| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <stdint.h> | 5 #include <stdint.h> |
| 6 | 6 |
| 7 #include "base/command_line.h" | 7 #include "base/command_line.h" |
| 8 #include "base/containers/hash_tables.h" | 8 #include "base/containers/hash_tables.h" |
| 9 #include "base/macros.h" | 9 #include "base/macros.h" |
| 10 #include "base/strings/utf_string_conversions.h" | 10 #include "base/strings/utf_string_conversions.h" |
| 11 #include "build/build_config.h" | 11 #include "build/build_config.h" |
| 12 #include "content/browser/dom_storage/dom_storage_context_wrapper.h" | 12 #include "content/browser/dom_storage/dom_storage_context_wrapper.h" |
| 13 #include "content/browser/dom_storage/session_storage_namespace_impl.h" | 13 #include "content/browser/dom_storage/session_storage_namespace_impl.h" |
| 14 #include "content/browser/frame_host/navigator.h" | 14 #include "content/browser/frame_host/navigator.h" |
| 15 #include "content/browser/frame_host/render_frame_host_impl.h" | 15 #include "content/browser/frame_host/render_frame_host_impl.h" |
| 16 #include "content/browser/renderer_host/render_view_host_factory.h" | 16 #include "content/browser/renderer_host/render_view_host_factory.h" |
| 17 #include "content/browser/renderer_host/render_view_host_impl.h" | 17 #include "content/browser/renderer_host/render_view_host_impl.h" |
| 18 #include "content/browser/web_contents/web_contents_impl.h" | 18 #include "content/browser/web_contents/web_contents_impl.h" |
| 19 #include "content/common/frame_messages.h" | 19 #include "content/common/frame_messages.h" |
| 20 #include "content/common/resource_messages.h" | 20 #include "content/common/resource_messages.h" |
| 21 #include "content/common/resource_request.h" |
| 21 #include "content/common/view_messages.h" | 22 #include "content/common/view_messages.h" |
| 22 #include "content/public/browser/browser_context.h" | 23 #include "content/public/browser/browser_context.h" |
| 23 #include "content/public/browser/content_browser_client.h" | 24 #include "content/public/browser/content_browser_client.h" |
| 24 #include "content/public/browser/interstitial_page.h" | 25 #include "content/public/browser/interstitial_page.h" |
| 25 #include "content/public/browser/interstitial_page_delegate.h" | 26 #include "content/public/browser/interstitial_page_delegate.h" |
| 26 #include "content/public/browser/resource_dispatcher_host.h" | 27 #include "content/public/browser/resource_dispatcher_host.h" |
| 27 #include "content/public/browser/storage_partition.h" | 28 #include "content/public/browser/storage_partition.h" |
| 28 #include "content/public/common/appcache_info.h" | 29 #include "content/public/common/appcache_info.h" |
| 29 #include "content/public/common/browser_side_navigation_policy.h" | 30 #include "content/public/common/browser_side_navigation_policy.h" |
| 30 #include "content/public/common/content_switches.h" | 31 #include "content/public/common/content_switches.h" |
| (...skipping 68 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 99 else | 100 else |
| 100 next_rfh = wc->GetRenderManagerForTesting()->pending_frame_host(); | 101 next_rfh = wc->GetRenderManagerForTesting()->pending_frame_host(); |
| 101 | 102 |
| 102 EXPECT_TRUE(next_rfh); | 103 EXPECT_TRUE(next_rfh); |
| 103 EXPECT_NE(shell->web_contents()->GetRenderProcessHost()->GetID(), | 104 EXPECT_NE(shell->web_contents()->GetRenderProcessHost()->GetID(), |
| 104 next_rfh->GetProcess()->GetID()); | 105 next_rfh->GetProcess()->GetID()); |
| 105 | 106 |
