| OLD | NEW |
| 1 /* | 1 /* |
| 2 * Copyright (C) 2011 Google Inc. All rights reserved. | 2 * Copyright (C) 2011 Google Inc. All rights reserved. |
| 3 * | 3 * |
| 4 * Redistribution and use in source and binary forms, with or without | 4 * Redistribution and use in source and binary forms, with or without |
| 5 * modification, are permitted provided that the following conditions are | 5 * modification, are permitted provided that the following conditions are |
| 6 * met: | 6 * met: |
| 7 * | 7 * |
| 8 * * Redistributions of source code must retain the above copyright | 8 * * Redistributions of source code must retain the above copyright |
| 9 * notice, this list of conditions and the following disclaimer. | 9 * notice, this list of conditions and the following disclaimer. |
| 10 * * Redistributions in binary form must reproduce the above | 10 * * Redistributions in binary form must reproduce the above |
| (...skipping 166 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 177 | 177 |
| 178 void didFail(WebURLLoader* loader, const WebURLError& error) override | 178 void didFail(WebURLLoader* loader, const WebURLError& error) override |
| 179 { | 179 { |
| 180 m_didFail = true; | 180 m_didFail = true; |
| 181 EXPECT_EQ(m_expectedLoader.get(), loader); | 181 EXPECT_EQ(m_expectedLoader.get(), loader); |
| 182 } | 182 } |
| 183 | 183 |
| 184 void CheckMethodFails(const char* unsafeMethod) | 184 void CheckMethodFails(const char* unsafeMethod) |
| 185 { | 185 { |
| 186 WebURLRequest request; | 186 WebURLRequest request; |
| 187 request.initialize(); | |
| 188 request.setURL(toKURL("http://www.test.com/success.html")); | 187 request.setURL(toKURL("http://www.test.com/success.html")); |
| 189 request.setHTTPMethod(WebString::fromUTF8(unsafeMethod)); | 188 request.setHTTPMethod(WebString::fromUTF8(unsafeMethod)); |
| 190 WebURLLoaderOptions options; | 189 WebURLLoaderOptions options; |
| 191 options.untrustedHTTP = true; | 190 options.untrustedHTTP = true; |
| 192 CheckFails(request, options); | 191 CheckFails(request, options); |
| 193 } | 192 } |
| 194 | 193 |
| 195 void CheckHeaderFails(const char* headerField) | 194 void CheckHeaderFails(const char* headerField) |
| 196 { | 195 { |
| 197 CheckHeaderFails(headerField, "foo"); | 196 CheckHeaderFails(headerField, "foo"); |
| 198 } | 197 } |
| 199 | 198 |
| 200 void CheckHeaderFails(const char* headerField, const char* headerValue) | 199 void CheckHeaderFails(const char* headerField, const char* headerValue) |
| 201 { | 200 { |
| 202 WebURLRequest request; | 201 WebURLRequest request; |
| 203 request.initialize(); | |
| 204 request.setURL(toKURL("http://www.test.com/success.html")); | 202 request.setURL(toKURL("http://www.test.com/success.html")); |
| 205 if (equalIgnoringCase(WebString::fromUTF8(headerField), "referer")) | 203 if (equalIgnoringCase(WebString::fromUTF8(headerField), "referer")) |
| 206 request.setHTTPReferrer(WebString::fromUTF8(headerValue), WebReferre
rPolicyDefault); | 204 request.setHTTPReferrer(WebString::fromUTF8(headerValue), WebReferre
rPolicyDefault); |
| 207 else | 205 else |
| 208 request.setHTTPHeaderField(WebString::fromUTF8(headerField), WebStri
ng::fromUTF8(headerValue)); | 206 request.setHTTPHeaderField(WebString::fromUTF8(headerField), WebStri
ng::fromUTF8(headerValue)); |
| 209 WebURLLoaderOptions options; | 207 WebURLLoaderOptions options; |
| 210 options.untrustedHTTP = true; | 208 options.untrustedHTTP = true; |
| 211 CheckFails(request, options); | 209 CheckFails(request, options); |
| 212 } | 210 } |
| 213 | 211 |
| (...skipping 14 matching lines...) Expand all Loading... |
| 228 bool CheckAccessControlHeaders(const char* headerName, bool exposed) | 226 bool CheckAccessControlHeaders(const char* headerName, bool exposed) |
| 229 { | 227 { |
| 230 std::string id("http://www.other.com/CheckAccessControlExposeHeaders_"); | 228 std::string id("http://www.other.com/CheckAccessControlExposeHeaders_"); |
| 231 id.append(headerName); | 229 id.append(headerName); |
| 232 if (exposed) | 230 if (exposed) |
| 233 id.append("-Exposed"); | 231 id.append("-Exposed"); |
| 234 id.append(".html"); | 232 id.append(".html"); |
| 235 | 233 |
| 236 KURL url = toKURL(id); | 234 KURL url = toKURL(id); |
| 237 WebURLRequest request; | 235 WebURLRequest request; |
| 238 request.initialize(); | |
| 239 request.setURL(url); | 236 request.setURL(url); |
| 240 | 237 |
| 241 WebString headerNameString(WebString::fromUTF8(headerName)); | 238 WebString headerNameString(WebString::fromUTF8(headerName)); |
