OLD | NEW |
1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "core/frame/csp/CSPSource.h" | 5 #include "core/frame/csp/CSPSource.h" |
6 | 6 |
7 #include "core/dom/Document.h" | 7 #include "core/dom/Document.h" |
8 #include "core/frame/csp/ContentSecurityPolicy.h" | 8 #include "core/frame/csp/ContentSecurityPolicy.h" |
| 9 #include "platform/network/ResourceRequest.h" |
9 #include "platform/weborigin/KURL.h" | 10 #include "platform/weborigin/KURL.h" |
10 #include "platform/weborigin/SecurityOrigin.h" | 11 #include "platform/weborigin/SecurityOrigin.h" |
11 #include "testing/gtest/include/gtest/gtest.h" | 12 #include "testing/gtest/include/gtest/gtest.h" |
12 | 13 |
13 namespace blink { | 14 namespace blink { |
14 | 15 |
15 class CSPSourceTest : public ::testing::Test { | 16 class CSPSourceTest : public ::testing::Test { |
16 public: | 17 public: |
17 CSPSourceTest() | 18 CSPSourceTest() |
18 : csp(ContentSecurityPolicy::create()) | 19 : csp(ContentSecurityPolicy::create()) |
(...skipping 36 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
55 EXPECT_FALSE(source.matches(KURL(base, "http://example.foo.com:8000/"))); | 56 EXPECT_FALSE(source.matches(KURL(base, "http://example.foo.com:8000/"))); |
56 EXPECT_FALSE(source.matches(KURL(base, "https://example.foo.com:8000/"))); | 57 EXPECT_FALSE(source.matches(KURL(base, "https://example.foo.com:8000/"))); |
57 EXPECT_FALSE(source.matches(KURL(base, "https://example.com:8000/bar/"))); | 58 EXPECT_FALSE(source.matches(KURL(base, "https://example.com:8000/bar/"))); |
58 } | 59 } |
59 | 60 |
60 TEST_F(CSPSourceTest, RedirectMatching) | 61 TEST_F(CSPSourceTest, RedirectMatching) |
61 { | 62 { |
62 KURL base; | 63 KURL base; |
63 CSPSource source(csp.get(), "http", "example.com", 8000, "/bar/", CSPSource:
:NoWildcard, CSPSource::NoWildcard); | 64 CSPSource source(csp.get(), "http", "example.com", 8000, "/bar/", CSPSource:
:NoWildcard, CSPSource::NoWildcard); |
64 | 65 |
65 EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/"), ContentSe
curityPolicy::DidRedirect)); | 66 EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/"), ResourceR
equest::RedirectStatus::FollowedRedirect)); |
66 EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/foo"), Conten
tSecurityPolicy::DidRedirect)); | 67 EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/foo"), Resour
ceRequest::RedirectStatus::FollowedRedirect)); |
67 EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/foo"), Conte
ntSecurityPolicy::DidRedirect)); | 68 EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/foo"), Resou
rceRequest::RedirectStatus::FollowedRedirect)); |
68 | 69 |
69 EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:8000/foo"), C
ontentSecurityPolicy::DidRedirect)); | 70 EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:8000/foo"), R
esourceRequest::RedirectStatus::FollowedRedirect)); |
70 EXPECT_FALSE(source.matches(KURL(base, "http://example.com:9000/foo/"), Cont
entSecurityPolicy::DidNotRedirect)); | 71 EXPECT_FALSE(source.matches(KURL(base, "http://example.com:9000/foo/"), Reso
urceRequest::RedirectStatus::NoRedirect)); |
71 } | 72 } |
72 | 73 |
73 TEST_F(CSPSourceTest, InsecureSourceMatchesSecure) | 74 TEST_F(CSPSourceTest, InsecureSourceMatchesSecure) |
74 { | 75 { |
75 KURL base; | 76 KURL base; |
76 CSPSource source(csp.get(), "http", "", 0, "/", CSPSource::NoWildcard, CSPSo
urce::HasWildcard); | 77 CSPSource source(csp.get(), "http", "", 0, "/", CSPSource::NoWildcard, CSPSo
urce::HasWildcard); |
77 | 78 |
78 EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/"))); | 79 EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/"))); |
79 EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/"))); | 80 EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/"))); |
80 EXPECT_TRUE(source.matches(KURL(base, "http://not-example.com:8000/"))); | 81 EXPECT_TRUE(source.matches(KURL(base, "http://not-example.com:8000/"))); |
81 EXPECT_TRUE(source.matches(KURL(base, "https://not-example.com:8000/"))); | 82 EXPECT_TRUE(source.matches(KURL(base, "https://not-example.com:8000/"))); |
82 EXPECT_FALSE(source.matches(KURL(base, "ftp://example.com:8000/"))); | 83 EXPECT_FALSE(source.matches(KURL(base, "ftp://example.com:8000/"))); |
83 } | 84 } |
84 | 85 |
85 TEST_F(CSPSourceTest, InsecureHostMatchesSecure) | 86 TEST_F(CSPSourceTest, InsecureHostMatchesSecure) |
86 { | 87 { |
87 KURL base; | 88 KURL base; |
88 CSPSource source(csp.get(), "http", "example.com", 0, "/", CSPSource::NoWild
card, CSPSource::HasWildcard); | 89 CSPSource source(csp.get(), "http", "example.com", 0, "/", CSPSource::NoWild
card, CSPSource::HasWildcard); |
89 | 90 |
90 EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/"))); | 91 EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/"))); |
91 EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:8000/"))); | 92 EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:8000/"))); |
92 EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/"))); | 93 EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/"))); |
93 EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:8000/"))); | 94 EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:8000/"))); |
94 } | 95 } |
95 | 96 |
96 } // namespace blink | 97 } // namespace blink |
OLD | NEW |