| 106 return next_rfh->render_view_host(); | 107 return next_rfh->render_view_host(); |
| 107 } | 108 } |
| 108 | 109 |
| 109 ResourceHostMsg_Request CreateXHRRequest(const char* url) { | 110 ResourceRequest CreateXHRRequest(const char* url) { |
| 110 ResourceHostMsg_Request request; | 111 ResourceRequest request; |
| 111 request.method = "GET"; | 112 request.method = "GET"; |
| 112 request.url = GURL(url); | 113 request.url = GURL(url); |
| 113 request.referrer_policy = blink::WebReferrerPolicyDefault; | 114 request.referrer_policy = blink::WebReferrerPolicyDefault; |
| 114 request.load_flags = 0; | 115 request.load_flags = 0; |
| 115 request.origin_pid = 0; | 116 request.origin_pid = 0; |
| 116 request.resource_type = RESOURCE_TYPE_XHR; | 117 request.resource_type = RESOURCE_TYPE_XHR; |
| 117 request.request_context = 0; | 118 request.request_context = 0; |
| 118 request.appcache_host_id = kAppCacheNoHostId; | 119 request.appcache_host_id = kAppCacheNoHostId; |
| 119 request.download_to_file = false; | 120 request.download_to_file = false; |
| 120 request.should_reset_appcache = false; | 121 request.should_reset_appcache = false; |
| 121 request.is_main_frame = true; | 122 request.is_main_frame = true; |
| 122 request.parent_is_main_frame = false; | 123 request.parent_is_main_frame = false; |
| 123 request.parent_render_frame_id = -1; | 124 request.parent_render_frame_id = -1; |
| 124 request.transition_type = ui::PAGE_TRANSITION_LINK; | 125 request.transition_type = ui::PAGE_TRANSITION_LINK; |
| 125 request.allow_download = true; | 126 request.allow_download = true; |
| 126 return request; | 127 return request; |
| 127 } | 128 } |
| 128 | 129 |
| 129 ResourceHostMsg_Request CreateXHRRequestWithOrigin(const char* origin) { | 130 ResourceRequest CreateXHRRequestWithOrigin(const char* origin) { |
| 130 ResourceHostMsg_Request request = | 131 ResourceRequest request = CreateXHRRequest("http://bar.com/simple_page.html"); |
| 131 CreateXHRRequest("http://bar.com/simple_page.html"); | |
| 132 request.first_party_for_cookies = GURL(origin); | 132 request.first_party_for_cookies = GURL(origin); |
| 133 request.headers = base::StringPrintf("Origin: %s\r\n", origin); | 133 request.headers = base::StringPrintf("Origin: %s\r\n", origin); |
| 134 return request; | 134 return request; |
| 135 } | 135 } |
| 136 | 136 |
| 137 void TryCreateDuplicateRequestIds(Shell* shell, bool block_loaders) { | 137 void TryCreateDuplicateRequestIds(Shell* shell, bool block_loaders) { |
| 138 NavigateToURL(shell, GURL("http://foo.com/simple_page.html")); | 138 NavigateToURL(shell, GURL("http://foo.com/simple_page.html")); |
| 139 RenderFrameHost* rfh = shell->web_contents()->GetMainFrame(); | 139 RenderFrameHost* rfh = shell->web_contents()->GetMainFrame(); |
| 140 | 140 |
| 141 if (block_loaders) { | 141 if (block_loaders) { |
| 142 // Test the case where loaders are placed into blocked_loaders_map_. | 142 // Test the case where loaders are placed into blocked_loaders_map_. |
| 143 ResourceDispatcherHost::BlockRequestsForFrameFromUI(rfh); | 143 ResourceDispatcherHost::BlockRequestsForFrameFromUI(rfh); |
| 144 } | 144 } |
| 145 | 145 |
| 146 // URLRequestSlowDownloadJob waits for another request to kFinishDownloadUrl | 146 // URLRequestSlowDownloadJob waits for another request to kFinishDownloadUrl |
| 147 // to finish all pending requests. It is never sent, so the following URL | 147 // to finish all pending requests. It is never sent, so the following URL |