| 242 m_expectedResponse = WebURLResponse(); | 239 m_expectedResponse = WebURLResponse(); |
| 243 m_expectedResponse.setMIMEType("text/html"); | 240 m_expectedResponse.setMIMEType("text/html"); |
| 244 m_expectedResponse.setHTTPStatusCode(200); | 241 m_expectedResponse.setHTTPStatusCode(200); |
| 245 m_expectedResponse.addHTTPHeaderField("Access-Control-Allow-Origin", "*"
); | 242 m_expectedResponse.addHTTPHeaderField("Access-Control-Allow-Origin", "*"
); |
| 246 if (exposed) | 243 if (exposed) |
| 247 m_expectedResponse.addHTTPHeaderField("access-control-expose-headers
", headerNameString); | 244 m_expectedResponse.addHTTPHeaderField("access-control-expose-headers
", headerNameString); |
| 248 m_expectedResponse.addHTTPHeaderField(headerNameString, "foo"); | 245 m_expectedResponse.addHTTPHeaderField(headerNameString, "foo"); |
| (...skipping 32 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 281 bool m_didReceiveCachedMetadata; | 278 bool m_didReceiveCachedMetadata; |
| 282 bool m_didFinishLoading; | 279 bool m_didFinishLoading; |
| 283 bool m_didFail; | 280 bool m_didFail; |
| 284 }; | 281 }; |
| 285 | 282 |
| 286 // Test a successful same-origin URL load. | 283 // Test a successful same-origin URL load. |
| 287 TEST_F(AssociatedURLLoaderTest, SameOriginSuccess) | 284 TEST_F(AssociatedURLLoaderTest, SameOriginSuccess) |
| 288 { | 285 { |
| 289 KURL url = toKURL("http://www.test.com/SameOriginSuccess.html"); | 286 KURL url = toKURL("http://www.test.com/SameOriginSuccess.html"); |
| 290 WebURLRequest request; | 287 WebURLRequest request; |
| 291 request.initialize(); | |
| 292 request.setURL(url); | 288 request.setURL(url); |
| 293 | 289 |
| 294 m_expectedResponse = WebURLResponse(); | 290 m_expectedResponse = WebURLResponse(); |
| 295 m_expectedResponse.setMIMEType("text/html"); | 291 m_expectedResponse.setMIMEType("text/html"); |
| 296 m_expectedResponse.setHTTPStatusCode(200); | 292 m_expectedResponse.setHTTPStatusCode(200); |
| 297 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
esponse, m_frameFilePath); | 293 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
esponse, m_frameFilePath); |
| 298 | 294 |
| 299 m_expectedLoader = createAssociatedURLLoader(); | 295 m_expectedLoader = createAssociatedURLLoader(); |
| 300 EXPECT_TRUE(m_expectedLoader); | 296 EXPECT_TRUE(m_expectedLoader); |
| 301 m_expectedLoader->loadAsynchronously(request, this); | 297 m_expectedLoader->loadAsynchronously(request, this); |
| 302 serveRequests(); | 298 serveRequests(); |
| 303 EXPECT_TRUE(m_didReceiveResponse); | 299 EXPECT_TRUE(m_didReceiveResponse); |
| 304 EXPECT_TRUE(m_didReceiveData); | 300 EXPECT_TRUE(m_didReceiveData); |
| 305 EXPECT_TRUE(m_didFinishLoading); | 301 EXPECT_TRUE(m_didFinishLoading); |
| 306 } | 302 } |
| 307 | 303 |
| 308 // Test that the same-origin restriction is the default. | 304 // Test that the same-origin restriction is the default. |
| 309 TEST_F(AssociatedURLLoaderTest, SameOriginRestriction) | 305 TEST_F(AssociatedURLLoaderTest, SameOriginRestriction) |
| 310 { | 306 { |
| 311 // This is cross-origin since the frame was loaded from www.test.com. | 307 // This is cross-origin since the frame was loaded from www.test.com. |
| 312 KURL url = toKURL("http://www.other.com/SameOriginRestriction.html"); | 308 KURL url = toKURL("http://www.other.com/SameOriginRestriction.html"); |
| 313 WebURLRequest request; | 309 WebURLRequest request; |
| 314 request.initialize(); | |
| 315 request.setURL(url); | 310 request.setURL(url); |
| 316 CheckFails(request); | 311 CheckFails(request); |
| 317 } | 312 } |
| 318 | 313 |
| 319 // Test a successful cross-origin load. | 314 // Test a successful cross-origin load. |
| 320 TEST_F(AssociatedURLLoaderTest, CrossOriginSuccess) | 315 TEST_F(AssociatedURLLoaderTest, CrossOriginSuccess) |
| 321 { | 316 { |
| 322 // This is cross-origin since the frame was loaded from www.test.com. | 317 // This is cross-origin since the frame was loaded from www.test.com. |
| 323 KURL url = toKURL("http://www.other.com/CrossOriginSuccess"); | 318 KURL url = toKURL("http://www.other.com/CrossOriginSuccess"); |
| 324 WebURLRequest request; | 319 WebURLRequest request; |
| 325 request.initialize(); | |
| 326 request.setURL(url); | 320 request.setURL(url); |
| 327 // No-CORS requests (CrossOriginRequestPolicyAllow) aren't allowed for the | 321 // No-CORS requests (CrossOriginRequestPolicyAllow) aren't allowed for the |
