OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "base/command_line.h" | 5 #include "base/command_line.h" |
6 #include "base/strings/stringprintf.h" | 6 #include "base/strings/stringprintf.h" |
7 #include "base/strings/utf_string_conversions.h" | 7 #include "base/strings/utf_string_conversions.h" |
8 #include "chrome/browser/ui/browser.h" | 8 #include "chrome/browser/ui/browser.h" |
9 #include "chrome/browser/ui/browser_commands.h" | 9 #include "chrome/browser/ui/browser_commands.h" |
10 #include "chrome/browser/ui/singleton_tabs.h" | 10 #include "chrome/browser/ui/singleton_tabs.h" |
11 #include "chrome/browser/ui/tabs/tab_strip_model.h" | 11 #include "chrome/browser/ui/tabs/tab_strip_model.h" |
12 #include "chrome/test/base/in_process_browser_test.h" | 12 #include "chrome/test/base/in_process_browser_test.h" |
13 #include "chrome/test/base/ui_test_utils.h" | 13 #include "chrome/test/base/ui_test_utils.h" |
14 #include "content/public/browser/notification_observer.h" | 14 #include "content/public/browser/notification_observer.h" |
15 #include "content/public/browser/notification_service.h" | 15 #include "content/public/browser/notification_service.h" |
16 #include "content/public/browser/notification_types.h" | 16 #include "content/public/browser/notification_types.h" |
17 #include "content/public/browser/resource_request_details.h" | 17 #include "content/public/browser/resource_request_details.h" |
18 #include "content/public/browser/web_contents_observer.h" | 18 #include "content/public/browser/web_contents_observer.h" |
19 #include "content/public/common/content_switches.h" | 19 #include "content/public/common/content_switches.h" |
20 #include "content/public/test/browser_test_utils.h" | 20 #include "content/public/test/browser_test_utils.h" |
| 21 #include "net/test/embedded_test_server/embedded_test_server.h" |
21 | 22 |
22 // The goal of these tests is to "simulate" exploited renderer processes, which | 23 // The goal of these tests is to "simulate" exploited renderer processes, which |
23 // can send arbitrary IPC messages and confuse browser process internal state, | 24 // can send arbitrary IPC messages and confuse browser process internal state, |
24 // leading to security bugs. We are trying to verify that the browser doesn't | 25 // leading to security bugs. We are trying to verify that the browser doesn't |
25 // perform any dangerous operations in such cases. | 26 // perform any dangerous operations in such cases. |
26 // This is similar to the security_exploit_browsertest.cc tests, but also | 27 // This is similar to the security_exploit_browsertest.cc tests, but also |
27 // includes chrome/ layer concepts such as extensions. | 28 // includes chrome/ layer concepts such as extensions. |
28 class ChromeSecurityExploitBrowserTest : public InProcessBrowserTest { | 29 class ChromeSecurityExploitBrowserTest : public InProcessBrowserTest { |
29 public: | 30 public: |
30 ChromeSecurityExploitBrowserTest() {} | 31 ChromeSecurityExploitBrowserTest() {} |
31 ~ChromeSecurityExploitBrowserTest() override {} | 32 ~ChromeSecurityExploitBrowserTest() override {} |
32 | 33 |
33 void SetUpCommandLine(base::CommandLine* command_line) override { | 34 void SetUpCommandLine(base::CommandLine* command_line) override { |
34 ASSERT_TRUE(test_server()->Start()); | 35 ASSERT_TRUE(embedded_test_server()->Start()); |
35 net::SpawnedTestServer https_server( | |
36 net::SpawnedTestServer::TYPE_HTTPS, | |
37 net::SpawnedTestServer::kLocalhost, | |
38 base::FilePath(FILE_PATH_LITERAL("chrome/test/data"))); | |
39 ASSERT_TRUE(https_server.Start()); | |
40 | 36 |
41 // Add a host resolver rule to map all outgoing requests to the test server. | 37 // Add a host resolver rule to map all outgoing requests to the test server. |
42 // This allows us to use "real" hostnames in URLs, which we can use to | 38 // This allows us to use "real" hostnames in URLs, which we can use to |
43 // create arbitrary SiteInstances. | 39 // create arbitrary SiteInstances. |
44 command_line->AppendSwitchASCII( | 40 command_line->AppendSwitchASCII( |
45 switches::kHostResolverRules, | 41 switches::kHostResolverRules, |
46 "MAP * " + test_server()->host_port_pair().ToString() + | 42 "MAP * " + embedded_test_server()->host_port_pair().ToString() + |
47 ",EXCLUDE localhost"); | 43 ",EXCLUDE localhost"); |
48 | 44 |
49 // Since we assume exploited renderer process, it can bypass the same origin | 45 // Since we assume exploited renderer process, it can bypass the same origin |
50 // policy at will. Simulate that by passing the disable-web-security flag. | 46 // policy at will. Simulate that by passing the disable-web-security flag. |
51 command_line->AppendSwitch(switches::kDisableWebSecurity); | 47 command_line->AppendSwitch(switches::kDisableWebSecurity); |
52 } | 48 } |
53 | 49 |
54 private: | 50 private: |
55 DISALLOW_COPY_AND_ASSIGN(ChromeSecurityExploitBrowserTest); | 51 DISALLOW_COPY_AND_ASSIGN(ChromeSecurityExploitBrowserTest); |
56 }; | 52 }; |
57 | 53 |
58 IN_PROC_BROWSER_TEST_F(ChromeSecurityExploitBrowserTest, | 54 IN_PROC_BROWSER_TEST_F(ChromeSecurityExploitBrowserTest, |
59 ChromeExtensionResources) { | 55 ChromeExtensionResources) { |
60 // Load a page that requests a chrome-extension:// image through XHR. We | 56 // Load a page that requests a chrome-extension:// image through XHR. We |
61 // expect this load to fail, as it is an illegal request. | 57 // expect this load to fail, as it is an illegal request. |
62 GURL foo("http://foo.com/files/chrome_extension_resource.html"); | 58 GURL foo("http://foo.com/chrome_extension_resource.html"); |
63 | 59 |
64 content::DOMMessageQueue msg_queue; | 60 content::DOMMessageQueue msg_queue; |
65 | 61 |
66 ui_test_utils::NavigateToURL(browser(), foo); | 62 ui_test_utils::NavigateToURL(browser(), foo); |
67 | 63 |
68 std::string status; | 64 std::string status; |
69 std::string expected_status("0"); | 65 std::string expected_status("0"); |
70 EXPECT_TRUE(msg_queue.WaitForMessage(&status)); | 66 EXPECT_TRUE(msg_queue.WaitForMessage(&status)); |
71 EXPECT_STREQ(status.c_str(), expected_status.c_str()); | 67 EXPECT_STREQ(status.c_str(), expected_status.c_str()); |
72 } | 68 } |
OLD | NEW |