184 tab->GetRenderViewHost(), | 184 tab->GetRenderViewHost(), std::wstring(), |
185 "", | 185 L"window.domAutomationController.send(IsWorkerFinished());", |
186 "window.domAutomationController.send(IsWorkerFinished());", | |
187 &workerFinished)); | 186 &workerFinished)); |
188 | 187 |
189 if (workerFinished) | 188 if (workerFinished) |
190 break; | 189 break; |
191 | 190 |
192 // Wait a bit. | 191 // Wait a bit. |
193 MessageLoop::current()->PostDelayedTask( | 192 MessageLoop::current()->PostDelayedTask( |
194 FROM_HERE, | 193 FROM_HERE, |
195 MessageLoop::QuitClosure(), | 194 MessageLoop::QuitClosure(), |
196 base::TimeDelta::FromMilliseconds(timeout_ms)); | 195 base::TimeDelta::FromMilliseconds(timeout_ms)); |
197 content::RunMessageLoop(); | 196 content::RunMessageLoop(); |
198 } | 197 } |
199 | 198 |
200 bool actuallyLoadedContent = false; | 199 bool actuallyLoadedContent = false; |
201 ASSERT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 200 ASSERT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
202 tab->GetRenderViewHost(), | 201 tab->GetRenderViewHost(), std::wstring(), |
203 "", | 202 L"window.domAutomationController.send(IsContentLoaded());", |
204 "window.domAutomationController.send(IsContentLoaded());", | |
205 &actuallyLoadedContent)); | 203 &actuallyLoadedContent)); |
206 EXPECT_EQ(expectLoaded, actuallyLoadedContent); | 204 EXPECT_EQ(expectLoaded, actuallyLoadedContent); |
207 } | 205 } |
208 | 206 |
209 void ProceedThroughInterstitial(WebContents* tab) { | 207 void ProceedThroughInterstitial(WebContents* tab) { |
210 InterstitialPage* interstitial_page = tab->GetInterstitialPage(); | 208 InterstitialPage* interstitial_page = tab->GetInterstitialPage(); |
211 ASSERT_TRUE(interstitial_page); | 209 ASSERT_TRUE(interstitial_page); |
212 content::WindowedNotificationObserver observer( | 210 content::WindowedNotificationObserver observer( |
213 content::NOTIFICATION_LOAD_STOP, | 211 content::NOTIFICATION_LOAD_STOP, |
214 content::Source<NavigationController>(&tab->GetController())); | 212 content::Source<NavigationController>(&tab->GetController())); |
(...skipping 641 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
856 | 854 |
857 // Because of cross-frame scripting restrictions, we cannot access the iframe | 855 // Because of cross-frame scripting restrictions, we cannot access the iframe |
858 // content. So to know if the frame was loaded, we just check if a popup was | 856 // content. So to know if the frame was loaded, we just check if a popup was |
859 // opened (the iframe content opens one). | 857 // opened (the iframe content opens one). |
860 // Note: because of bug 1115868, no constrained window is opened right now. | 858 // Note: because of bug 1115868, no constrained window is opened right now. |
861 // Once the bug is fixed, this will do the real check. | 859 // Once the bug is fixed, this will do the real check. |
862 EXPECT_EQ(0U, GetConstrainedWindowCount()); | 860 EXPECT_EQ(0U, GetConstrainedWindowCount()); |
863 | 861 |
864 int img_width; | 862 int img_width; |
865 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractInt( | 863 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractInt( |
866 tab->GetRenderViewHost(), | 864 tab->GetRenderViewHost(), std::wstring(), |
867 "", | 865 L"window.domAutomationController.send(ImageWidth());", &img_width)); |
868 "window.domAutomationController.send(ImageWidth());", | |
869 &img_width)); | |
870 // In order to check that the image was not loaded, we check its width. | 866 // In order to check that the image was not loaded, we check its width. |
871 // The actual image (Google logo) is 114 pixels wide, we assume the broken | 867 // The actual image (Google logo) is 114 pixels wide, we assume the broken |
872 // image is less than 100. | 868 // image is less than 100. |