| 328 // default context. So we set the context as Script here. | 322 // default context. So we set the context as Script here. |
| 329 request.setRequestContext(WebURLRequest::RequestContextScript); | 323 request.setRequestContext(WebURLRequest::RequestContextScript); |
| 330 | 324 |
| 331 m_expectedResponse = WebURLResponse(); | 325 m_expectedResponse = WebURLResponse(); |
| 332 m_expectedResponse.setMIMEType("text/html"); | 326 m_expectedResponse.setMIMEType("text/html"); |
| 333 m_expectedResponse.setHTTPStatusCode(200); | 327 m_expectedResponse.setHTTPStatusCode(200); |
| 334 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
esponse, m_frameFilePath); | 328 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
esponse, m_frameFilePath); |
| 335 | 329 |
| 336 WebURLLoaderOptions options; | 330 WebURLLoaderOptions options; |
| 337 options.crossOriginRequestPolicy = WebURLLoaderOptions::CrossOriginRequestPo
licyAllow; | 331 options.crossOriginRequestPolicy = WebURLLoaderOptions::CrossOriginRequestPo
licyAllow; |
| 338 m_expectedLoader = createAssociatedURLLoader(options); | 332 m_expectedLoader = createAssociatedURLLoader(options); |
| 339 EXPECT_TRUE(m_expectedLoader); | 333 EXPECT_TRUE(m_expectedLoader); |
| 340 m_expectedLoader->loadAsynchronously(request, this); | 334 m_expectedLoader->loadAsynchronously(request, this); |
| 341 serveRequests(); | 335 serveRequests(); |
| 342 EXPECT_TRUE(m_didReceiveResponse); | 336 EXPECT_TRUE(m_didReceiveResponse); |
| 343 EXPECT_TRUE(m_didReceiveData); | 337 EXPECT_TRUE(m_didReceiveData); |
| 344 EXPECT_TRUE(m_didFinishLoading); | 338 EXPECT_TRUE(m_didFinishLoading); |
| 345 } | 339 } |
| 346 | 340 |
| 347 // Test a successful cross-origin load using CORS. | 341 // Test a successful cross-origin load using CORS. |
| 348 TEST_F(AssociatedURLLoaderTest, CrossOriginWithAccessControlSuccess) | 342 TEST_F(AssociatedURLLoaderTest, CrossOriginWithAccessControlSuccess) |
| 349 { | 343 { |
| 350 // This is cross-origin since the frame was loaded from www.test.com. | 344 // This is cross-origin since the frame was loaded from www.test.com. |
| 351 KURL url = toKURL("http://www.other.com/CrossOriginWithAccessControlSuccess.
html"); | 345 KURL url = toKURL("http://www.other.com/CrossOriginWithAccessControlSuccess.
html"); |
| 352 WebURLRequest request; | 346 WebURLRequest request; |
| 353 request.initialize(); | |
| 354 request.setURL(url); | 347 request.setURL(url); |
| 355 | 348 |
| 356 m_expectedResponse = WebURLResponse(); | 349 m_expectedResponse = WebURLResponse(); |
| 357 m_expectedResponse.setMIMEType("text/html"); | 350 m_expectedResponse.setMIMEType("text/html"); |
| 358 m_expectedResponse.setHTTPStatusCode(200); | 351 m_expectedResponse.setHTTPStatusCode(200); |
| 359 m_expectedResponse.addHTTPHeaderField("access-control-allow-origin", "*"); | 352 m_expectedResponse.addHTTPHeaderField("access-control-allow-origin", "*"); |
| 360 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
esponse, m_frameFilePath); | 353 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
esponse, m_frameFilePath); |
| 361 | 354 |
| 362 WebURLLoaderOptions options; | 355 WebURLLoaderOptions options; |
| 363 options.crossOriginRequestPolicy = WebURLLoaderOptions::CrossOriginRequestPo
licyUseAccessControl; | 356 options.crossOriginRequestPolicy = WebURLLoaderOptions::CrossOriginRequestPo
licyUseAccessControl; |
| 364 m_expectedLoader = createAssociatedURLLoader(options); | 357 m_expectedLoader = createAssociatedURLLoader(options); |
| 365 EXPECT_TRUE(m_expectedLoader); | 358 EXPECT_TRUE(m_expectedLoader); |
| 366 m_expectedLoader->loadAsynchronously(request, this); | 359 m_expectedLoader->loadAsynchronously(request, this); |
| 367 serveRequests(); | 360 serveRequests(); |
| 368 EXPECT_TRUE(m_didReceiveResponse); | 361 EXPECT_TRUE(m_didReceiveResponse); |
| 369 EXPECT_TRUE(m_didReceiveData); | 362 EXPECT_TRUE(m_didReceiveData); |
| 370 EXPECT_TRUE(m_didFinishLoading); | 363 EXPECT_TRUE(m_didFinishLoading); |
| 371 } | 364 } |
| 372 | 365 |
| 373 // Test an unsuccessful cross-origin load using CORS. | 366 // Test an unsuccessful cross-origin load using CORS. |
| 374 TEST_F(AssociatedURLLoaderTest, CrossOriginWithAccessControlFailure) | 367 TEST_F(AssociatedURLLoaderTest, CrossOriginWithAccessControlFailure) |
| 375 { | 368 { |
| 376 // This is cross-origin since the frame was loaded from www.test.com. | 369 // This is cross-origin since the frame was loaded from www.test.com. |
| 377 KURL url = toKURL("http://www.other.com/CrossOriginWithAccessControlFailure.
