OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "chrome/common/extensions/csp_validator.h" | 5 #include "chrome/common/extensions/csp_validator.h" |
6 #include "testing/gtest/include/gtest/gtest.h" | 6 #include "testing/gtest/include/gtest/gtest.h" |
7 | 7 |
8 using extensions::csp_validator::ContentSecurityPolicyIsLegal; | 8 using extensions::csp_validator::ContentSecurityPolicyIsLegal; |
9 using extensions::csp_validator::ContentSecurityPolicyIsSecure; | 9 using extensions::csp_validator::ContentSecurityPolicyIsSecure; |
10 using extensions::csp_validator::ContentSecurityPolicyIsSandboxed; | 10 using extensions::csp_validator::ContentSecurityPolicyIsSandboxed; |
11 using extensions::Manifest; | 11 using extensions::Manifest; |
12 | 12 |
13 TEST(ExtensionCSPValidator, IsLegal) { | 13 TEST(ExtensionCSPValidator, IsLegal) { |
14 EXPECT_TRUE(ContentSecurityPolicyIsLegal("foo")); | 14 EXPECT_TRUE(ContentSecurityPolicyIsLegal("foo")); |
15 EXPECT_TRUE(ContentSecurityPolicyIsLegal( | 15 EXPECT_TRUE(ContentSecurityPolicyIsLegal( |
16 "default-src 'self'; script-src http://www.google.com")); | 16 "default-src 'self'; script-src http://www.google.com")); |
17 EXPECT_FALSE(ContentSecurityPolicyIsLegal( | 17 EXPECT_FALSE(ContentSecurityPolicyIsLegal( |
18 "default-src 'self';\nscript-src http://www.google.com")); | 18 "default-src 'self';\nscript-src http://www.google.com")); |
19 EXPECT_FALSE(ContentSecurityPolicyIsLegal( | 19 EXPECT_FALSE(ContentSecurityPolicyIsLegal( |
20 "default-src 'self';\rscript-src http://www.google.com")); | 20 "default-src 'self';\rscript-src http://www.google.com")); |
21 EXPECT_FALSE(ContentSecurityPolicyIsLegal( | 21 EXPECT_FALSE(ContentSecurityPolicyIsLegal( |
22 "default-src 'self';,script-src http://www.google.com")); | 22 "default-src 'self';,script-src http://www.google.com")); |
23 } | 23 } |
24 | 24 |
25 TEST(ExtensionCSPValidator, IsSecure) { | 25 TEST(ExtensionCSPValidator, IsSecure) { |
26 EXPECT_FALSE(ContentSecurityPolicyIsSecure( | 26 EXPECT_FALSE( |
27 "", Manifest::TYPE_EXTENSION)); | 27 ContentSecurityPolicyIsSecure(std::string(), Manifest::TYPE_EXTENSION)); |
28 EXPECT_FALSE(ContentSecurityPolicyIsSecure( | 28 EXPECT_FALSE(ContentSecurityPolicyIsSecure("img-src https://google.com", |
29 "img-src https://google.com", Manifest::TYPE_EXTENSION)); | 29 Manifest::TYPE_EXTENSION)); |
30 | 30 |
31 EXPECT_FALSE(ContentSecurityPolicyIsSecure( | 31 EXPECT_FALSE(ContentSecurityPolicyIsSecure( |
32 "default-src *", Manifest::TYPE_EXTENSION)); | 32 "default-src *", Manifest::TYPE_EXTENSION)); |
33 EXPECT_TRUE(ContentSecurityPolicyIsSecure( | 33 EXPECT_TRUE(ContentSecurityPolicyIsSecure( |
34 "default-src 'self'", Manifest::TYPE_EXTENSION)); | 34 "default-src 'self'", Manifest::TYPE_EXTENSION)); |
35 EXPECT_TRUE(ContentSecurityPolicyIsSecure( | 35 EXPECT_TRUE(ContentSecurityPolicyIsSecure( |
36 "default-src 'none'", Manifest::TYPE_EXTENSION)); | 36 "default-src 'none'", Manifest::TYPE_EXTENSION)); |
37 EXPECT_FALSE(ContentSecurityPolicyIsSecure( | 37 EXPECT_FALSE(ContentSecurityPolicyIsSecure( |
38 "default-src 'self' ftp://google.com", Manifest::TYPE_EXTENSION)); | 38 "default-src 'self' ftp://google.com", Manifest::TYPE_EXTENSION)); |
39 EXPECT_TRUE(ContentSecurityPolicyIsSecure( | 39 EXPECT_TRUE(ContentSecurityPolicyIsSecure( |
(...skipping 99 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
139 "default-src 'self' blob:http://example.com/XXX", | 139 "default-src 'self' blob:http://example.com/XXX", |
140 Manifest::TYPE_EXTENSION)); | 140 Manifest::TYPE_EXTENSION)); |
