Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(337)

Issues Search
    My Issues | Starred     Open | Closed | All

Unified Diff: content/browser/child_process_security_policy_unittest.cc

Issue 19599006: ChildProcessSecurityPolicy: Deprecate bitmask-based permissions checks for files. (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: fix test on win Created 7 years, 5 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « content/browser/child_process_security_policy_impl.cc ('k') | content/public/browser/child_process_security_policy.h » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: content/browser/child_process_security_policy_unittest.cc
diff --git a/content/browser/child_process_security_policy_unittest.cc b/content/browser/child_process_security_policy_unittest.cc
index 35a044a491afae61a6f4a5655183c1cdd9986aee..b914eac549a8af013ad76a0f742fb5d9aa307a48 100644
--- a/content/browser/child_process_security_policy_unittest.cc
+++ b/content/browser/child_process_security_policy_unittest.cc
@@ -13,7 +13,10 @@
#include "content/test/test_content_browser_client.h"
#include "testing/gtest/include/gtest/gtest.h"
#include "url/gurl.h"
+#include "webkit/browser/fileapi/file_permission_policy.h"
+#include "webkit/browser/fileapi/file_system_url.h"
#include "webkit/browser/fileapi/isolated_context.h"
+#include "webkit/common/fileapi/file_system_types.h"
namespace content {
namespace {
@@ -91,6 +94,7 @@ class ChildProcessSecurityPolicyTest : public testing::Test {
ContentBrowserClient* old_browser_client_;
};
+
TEST_F(ChildProcessSecurityPolicyTest, IsWebSafeSchemeTest) {
ChildProcessSecurityPolicyImpl* p =
ChildProcessSecurityPolicyImpl::GetInstance();
@@ -362,28 +366,120 @@ TEST_F(ChildProcessSecurityPolicyTest, FileSystemGrantsTest) {
fileapi::IsolatedContext::GetInstance()->RevokeFileSystem(copy_into_id);
}
-TEST_F(ChildProcessSecurityPolicyTest, CanReadFiles) {
+TEST_F(ChildProcessSecurityPolicyTest, FilePermissionGrantingAndRevoking) {
ChildProcessSecurityPolicyImpl* p =
ChildProcessSecurityPolicyImpl::GetInstance();
+ p->RegisterFileSystemPermissionPolicy(
+ fileapi::kFileSystemTypeTest,
+ fileapi::FILE_PERMISSION_USE_FILE_PERMISSION);
+
p->Add(kRendererID);
+ base::FilePath file(TEST_PATH("/dir/testfile"));
+ file = file.NormalizePathSeparators();
+ fileapi::FileSystemURL url = fileapi::FileSystemURL::CreateForTest(
+ GURL("http://foo/"), fileapi::kFileSystemTypeTest, file);
- EXPECT_FALSE(p->CanReadFile(kRendererID,
- base::FilePath(TEST_PATH("/etc/passwd"))));
- p->GrantReadFile(kRendererID, base::FilePath(TEST_PATH("/etc/passwd")));
- EXPECT_TRUE(p->CanReadFile(kRendererID,
- base::FilePath(TEST_PATH("/etc/passwd"))));
- EXPECT_FALSE(p->CanReadFile(kRendererID,
- base::FilePath(TEST_PATH("/etc/shadow"))));
+ // Test initially having no permissions.
+ EXPECT_FALSE(p->CanReadFile(kRendererID, file));
+ EXPECT_FALSE(p->CanWriteFile(kRendererID, file));
+ EXPECT_FALSE(p->CanCreateFile(kRendererID, file));
+ EXPECT_FALSE(p->CanCreateWriteFile(kRendererID, file));
+ EXPECT_FALSE(p->CanReadFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanWriteFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanCreateFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanCreateWriteFileSystemFile(kRendererID, url));
+
+ // Testing every combination of permissions granting and revoking.
+ p->GrantReadFile(kRendererID, file);
+ EXPECT_TRUE(p->CanReadFile(kRendererID, file));
+ EXPECT_FALSE(p->CanWriteFile(kRendererID, file));
+ EXPECT_FALSE(p->CanCreateFile(kRendererID, file));
+ EXPECT_FALSE(p->CanCreateWriteFile(kRendererID, file));
+ EXPECT_TRUE(p->CanReadFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanWriteFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanCreateFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanCreateWriteFileSystemFile(kRendererID, url));
+ p->RevokeAllPermissionsForFile(kRendererID, file);
+ EXPECT_FALSE(p->CanReadFile(kRendererID, file));
+ EXPECT_FALSE(p->CanWriteFile(kRendererID, file));
+ EXPECT_FALSE(p->CanCreateFile(kRendererID, file));
+ EXPECT_FALSE(p->CanCreateWriteFile(kRendererID, file));