html"); | 370 KURL url = toKURL("http://www.other.com/CrossOriginWithAccessControlFailure.
html"); |
| 378 WebURLRequest request; | 371 WebURLRequest request; |
| 379 request.initialize(); | |
| 380 request.setURL(url); | 372 request.setURL(url); |
| 381 | 373 |
| 382 m_expectedResponse = WebURLResponse(); | 374 m_expectedResponse = WebURLResponse(); |
| 383 m_expectedResponse.setMIMEType("text/html"); | 375 m_expectedResponse.setMIMEType("text/html"); |
| 384 m_expectedResponse.setHTTPStatusCode(200); | 376 m_expectedResponse.setHTTPStatusCode(200); |
| 385 m_expectedResponse.addHTTPHeaderField("access-control-allow-origin", "*"); | 377 m_expectedResponse.addHTTPHeaderField("access-control-allow-origin", "*"); |
| 386 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
esponse, m_frameFilePath); | 378 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
esponse, m_frameFilePath); |
| 387 | 379 |
| 388 WebURLLoaderOptions options; | 380 WebURLLoaderOptions options; |
| 389 // Send credentials. This will cause the CORS checks to fail, because creden
tials can't be | 381 // Send credentials. This will cause the CORS checks to fail, because creden
tials can't be |
| (...skipping 11 matching lines...) Expand all Loading... |
| 401 EXPECT_TRUE(m_didFail); | 393 EXPECT_TRUE(m_didFail); |
| 402 EXPECT_FALSE(m_didReceiveResponse); | 394 EXPECT_FALSE(m_didReceiveResponse); |
| 403 } | 395 } |
| 404 | 396 |
| 405 // Test an unsuccessful cross-origin load using CORS. | 397 // Test an unsuccessful cross-origin load using CORS. |
| 406 TEST_F(AssociatedURLLoaderTest, CrossOriginWithAccessControlFailureBadStatusCode
) | 398 TEST_F(AssociatedURLLoaderTest, CrossOriginWithAccessControlFailureBadStatusCode
) |
| 407 { | 399 { |
| 408 // This is cross-origin since the frame was loaded from www.test.com. | 400 // This is cross-origin since the frame was loaded from www.test.com. |
| 409 KURL url = toKURL("http://www.other.com/CrossOriginWithAccessControlFailure.
html"); | 401 KURL url = toKURL("http://www.other.com/CrossOriginWithAccessControlFailure.
html"); |
| 410 WebURLRequest request; | 402 WebURLRequest request; |
| 411 request.initialize(); | |
| 412 request.setURL(url); | 403 request.setURL(url); |
| 413 | 404 |
| 414 m_expectedResponse = WebURLResponse(); | 405 m_expectedResponse = WebURLResponse(); |
| 415 m_expectedResponse.setMIMEType("text/html"); | 406 m_expectedResponse.setMIMEType("text/html"); |
| 416 m_expectedResponse.setHTTPStatusCode(0); | 407 m_expectedResponse.setHTTPStatusCode(0); |
| 417 m_expectedResponse.addHTTPHeaderField("access-control-allow-origin", "*"); | 408 m_expectedResponse.addHTTPHeaderField("access-control-allow-origin", "*"); |
| 418 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
esponse, m_frameFilePath); | 409 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
esponse, m_frameFilePath); |
| 419 | 410 |
| 420 WebURLLoaderOptions options; | 411 WebURLLoaderOptions options; |
| 421 options.crossOriginRequestPolicy = WebURLLoaderOptions::CrossOriginRequestPo
licyUseAccessControl; | 412 options.crossOriginRequestPolicy = WebURLLoaderOptions::CrossOriginRequestPo
licyUseAccessControl; |
| (...skipping 10 matching lines...) Expand all Loading... |
| 432 } | 423 } |
| 433 | 424 |
| 434 // Test a same-origin URL redirect and load. | 425 // Test a same-origin URL redirect and load. |
| 435 TEST_F(AssociatedURLLoaderTest, RedirectSuccess) | 426 TEST_F(AssociatedURLLoaderTest, RedirectSuccess) |
| 436 { | 427 { |
| 437 KURL url = toKURL("http://www.test.com/RedirectSuccess.html"); | 428 KURL url = toKURL("http://www.test.com/RedirectSuccess.html"); |
| 438 char redirect[] = "http://www.test.com/RedirectSuccess2.html"; // Same-orig
in | 429 char redirect[] = "http://www.test.com/RedirectSuccess2.html"; // Same-orig
in |
| 439 KURL redirectURL = toKURL(redirect); | 430 KURL redirectURL = toKURL(redirect); |
| 440 | 431 |
| 441 WebURLRequest request; | 432 WebURLRequest request; |
| 442 request.initialize(); | |
| 443 request.setURL(url); | 433 request.setURL(url); |