873 EXPECT_LT(img_width, 100); | 869 EXPECT_LT(img_width, 100); |
874 | 870 |
875 bool js_result = false; | 871 bool js_result = false; |
876 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 872 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
877 tab->GetRenderViewHost(), | 873 tab->GetRenderViewHost(), std::wstring(), |
878 "", | 874 L"window.domAutomationController.send(IsFooSet());", &js_result)); |
879 "window.domAutomationController.send(IsFooSet());", | |
880 &js_result)); | |
881 EXPECT_FALSE(js_result); | 875 EXPECT_FALSE(js_result); |
882 } | 876 } |
883 | 877 |
884 // Visits a page with insecure content loaded by JS (after the initial page | 878 // Visits a page with insecure content loaded by JS (after the initial page |
885 // load). | 879 // load). |
886 IN_PROC_BROWSER_TEST_F(SSLUITest, TestDisplaysInsecureContentLoadedFromJS) { | 880 IN_PROC_BROWSER_TEST_F(SSLUITest, TestDisplaysInsecureContentLoadedFromJS) { |
887 ASSERT_TRUE(test_server()->Start()); | 881 ASSERT_TRUE(test_server()->Start()); |
888 ASSERT_TRUE(https_server_.Start()); | 882 ASSERT_TRUE(https_server_.Start()); |
889 | 883 |
890 std::string replacement_path; | 884 std::string replacement_path; |
891 ASSERT_TRUE(GetFilePathWithHostAndPortReplacement( | 885 ASSERT_TRUE(GetFilePathWithHostAndPortReplacement( |
892 "files/ssl/page_with_dynamic_insecure_content.html", | 886 "files/ssl/page_with_dynamic_insecure_content.html", |
893 test_server()->host_port_pair(), | 887 test_server()->host_port_pair(), |
894 &replacement_path)); | 888 &replacement_path)); |
895 ui_test_utils::NavigateToURL(browser(), https_server_.GetURL( | 889 ui_test_utils::NavigateToURL(browser(), https_server_.GetURL( |
896 replacement_path)); | 890 replacement_path)); |
897 | 891 |
898 WebContents* tab = chrome::GetActiveWebContents(browser()); | 892 WebContents* tab = chrome::GetActiveWebContents(browser()); |
899 CheckAuthenticatedState(tab, false); | 893 CheckAuthenticatedState(tab, false); |
900 | 894 |
901 // Load the insecure image. | 895 // Load the insecure image. |
902 bool js_result = false; | 896 bool js_result = false; |
903 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 897 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
904 tab->GetRenderViewHost(), | 898 tab->GetRenderViewHost(), std::wstring(), L"loadBadImage();", |
905 "", | |
906 "loadBadImage();", | |
907 &js_result)); | 899 &js_result)); |
908 EXPECT_TRUE(js_result); | 900 EXPECT_TRUE(js_result); |
909 | 901 |
910 // We should now have insecure content. | 902 // We should now have insecure content. |
911 CheckAuthenticatedState(tab, true); | 903 CheckAuthenticatedState(tab, true); |
912 } | 904 } |
913 | 905 |
914 // Visits two pages from the same origin: one that displays insecure content and | 906 // Visits two pages from the same origin: one that displays insecure content and |
915 // one that doesn't. The test checks that we do not propagate the insecure | 907 // one that doesn't. The test checks that we do not propagate the insecure |
916 // content state from one to the other. | 908 // content state from one to the other. |
(...skipping 381 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1298 | 1290 |
1299 CheckAuthenticatedState(tab, false); | 1291 CheckAuthenticatedState(tab, false); |
1300 | 1292 |
1301 bool success = false; | 1293 bool success = false; |
1302 // Now navigate inside the frame. | 1294 // Now navigate inside the frame. |
1303 { | 1295 { |
1304 content::WindowedNotificationObserver observer( | 1296 content::WindowedNotificationObserver observer( |
1305 content::NOTIFICATION_LOAD_STOP, | 1297 content::NOTIFICATION_LOAD_STOP, |
1306 content::Source<NavigationController>(&tab->GetController())); | 1298 content::Source<NavigationController>(&tab->GetController())); |
1307 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1299 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
