Skeleton of the Safe Browsing Subresource Filter.

third_party/WebKit/Source/web/tests/WebFrameTest.cpp

 /*
  * Copyright (C) 2010 Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 72 matching lines @@
 #include "platform/UserGestureIndicator.h"
 #include "platform/geometry/FloatRect.h"
 #include "platform/network/ResourceError.h"
 #include "platform/scroll/ScrollbarTheme.h"
 #include "platform/testing/URLTestHelpers.h"
 #include "platform/testing/UnitTestHelpers.h"
 #include "platform/weborigin/SchemeRegistry.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "public/platform/Platform.h"
 #include "public/platform/WebCachePolicy.h"
+#include "public/platform/WebDocumentSubresourceFilter.h"
 #include "public/platform/WebFloatRect.h"
 #include "public/platform/WebSecurityOrigin.h"
 #include "public/platform/WebThread.h"
 #include "public/platform/WebURL.h"
 #include "public/platform/WebURLLoaderMockFactory.h"
 #include "public/platform/WebURLResponse.h"
 #include "public/web/WebCache.h"
 #include "public/web/WebConsoleMessage.h"
 #include "public/web/WebDataSource.h"
 #include "public/web/WebDeviceEmulationParams.h"
@@ skipping 22 matching lines @@
 #include "web/TextFinder.h"
 #include "web/WebLocalFrameImpl.h"
 #include "web/WebRemoteFrameImpl.h"
 #include "web/WebViewImpl.h"
 #include "web/tests/FrameTestHelpers.h"
 #include "wtf/Forward.h"
 #include "wtf/dtoa/utils.h"
 #include <map>
 #include <stdarg.h>
 #include <v8.h>
+#include <vector>
 
 using blink::URLTestHelpers::toKURL;
 using blink::testing::runPendingTasks;
 using testing::ElementsAre;
 using testing::Mock;
 using testing::_;
 
 namespace blink {
 
 ::std::ostream& operator<<(::std::ostream& os, const WebFloatSize& size)
@@ skipping 8536 matching lines @@
 
     WebLocalFrame* mainFrame = helper.webView()->mainFrame()->toWebLocalFrame();
     v8::HandleScope scope(v8::Isolate::GetCurrent());
     mainFrame->executeScript(WebScriptSource("hello = 'world';"));
     FrameTestHelpers::loadFrame(mainFrame, "data:text/html,new page");
     v8::Local<v8::Value> result = mainFrame->executeScriptAndReturnValue(WebScriptSource("hello"));
     ASSERT_TRUE(result->IsString());
     EXPECT_EQ("world", toCoreString(result->ToString(mainFrame->mainWorldScriptContext()).ToLocalChecked()));
 }
 
+class TestDocumentSubresourceFilter : public WebDocumentSubresourceFilter {

[battre, 2016/05/30 15:29:26]

Should this be called BlockEverysthingSubresourceFilter?

[engedy, 2016/05/30 20:54:01]

Yes, I was considering that too, but naming classes Test* is pretty common in
this file, and another important functionality is that it also collects the
resource URLs.

I think I'll ultimately defer to core/loader owners on this.

+public:
+    TestDocumentSubresourceFilter() {}
+    ~TestDocumentSubresourceFilter() override {}
+
+    bool allowLoad(const WebURL& resourceUrl, WebURLRequest::RequestContext) override
+    {
+        std::string resourcePath = WebString(KURL(resourceUrl).path()).utf8();
+        if (std::find(m_requestedSubresourcePaths.begin(), m_requestedSubresourcePaths.end(), resourcePath) == m_requestedSubresourcePaths.end())
+            m_requestedSubresourcePaths.push_back(resourcePath);
+        return false;
+    }
+
+    const std::vector<std::string>& requestedSubresourcePaths() const { return m_requestedSubresourcePaths; }
+
+private:
+    std::vector<std::string> m_requestedSubresourcePaths;
+};
+
+class SubresourceFilteringWebFrameClient : public FrameTestHelpers::TestWebFrameClient {
+public:
+    void didStartProvisionalLoad(WebLocalFrame* localFrame, double) override
+    {
+        // Normally, the filter should be set when the load is committed. For
+        // the sake of this test, however, inject it earlier to verify that it
+        // is not consulted for the main/imported resource load.
+        m_subresourceFilter = new TestDocumentSubresourceFilter();
+        localFrame->provisionalDataSource()->setSubresourceFilter(m_subresourceFilter);
+    }
+
+    const TestDocumentSubresourceFilter* subresourceFilter() const
+    {
+        return m_subresourceFilter;
+    }
+
+private:
+    // Weak, owned by WebDataSource.
+    TestDocumentSubresourceFilter* m_subresourceFilter = nullptr;
+};
+
+class WebFrameSubresourceFilterTest : public WebFrameTest {
+public:
+    WebFrameSubresourceFilterTest()
+    {
+        registerMockedHttpURLLoad("include-script.html");
+        registerMockedHttpURLLoad("included-script.js");
+        m_webViewhelper.initialize(true /* enableJavascript */, &m_client);
+    }
+
+protected:
+    void expectScriptDisallowed()
+    {
+        EXPECT_FALSE(evaluateBoolean("document.scriptExecuted"));
+        EXPECT_FALSE(evaluateBoolean("document.scriptLoaded"));
+        EXPECT_TRUE(evaluateBoolean("document.scriptFailed"));
+    }
+
+    WebFrame* mainFrame() { return m_webViewhelper.webViewImpl()->mainFrame(); }
+    const std::vector<std::string>& requestedSubresourcePaths() const { return m_client.subresourceFilter()->requestedSubresourcePaths(); }
+
+private:
+    bool evaluateBoolean(const std::string& expression)
+    {
+        v8::HandleScope scope(v8::Isolate::GetCurrent());
+        v8::Local<v8::Value> result = mainFrame()->executeScriptAndReturnValue(WebScriptSource(WebString::fromUTF8(expression)));
+        return result.As<v8::Boolean>()->Value();
+    }
+
+    SubresourceFilteringWebFrameClient m_client;
+    FrameTestHelpers::WebViewHelper m_webViewhelper;
+};
+
+TEST_F(WebFrameSubresourceFilterTest, MainDocument)
+{
+    FrameTestHelpers::loadFrame(mainFrame(), m_baseURL + "include-script.html");
+    EXPECT_THAT(requestedSubresourcePaths(), ElementsAre("/included-script.js"));
+    expectScriptDisallowed();
+}
+
+TEST_F(WebFrameSubresourceFilterTest, ImportDocument)
+{
+    const char kHostDocument[] = "<html><head><link id=\"importLink\" rel=\"import\" href=\"include-script.html\"></head></html>";
+    FrameTestHelpers::loadHTMLString(mainFrame(), kHostDocument, toKURL("http://internal.test/host-include-script.html"));
+    EXPECT_THAT(requestedSubresourcePaths(), ElementsAre("/included-script.js"));
+    expectScriptDisallowed();
+}
+
 } // namespace blink