| 444 | 434 |
| 445 m_expectedRedirectResponse = WebURLResponse(); | 435 m_expectedRedirectResponse = WebURLResponse(); |
| 446 m_expectedRedirectResponse.setMIMEType("text/html"); | 436 m_expectedRedirectResponse.setMIMEType("text/html"); |
| 447 m_expectedRedirectResponse.setHTTPStatusCode(301); | 437 m_expectedRedirectResponse.setHTTPStatusCode(301); |
| 448 m_expectedRedirectResponse.setHTTPHeaderField("Location", redirect); | 438 m_expectedRedirectResponse.setHTTPHeaderField("Location", redirect); |
| 449 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
edirectResponse, m_frameFilePath); | 439 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
edirectResponse, m_frameFilePath); |
| 450 | 440 |
| 451 m_expectedNewRequest = WebURLRequest(); | 441 m_expectedNewRequest = WebURLRequest(); |
| 452 m_expectedNewRequest.initialize(); | |
| 453 m_expectedNewRequest.setURL(redirectURL); | 442 m_expectedNewRequest.setURL(redirectURL); |
| 454 | 443 |
| 455 m_expectedResponse = WebURLResponse(); | 444 m_expectedResponse = WebURLResponse(); |
| 456 m_expectedResponse.setMIMEType("text/html"); | 445 m_expectedResponse.setMIMEType("text/html"); |
| 457 m_expectedResponse.setHTTPStatusCode(200); | 446 m_expectedResponse.setHTTPStatusCode(200); |
| 458 Platform::current()->getURLLoaderMockFactory()->registerURL(redirectURL, m_e
xpectedResponse, m_frameFilePath); | 447 Platform::current()->getURLLoaderMockFactory()->registerURL(redirectURL, m_e
xpectedResponse, m_frameFilePath); |
| 459 | 448 |
| 460 m_expectedLoader = createAssociatedURLLoader(); | 449 m_expectedLoader = createAssociatedURLLoader(); |
| 461 EXPECT_TRUE(m_expectedLoader); | 450 EXPECT_TRUE(m_expectedLoader); |
| 462 m_expectedLoader->loadAsynchronously(request, this); | 451 m_expectedLoader->loadAsynchronously(request, this); |
| 463 serveRequests(); | 452 serveRequests(); |
| 464 EXPECT_TRUE(m_willFollowRedirect); | 453 EXPECT_TRUE(m_willFollowRedirect); |
| 465 EXPECT_TRUE(m_didReceiveResponse); | 454 EXPECT_TRUE(m_didReceiveResponse); |
| 466 EXPECT_TRUE(m_didReceiveData); | 455 EXPECT_TRUE(m_didReceiveData); |
| 467 EXPECT_TRUE(m_didFinishLoading); | 456 EXPECT_TRUE(m_didFinishLoading); |
| 468 } | 457 } |
| 469 | 458 |
| 470 // Test a cross-origin URL redirect without Access Control set. | 459 // Test a cross-origin URL redirect without Access Control set. |
| 471 TEST_F(AssociatedURLLoaderTest, RedirectCrossOriginFailure) | 460 TEST_F(AssociatedURLLoaderTest, RedirectCrossOriginFailure) |
| 472 { | 461 { |
| 473 KURL url = toKURL("http://www.test.com/RedirectCrossOriginFailure.html"); | 462 KURL url = toKURL("http://www.test.com/RedirectCrossOriginFailure.html"); |
| 474 char redirect[] = "http://www.other.com/RedirectCrossOriginFailure.html"; /
/ Cross-origin | 463 char redirect[] = "http://www.other.com/RedirectCrossOriginFailure.html"; /
/ Cross-origin |
| 475 KURL redirectURL = toKURL(redirect); | 464 KURL redirectURL = toKURL(redirect); |
| 476 | 465 |
| 477 WebURLRequest request; | 466 WebURLRequest request; |
| 478 request.initialize(); | |
| 479 request.setURL(url); | 467 request.setURL(url); |
| 480 | 468 |
| 481 m_expectedRedirectResponse = WebURLResponse(); | 469 m_expectedRedirectResponse = WebURLResponse(); |
| 482 m_expectedRedirectResponse.setMIMEType("text/html"); | 470 m_expectedRedirectResponse.setMIMEType("text/html"); |
| 483 m_expectedRedirectResponse.setHTTPStatusCode(301); | 471 m_expectedRedirectResponse.setHTTPStatusCode(301); |
| 484 m_expectedRedirectResponse.setHTTPHeaderField("Location", redirect); | 472 m_expectedRedirectResponse.setHTTPHeaderField("Location", redirect); |
| 485 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
edirectResponse, m_frameFilePath); | 473 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
edirectResponse, m_frameFilePath); |
| 486 | 474 |
| 487 m_expectedNewRequest = WebURLRequest(); | 475 m_expectedNewRequest = WebURLRequest(); |
| 488 m_expectedNewRequest.initialize(); | |
| 489 m_expectedNewRequest.setURL(redirectURL); | 476 m_expectedNewRequest.setURL(redirectURL); |
