Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(62)

Side by Side Diff: content/browser/security_exploit_browsertest.cc

Issue 1977313002: Define parameter structs of resource messages out of resource_messages.h (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Created 4 years, 7 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « content/browser/loader/resource_message_filter.h ('k') | content/child/request_extra_data.h » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include <stdint.h> 5 #include <stdint.h>
6 6
7 #include "base/command_line.h" 7 #include "base/command_line.h"
8 #include "base/containers/hash_tables.h" 8 #include "base/containers/hash_tables.h"
9 #include "base/macros.h" 9 #include "base/macros.h"
10 #include "base/strings/utf_string_conversions.h" 10 #include "base/strings/utf_string_conversions.h"
11 #include "build/build_config.h" 11 #include "build/build_config.h"
12 #include "content/browser/dom_storage/dom_storage_context_wrapper.h" 12 #include "content/browser/dom_storage/dom_storage_context_wrapper.h"
13 #include "content/browser/dom_storage/session_storage_namespace_impl.h" 13 #include "content/browser/dom_storage/session_storage_namespace_impl.h"
14 #include "content/browser/frame_host/navigator.h" 14 #include "content/browser/frame_host/navigator.h"
15 #include "content/browser/frame_host/render_frame_host_impl.h" 15 #include "content/browser/frame_host/render_frame_host_impl.h"
16 #include "content/browser/renderer_host/render_view_host_factory.h" 16 #include "content/browser/renderer_host/render_view_host_factory.h"
17 #include "content/browser/renderer_host/render_view_host_impl.h" 17 #include "content/browser/renderer_host/render_view_host_impl.h"
18 #include "content/browser/web_contents/web_contents_impl.h" 18 #include "content/browser/web_contents/web_contents_impl.h"
19 #include "content/common/frame_messages.h" 19 #include "content/common/frame_messages.h"
20 #include "content/common/resource_messages.h" 20 #include "content/common/resource_messages.h"
21 #include "content/common/resource_request.h"
21 #include "content/common/view_messages.h" 22 #include "content/common/view_messages.h"
22 #include "content/public/browser/browser_context.h" 23 #include "content/public/browser/browser_context.h"
23 #include "content/public/browser/content_browser_client.h" 24 #include "content/public/browser/content_browser_client.h"
24 #include "content/public/browser/interstitial_page.h" 25 #include "content/public/browser/interstitial_page.h"
25 #include "content/public/browser/interstitial_page_delegate.h" 26 #include "content/public/browser/interstitial_page_delegate.h"
26 #include "content/public/browser/resource_dispatcher_host.h" 27 #include "content/public/browser/resource_dispatcher_host.h"
27 #include "content/public/browser/storage_partition.h" 28 #include "content/public/browser/storage_partition.h"
28 #include "content/public/common/appcache_info.h" 29 #include "content/public/common/appcache_info.h"
29 #include "content/public/common/browser_side_navigation_policy.h" 30 #include "content/public/common/browser_side_navigation_policy.h"
30 #include "content/public/common/content_switches.h" 31 #include "content/public/common/content_switches.h"
(...skipping 68 matching lines...) Expand 10 before | Expand all | Expand 10 after
99 else 100 else
100 next_rfh = wc->GetRenderManagerForTesting()->pending_frame_host(); 101 next_rfh = wc->GetRenderManagerForTesting()->pending_frame_host();
101 102
102 EXPECT_TRUE(next_rfh); 103 EXPECT_TRUE(next_rfh);
103 EXPECT_NE(shell->web_contents()->GetRenderProcessHost()->GetID(), 104 EXPECT_NE(shell->web_contents()->GetRenderProcessHost()->GetID(),
104 next_rfh->GetProcess()->GetID()); 105 next_rfh->GetProcess()->GetID());
105 106
106 return next_rfh->render_view_host(); 107 return next_rfh->render_view_host();
107 } 108 }
108 109
109 ResourceHostMsg_Request CreateXHRRequest(const char* url) { 110 ResourceRequest CreateXHRRequest(const char* url) {
110 ResourceHostMsg_Request request; 111 ResourceRequest request;
111 request.method = "GET"; 112 request.method = "GET";
112 request.url = GURL(url); 113 request.url = GURL(url);
113 request.referrer_policy = blink::WebReferrerPolicyDefault; 114 request.referrer_policy = blink::WebReferrerPolicyDefault;
114 request.load_flags = 0; 115 request.load_flags = 0;
115 request.origin_pid = 0; 116 request.origin_pid = 0;
116 request.resource_type = RESOURCE_TYPE_XHR; 117 request.resource_type = RESOURCE_TYPE_XHR;
117 request.request_context = 0; 118 request.request_context = 0;
118 request.appcache_host_id = kAppCacheNoHostId; 119 request.appcache_host_id = kAppCacheNoHostId;
