OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <stdint.h> | 5 #include <stdint.h> |
6 | 6 |
7 #include "base/command_line.h" | 7 #include "base/command_line.h" |
8 #include "base/containers/hash_tables.h" | 8 #include "base/containers/hash_tables.h" |
9 #include "base/macros.h" | 9 #include "base/macros.h" |
10 #include "base/strings/utf_string_conversions.h" | 10 #include "base/strings/utf_string_conversions.h" |
11 #include "build/build_config.h" | 11 #include "build/build_config.h" |
| 12 #include "content/browser/bad_message.h" |
12 #include "content/browser/dom_storage/dom_storage_context_wrapper.h" | 13 #include "content/browser/dom_storage/dom_storage_context_wrapper.h" |
13 #include "content/browser/dom_storage/session_storage_namespace_impl.h" | 14 #include "content/browser/dom_storage/session_storage_namespace_impl.h" |
14 #include "content/browser/frame_host/navigator.h" | 15 #include "content/browser/frame_host/navigator.h" |
15 #include "content/browser/frame_host/render_frame_host_impl.h" | 16 #include "content/browser/frame_host/render_frame_host_impl.h" |
16 #include "content/browser/renderer_host/render_view_host_factory.h" | 17 #include "content/browser/renderer_host/render_view_host_factory.h" |
17 #include "content/browser/renderer_host/render_view_host_impl.h" | 18 #include "content/browser/renderer_host/render_view_host_impl.h" |
18 #include "content/browser/web_contents/web_contents_impl.h" | 19 #include "content/browser/web_contents/web_contents_impl.h" |
19 #include "content/common/frame_messages.h" | 20 #include "content/common/frame_messages.h" |
20 #include "content/common/resource_messages.h" | 21 #include "content/common/resource_messages.h" |
21 #include "content/common/resource_request.h" | 22 #include "content/common/resource_request.h" |
22 #include "content/common/view_messages.h" | 23 #include "content/common/view_messages.h" |
23 #include "content/public/browser/browser_context.h" | 24 #include "content/public/browser/browser_context.h" |
24 #include "content/public/browser/content_browser_client.h" | 25 #include "content/public/browser/content_browser_client.h" |
25 #include "content/public/browser/interstitial_page.h" | 26 #include "content/public/browser/interstitial_page.h" |
26 #include "content/public/browser/interstitial_page_delegate.h" | 27 #include "content/public/browser/interstitial_page_delegate.h" |
| 28 #include "content/public/browser/resource_context.h" |
27 #include "content/public/browser/resource_dispatcher_host.h" | 29 #include "content/public/browser/resource_dispatcher_host.h" |
| 30 #include "content/public/browser/resource_dispatcher_host_interceptor.h" |
28 #include "content/public/browser/storage_partition.h" | 31 #include "content/public/browser/storage_partition.h" |
29 #include "content/public/common/appcache_info.h" | 32 #include "content/public/common/appcache_info.h" |
30 #include "content/public/common/browser_side_navigation_policy.h" | 33 #include "content/public/common/browser_side_navigation_policy.h" |
31 #include "content/public/common/content_switches.h" | 34 #include "content/public/common/content_switches.h" |
32 #include "content/public/common/file_chooser_params.h" | 35 #include "content/public/common/file_chooser_params.h" |
33 #include "content/public/test/browser_test_utils.h" | 36 #include "content/public/test/browser_test_utils.h" |
34 #include "content/public/test/content_browser_test.h" | 37 #include "content/public/test/content_browser_test.h" |
35 #include "content/public/test/content_browser_test_utils.h" | 38 #include "content/public/test/content_browser_test_utils.h" |
36 #include "content/public/test/test_utils.h" | 39 #include "content/public/test/test_utils.h" |
37 #include "content/shell/browser/shell.h" | 40 #include "content/shell/browser/shell.h" |
(...skipping 356 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
394 | 397 |
395 // Send a second message from the interstitial page, and make sure that the | 398 // Send a second message from the interstitial page, and make sure that the |
396 // "evil" message doesn't arrive in the intervening period. | 399 // "evil" message doesn't arrive in the intervening period. |
397 ASSERT_TRUE(ExecuteScript(interstitial_page->GetMainFrame(), | 400 ASSERT_TRUE(ExecuteScript(interstitial_page->GetMainFrame(), |
398 "window.domAutomationController.send(\"okay2\");")); | 401 "window.domAutomationController.send(\"okay2\");")); |
399 ASSERT_TRUE(message_queue.WaitForMessage(&message)); | 402 ASSERT_TRUE(message_queue.WaitForMessage(&message)); |
400 ASSERT_EQ("\"okay2\"", message); | 403 ASSERT_EQ("\"okay2\"", message); |
401 ASSERT_EQ("\"okay2\"", interstitial->last_command()); | 404 ASSERT_EQ("\"okay2\"", interstitial->last_command()); |
402 } | 405 } |
403 | 406 |
404 class IsolatedAppContentBrowserClient : public TestContentBrowserClient { | 407 // Intercepts the HTTP origin header and on being invoked once it is found |