| 490 | 477 |
| 491 m_expectedResponse = WebURLResponse(); | 478 m_expectedResponse = WebURLResponse(); |
| 492 m_expectedResponse.setMIMEType("text/html"); | 479 m_expectedResponse.setMIMEType("text/html"); |
| 493 m_expectedResponse.setHTTPStatusCode(200); | 480 m_expectedResponse.setHTTPStatusCode(200); |
| 494 Platform::current()->getURLLoaderMockFactory()->registerURL(redirectURL, m_e
xpectedResponse, m_frameFilePath); | 481 Platform::current()->getURLLoaderMockFactory()->registerURL(redirectURL, m_e
xpectedResponse, m_frameFilePath); |
| 495 | 482 |
| 496 m_expectedLoader = createAssociatedURLLoader(); | 483 m_expectedLoader = createAssociatedURLLoader(); |
| 497 EXPECT_TRUE(m_expectedLoader); | 484 EXPECT_TRUE(m_expectedLoader); |
| 498 m_expectedLoader->loadAsynchronously(request, this); | 485 m_expectedLoader->loadAsynchronously(request, this); |
| 499 | 486 |
| 500 serveRequests(); | 487 serveRequests(); |
| 501 EXPECT_FALSE(m_willFollowRedirect); | 488 EXPECT_FALSE(m_willFollowRedirect); |
| 502 EXPECT_FALSE(m_didReceiveResponse); | 489 EXPECT_FALSE(m_didReceiveResponse); |
| 503 EXPECT_FALSE(m_didReceiveData); | 490 EXPECT_FALSE(m_didReceiveData); |
| 504 EXPECT_FALSE(m_didFinishLoading); | 491 EXPECT_FALSE(m_didFinishLoading); |
| 505 } | 492 } |
| 506 | 493 |
| 507 // Test that a cross origin redirect response without CORS headers fails. | 494 // Test that a cross origin redirect response without CORS headers fails. |
| 508 TEST_F(AssociatedURLLoaderTest, RedirectCrossOriginWithAccessControlFailure) | 495 TEST_F(AssociatedURLLoaderTest, RedirectCrossOriginWithAccessControlFailure) |
| 509 { | 496 { |
| 510 KURL url = toKURL("http://www.test.com/RedirectCrossOriginWithAccessControlF
ailure.html"); | 497 KURL url = toKURL("http://www.test.com/RedirectCrossOriginWithAccessControlF
ailure.html"); |
| 511 char redirect[] = "http://www.other.com/RedirectCrossOriginWithAccessControl
Failure.html"; // Cross-origin | 498 char redirect[] = "http://www.other.com/RedirectCrossOriginWithAccessControl
Failure.html"; // Cross-origin |
| 512 KURL redirectURL = toKURL(redirect); | 499 KURL redirectURL = toKURL(redirect); |
| 513 | 500 |
| 514 WebURLRequest request; | 501 WebURLRequest request; |
| 515 request.initialize(); | |
| 516 request.setURL(url); | 502 request.setURL(url); |
| 517 | 503 |
| 518 m_expectedRedirectResponse = WebURLResponse(); | 504 m_expectedRedirectResponse = WebURLResponse(); |
| 519 m_expectedRedirectResponse.setMIMEType("text/html"); | 505 m_expectedRedirectResponse.setMIMEType("text/html"); |
| 520 m_expectedRedirectResponse.setHTTPStatusCode(301); | 506 m_expectedRedirectResponse.setHTTPStatusCode(301); |
| 521 m_expectedRedirectResponse.setHTTPHeaderField("Location", redirect); | 507 m_expectedRedirectResponse.setHTTPHeaderField("Location", redirect); |
| 522 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
edirectResponse, m_frameFilePath); | 508 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
edirectResponse, m_frameFilePath); |
| 523 | 509 |
| 524 m_expectedNewRequest = WebURLRequest(); | 510 m_expectedNewRequest = WebURLRequest(); |
| 525 m_expectedNewRequest.initialize(); | |
| 526 m_expectedNewRequest.setURL(redirectURL); | 511 m_expectedNewRequest.setURL(redirectURL); |
| 527 | 512 |
| 528 m_expectedResponse = WebURLResponse(); | 513 m_expectedResponse = WebURLResponse(); |
| 529 m_expectedResponse.setMIMEType("text/html"); | 514 m_expectedResponse.setMIMEType("text/html"); |
| 530 m_expectedResponse.setHTTPStatusCode(200); | 515 m_expectedResponse.setHTTPStatusCode(200); |
| 531 Platform::current()->getURLLoaderMockFactory()->registerURL(redirectURL, m_e
xpectedResponse, m_frameFilePath); | 516 Platform::current()->getURLLoaderMockFactory()->registerURL(redirectURL, m_e
xpectedResponse, m_frameFilePath); |
| 532 | 517 |
| 533 WebURLLoaderOptions options; | 518 WebURLLoaderOptions options; |
| 534 options.crossOriginRequestPolicy = WebURLLoaderOptions::CrossOriginRequestPo
