Stop trusting the sign-in process if it manages to navigate to another URL.

chrome/browser/signin/signin_browsertest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CHROME_BROWSER_SIGNIN_SIGNIN_BROWSERTEST_H_
 #define CHROME_BROWSER_SIGNIN_SIGNIN_BROWSERTEST_H_
 
+#include "base/command_line.h"
 #include "chrome/browser/signin/signin_manager.h"
 #include "chrome/browser/signin/signin_manager_factory.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/singleton_tabs.h"
 #include "chrome/browser/ui/sync/sync_promo_ui.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/browser/ui/webui/signin/login_ui_service.h"
 #include "chrome/browser/ui/webui/signin/login_ui_service_factory.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/web_contents.h"
+#include "content/public/common/content_switches.h"
 #include "google_apis/gaia/gaia_urls.h"
 #include "net/url_request/test_url_fetcher_factory.h"
 
 namespace {
   const char kNonSigninURL[] = "www.google.com";
 }
 
 class SigninBrowserTest : public InProcessBrowserTest {
  public:
+  virtual void SetUpCommandLine(CommandLine* command_line) OVERRIDE {
+    https_server_.reset(new net::SpawnedTestServer(
+        net::SpawnedTestServer::TYPE_HTTPS,
+        net::SpawnedTestServer::kLocalhost,
+        base::FilePath(FILE_PATH_LITERAL("chrome/test/data"))));
+    ASSERT_TRUE(https_server_->Start());
+
+    // Add a host resolver rule to map all outgoing requests to the test server.
+    // This allows us to use "real" hostnames in URLs, which we can use to
+    // create arbitrary SiteInstances.
+    command_line->AppendSwitchASCII(
+        switches::kHostResolverRules,
+        "MAP * " + https_server_->host_port_pair().ToString() +
+            ",EXCLUDE localhost");
+    command_line->AppendSwitch(switches::kIgnoreCertificateErrors);
+  }
+
   virtual void SetUp() OVERRIDE {
     factory_.reset(new net::URLFetcherImplFactory());
     fake_factory_.reset(new net::FakeURLFetcherFactory(factory_.get()));
     fake_factory_->SetFakeResponse(
         GaiaUrls::GetInstance()->service_login_url(),
         std::string(),
         true);
     fake_factory_->SetFakeResponse(kNonSigninURL, std::string(), true);
     // Yield control back to the InProcessBrowserTest framework.
     InProcessBrowserTest::SetUp();
@@ skipping 11 matching lines @@
     factory_.reset();
     InProcessBrowserTest::TearDown();
   }
 
  private:
   // Fake URLFetcher factory used to mock out GAIA signin.
   scoped_ptr<net::FakeURLFetcherFactory> fake_factory_;
 
   // The URLFetcherImplFactory instance used to instantiate |fake_factory_|.
   scoped_ptr<net::URLFetcherImplFactory> factory_;
+
+  scoped_ptr<net::SpawnedTestServer> https_server_;
 };
 
+// If the one-click-signin feature is not enabled (e.g Chrome OS), we
+// never grant signin privileges to any renderer processes.
+#if defined(ENABLE_ONE_CLICK_SIGNIN)
+const bool kOneClickSigninEnabled = true;
+#else
+const bool kOneClickSigninEnabled = false;
+#endif
+
 // Disabled on Windows due to flakiness. http://crbug.com/249055
 #if defined(OS_WIN)
 #define MAYBE_ProcessIsolation DISABLED_ProcessIsolation
 #else
 #define MAYBE_ProcessIsolation ProcessIsolation
 #endif
 IN_PROC_BROWSER_TEST_F(SigninBrowserTest, MAYBE_ProcessIsolation) {
-  // If the one-click-signin feature is not enabled (e.g Chrome OS), we
-  // never grant signin privileges to any renderer processes.
-#if defined(ENABLE_ONE_CLICK_SIGNIN)
-  const bool kOneClickSigninEnabled = true;
-#else
-  const bool kOneClickSigninEnabled = false;
-#endif
-
   SigninManager* signin = SigninManagerFactory::GetForProfile(
       browser()->profile());
   EXPECT_FALSE(signin->HasSigninProcess());
 
   ui_test_utils::NavigateToURL(browser(), SyncPromoUI::GetSyncPromoURL(
       SyncPromoUI::SOURCE_NTP_LINK, true));
   EXPECT_EQ(kOneClickSigninEnabled, signin->HasSigninProcess());
 
   // Navigating away should change the process.
   ui_test_utils::NavigateToURL(browser(), GURL(chrome::kChromeUINewTabURL));
@@ skipping 22 matching lines @@
   EXPECT_EQ(active_tab, browser()->tab_strip_model()->GetActiveWebContents());
   EXPECT_EQ(kOneClickSigninEnabled,
             signin->IsSigninProcess(active_tab_process_id));
 
   // Navigating away should change the process.
   ui_test_utils::NavigateToURL(browser(), GURL(kNonSigninURL));
   EXPECT_FALSE(signin->IsSigninProcess(
       active_tab->GetRenderProcessHost()->GetID()));
 }
 
+IN_PROC_BROWSER_TEST_F(SigninBrowserTest, NotTrustedAfterRedirect) {
+  SigninManager* signin = SigninManagerFactory::GetForProfile(
+      browser()->profile());
+  EXPECT_FALSE(signin->HasSigninProcess());
+
+  GURL url = SyncPromoUI::GetSyncPromoURL(SyncPromoUI::SOURCE_NTP_LINK, true);
+  ui_test_utils::NavigateToURL(browser(), url);
+  EXPECT_EQ(kOneClickSigninEnabled, signin->HasSigninProcess());
+
+  // Navigating away should change the process.
+  GURL redirect_url("https://accounts.google.com/server-redirect?"
+      "https://foo.com?service=chromiumsync");
+  ui_test_utils::NavigateToURL(browser(), redirect_url);
+  EXPECT_FALSE(signin->HasSigninProcess());
+}
+
 #endif  // CHROME_BROWSER_SIGNIN_SIGNIN_BROWSERTEST_H_