Deprecate MountPointProvider::IsAccessAllowed in favor of GetPermissionPolicy

webkit/fileapi/sandbox_mount_point_provider_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "webkit/fileapi/sandbox_mount_point_provider.h"
 
 #include <set>
 
 #include "base/basictypes.h"
 #include "base/file_util.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/memory/scoped_ptr.h"
 #include "base/message_loop.h"
 #include "base/message_loop_proxy.h"
 #include "googleurl/src/gurl.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "webkit/fileapi/file_system_mount_point_provider.h"
+#include "webkit/fileapi/file_system_url.h"
 #include "webkit/fileapi/file_system_util.h"
 #include "webkit/fileapi/mock_file_system_options.h"
 
 namespace fileapi {
 
+namespace {
+
+FileSystemURL CreateFileSystemURL(const char* path) {
+  const GURL kOrigin("http://foo/");
+  return FileSystemURL::CreateForTest(
+      kOrigin, kFileSystemTypeTemporary, FilePath::FromUTF8Unsafe(path));
+}
+
+}  // namespace
+
 class SandboxMountPointProviderOriginEnumeratorTest : public testing::Test {
  public:
   void SetUp() {
     ASSERT_TRUE(data_dir_.CreateUniqueTempDir());
     sandbox_provider_.reset(
         new SandboxMountPointProvider(
             NULL,
             base::MessageLoopProxy::current(),
             data_dir_.path(),
             CreateAllowFileAccessOptions()));
@@ skipping 64 matching lines @@
     if (enumerator->HasFileSystemType(kFileSystemTypePersistent)) {
       ASSERT_TRUE(persistent_set.find(current) != persistent_set.end());
       ++persistent_actual_size;
     }
   }
 
   EXPECT_EQ(temporary_size, temporary_actual_size);
   EXPECT_EQ(persistent_size, persistent_actual_size);
 }
 
+TEST(SandboxMountPointProviderTest, AccessPermissions) {
+  MessageLoop message_loop_;
+  SandboxMountPointProvider provider(
+      NULL, base::MessageLoopProxy::current(), FilePath(),
+      CreateAllowFileAccessOptions());
+
+  // Any access should be allowed in sandbox directory.
+  EXPECT_EQ(FILE_PERMISSION_ALWAYS_ALLOW,
+            provider.GetPermissionPolicy(CreateFileSystemURL("foo"),
+                                         kReadFilePermissions));
+  EXPECT_EQ(FILE_PERMISSION_ALWAYS_ALLOW,
+            provider.GetPermissionPolicy(CreateFileSystemURL("foo"),
+                                         kWriteFilePermissions));
+  EXPECT_EQ(FILE_PERMISSION_ALWAYS_ALLOW,
+            provider.GetPermissionPolicy(CreateFileSystemURL("foo"),
+                                         kCreateFilePermissions));
+
+  // Access to a path with parent references ('..') should be disallowed.
+  EXPECT_EQ(FILE_PERMISSION_ALWAYS_DENY,
+            provider.GetPermissionPolicy(CreateFileSystemURL("a/../b"),
+                                         kReadFilePermissions));
+
+  // Access from non-allowed scheme should be disallowed.
+  EXPECT_EQ(FILE_PERMISSION_ALWAYS_DENY,
+            provider.GetPermissionPolicy(
+                FileSystemURL::CreateForTest(
+                    GURL("unknown://bar"), kFileSystemTypeTemporary,
+                    FilePath::FromUTF8Unsafe("foo")),
+                kReadFilePermissions));
+
+  // Access for non-sandbox type should be disallowed.
+  EXPECT_EQ(FILE_PERMISSION_ALWAYS_DENY,
+            provider.GetPermissionPolicy(
+                FileSystemURL::CreateForTest(
+                    GURL("http://foo/"), kFileSystemTypeTest,
+                    FilePath::FromUTF8Unsafe("foo")),
+                kReadFilePermissions));
+
+  // Create access with ristricted name should be disallowed.

[ericu, 2013/02/11 22:29:17]

typo: restricted

+  EXPECT_EQ(FILE_PERMISSION_ALWAYS_DENY,
+            provider.GetPermissionPolicy(CreateFileSystemURL(".."),
+                                         kCreateFilePermissions));
+  EXPECT_EQ(FILE_PERMISSION_ALWAYS_DENY,
+            provider.GetPermissionPolicy(CreateFileSystemURL("."),
+                                         kCreateFilePermissions));
+
+  // Similar but safe cases.
+  EXPECT_EQ(FILE_PERMISSION_ALWAYS_ALLOW,
+            provider.GetPermissionPolicy(CreateFileSystemURL(" ."),
+                                         kCreateFilePermissions));
+  EXPECT_EQ(FILE_PERMISSION_ALWAYS_ALLOW,
+            provider.GetPermissionPolicy(CreateFileSystemURL(". "),
+                                         kCreateFilePermissions));
+  EXPECT_EQ(FILE_PERMISSION_ALWAYS_ALLOW,
+            provider.GetPermissionPolicy(CreateFileSystemURL(" .."),
+                                         kCreateFilePermissions));
+  EXPECT_EQ(FILE_PERMISSION_ALWAYS_ALLOW,
+            provider.GetPermissionPolicy(CreateFileSystemURL(".. "),
+                                         kCreateFilePermissions));
+  EXPECT_EQ(FILE_PERMISSION_ALWAYS_ALLOW,
+            provider.GetPermissionPolicy(CreateFileSystemURL("b."),
+                                         kCreateFilePermissions));
+  EXPECT_EQ(FILE_PERMISSION_ALWAYS_ALLOW,
+            provider.GetPermissionPolicy(CreateFileSystemURL(".b"),
+                                         kCreateFilePermissions));
+}
+
 }  // namespace fileapi