third_party/WebKit/Source/core/frame/csp/CSPSourceListTest.cpp - Issue 1367933003: CSP source *.x.y should not match host x.y

Side by Side Diff: third_party/WebKit/Source/core/frame/csp/CSPSourceListTest.cpp

Issue 1367933003: CSP source *.x.y should not match host x.y (Closed) Base URL: https://chromium.googlesource.com/chromium/src@master

Patch Set: Created 5 years, 3 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

« no previous file with comments | « third_party/WebKit/Source/core/frame/csp/CSPSource.cpp ('k') | third_party/WebKit/Source/core/frame/csp/CSPSourceTest.cpp » ('j') | tools/metrics/histograms/histograms.xml » ('J')
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

OLD	NEW
1 // Copyright 2015 The Chromium Authors. All rights reserved.	1 // Copyright 2015 The Chromium Authors. All rights reserved.

2 // Use of this source code is governed by a BSD-style license that can be	2 // Use of this source code is governed by a BSD-style license that can be

3 // found in the LICENSE file.	3 // found in the LICENSE file.

4	4

5 #include "config.h"	5 #include "config.h"

6 #include "core/frame/csp/CSPSourceList.h"	6 #include "core/frame/csp/CSPSourceList.h"

7	7

8 #include "core/dom/Document.h"	8 #include "core/dom/Document.h"

9 #include "core/frame/csp/CSPSource.h"	9 #include "core/frame/csp/CSPSource.h"

10 #include "core/frame/csp/ContentSecurityPolicy.h"	10 #include "core/frame/csp/ContentSecurityPolicy.h"

(...skipping 108 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
119 {	119 {

120 KURL base;	120 KURL base;

121 String sources = "http://example1.com:/foo/ https://.example2.com/bar/ htt p://*.test/";	121 String sources = "http://example1.com:/foo/ https://.example2.com/bar/ htt p://*.test/";

122 CSPSourceList sourceList(csp.get(), "script-src");	122 CSPSourceList sourceList(csp.get(), "script-src");

123 parseSourceList(sourceList, sources);	123 parseSourceList(sourceList, sources);

124	124

125 EXPECT_TRUE(sourceList.matches(KURL(base, "http://example1.com/foo/")));	125 EXPECT_TRUE(sourceList.matches(KURL(base, "http://example1.com/foo/")));

126 EXPECT_TRUE(sourceList.matches(KURL(base, "http://example1.com:8000/foo/"))) ;	126 EXPECT_TRUE(sourceList.matches(KURL(base, "http://example1.com:8000/foo/"))) ;

127 EXPECT_TRUE(sourceList.matches(KURL(base, "http://example1.com:9000/foo/"))) ;	127 EXPECT_TRUE(sourceList.matches(KURL(base, "http://example1.com:9000/foo/"))) ;

128 EXPECT_TRUE(sourceList.matches(KURL(base, "https://foo.example2.com/bar/"))) ;	128 EXPECT_TRUE(sourceList.matches(KURL(base, "https://foo.example2.com/bar/"))) ;

129 EXPECT_TRUE(sourceList.matches(KURL(base, "https://example2.com/bar/")));

130 EXPECT_TRUE(sourceList.matches(KURL(base, "http://foo.test/")));	129 EXPECT_TRUE(sourceList.matches(KURL(base, "http://foo.test/")));

131 EXPECT_TRUE(sourceList.matches(KURL(base, "http://foo.bar.test/")));	130 EXPECT_TRUE(sourceList.matches(KURL(base, "http://foo.bar.test/")));

132	131

133 EXPECT_FALSE(sourceList.matches(KURL(base, "https://example1.com:8000/foo")) );	132 EXPECT_FALSE(sourceList.matches(KURL(base, "https://example1.com:8000/foo")) );

134 EXPECT_FALSE(sourceList.matches(KURL(base, "https://example2.com:8000/bar")) );	133 EXPECT_FALSE(sourceList.matches(KURL(base, "https://example2.com:8000/bar")) );

135 EXPECT_FALSE(sourceList.matches(KURL(base, "https://foo.example2.com:8000/ba r")));	134 EXPECT_FALSE(sourceList.matches(KURL(base, "https://foo.example2.com:8000/ba r")));

136 EXPECT_FALSE(sourceList.matches(KURL(base, "https://example2.foo.com/bar"))) ;	135 EXPECT_FALSE(sourceList.matches(KURL(base, "https://example2.foo.com/bar"))) ;

137 EXPECT_FALSE(sourceList.matches(KURL(base, "https://foo.test/")));	136 EXPECT_FALSE(sourceList.matches(KURL(base, "https://foo.test/")));

138 EXPECT_FALSE(sourceList.matches(KURL(base, "http://foo.test.bar/")));	137 EXPECT_FALSE(sourceList.matches(KURL(base, "http://foo.test.bar/")));

	138 EXPECT_FALSE(sourceList.matches(KURL(base, "https://example2.com/bar/")));

	139 EXPECT_FALSE(sourceList.matches(KURL(base, "http://test/")));

139 }	140 }

140	141

141 TEST_F(CSPSourceListTest, RedirectMatching)	142 TEST_F(CSPSourceListTest, RedirectMatching)

142 {	143 {

143 KURL base;	144 KURL base;

144 String sources = "http://example1.com/foo/ http://example2.com/bar/";	145 String sources = "http://example1.com/foo/ http://example2.com/bar/";

145 CSPSourceList sourceList(csp.get(), "script-src");	146 CSPSourceList sourceList(csp.get(), "script-src");

146 parseSourceList(sourceList, sources);	147 parseSourceList(sourceList, sources);

147	148

148 EXPECT_TRUE(sourceList.matches(KURL(base, "http://example1.com/foo/"), Conte ntSecurityPolicy::DidRedirect));	149 EXPECT_TRUE(sourceList.matches(KURL(base, "http://example1.com/foo/"), Conte ntSecurityPolicy::DidRedirect));

149 EXPECT_TRUE(sourceList.matches(KURL(base, "http://example1.com/bar/"), Conte ntSecurityPolicy::DidRedirect));	150 EXPECT_TRUE(sourceList.matches(KURL(base, "http://example1.com/bar/"), Conte ntSecurityPolicy::DidRedirect));

150 EXPECT_TRUE(sourceList.matches(KURL(base, "http://example2.com/bar/"), Conte ntSecurityPolicy::DidRedirect));	151 EXPECT_TRUE(sourceList.matches(KURL(base, "http://example2.com/bar/"), Conte ntSecurityPolicy::DidRedirect));

151 EXPECT_TRUE(sourceList.matches(KURL(base, "http://example2.com/foo/"), Conte ntSecurityPolicy::DidRedirect));	152 EXPECT_TRUE(sourceList.matches(KURL(base, "http://example2.com/foo/"), Conte ntSecurityPolicy::DidRedirect));

152	153

153 EXPECT_FALSE(sourceList.matches(KURL(base, "http://example3.com/foo/"), Cont entSecurityPolicy::DidRedirect));	154 EXPECT_FALSE(sourceList.matches(KURL(base, "http://example3.com/foo/"), Cont entSecurityPolicy::DidRedirect));

154 EXPECT_FALSE(sourceList.matches(KURL(base, "https://example1.com/foo/"), Con tentSecurityPolicy::DidRedirect));	155 EXPECT_FALSE(sourceList.matches(KURL(base, "https://example1.com/foo/"), Con tentSecurityPolicy::DidRedirect));

155 }	156 }

156	157

157 } // namespace	158 } // namespace

OLD	NEW