service worker: Don't control a subframe of an insecure context

chrome/browser/extensions/service_worker_apitest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdint.h>
 
 #include "base/bind_helpers.h"
 #include "base/macros.h"
 #include "base/strings/stringprintf.h"
 #include "base/strings/utf_string_conversions.h"
 #include "chrome/browser/extensions/extension_apitest.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/notifications/desktop_notification_profile_util.h"
 #include "chrome/browser/push_messaging/push_messaging_app_identifier.h"
 #include "chrome/browser/push_messaging/push_messaging_service_factory.h"
 #include "chrome/browser/push_messaging/push_messaging_service_impl.h"
 #include "chrome/browser/services/gcm/fake_gcm_profile_service.h"
 #include "chrome/browser/services/gcm/gcm_profile_service_factory.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "components/version_info/version_info.h"
 #include "content/public/browser/navigation_controller.h"
 #include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/content_switches.h"
+#include "content/public/common/origin_util.h"
 #include "content/public/common/page_type.h"
 #include "content/public/test/background_sync_test_util.h"
 #include "content/public/test/browser_test_utils.h"
 #include "extensions/browser/extension_host.h"
 #include "extensions/browser/extension_registry.h"
 #include "extensions/browser/process_manager.h"
 #include "extensions/test/background_page_watcher.h"
 #include "extensions/test/extension_test_message_listener.h"
+#include "net/dns/mock_host_resolver.h"
 #include "net/test/embedded_test_server/embedded_test_server.h"
 
 namespace extensions {
 
 namespace {
 
 // Pass into ServiceWorkerTest::StartTestFromBackgroundPage to indicate that
 // registration is expected to succeed.
 std::string* const kExpectSuccess = nullptr;
 
@@ skipping 581 matching lines @@
 // This test also verifies that if the requested resource exists in the manifest
 // but is not present in the extension directory, the Service Worker can still
 // serve the resource file.
 IN_PROC_BROWSER_TEST_F(ServiceWorkerTest, WebAccessibleResourcesIframeSrc) {
   const Extension* extension = LoadExtensionWithFlags(
       test_data_dir_.AppendASCII(
           "service_worker/web_accessible_resources/iframe_src"),
       kFlagNone);
   ASSERT_TRUE(extension);
   ASSERT_TRUE(StartEmbeddedTestServer());
-  GURL page_url = embedded_test_server()->GetURL(
-      "/extensions/api_test/service_worker/web_accessible_resources/"
-      "webpage.html");
+
+  // Extension service workers must be able to control insecure contexts. So set

[Devlin, 2016/06/06 15:20:57]

I don't quite understand this comment.  I'm assuming "insecure context" refers
to a.com?  The extension isn't actually controlling the insecure context at all
(we don't allow extensions to serve up other origins) - it just controls and
extension page (secure context) iframed within an insecure context.  Right?  Or
am I missing something?

[Marijn Kruisselbrink, 2016/06/06 17:31:20]

An iframe within an insecure context is itself an insecure context, even if it
is served from a secure scheme like https (see example 7 in
https://w3c.github.io/webappsec-secure-contexts/#examples-framed). But yes, it
does seem like the comment could do a better job explaining what this code is
doing (probably by mentioning iframes inside insecure contexts rather than just
insecure contexts).

[falken, 2016/06/07 01:15:30]

Thanks, I revised the comment. What do you think?

+  // up an insecure URL.
+  host_resolver()->AddRule("a.com", "127.0.0.1");
+  GURL page_url =
+      embedded_test_server()->GetURL("a.com",
+                                     "/extensions/api_test/service_worker/"
+                                     "web_accessible_resources/webpage.html");
+  EXPECT_FALSE(content::IsOriginSecure(page_url));
 
   content::WebContents* web_contents = AddTab(browser(), page_url);
   std::string result;
   // webpage.html will create an iframe pointing to a resource from |extension|.
   // Expect the resource to be served by the extension.
   EXPECT_TRUE(content::ExecuteScriptAndExtractString(
       web_contents, base::StringPrintf("window.testIframe('%s', 'iframe.html')",
                                        extension->id().c_str()),
       &result));
   EXPECT_EQ("FROM_EXTENSION_RESOURCE", result);
@@ skipping 106 matching lines @@
   message.sender_id = "1234567890";
   message.raw_data = "testdata";
   message.decrypted = true;
   push_service()->SetMessageCallbackForTesting(run_loop.QuitClosure());
   push_service()->OnMessage(app_identifier.app_id(), message);
   EXPECT_TRUE(push_message_listener.WaitUntilSatisfied());
   run_loop.Run();  // Wait until the message is handled by push service.
 }
 
 }  // namespace extensions