1308 tab->GetRenderViewHost(), | 1300 tab->GetRenderViewHost(), std::wstring(), |
1309 "", | 1301 L"window.domAutomationController.send(clickLink('goodHTTPSLink'));", |
1310 "window.domAutomationController.send(clickLink('goodHTTPSLink'));", | |
1311 &success)); | 1302 &success)); |
1312 ASSERT_TRUE(success); | 1303 ASSERT_TRUE(success); |
1313 observer.Wait(); | 1304 observer.Wait(); |
1314 } | 1305 } |
1315 | 1306 |
1316 // We should still be fine. | 1307 // We should still be fine. |
1317 CheckAuthenticatedState(tab, false); | 1308 CheckAuthenticatedState(tab, false); |
1318 | 1309 |
1319 // Now let's hit a bad page. | 1310 // Now let's hit a bad page. |
1320 { | 1311 { |
1321 content::WindowedNotificationObserver observer( | 1312 content::WindowedNotificationObserver observer( |
1322 content::NOTIFICATION_LOAD_STOP, | 1313 content::NOTIFICATION_LOAD_STOP, |
1323 content::Source<NavigationController>(&tab->GetController())); | 1314 content::Source<NavigationController>(&tab->GetController())); |
1324 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1315 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
1325 tab->GetRenderViewHost(), | 1316 tab->GetRenderViewHost(), std::wstring(), |
1326 "", | 1317 L"window.domAutomationController.send(clickLink('badHTTPSLink'));", |
1327 "window.domAutomationController.send(clickLink('badHTTPSLink'));", | |
1328 &success)); | 1318 &success)); |
1329 ASSERT_TRUE(success); | 1319 ASSERT_TRUE(success); |
1330 observer.Wait(); | 1320 observer.Wait(); |
1331 } | 1321 } |
1332 | 1322 |
1333 // The security style should still be secure. | 1323 // The security style should still be secure. |
1334 CheckAuthenticatedState(tab, false); | 1324 CheckAuthenticatedState(tab, false); |
1335 | 1325 |
1336 // And the frame should be blocked. | 1326 // And the frame should be blocked. |
1337 bool is_content_evil = true; | 1327 bool is_content_evil = true; |
1338 std::string content_frame_xpath("html/frameset/frame[2]"); | 1328 std::wstring content_frame_xpath(L"html/frameset/frame[2]"); |
1339 std::string is_evil_js("window.domAutomationController.send(" | 1329 std::wstring is_evil_js(L"window.domAutomationController.send(" |
1340 "document.getElementById('evilDiv') != null);"); | 1330 L"document.getElementById('evilDiv') != null);"); |
1341 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1331 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
1342 tab->GetRenderViewHost(), | 1332 tab->GetRenderViewHost(), content_frame_xpath, is_evil_js, |
1343 content_frame_xpath, | |
1344 is_evil_js, | |
1345 &is_content_evil)); | 1333 &is_content_evil)); |
1346 EXPECT_FALSE(is_content_evil); | 1334 EXPECT_FALSE(is_content_evil); |
1347 | 1335 |
1348 // Now go back, our state should still be OK. | 1336 // Now go back, our state should still be OK. |
1349 { | 1337 { |
1350 content::WindowedNotificationObserver observer( | 1338 content::WindowedNotificationObserver observer( |
1351 content::NOTIFICATION_LOAD_STOP, | 1339 content::NOTIFICATION_LOAD_STOP, |
1352 content::Source<NavigationController>(&tab->GetController())); | 1340 content::Source<NavigationController>(&tab->GetController())); |
1353 tab->GetController().GoBack(); | 1341 tab->GetController().GoBack(); |
1354 observer.Wait(); | 1342 observer.Wait(); |
1355 } | 1343 } |
1356 CheckAuthenticatedState(tab, false); | 1344 CheckAuthenticatedState(tab, false); |
1357 | 1345 |
1358 // Navigate to a page served over HTTP. | 1346 // Navigate to a page served over HTTP. |
1359 { | 1347 { |
1360 content::WindowedNotificationObserver observer( | 1348 content::WindowedNotificationObserver observer( |
1361 content::NOTIFICATION_LOAD_STOP, | 1349 content::NOTIFICATION_LOAD_STOP, |
1362 content::Source<NavigationController>(&tab->GetController())); | 1350 content::Source<NavigationController>(&tab->GetController())); |