licyUseAccessControl; | 519 options.crossOriginRequestPolicy = WebURLLoaderOptions::CrossOriginRequestPo
licyUseAccessControl; |
| 535 m_expectedLoader = createAssociatedURLLoader(options); | 520 m_expectedLoader = createAssociatedURLLoader(options); |
| 536 EXPECT_TRUE(m_expectedLoader); | 521 EXPECT_TRUE(m_expectedLoader); |
| 537 m_expectedLoader->loadAsynchronously(request, this); | 522 m_expectedLoader->loadAsynchronously(request, this); |
| 538 | 523 |
| 539 serveRequests(); | 524 serveRequests(); |
| 540 // We should get a notification about access control check failure. | 525 // We should get a notification about access control check failure. |
| 541 EXPECT_FALSE(m_willFollowRedirect); | 526 EXPECT_FALSE(m_willFollowRedirect); |
| 542 EXPECT_FALSE(m_didReceiveResponse); | 527 EXPECT_FALSE(m_didReceiveResponse); |
| 543 EXPECT_FALSE(m_didReceiveData); | 528 EXPECT_FALSE(m_didReceiveData); |
| 544 EXPECT_TRUE(m_didFail); | 529 EXPECT_TRUE(m_didFail); |
| 545 } | 530 } |
| 546 | 531 |
| 547 // Test that a cross origin redirect response with CORS headers that allow the r
equesting origin succeeds. | 532 // Test that a cross origin redirect response with CORS headers that allow the r
equesting origin succeeds. |
| 548 TEST_F(AssociatedURLLoaderTest, RedirectCrossOriginWithAccessControlSuccess) | 533 TEST_F(AssociatedURLLoaderTest, RedirectCrossOriginWithAccessControlSuccess) |
| 549 { | 534 { |
| 550 KURL url = toKURL("http://www.test.com/RedirectCrossOriginWithAccessControlS
uccess.html"); | 535 KURL url = toKURL("http://www.test.com/RedirectCrossOriginWithAccessControlS
uccess.html"); |
| 551 char redirect[] = "http://www.other.com/RedirectCrossOriginWithAccessControl
Success.html"; // Cross-origin | 536 char redirect[] = "http://www.other.com/RedirectCrossOriginWithAccessControl
Success.html"; // Cross-origin |
| 552 KURL redirectURL = toKURL(redirect); | 537 KURL redirectURL = toKURL(redirect); |
| 553 | 538 |
| 554 WebURLRequest request; | 539 WebURLRequest request; |
| 555 request.initialize(); | |
| 556 request.setURL(url); | 540 request.setURL(url); |
| 557 // Add a CORS simple header. | 541 // Add a CORS simple header. |
| 558 request.setHTTPHeaderField("accept", "application/json"); | 542 request.setHTTPHeaderField("accept", "application/json"); |
| 559 | 543 |
| 560 // Create a redirect response that allows the redirect to pass the access co
ntrol checks. | 544 // Create a redirect response that allows the redirect to pass the access co
ntrol checks. |
| 561 m_expectedRedirectResponse = WebURLResponse(); | 545 m_expectedRedirectResponse = WebURLResponse(); |
| 562 m_expectedRedirectResponse.setMIMEType("text/html"); | 546 m_expectedRedirectResponse.setMIMEType("text/html"); |
| 563 m_expectedRedirectResponse.setHTTPStatusCode(301); | 547 m_expectedRedirectResponse.setHTTPStatusCode(301); |
| 564 m_expectedRedirectResponse.setHTTPHeaderField("Location", redirect); | 548 m_expectedRedirectResponse.setHTTPHeaderField("Location", redirect); |
| 565 m_expectedRedirectResponse.addHTTPHeaderField("access-control-allow-origin",
"*"); | 549 m_expectedRedirectResponse.addHTTPHeaderField("access-control-allow-origin",
"*"); |
| 566 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
edirectResponse, m_frameFilePath); | 550 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
edirectResponse, m_frameFilePath); |
| 567 | 551 |
| 568 m_expectedNewRequest = WebURLRequest(); | 552 m_expectedNewRequest = WebURLRequest(); |
| 569 m_expectedNewRequest.initialize(); | |
| 570 m_expectedNewRequest.setURL(redirectURL); | 553 m_expectedNewRequest.setURL(redirectURL); |
| 571 m_expectedNewRequest.setHTTPHeaderField("accept", "application/json"); | 554 m_expectedNewRequest.setHTTPHeaderField("accept", "application/json"); |
| 572 | 555 |
| 573 m_expectedResponse = WebURLResponse(); | 556 m_expectedResponse = WebURLResponse(); |
| 574 m_expectedResponse.setMIMEType("text/html"); | 557 m_expectedResponse.setMIMEType("text/html"); |
| 575 m_expectedResponse.setHTTPStatusCode(200); | 558 m_expectedResponse.setHTTPStatusCode(200); |