119 request.download_to_file = false; 120 request.download_to_file = false;
120 request.should_reset_appcache = false; 121 request.should_reset_appcache = false;
121 request.is_main_frame = true; 122 request.is_main_frame = true;
122 request.parent_is_main_frame = false; 123 request.parent_is_main_frame = false;
123 request.parent_render_frame_id = -1; 124 request.parent_render_frame_id = -1;
124 request.transition_type = ui::PAGE_TRANSITION_LINK; 125 request.transition_type = ui::PAGE_TRANSITION_LINK;
125 request.allow_download = true; 126 request.allow_download = true;
126 return request; 127 return request;
127 } 128 }
128 129
129 ResourceHostMsg_Request CreateXHRRequestWithOrigin(const char* origin) { 130 ResourceRequest CreateXHRRequestWithOrigin(const char* origin) {
130 ResourceHostMsg_Request request = 131 ResourceRequest request = CreateXHRRequest("http://bar.com/simple_page.html");
131 CreateXHRRequest("http://bar.com/simple_page.html");
132 request.first_party_for_cookies = GURL(origin); 132 request.first_party_for_cookies = GURL(origin);
133 request.headers = base::StringPrintf("Origin: %s\r\n", origin); 133 request.headers = base::StringPrintf("Origin: %s\r\n", origin);
134 return request; 134 return request;
135 } 135 }
136 136
137 void TryCreateDuplicateRequestIds(Shell* shell, bool block_loaders) { 137 void TryCreateDuplicateRequestIds(Shell* shell, bool block_loaders) {
138 NavigateToURL(shell, GURL("http://foo.com/simple_page.html")); 138 NavigateToURL(shell, GURL("http://foo.com/simple_page.html"));
139 RenderFrameHost* rfh = shell->web_contents()->GetMainFrame(); 139 RenderFrameHost* rfh = shell->web_contents()->GetMainFrame();
140 140
141 if (block_loaders) { 141 if (block_loaders) {
142 // Test the case where loaders are placed into blocked_loaders_map_. 142 // Test the case where loaders are placed into blocked_loaders_map_.
143 ResourceDispatcherHost::BlockRequestsForFrameFromUI(rfh); 143 ResourceDispatcherHost::BlockRequestsForFrameFromUI(rfh);
144 } 144 }
145 145
146 // URLRequestSlowDownloadJob waits for another request to kFinishDownloadUrl 146 // URLRequestSlowDownloadJob waits for another request to kFinishDownloadUrl
147 // to finish all pending requests. It is never sent, so the following URL 147 // to finish all pending requests. It is never sent, so the following URL
148 // blocks indefinitely, which is good because the request stays alive and the 148 // blocks indefinitely, which is good because the request stays alive and the
149 // test can try to reuse the request id without a race. 149 // test can try to reuse the request id without a race.
150 const char* blocking_url = net::URLRequestSlowDownloadJob::kUnknownSizeUrl; 150 const char* blocking_url = net::URLRequestSlowDownloadJob::kUnknownSizeUrl;
151 ResourceHostMsg_Request request(CreateXHRRequest(blocking_url)); 151 ResourceRequest request(CreateXHRRequest(blocking_url));
152 152
153 // Use the same request id twice. 153 // Use the same request id twice.
154 RenderProcessHostWatcher process_killed( 154 RenderProcessHostWatcher process_killed(
155 rfh->GetProcess(), RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); 155 rfh->GetProcess(), RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
156 IPC::IpcSecurityTestUtil::PwnMessageReceived( 156 IPC::IpcSecurityTestUtil::PwnMessageReceived(
157 rfh->GetProcess()->GetChannel(), 157 rfh->GetProcess()->GetChannel(),
158 ResourceHostMsg_RequestResource(rfh->GetRoutingID(), 158 ResourceHostMsg_RequestResource(rfh->GetRoutingID(),
159 kRequestIdNotPreviouslyUsed, request)); 159 kRequestIdNotPreviouslyUsed, request));
160 IPC::IpcSecurityTestUtil::PwnMessageReceived( 160 IPC::IpcSecurityTestUtil::PwnMessageReceived(
161 rfh->GetProcess()->GetChannel(), 161 rfh->GetProcess()->GetChannel(),
(...skipping 245 matching lines...) Expand 10 before | Expand all | Expand 10 after
407 int child_process_id, 407 int child_process_id,
408 const GURL& origin) override { 408 const GURL& origin) override {
409 // Simulate a case where an app origin is not in an app process. 409 // Simulate a case where an app origin is not in an app process.
410 return true; 410 return true;
411 } 411 }
412 }; 412 };
413 413
414 // Renderer processes should not be able to spoof Origin HTTP headers. 414 // Renderer processes should not be able to spoof Origin HTTP headers.
415 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, InvalidOriginHeaders) { 415 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, InvalidOriginHeaders) {
416 // Create a set of IPC messages with various Origin headers. 416 // Create a set of IPC messages with various Origin headers.
