| OLD | NEW |
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "core/frame/csp/CSPSource.h" | 5 #include "core/frame/csp/CSPSource.h" |
| 6 | 6 |
| 7 #include "core/dom/Document.h" | 7 #include "core/dom/Document.h" |
| 8 #include "core/frame/csp/ContentSecurityPolicy.h" | 8 #include "core/frame/csp/ContentSecurityPolicy.h" |
| 9 #include "platform/network/ResourceRequest.h" |
| 9 #include "platform/weborigin/KURL.h" | 10 #include "platform/weborigin/KURL.h" |
| 10 #include "platform/weborigin/SecurityOrigin.h" | 11 #include "platform/weborigin/SecurityOrigin.h" |
| 11 #include "testing/gtest/include/gtest/gtest.h" | 12 #include "testing/gtest/include/gtest/gtest.h" |
| 12 | 13 |
| 13 namespace blink { | 14 namespace blink { |
| 14 | 15 |
| 15 class CSPSourceTest : public ::testing::Test { | 16 class CSPSourceTest : public ::testing::Test { |
| 16 public: | 17 public: |
| 17 CSPSourceTest() | 18 CSPSourceTest() |
| 18 : csp(ContentSecurityPolicy::create()) | 19 : csp(ContentSecurityPolicy::create()) |
| (...skipping 36 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 55 EXPECT_FALSE(source.matches(KURL(base, "http://example.foo.com:8000/"))); | 56 EXPECT_FALSE(source.matches(KURL(base, "http://example.foo.com:8000/"))); |
| 56 EXPECT_FALSE(source.matches(KURL(base, "https://example.foo.com:8000/"))); | 57 EXPECT_FALSE(source.matches(KURL(base, "https://example.foo.com:8000/"))); |
| 57 EXPECT_FALSE(source.matches(KURL(base, "https://example.com:8000/bar/"))); | 58 EXPECT_FALSE(source.matches(KURL(base, "https://example.com:8000/bar/"))); |
| 58 } | 59 } |
| 59 | 60 |
| 60 TEST_F(CSPSourceTest, RedirectMatching) | 61 TEST_F(CSPSourceTest, RedirectMatching) |
| 61 { | 62 { |
| 62 KURL base; | 63 KURL base; |
| 63 CSPSource source(csp.get(), "http", "example.com", 8000, "/bar/", CSPSource:
:NoWildcard, CSPSource::NoWildcard); | 64 CSPSource source(csp.get(), "http", "example.com", 8000, "/bar/", CSPSource:
:NoWildcard, CSPSource::NoWildcard); |
| 64 | 65 |
| 65 EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/"), ContentSe
curityPolicy::DidRedirect)); | 66 EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/"), ResourceR
equest::RedirectStatus::FollowedRedirect)); |
| 66 EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/foo"), Conten
tSecurityPolicy::DidRedirect)); | 67 EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/foo"), Resour
ceRequest::RedirectStatus::FollowedRedirect)); |
| 67 EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/foo"), Conte
ntSecurityPolicy::DidRedirect)); | 68 EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/foo"), Resou
rceRequest::RedirectStatus::FollowedRedirect)); |
| 68 | 69 |
| 69 EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:8000/foo"), C
ontentSecurityPolicy::DidRedirect)); | 70 EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:8000/foo"), R
esourceRequest::RedirectStatus::FollowedRedirect)); |
| 70 EXPECT_FALSE(source.matches(KURL(base, "http://example.com:9000/foo/"), Cont
entSecurityPolicy::DidNotRedirect)); | 71 EXPECT_FALSE(source.matches(KURL(base, "http://example.com:9000/foo/"), Reso
urceRequest::RedirectStatus::NoRedirect)); |
| 71 } | 72 } |
| 72 | 73 |
| 73 TEST_F(CSPSourceTest, InsecureSourceMatchesSecure) | 74 TEST_F(CSPSourceTest, InsecureSourceMatchesSecure) |
| 74 { | 75 { |
| 75 KURL base; | 76 KURL base; |
| 76 CSPSource source(csp.get(), "http", "", 0, "/", CSPSource::NoWildcard, CSPSo
urce::HasWildcard); | 77 CSPSource source(csp.get(), "http", "", 0, "/", CSPSource::NoWildcard, CSPSo
urce::HasWildcard); |
| 77 | 78 |
| 78 EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/"))); | 79 EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/"))); |
| 79 EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/"))); | 80 EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/"))); |
| 80 EXPECT_TRUE(source.matches(KURL(base, "http://not-example.com:8000/"))); | 81 EXPECT_TRUE(source.matches(KURL(base, "http://not-example.com:8000/"))); |
| 81 EXPECT_TRUE(source.matches(KURL(base, "https://not-example.com:8000/"))); | 82 EXPECT_TRUE(source.matches(KURL(base, "https://not-example.com:8000/"))); |
| 82 EXPECT_FALSE(source.matches(KURL(base, "ftp://example.com:8000/"))); | 83 EXPECT_FALSE(source.matches(KURL(base, "ftp://example.com:8000/"))); |
| 83 } | 84 } |
| 84 | 85 |
| 85 TEST_F(CSPSourceTest, InsecureHostMatchesSecure) | 86 TEST_F(CSPSourceTest, InsecureHostMatchesSecure) |
| 86 { | 87 { |
| 87 KURL base; | 88 KURL base; |
| 88 CSPSource source(csp.get(), "http", "example.com", 0, "/", CSPSource::NoWild
card, CSPSource::HasWildcard); | 89 CSPSource source(csp.get(), "http", "example.com", 0, "/", CSPSource::NoWild
card, CSPSource::HasWildcard); |
| 89 | 90 |
| 90 EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/"))); | 91 EXPECT_TRUE(source.matches(KURL(base, "http://example.com:8000/"))); |
| 91 EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:8000/"))); | 92 EXPECT_FALSE(source.matches(KURL(base, "http://not-example.com:8000/"))); |
| 92 EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/"))); | 93 EXPECT_TRUE(source.matches(KURL(base, "https://example.com:8000/"))); |
| 93 EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:8000/"))); | 94 EXPECT_FALSE(source.matches(KURL(base, "https://not-example.com:8000/"))); |
| 94 } | 95 } |
| 95 | 96 |
| 96 } // namespace blink | 97 } // namespace blink |
| OLD | NEW |