| 148 // blocks indefinitely, which is good because the request stays alive and the | 148 // blocks indefinitely, which is good because the request stays alive and the |
| 149 // test can try to reuse the request id without a race. | 149 // test can try to reuse the request id without a race. |
| 150 const char* blocking_url = net::URLRequestSlowDownloadJob::kUnknownSizeUrl; | 150 const char* blocking_url = net::URLRequestSlowDownloadJob::kUnknownSizeUrl; |
| 151 ResourceHostMsg_Request request(CreateXHRRequest(blocking_url)); | 151 ResourceRequest request(CreateXHRRequest(blocking_url)); |
| 152 | 152 |
| 153 // Use the same request id twice. | 153 // Use the same request id twice. |
| 154 RenderProcessHostWatcher process_killed( | 154 RenderProcessHostWatcher process_killed( |
| 155 rfh->GetProcess(), RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); | 155 rfh->GetProcess(), RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); |
| 156 IPC::IpcSecurityTestUtil::PwnMessageReceived( | 156 IPC::IpcSecurityTestUtil::PwnMessageReceived( |
| 157 rfh->GetProcess()->GetChannel(), | 157 rfh->GetProcess()->GetChannel(), |
| 158 ResourceHostMsg_RequestResource(rfh->GetRoutingID(), | 158 ResourceHostMsg_RequestResource(rfh->GetRoutingID(), |
| 159 kRequestIdNotPreviouslyUsed, request)); | 159 kRequestIdNotPreviouslyUsed, request)); |
| 160 IPC::IpcSecurityTestUtil::PwnMessageReceived( | 160 IPC::IpcSecurityTestUtil::PwnMessageReceived( |
| 161 rfh->GetProcess()->GetChannel(), | 161 rfh->GetProcess()->GetChannel(), |
| (...skipping 245 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 407 int child_process_id, | 407 int child_process_id, |
| 408 const GURL& origin) override { | 408 const GURL& origin) override { |
| 409 // Simulate a case where an app origin is not in an app process. | 409 // Simulate a case where an app origin is not in an app process. |
| 410 return true; | 410 return true; |
| 411 } | 411 } |
| 412 }; | 412 }; |
| 413 | 413 |
| 414 // Renderer processes should not be able to spoof Origin HTTP headers. | 414 // Renderer processes should not be able to spoof Origin HTTP headers. |
| 415 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, InvalidOriginHeaders) { | 415 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, InvalidOriginHeaders) { |
| 416 // Create a set of IPC messages with various Origin headers. | 416 // Create a set of IPC messages with various Origin headers. |
| 417 ResourceHostMsg_Request chrome_origin_msg( | 417 ResourceRequest chrome_origin_msg( |
| 418 CreateXHRRequestWithOrigin("chrome://settings")); | 418 CreateXHRRequestWithOrigin("chrome://settings")); |
| 419 ResourceHostMsg_Request embedder_isolated_origin_msg( | 419 ResourceRequest embedder_isolated_origin_msg( |
| 420 CreateXHRRequestWithOrigin("https://isolated.bar.com")); | 420 CreateXHRRequestWithOrigin("https://isolated.bar.com")); |
| 421 ResourceHostMsg_Request invalid_origin_msg( | 421 ResourceRequest invalid_origin_msg(CreateXHRRequestWithOrigin("invalidurl")); |
| 422 CreateXHRRequestWithOrigin("invalidurl")); | 422 ResourceRequest invalid_scheme_origin_msg( |
| 423 ResourceHostMsg_Request invalid_scheme_origin_msg( | |
| 424 CreateXHRRequestWithOrigin("fake-scheme://foo")); | 423 CreateXHRRequestWithOrigin("fake-scheme://foo")); |
| 425 | 424 |
| 426 GURL web_url("http://foo.com/simple_page.html"); | 425 GURL web_url("http://foo.com/simple_page.html"); |
| 427 NavigateToURL(shell(), web_url); | 426 NavigateToURL(shell(), web_url); |
| 428 RenderFrameHost* web_rfh = shell()->web_contents()->GetMainFrame(); | 427 RenderFrameHost* web_rfh = shell()->web_contents()->GetMainFrame(); |