417 ResourceHostMsg_Request chrome_origin_msg( 417 ResourceRequest chrome_origin_msg(
418 CreateXHRRequestWithOrigin("chrome://settings")); 418 CreateXHRRequestWithOrigin("chrome://settings"));
419 ResourceHostMsg_Request embedder_isolated_origin_msg( 419 ResourceRequest embedder_isolated_origin_msg(
420 CreateXHRRequestWithOrigin("https://isolated.bar.com")); 420 CreateXHRRequestWithOrigin("https://isolated.bar.com"));
421 ResourceHostMsg_Request invalid_origin_msg( 421 ResourceRequest invalid_origin_msg(CreateXHRRequestWithOrigin("invalidurl"));
422 CreateXHRRequestWithOrigin("invalidurl")); 422 ResourceRequest invalid_scheme_origin_msg(
423 ResourceHostMsg_Request invalid_scheme_origin_msg(
424 CreateXHRRequestWithOrigin("fake-scheme://foo")); 423 CreateXHRRequestWithOrigin("fake-scheme://foo"));
425 424
426 GURL web_url("http://foo.com/simple_page.html"); 425 GURL web_url("http://foo.com/simple_page.html");
427 NavigateToURL(shell(), web_url); 426 NavigateToURL(shell(), web_url);
428 RenderFrameHost* web_rfh = shell()->web_contents()->GetMainFrame(); 427 RenderFrameHost* web_rfh = shell()->web_contents()->GetMainFrame();
429 428
430 // Web processes cannot make XHRs with chrome:// Origin headers. 429 // Web processes cannot make XHRs with chrome:// Origin headers.
431 { 430 {
432 RenderProcessHostWatcher web_process_killed( 431 RenderProcessHostWatcher web_process_killed(
433 web_rfh->GetProcess(), 432 web_rfh->GetProcess(),
434 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); 433 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
435 IPC::IpcSecurityTestUtil::PwnMessageReceived( 434 IPC::IpcSecurityTestUtil::PwnMessageReceived(
436 web_rfh->GetProcess()->GetChannel(), 435 web_rfh->GetProcess()->GetChannel(),
437 ResourceHostMsg_RequestResource(web_rfh->GetRoutingID(), 436 ResourceHostMsg_RequestResource(web_rfh->GetRoutingID(),
438 kRequestIdNotPreviouslyUsed, 437 kRequestIdNotPreviouslyUsed,
439 chrome_origin_msg)); 438 chrome_origin_msg));
440 web_process_killed.Wait(); 439 web_process_killed.Wait();
441 } 440 }
442 441
443 // Web processes cannot make XHRs with URLs that the content embedder expects 442 // Web processes cannot make XHRs with URLs that the content embedder expects
444 // to have process isolation. Ideally this would test chrome-extension:// 443 // to have process isolation. Ideally this would test chrome-extension://
445 // URLs for Chrome Apps, but those can't be tested inside content/ and the 444 // URLs for Chrome Apps, but those can't be tested inside content/ and the
446 // ResourceHostMsg_Request IPC can't be created in a test outside content/. 445 // ResourceRequest IPC can't be created in a test outside content/.
447 NavigateToURL(shell(), web_url); 446 NavigateToURL(shell(), web_url);
448 { 447 {
449 // Set up a ContentBrowserClient that simulates an app URL in a non-app 448 // Set up a ContentBrowserClient that simulates an app URL in a non-app
450 // process. 449 // process.
451 IsolatedAppContentBrowserClient app_client; 450 IsolatedAppContentBrowserClient app_client;
452 ContentBrowserClient* old_client = SetBrowserClientForTesting(&app_client); 451 ContentBrowserClient* old_client = SetBrowserClientForTesting(&app_client);
453 RenderProcessHostWatcher web_process_killed( 452 RenderProcessHostWatcher web_process_killed(
454 web_rfh->GetProcess(), 453 web_rfh->GetProcess(),
455 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); 454 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
456 IPC::IpcSecurityTestUtil::PwnMessageReceived( 455 IPC::IpcSecurityTestUtil::PwnMessageReceived(
(...skipping 94 matching lines...) Expand 10 before | Expand all | Expand 10 after
551 // separate task of the message loop, so ensure that the process is still 550 // separate task of the message loop, so ensure that the process is still
552 // considered alive. 551 // considered alive.
553 EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection()); 552 EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection());
554 553
555 exit_observer.Wait(); 554 exit_observer.Wait();
556 EXPECT_FALSE(exit_observer.did_exit_normally()); 555 EXPECT_FALSE(exit_observer.did_exit_normally());
557 ResourceDispatcherHost::Get()->SetDelegate(nullptr); 556 ResourceDispatcherHost::Get()->SetDelegate(nullptr);
558 } 557 }
559 558
560 } // namespace content 559 } // namespace content
OLDNEW
« no previous file with comments | « content/browser/loader/resource_message_filter.h ('k') | content/child/request_extra_data.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698