Introduce AncestorThrottle, which will process 'X-Frame-Options' headers.

content/browser/frame_host/ancestor_throttle_unittest.cc

+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "base/bind.h"
+#include "base/bind_helpers.h"
+#include "base/memory/scoped_ptr.h"
+#include "content/browser/frame_host/ancestor_throttle.h"
+#include "content/public/browser/navigation_handle.h"
+#include "content/public/browser/navigation_throttle.h"
+#include "content/public/browser/web_contents.h"
+#include "content/public/test/test_renderer_host.h"
+#include "net/http/http_response_headers.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace content {
+
+namespace {
+
+net::HttpResponseHeaders* GetAncestorHeaders(const char* xfo, const char* csp) {
+  std::string header_string("HTTP/1.1 200 OK\nX-Frame-Options: ");
+  header_string += xfo;
+  if (csp != nullptr) {
+    header_string += "\nContent-Security-Policy: ";
+    header_string += csp;
+  }
+  header_string += "\n\n";
+  std::replace(header_string.begin(), header_string.end(), '\n', '\0');
+  net::HttpResponseHeaders* headers =
+      new net::HttpResponseHeaders(header_string);
+  EXPECT_TRUE(headers->HasHeader("X-Frame-Options"));
+  if (csp != nullptr)
+    EXPECT_TRUE(headers->HasHeader("Content-Security-Policy"));
+  return headers;
+}
+
+}  // namespace
+
+// AncestorThrottleTest
+// -------------------------------------------------------------
+
+class AncestorThrottleTest : public testing::Test {};
+
+TEST_F(AncestorThrottleTest, ParsingXFrameOptions) {
+  struct TestCase {
+    const char* header;
+    AncestorThrottle::HeaderDisposition expected;
+    const char* value;
+  } cases[] = {
+      // Basic keywords
+      {"DENY", AncestorThrottle::DENY, "DENY"},
+      {"SAMEORIGIN", AncestorThrottle::SAMEORIGIN, "SAMEORIGIN"},
+      {"ALLOWALL", AncestorThrottle::ALLOWALL, "ALLOWALL"},
+
+      // Repeated keywords
+      {"DENY,DENY", AncestorThrottle::DENY, "DENY, DENY"},
+      {"SAMEORIGIN,SAMEORIGIN", AncestorThrottle::SAMEORIGIN,
+       "SAMEORIGIN, SAMEORIGIN"},
+      {"ALLOWALL,ALLOWALL", AncestorThrottle::ALLOWALL, "ALLOWALL, ALLOWALL"},
+
+      // Case-insensitive
+      {"deNy", AncestorThrottle::DENY, "deNy"},
+      {"sAmEorIgIn", AncestorThrottle::SAMEORIGIN, "sAmEorIgIn"},
+      {"AlLOWaLL", AncestorThrottle::ALLOWALL, "AlLOWaLL"},
+
+      // Trim whitespace
+      {" DENY", AncestorThrottle::DENY, "DENY"},
+      {"SAMEORIGIN ", AncestorThrottle::SAMEORIGIN, "SAMEORIGIN"},
+      {" ALLOWALL ", AncestorThrottle::ALLOWALL, "ALLOWALL"},
+      {"   DENY", AncestorThrottle::DENY, "DENY"},
+      {"SAMEORIGIN   ", AncestorThrottle::SAMEORIGIN, "SAMEORIGIN"},
+      {"   ALLOWALL   ", AncestorThrottle::ALLOWALL, "ALLOWALL"},
+      {" DENY , DENY ", AncestorThrottle::DENY, "DENY, DENY"},
+      {"SAMEORIGIN,  SAMEORIGIN", AncestorThrottle::SAMEORIGIN,
+       "SAMEORIGIN, SAMEORIGIN"},
+      {"ALLOWALL  ,ALLOWALL", AncestorThrottle::ALLOWALL, "ALLOWALL, ALLOWALL"},
+  };
+
+  AncestorThrottle throttle(nullptr);
+  for (const auto& test : cases) {
+    SCOPED_TRACE(test.header);
+    scoped_refptr<net::HttpResponseHeaders> headers =
+        GetAncestorHeaders(test.header, nullptr);
+    std::string header_value;
+    EXPECT_EQ(test.expected,
+              throttle.ParseHeader(headers.get(), &header_value));
+    EXPECT_EQ(test.value, header_value);
+  }
+}
+
+TEST_F(AncestorThrottleTest, ErrorsParsingXFrameOptions) {
+  struct TestCase {
+    const char* header;
+    AncestorThrottle::HeaderDisposition expected;
+    const char* failure;
+  } cases[] = {
+      // Empty == Invalid.