| 576 m_expectedResponse.addHTTPHeaderField("access-control-allow-origin", "*"); | 559 m_expectedResponse.addHTTPHeaderField("access-control-allow-origin", "*"); |
| 577 Platform::current()->getURLLoaderMockFactory()->registerURL(redirectURL, m_e
xpectedResponse, m_frameFilePath); | 560 Platform::current()->getURLLoaderMockFactory()->registerURL(redirectURL, m_e
xpectedResponse, m_frameFilePath); |
| 578 | 561 |
| 579 WebURLLoaderOptions options; | 562 WebURLLoaderOptions options; |
| (...skipping 91 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 671 EXPECT_TRUE(CheckAccessControlHeaders("non-whitelisted", true)); | 654 EXPECT_TRUE(CheckAccessControlHeaders("non-whitelisted", true)); |
| 672 | 655 |
| 673 // Test that Set-Cookie headers aren't returned, even if exposed. | 656 // Test that Set-Cookie headers aren't returned, even if exposed. |
| 674 EXPECT_FALSE(CheckAccessControlHeaders("Set-Cookie", true)); | 657 EXPECT_FALSE(CheckAccessControlHeaders("Set-Cookie", true)); |
| 675 } | 658 } |
| 676 | 659 |
| 677 // Test that the loader can allow non-whitelisted response headers for trusted C
ORS loads. | 660 // Test that the loader can allow non-whitelisted response headers for trusted C
ORS loads. |
| 678 TEST_F(AssociatedURLLoaderTest, CrossOriginHeaderAllowResponseHeaders) | 661 TEST_F(AssociatedURLLoaderTest, CrossOriginHeaderAllowResponseHeaders) |
| 679 { | 662 { |
| 680 WebURLRequest request; | 663 WebURLRequest request; |
| 681 request.initialize(); | |
| 682 KURL url = toKURL("http://www.other.com/CrossOriginHeaderAllowResponseHeader
s.html"); | 664 KURL url = toKURL("http://www.other.com/CrossOriginHeaderAllowResponseHeader
s.html"); |
| 683 request.setURL(url); | 665 request.setURL(url); |
| 684 | 666 |
| 685 WebString headerNameString(WebString::fromUTF8("non-whitelisted")); | 667 WebString headerNameString(WebString::fromUTF8("non-whitelisted")); |
| 686 m_expectedResponse = WebURLResponse(); | 668 m_expectedResponse = WebURLResponse(); |
| 687 m_expectedResponse.setMIMEType("text/html"); | 669 m_expectedResponse.setMIMEType("text/html"); |
| 688 m_expectedResponse.setHTTPStatusCode(200); | 670 m_expectedResponse.setHTTPStatusCode(200); |
| 689 m_expectedResponse.addHTTPHeaderField("Access-Control-Allow-Origin", "*"); | 671 m_expectedResponse.addHTTPHeaderField("Access-Control-Allow-Origin", "*"); |
| 690 m_expectedResponse.addHTTPHeaderField(headerNameString, "foo"); | 672 m_expectedResponse.addHTTPHeaderField(headerNameString, "foo"); |
| 691 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
esponse, m_frameFilePath); | 673 Platform::current()->getURLLoaderMockFactory()->registerURL(url, m_expectedR
esponse, m_frameFilePath); |
| 692 | 674 |
| 693 WebURLLoaderOptions options; | 675 WebURLLoaderOptions options; |
| 694 options.exposeAllResponseHeaders = true; // This turns off response whitelis
ting. | 676 options.exposeAllResponseHeaders = true; // This turns off response whitelis
ting. |
| 695 options.crossOriginRequestPolicy = WebURLLoaderOptions::CrossOriginRequestPo
licyUseAccessControl; | 677 options.crossOriginRequestPolicy = WebURLLoaderOptions::CrossOriginRequestPo
licyUseAccessControl; |
| 696 m_expectedLoader = createAssociatedURLLoader(options); | 678 m_expectedLoader = createAssociatedURLLoader(options); |
| 697 EXPECT_TRUE(m_expectedLoader); | 679 EXPECT_TRUE(m_expectedLoader); |
| 698 m_expectedLoader->loadAsynchronously(request, this); | 680 m_expectedLoader->loadAsynchronously(request, this); |
| 699 serveRequests(); | 681 serveRequests(); |
| 700 EXPECT_TRUE(m_didReceiveResponse); | 682 EXPECT_TRUE(m_didReceiveResponse); |
| 701 EXPECT_TRUE(m_didReceiveData); | 683 EXPECT_TRUE(m_didReceiveData); |
| 702 EXPECT_TRUE(m_didFinishLoading); | 684 EXPECT_TRUE(m_didFinishLoading); |
| 703 | 685 |
| 704 EXPECT_FALSE(m_actualResponse.httpHeaderField(headerNameString).isEmpty()); | 686 EXPECT_FALSE(m_actualResponse.httpHeaderField(headerNameString).isEmpty()); |
| 705 } | 687 } |
| 706 | 688 |
| 707 } // namespace blink | 689 } // namespace blink |
| OLD | NEW |