| OLD | NEW |
| 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "chrome/common/extensions/csp_validator.h" | 5 #include "chrome/common/extensions/csp_validator.h" |
| 6 #include "testing/gtest/include/gtest/gtest.h" | 6 #include "testing/gtest/include/gtest/gtest.h" |
| 7 | 7 |
| 8 using extensions::csp_validator::ContentSecurityPolicyIsLegal; | 8 using extensions::csp_validator::ContentSecurityPolicyIsLegal; |
| 9 using extensions::csp_validator::ContentSecurityPolicyIsSecure; | 9 using extensions::csp_validator::ContentSecurityPolicyIsSecure; |
| 10 using extensions::csp_validator::ContentSecurityPolicyIsSandboxed; | 10 using extensions::csp_validator::ContentSecurityPolicyIsSandboxed; |
| 11 using extensions::Manifest; | 11 using extensions::Manifest; |
| 12 | 12 |
| 13 TEST(ExtensionCSPValidator, IsLegal) { | 13 TEST(ExtensionCSPValidator, IsLegal) { |
| 14 EXPECT_TRUE(ContentSecurityPolicyIsLegal("foo")); | 14 EXPECT_TRUE(ContentSecurityPolicyIsLegal("foo")); |
| 15 EXPECT_TRUE(ContentSecurityPolicyIsLegal( | 15 EXPECT_TRUE(ContentSecurityPolicyIsLegal( |
| 16 "default-src 'self'; script-src http://www.google.com")); | 16 "default-src 'self'; script-src http://www.google.com")); |
| 17 EXPECT_FALSE(ContentSecurityPolicyIsLegal( | 17 EXPECT_FALSE(ContentSecurityPolicyIsLegal( |
| 18 "default-src 'self';\nscript-src http://www.google.com")); | 18 "default-src 'self';\nscript-src http://www.google.com")); |
| 19 EXPECT_FALSE(ContentSecurityPolicyIsLegal( | 19 EXPECT_FALSE(ContentSecurityPolicyIsLegal( |
| 20 "default-src 'self';\rscript-src http://www.google.com")); | 20 "default-src 'self';\rscript-src http://www.google.com")); |
| 21 EXPECT_FALSE(ContentSecurityPolicyIsLegal( | 21 EXPECT_FALSE(ContentSecurityPolicyIsLegal( |
| 22 "default-src 'self';,script-src http://www.google.com")); | 22 "default-src 'self';,script-src http://www.google.com")); |
| 23 } | 23 } |
| 24 | 24 |
| 25 TEST(ExtensionCSPValidator, IsSecure) { | 25 TEST(ExtensionCSPValidator, IsSecure) { |
| 26 EXPECT_FALSE(ContentSecurityPolicyIsSecure( | 26 EXPECT_FALSE( |
| 27 "", Manifest::TYPE_EXTENSION)); | 27 ContentSecurityPolicyIsSecure(std::string(), Manifest::TYPE_EXTENSION)); |
| 28 EXPECT_FALSE(ContentSecurityPolicyIsSecure( | 28 EXPECT_FALSE(ContentSecurityPolicyIsSecure("img-src https://google.com", |
| 29 "img-src https://google.com", Manifest::TYPE_EXTENSION)); | 29 Manifest::TYPE_EXTENSION)); |
| 30 | 30 |
| 31 EXPECT_FALSE(ContentSecurityPolicyIsSecure( | 31 EXPECT_FALSE(ContentSecurityPolicyIsSecure( |
| 32 "default-src *", Manifest::TYPE_EXTENSION)); | 32 "default-src *", Manifest::TYPE_EXTENSION)); |
| 33 EXPECT_TRUE(ContentSecurityPolicyIsSecure( | 33 EXPECT_TRUE(ContentSecurityPolicyIsSecure( |
| 34 "default-src 'self'", Manifest::TYPE_EXTENSION)); | 34 "default-src 'self'", Manifest::TYPE_EXTENSION)); |
| 35 EXPECT_TRUE(ContentSecurityPolicyIsSecure( | 35 EXPECT_TRUE(ContentSecurityPolicyIsSecure( |
| 36 "default-src 'none'", Manifest::TYPE_EXTENSION)); | 36 "default-src 'none'", Manifest::TYPE_EXTENSION)); |
| 37 EXPECT_FALSE(ContentSecurityPolicyIsSecure( | 37 EXPECT_FALSE(ContentSecurityPolicyIsSecure( |
| 38 "default-src 'self' ftp://google.com", Manifest::TYPE_EXTENSION)); | 38 "default-src 'self' ftp://google.com", Manifest::TYPE_EXTENSION)); |
| 39 EXPECT_TRUE(ContentSecurityPolicyIsSecure( | 39 EXPECT_TRUE(ContentSecurityPolicyIsSecure( |
| (...skipping 99 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 139 "default-src 'self' blob:http://example.com/XXX", | 139 "default-src 'self' blob:http://example.com/XXX", |
| 140 Manifest::TYPE_EXTENSION)); | 140 Manifest::TYPE_EXTENSION)); |