+      {"", AncestorThrottle::INVALID, ""},
+
+      // Invalid
+      {"INVALID", AncestorThrottle::INVALID, "INVALID"},
+      {"INVALID DENY", AncestorThrottle::INVALID, "INVALID DENY"},
+      {"DENY DENY", AncestorThrottle::INVALID, "DENY DENY"},
+      {"DE NY", AncestorThrottle::INVALID, "DE NY"},
+
+      // Conflicts
+      {"INVALID,DENY", AncestorThrottle::CONFLICT, "INVALID, DENY"},
+      {"DENY,ALLOWALL", AncestorThrottle::CONFLICT, "DENY, ALLOWALL"},
+      {"SAMEORIGIN,DENY", AncestorThrottle::CONFLICT, "SAMEORIGIN, DENY"},
+      {"ALLOWALL,SAMEORIGIN", AncestorThrottle::CONFLICT,
+       "ALLOWALL, SAMEORIGIN"},
+      {"DENY,  SAMEORIGIN", AncestorThrottle::CONFLICT, "DENY, SAMEORIGIN"}};
+
+  AncestorThrottle throttle(nullptr);
+  for (const auto& test : cases) {
+    SCOPED_TRACE(test.header);
+    scoped_refptr<net::HttpResponseHeaders> headers =
+        GetAncestorHeaders(test.header, nullptr);
+    std::string header_value;
+    EXPECT_EQ(test.expected,
+              throttle.ParseHeader(headers.get(), &header_value));
+    EXPECT_EQ(test.failure, header_value);
+  }
+}
+
+TEST_F(AncestorThrottleTest, IgnoreWhenFrameAncestorsPresent) {
+  struct TestCase {
+    const char* csp;
+    AncestorThrottle::HeaderDisposition expected;
+  } cases[] = {
+      {"", AncestorThrottle::DENY},
+      {"frame-ancestors 'none'", AncestorThrottle::IGNORE},
+      {"frame-ancestors *", AncestorThrottle::IGNORE},
+      {"frame-ancestors 'self'", AncestorThrottle::IGNORE},
+      {"frame-ancestors https://example.com", AncestorThrottle::IGNORE},
+      {"fRaMe-AnCeStOrS *", AncestorThrottle::IGNORE},
+      {"directive1; frame-ancestors 'none'", AncestorThrottle::IGNORE},
+      {"directive1; frame-ancestors *", AncestorThrottle::IGNORE},
+      {"directive1; frame-ancestors 'self'", AncestorThrottle::IGNORE},
+      {"directive1; frame-ancestors https://example.com",
+       AncestorThrottle::IGNORE},
+      {"directive1; fRaMe-AnCeStOrS *", AncestorThrottle::IGNORE},
+      {"policy1, frame-ancestors 'none'", AncestorThrottle::IGNORE},
+      {"policy1, frame-ancestors *", AncestorThrottle::IGNORE},
+      {"policy1, frame-ancestors 'self'", AncestorThrottle::IGNORE},
+      {"policy1, frame-ancestors https://example.com",
+       AncestorThrottle::IGNORE},
+      {"policy1, frame-ancestors 'none'", AncestorThrottle::IGNORE},
+      {"policy1, directive1; frame-ancestors *", AncestorThrottle::IGNORE},
+      {"policy1, directive1; frame-ancestors 'self'", AncestorThrottle::IGNORE},
+      {"policy1, directive1; frame-ancestors https://example.com",
+       AncestorThrottle::IGNORE},
+      {"policy1, directive1; fRaMe-AnCeStOrS *", AncestorThrottle::IGNORE},
+      {"policy1, directive1; fRaMe-AnCeStOrS *", AncestorThrottle::IGNORE},
+
+      {"not-frame-ancestors *", AncestorThrottle::DENY},
+      {"frame-ancestors-are-lovely", AncestorThrottle::DENY},
+      {"directive1; not-frame-ancestors *", AncestorThrottle::DENY},
+      {"directive1; frame-ancestors-are-lovely", AncestorThrottle::DENY},
+      {"policy1, not-frame-ancestors *", AncestorThrottle::DENY},
+      {"policy1, frame-ancestors-are-lovely", AncestorThrottle::DENY},
+      {"policy1, directive1; not-frame-ancestors *", AncestorThrottle::DENY},
+      {"policy1, directive1; frame-ancestors-are-lovely",
+       AncestorThrottle::DENY},
+  };
+
+  AncestorThrottle throttle(nullptr);
+  for (const auto& test : cases) {
+    SCOPED_TRACE(test.csp);
+    scoped_refptr<net::HttpResponseHeaders> headers =
+        GetAncestorHeaders("DENY", test.csp);
+    std::string header_value;
+    EXPECT_EQ(test.expected,
+              throttle.ParseHeader(headers.get(), &header_value));
+    EXPECT_EQ("DENY", header_value);
+  }
+}
+
+}  // namespace content