1363 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1351 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
1364 tab->GetRenderViewHost(), | 1352 tab->GetRenderViewHost(), std::wstring(), |
1365 "", | 1353 L"window.domAutomationController.send(clickLink('HTTPLink'));", |
1366 "window.domAutomationController.send(clickLink('HTTPLink'));", | |
1367 &success)); | 1354 &success)); |
1368 ASSERT_TRUE(success); | 1355 ASSERT_TRUE(success); |
1369 observer.Wait(); | 1356 observer.Wait(); |
1370 } | 1357 } |
1371 | 1358 |
1372 // Our state should be insecure. | 1359 // Our state should be insecure. |
1373 CheckAuthenticatedState(tab, true); | 1360 CheckAuthenticatedState(tab, true); |
1374 | 1361 |
1375 // Go back, our state should be unchanged. | 1362 // Go back, our state should be unchanged. |
1376 { | 1363 { |
(...skipping 25 matching lines...) Expand all Loading... |
1402 true); // Interstitial showing | 1389 true); // Interstitial showing |
1403 | 1390 |
1404 ProceedThroughInterstitial(tab); | 1391 ProceedThroughInterstitial(tab); |
1405 | 1392 |
1406 // Navigate to a good frame. | 1393 // Navigate to a good frame. |
1407 bool success = false; | 1394 bool success = false; |
1408 content::WindowedNotificationObserver observer( | 1395 content::WindowedNotificationObserver observer( |
1409 content::NOTIFICATION_LOAD_STOP, | 1396 content::NOTIFICATION_LOAD_STOP, |
1410 content::Source<NavigationController>(&tab->GetController())); | 1397 content::Source<NavigationController>(&tab->GetController())); |
1411 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1398 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
1412 tab->GetRenderViewHost(), | 1399 tab->GetRenderViewHost(), std::wstring(), |
1413 "", | 1400 L"window.domAutomationController.send(clickLink('goodHTTPSLink'));", |
1414 "window.domAutomationController.send(clickLink('goodHTTPSLink'));", | |
1415 &success)); | 1401 &success)); |
1416 ASSERT_TRUE(success); | 1402 ASSERT_TRUE(success); |
1417 observer.Wait(); | 1403 observer.Wait(); |
1418 | 1404 |
1419 // We should still be authentication broken. | 1405 // We should still be authentication broken. |
1420 CheckAuthenticationBrokenState(tab, net::CERT_STATUS_DATE_INVALID, false, | 1406 CheckAuthenticationBrokenState(tab, net::CERT_STATUS_DATE_INVALID, false, |
1421 false); | 1407 false); |
1422 } | 1408 } |
1423 | 1409 |
1424 // From an HTTP top frame, navigate to good and bad HTTPS (security state should | 1410 // From an HTTP top frame, navigate to good and bad HTTPS (security state should |
(...skipping 15 matching lines...) Expand all Loading... |
1440 test_server()->GetURL(top_frame_path)); | 1426 test_server()->GetURL(top_frame_path)); |
1441 CheckUnauthenticatedState(tab); | 1427 CheckUnauthenticatedState(tab); |
1442 | 1428 |
1443 // Now navigate inside the frame to a secure HTTPS frame. | 1429 // Now navigate inside the frame to a secure HTTPS frame. |
1444 { | 1430 { |
1445 bool success = false; | 1431 bool success = false; |
1446 content::WindowedNotificationObserver observer( | 1432 content::WindowedNotificationObserver observer( |
1447 content::NOTIFICATION_LOAD_STOP, | 1433 content::NOTIFICATION_LOAD_STOP, |
1448 content::Source<NavigationController>(&tab->GetController())); | 1434 content::Source<NavigationController>(&tab->GetController())); |
1449 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1435 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
1450 tab->GetRenderViewHost(), | 1436 tab->GetRenderViewHost(), std::wstring(), |
1451 "", | 1437 L"window.domAutomationController.send(clickLink('goodHTTPSLink'));", |
1452 "window.domAutomationController.send(clickLink('goodHTTPSLink'));", | |
1453 &success)); | 1438 &success)); |
1454 ASSERT_TRUE(success); | 1439 ASSERT_TRUE(success); |