| 429 | 428 |
| 430 // Web processes cannot make XHRs with chrome:// Origin headers. | 429 // Web processes cannot make XHRs with chrome:// Origin headers. |
| 431 { | 430 { |
| 432 RenderProcessHostWatcher web_process_killed( | 431 RenderProcessHostWatcher web_process_killed( |
| 433 web_rfh->GetProcess(), | 432 web_rfh->GetProcess(), |
| 434 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); | 433 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); |
| 435 IPC::IpcSecurityTestUtil::PwnMessageReceived( | 434 IPC::IpcSecurityTestUtil::PwnMessageReceived( |
| 436 web_rfh->GetProcess()->GetChannel(), | 435 web_rfh->GetProcess()->GetChannel(), |
| 437 ResourceHostMsg_RequestResource(web_rfh->GetRoutingID(), | 436 ResourceHostMsg_RequestResource(web_rfh->GetRoutingID(), |
| 438 kRequestIdNotPreviouslyUsed, | 437 kRequestIdNotPreviouslyUsed, |
| 439 chrome_origin_msg)); | 438 chrome_origin_msg)); |
| 440 web_process_killed.Wait(); | 439 web_process_killed.Wait(); |
| 441 } | 440 } |
| 442 | 441 |
| 443 // Web processes cannot make XHRs with URLs that the content embedder expects | 442 // Web processes cannot make XHRs with URLs that the content embedder expects |
| 444 // to have process isolation. Ideally this would test chrome-extension:// | 443 // to have process isolation. Ideally this would test chrome-extension:// |
| 445 // URLs for Chrome Apps, but those can't be tested inside content/ and the | 444 // URLs for Chrome Apps, but those can't be tested inside content/ and the |
| 446 // ResourceHostMsg_Request IPC can't be created in a test outside content/. | 445 // ResourceRequest IPC can't be created in a test outside content/. |
| 447 NavigateToURL(shell(), web_url); | 446 NavigateToURL(shell(), web_url); |
| 448 { | 447 { |
| 449 // Set up a ContentBrowserClient that simulates an app URL in a non-app | 448 // Set up a ContentBrowserClient that simulates an app URL in a non-app |
| 450 // process. | 449 // process. |
| 451 IsolatedAppContentBrowserClient app_client; | 450 IsolatedAppContentBrowserClient app_client; |
| 452 ContentBrowserClient* old_client = SetBrowserClientForTesting(&app_client); | 451 ContentBrowserClient* old_client = SetBrowserClientForTesting(&app_client); |
| 453 RenderProcessHostWatcher web_process_killed( | 452 RenderProcessHostWatcher web_process_killed( |
| 454 web_rfh->GetProcess(), | 453 web_rfh->GetProcess(), |
| 455 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); | 454 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); |
| 456 IPC::IpcSecurityTestUtil::PwnMessageReceived( | 455 IPC::IpcSecurityTestUtil::PwnMessageReceived( |
| (...skipping 94 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 551 // separate task of the message loop, so ensure that the process is still | 550 // separate task of the message loop, so ensure that the process is still |
| 552 // considered alive. | 551 // considered alive. |
| 553 EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection()); | 552 EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection()); |
| 554 | 553 |
| 555 exit_observer.Wait(); | 554 exit_observer.Wait(); |
| 556 EXPECT_FALSE(exit_observer.did_exit_normally()); | 555 EXPECT_FALSE(exit_observer.did_exit_normally()); |
| 557 ResourceDispatcherHost::Get()->SetDelegate(nullptr); | 556 ResourceDispatcherHost::Get()->SetDelegate(nullptr); |
| 558 } | 557 } |
| 559 | 558 |
| 560 } // namespace content | 559 } // namespace content |
| OLD | NEW |