+ EXPECT_FALSE(p->CanReadFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanWriteFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanCreateFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanCreateWriteFileSystemFile(kRendererID, url));
+
+ p->GrantCreateReadWriteFile(kRendererID, file);
+ EXPECT_TRUE(p->CanReadFile(kRendererID, file));
+ EXPECT_TRUE(p->CanWriteFile(kRendererID, file));
+ EXPECT_TRUE(p->CanCreateFile(kRendererID, file));
+ EXPECT_TRUE(p->CanCreateWriteFile(kRendererID, file));
+ EXPECT_TRUE(p->CanReadFileSystemFile(kRendererID, url));
+ EXPECT_TRUE(p->CanWriteFileSystemFile(kRendererID, url));
+ EXPECT_TRUE(p->CanCreateFileSystemFile(kRendererID, url));
+ EXPECT_TRUE(p->CanCreateWriteFileSystemFile(kRendererID, url));
+ p->RevokeAllPermissionsForFile(kRendererID, file);
+ EXPECT_FALSE(p->CanReadFile(kRendererID, file));
+ EXPECT_FALSE(p->CanWriteFile(kRendererID, file));
+ EXPECT_FALSE(p->CanCreateFile(kRendererID, file));
+ EXPECT_FALSE(p->CanCreateWriteFile(kRendererID, file));
+ EXPECT_FALSE(p->CanReadFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanWriteFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanCreateFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanCreateWriteFileSystemFile(kRendererID, url));
+
+ p->GrantCreateWriteFile(kRendererID, file);
+ EXPECT_FALSE(p->CanReadFile(kRendererID, file));
+ EXPECT_TRUE(p->CanWriteFile(kRendererID, file));
+ EXPECT_TRUE(p->CanCreateFile(kRendererID, file));
+ EXPECT_TRUE(p->CanCreateWriteFile(kRendererID, file));
+ EXPECT_FALSE(p->CanReadFileSystemFile(kRendererID, url));
+ EXPECT_TRUE(p->CanWriteFileSystemFile(kRendererID, url));
+ EXPECT_TRUE(p->CanCreateFileSystemFile(kRendererID, url));
+ EXPECT_TRUE(p->CanCreateWriteFileSystemFile(kRendererID, url));
+ p->RevokeAllPermissionsForFile(kRendererID, file);
+ EXPECT_FALSE(p->CanReadFile(kRendererID, file));
+ EXPECT_FALSE(p->CanWriteFile(kRendererID, file));
+ EXPECT_FALSE(p->CanCreateFile(kRendererID, file));
+ EXPECT_FALSE(p->CanCreateWriteFile(kRendererID, file));
+ EXPECT_FALSE(p->CanReadFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanWriteFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanCreateFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanCreateWriteFileSystemFile(kRendererID, url));
+ // Test revoke permissions on renderer ID removal.
+ p->GrantCreateReadWriteFile(kRendererID, file);
+ EXPECT_TRUE(p->CanReadFile(kRendererID, file));
+ EXPECT_TRUE(p->CanWriteFile(kRendererID, file));
+ EXPECT_TRUE(p->CanCreateFile(kRendererID, file));
+ EXPECT_TRUE(p->CanCreateWriteFile(kRendererID, file));
+ EXPECT_TRUE(p->CanReadFileSystemFile(kRendererID, url));
+ EXPECT_TRUE(p->CanWriteFileSystemFile(kRendererID, url));
+ EXPECT_TRUE(p->CanCreateFileSystemFile(kRendererID, url));
+ EXPECT_TRUE(p->CanCreateWriteFileSystemFile(kRendererID, url));
p->Remove(kRendererID);
- p->Add(kRendererID);
+ EXPECT_FALSE(p->CanReadFile(kRendererID, file));
+ EXPECT_FALSE(p->CanWriteFile(kRendererID, file));
+ EXPECT_FALSE(p->CanCreateFile(kRendererID, file));
+ EXPECT_FALSE(p->CanCreateWriteFile(kRendererID, file));
+ EXPECT_FALSE(p->CanReadFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanWriteFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanCreateFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanCreateWriteFileSystemFile(kRendererID, url));
- EXPECT_FALSE(p->CanReadFile(kRendererID,
- base::FilePath(TEST_PATH("/etc/passwd"))));
- EXPECT_FALSE(p->CanReadFile(kRendererID,
- base::FilePath(TEST_PATH("/etc/shadow"))));
+ // Test having no permissions upon re-adding same renderer ID.
+ p->Add(kRendererID);
+ EXPECT_FALSE(p->CanReadFile(kRendererID, file));
+ EXPECT_FALSE(p->CanWriteFile(kRendererID, file));
+ EXPECT_FALSE(p->CanCreateFile(kRendererID, file));
+ EXPECT_FALSE(p->CanCreateWriteFile(kRendererID, file));
+ EXPECT_FALSE(p->CanReadFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanWriteFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanCreateFileSystemFile(kRendererID, url));
+ EXPECT_FALSE(p->CanCreateWriteFileSystemFile(kRendererID, url));
+ // Cleanup.
p->Remove(kRendererID);
}
« no previous file with comments | « content/browser/child_process_security_policy_impl.cc ('k') | content/public/browser/child_process_security_policy.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698