| 141 EXPECT_TRUE(ContentSecurityPolicyIsSecure( | 141 EXPECT_TRUE(ContentSecurityPolicyIsSecure( |
| 142 "default-src 'self' filesystem:", Manifest::TYPE_EXTENSION)); | 142 "default-src 'self' filesystem:", Manifest::TYPE_EXTENSION)); |
| 143 EXPECT_FALSE(ContentSecurityPolicyIsSecure( | 143 EXPECT_FALSE(ContentSecurityPolicyIsSecure( |
| 144 "default-src 'self' filesystem:http://example.com/XXX", | 144 "default-src 'self' filesystem:http://example.com/XXX", |
| 145 Manifest::TYPE_EXTENSION)); | 145 Manifest::TYPE_EXTENSION)); |
| 146 } | 146 } |
| 147 | 147 |
| 148 TEST(ExtensionCSPValidator, IsSandboxed) { | 148 TEST(ExtensionCSPValidator, IsSandboxed) { |
| 149 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed("", Manifest::TYPE_EXTENSION)); | 149 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(std::string(), |
| 150 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed( | 150 Manifest::TYPE_EXTENSION)); |
| 151 "img-src https://google.com", Manifest::TYPE_EXTENSION)); | 151 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed("img-src https://google.com", |
| 152 Manifest::TYPE_EXTENSION)); |
| 152 | 153 |
| 153 // Sandbox directive is required. | 154 // Sandbox directive is required. |
| 154 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( | 155 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( |
| 155 "sandbox", Manifest::TYPE_EXTENSION)); | 156 "sandbox", Manifest::TYPE_EXTENSION)); |
| 156 | 157 |
| 157 // Additional sandbox tokens are OK. | 158 // Additional sandbox tokens are OK. |
| 158 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( | 159 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( |
| 159 "sandbox allow-scripts", Manifest::TYPE_EXTENSION)); | 160 "sandbox allow-scripts", Manifest::TYPE_EXTENSION)); |
| 160 // Except for allow-same-origin. | 161 // Except for allow-same-origin. |
| 161 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed( | 162 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed( |
| 162 "sandbox allow-same-origin", Manifest::TYPE_EXTENSION)); | 163 "sandbox allow-same-origin", Manifest::TYPE_EXTENSION)); |
| 163 | 164 |
| 164 // Additional directives are OK. | 165 // Additional directives are OK. |
| 165 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( | 166 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( |
| 166 "sandbox; img-src https://google.com", Manifest::TYPE_EXTENSION)); | 167 "sandbox; img-src https://google.com", Manifest::TYPE_EXTENSION)); |
| 167 | 168 |
| 168 // Extensions allow navigation, platform apps don't. | 169 // Extensions allow navigation, platform apps don't. |
| 169 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( | 170 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( |
| 170 "sandbox allow-top-navigation", Manifest::TYPE_EXTENSION)); | 171 "sandbox allow-top-navigation", Manifest::TYPE_EXTENSION)); |
| 171 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed( | 172 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed( |
| 172 "sandbox allow-top-navigation", Manifest::TYPE_PLATFORM_APP)); | 173 "sandbox allow-top-navigation", Manifest::TYPE_PLATFORM_APP)); |
| 173 | 174 |
| 174 // Popups are OK. | 175 // Popups are OK. |
| 175 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( | 176 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( |
| 176 "sandbox allow-popups", Manifest::TYPE_EXTENSION)); | 177 "sandbox allow-popups", Manifest::TYPE_EXTENSION)); |
| 177 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( | 178 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( |
| 178 "sandbox allow-popups", Manifest::TYPE_PLATFORM_APP)); | 179 "sandbox allow-popups", Manifest::TYPE_PLATFORM_APP)); |
| 179 } | 180 } |
| OLD | NEW |