141 EXPECT_TRUE(ContentSecurityPolicyIsSecure( | 141 EXPECT_TRUE(ContentSecurityPolicyIsSecure( |
142 "default-src 'self' filesystem:", Manifest::TYPE_EXTENSION)); | 142 "default-src 'self' filesystem:", Manifest::TYPE_EXTENSION)); |
143 EXPECT_FALSE(ContentSecurityPolicyIsSecure( | 143 EXPECT_FALSE(ContentSecurityPolicyIsSecure( |
144 "default-src 'self' filesystem:http://example.com/XXX", | 144 "default-src 'self' filesystem:http://example.com/XXX", |
145 Manifest::TYPE_EXTENSION)); | 145 Manifest::TYPE_EXTENSION)); |
146 } | 146 } |
147 | 147 |
148 TEST(ExtensionCSPValidator, IsSandboxed) { | 148 TEST(ExtensionCSPValidator, IsSandboxed) { |
149 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed("", Manifest::TYPE_EXTENSION)); | 149 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(std::string(), |
150 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed( | 150 Manifest::TYPE_EXTENSION)); |
151 "img-src https://google.com", Manifest::TYPE_EXTENSION)); | 151 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed("img-src https://google.com", |
| 152 Manifest::TYPE_EXTENSION)); |
152 | 153 |
153 // Sandbox directive is required. | 154 // Sandbox directive is required. |
154 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( | 155 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( |
155 "sandbox", Manifest::TYPE_EXTENSION)); | 156 "sandbox", Manifest::TYPE_EXTENSION)); |
156 | 157 |
157 // Additional sandbox tokens are OK. | 158 // Additional sandbox tokens are OK. |
158 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( | 159 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( |
159 "sandbox allow-scripts", Manifest::TYPE_EXTENSION)); | 160 "sandbox allow-scripts", Manifest::TYPE_EXTENSION)); |
160 // Except for allow-same-origin. | 161 // Except for allow-same-origin. |
161 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed( | 162 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed( |
162 "sandbox allow-same-origin", Manifest::TYPE_EXTENSION)); | 163 "sandbox allow-same-origin", Manifest::TYPE_EXTENSION)); |
163 | 164 |
164 // Additional directives are OK. | 165 // Additional directives are OK. |
165 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( | 166 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( |
166 "sandbox; img-src https://google.com", Manifest::TYPE_EXTENSION)); | 167 "sandbox; img-src https://google.com", Manifest::TYPE_EXTENSION)); |
167 | 168 |
168 // Extensions allow navigation, platform apps don't. | 169 // Extensions allow navigation, platform apps don't. |
169 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( | 170 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( |
170 "sandbox allow-top-navigation", Manifest::TYPE_EXTENSION)); | 171 "sandbox allow-top-navigation", Manifest::TYPE_EXTENSION)); |
171 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed( | 172 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed( |
172 "sandbox allow-top-navigation", Manifest::TYPE_PLATFORM_APP)); | 173 "sandbox allow-top-navigation", Manifest::TYPE_PLATFORM_APP)); |
173 | 174 |
174 // Popups are OK. | 175 // Popups are OK. |
175 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( | 176 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( |
176 "sandbox allow-popups", Manifest::TYPE_EXTENSION)); | 177 "sandbox allow-popups", Manifest::TYPE_EXTENSION)); |
177 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( | 178 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( |
178 "sandbox allow-popups", Manifest::TYPE_PLATFORM_APP)); | 179 "sandbox allow-popups", Manifest::TYPE_PLATFORM_APP)); |
179 } | 180 } |
OLD | NEW |