1455 observer.Wait(); | 1440 observer.Wait(); |
1456 } | 1441 } |
1457 | 1442 |
1458 // We should still be unauthenticated. | 1443 // We should still be unauthenticated. |
1459 CheckUnauthenticatedState(tab); | 1444 CheckUnauthenticatedState(tab); |
1460 | 1445 |
1461 // Now navigate to a bad HTTPS frame. | 1446 // Now navigate to a bad HTTPS frame. |
1462 { | 1447 { |
1463 bool success = false; | 1448 bool success = false; |
1464 content::WindowedNotificationObserver observer( | 1449 content::WindowedNotificationObserver observer( |
1465 content::NOTIFICATION_LOAD_STOP, | 1450 content::NOTIFICATION_LOAD_STOP, |
1466 content::Source<NavigationController>(&tab->GetController())); | 1451 content::Source<NavigationController>(&tab->GetController())); |
1467 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1452 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
1468 tab->GetRenderViewHost(), | 1453 tab->GetRenderViewHost(), std::wstring(), |
1469 "", | 1454 L"window.domAutomationController.send(clickLink('badHTTPSLink'));", |
1470 "window.domAutomationController.send(clickLink('badHTTPSLink'));", | |
1471 &success)); | 1455 &success)); |
1472 ASSERT_TRUE(success); | 1456 ASSERT_TRUE(success); |
1473 observer.Wait(); | 1457 observer.Wait(); |
1474 } | 1458 } |
1475 | 1459 |
1476 // State should not have changed. | 1460 // State should not have changed. |
1477 CheckUnauthenticatedState(tab); | 1461 CheckUnauthenticatedState(tab); |
1478 | 1462 |
1479 // And the frame should have been blocked (see bug #2316). | 1463 // And the frame should have been blocked (see bug #2316). |
1480 bool is_content_evil = true; | 1464 bool is_content_evil = true; |
1481 std::string content_frame_xpath("html/frameset/frame[2]"); | 1465 std::wstring content_frame_xpath(L"html/frameset/frame[2]"); |
1482 std::string is_evil_js("window.domAutomationController.send(" | 1466 std::wstring is_evil_js(L"window.domAutomationController.send(" |
1483 "document.getElementById('evilDiv') != null);"); | 1467 L"document.getElementById('evilDiv') != null);"); |
1484 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1468 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
1485 tab->GetRenderViewHost(), | 1469 tab->GetRenderViewHost(), content_frame_xpath, is_evil_js, |
1486 content_frame_xpath, | |
1487 is_evil_js, | |
1488 &is_content_evil)); | 1470 &is_content_evil)); |
1489 EXPECT_FALSE(is_content_evil); | 1471 EXPECT_FALSE(is_content_evil); |
1490 } | 1472 } |
1491 | 1473 |
1492 IN_PROC_BROWSER_TEST_F(SSLUITest, TestUnsafeContentsInWorkerFiltered) { | 1474 IN_PROC_BROWSER_TEST_F(SSLUITest, TestUnsafeContentsInWorkerFiltered) { |
1493 ASSERT_TRUE(https_server_.Start()); | 1475 ASSERT_TRUE(https_server_.Start()); |
1494 ASSERT_TRUE(https_server_expired_.Start()); | 1476 ASSERT_TRUE(https_server_expired_.Start()); |
1495 | 1477 |
1496 // This page will spawn a Worker which will try to load content from | 1478 // This page will spawn a Worker which will try to load content from |
1497 // BadCertServer. | 1479 // BadCertServer. |
(...skipping 127 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1625 | 1607 |
1626 // Visit a page over https that contains a frame with a redirect. | 1608 // Visit a page over https that contains a frame with a redirect. |
1627 | 1609 |
1628 // XMLHttpRequest insecure content in synchronous mode. | 1610 // XMLHttpRequest insecure content in synchronous mode. |
1629 | 1611 |
1630 // XMLHttpRequest insecure content in asynchronous mode. | 1612 // XMLHttpRequest insecure content in asynchronous mode. |
1631 | 1613 |
1632 // XMLHttpRequest over bad ssl in synchronous mode. | 1614 // XMLHttpRequest over bad ssl in synchronous mode. |
1633 | 1615 |
1634 // XMLHttpRequest over OK ssl in synchronous mode. | 1616 // XMLHttpRequest over OK ssl in synchronous mode. |
OLD | NEW |