| 408 // aborts the requeest. |
| 409 class HttpOriginInterceptor |
| 410 : public content::ResourceDispatcherHostInterceptor { |
405 public: | 411 public: |
406 bool IsIllegalOrigin(content::ResourceContext* resource_context, | 412 HttpOriginInterceptor() { |
407 int child_process_id, | 413 ResourceDispatcherHost::Get()->RegisterInterceptor("Origin", "", this); |
408 const GURL& origin) override { | |
409 // Simulate a case where an app origin is not in an app process. | |
410 return true; | |
411 } | 414 } |
| 415 |
| 416 ~HttpOriginInterceptor() override { |
| 417 ResourceDispatcherHost::Get()->UnregisterInterceptor("Origin", this); |
| 418 } |
| 419 |
| 420 void OnHttpHeaderReceived(const std::string& header, |
| 421 const std::string& value, |
| 422 int child_process_id, |
| 423 content::ResourceContext* resource_context, |
| 424 OnHeaderProcessedCallback callback) override { |
| 425 callback.Run(false, content::bad_message::RDH_ILLEGAL_ORIGIN); |
| 426 } |
| 427 |
| 428 private: |
| 429 DISALLOW_COPY_AND_ASSIGN(HttpOriginInterceptor); |
412 }; | 430 }; |
413 | 431 |
414 // Renderer processes should not be able to spoof Origin HTTP headers. | 432 // Renderer processes should not be able to spoof Origin HTTP headers. |
415 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, InvalidOriginHeaders) { | 433 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, InvalidOriginHeaders) { |
416 // Create a set of IPC messages with various Origin headers. | 434 // Create a set of IPC messages with various Origin headers. |
417 ResourceRequest chrome_origin_msg( | 435 ResourceRequest chrome_origin_msg( |
418 CreateXHRRequestWithOrigin("chrome://settings")); | 436 CreateXHRRequestWithOrigin("chrome://settings")); |
419 ResourceRequest embedder_isolated_origin_msg( | 437 ResourceRequest embedder_isolated_origin_msg( |
420 CreateXHRRequestWithOrigin("https://isolated.bar.com")); | 438 CreateXHRRequestWithOrigin("https://isolated.bar.com")); |
421 ResourceRequest invalid_origin_msg(CreateXHRRequestWithOrigin("invalidurl")); | 439 ResourceRequest invalid_origin_msg(CreateXHRRequestWithOrigin("invalidurl")); |
(...skipping 16 matching lines...) Expand all Loading... |
438 chrome_origin_msg)); | 456 chrome_origin_msg)); |
439 web_process_killed.Wait(); | 457 web_process_killed.Wait(); |
440 } | 458 } |
441 | 459 |
442 // Web processes cannot make XHRs with URLs that the content embedder expects | 460 // Web processes cannot make XHRs with URLs that the content embedder expects |
443 // to have process isolation. Ideally this would test chrome-extension:// | 461 // to have process isolation. Ideally this would test chrome-extension:// |
444 // URLs for Chrome Apps, but those can't be tested inside content/ and the | 462 // URLs for Chrome Apps, but those can't be tested inside content/ and the |
445 // ResourceRequest IPC can't be created in a test outside content/. | 463 // ResourceRequest IPC can't be created in a test outside content/. |
446 NavigateToURL(shell(), web_url); | 464 NavigateToURL(shell(), web_url); |
447 { | 465 { |
448 // Set up a ContentBrowserClient that simulates an app URL in a non-app | 466 std::unique_ptr<HttpOriginInterceptor> origin_interceptor( |
449 // process. | 467 new HttpOriginInterceptor); |
450 IsolatedAppContentBrowserClient app_client; | |
451 ContentBrowserClient* old_client = SetBrowserClientForTesting(&app_client); | |
452 RenderProcessHostWatcher web_process_killed( | 468 RenderProcessHostWatcher web_process_killed( |
453 web_rfh->GetProcess(), | 469 web_rfh->GetProcess(), |
454 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); | 470 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); |
455 IPC::IpcSecurityTestUtil::PwnMessageReceived( | 471 IPC::IpcSecurityTestUtil::PwnMessageReceived( |
456 web_rfh->GetProcess()->GetChannel(), | 472 web_rfh->GetProcess()->GetChannel(), |
457 ResourceHostMsg_RequestResource(web_rfh->GetRoutingID(), | 473 ResourceHostMsg_RequestResource(web_rfh->GetRoutingID(), |
458 kRequestIdNotPreviouslyUsed, | 474 kRequestIdNotPreviouslyUsed, |
459 embedder_isolated_origin_msg)); | 475 embedder_isolated_origin_msg)); |
460 web_process_killed.Wait(); | 476 web_process_killed.Wait(); |
461 SetBrowserClientForTesting(old_client); | |
462 } | 477 } |
463 | 478 |
464 // Web processes cannot make XHRs with invalid Origin headers. | 479 // Web processes cannot make XHRs with invalid Origin headers. |
465 NavigateToURL(shell(), web_url); | 480 NavigateToURL(shell(), web_url); |
466 { | 481 { |
467 RenderProcessHostWatcher web_process_killed( | 482 RenderProcessHostWatcher web_process_killed( |
468 web_rfh->GetProcess(), | 483 web_rfh->GetProcess(), |
469 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); | 484 RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); |
470 IPC::IpcSecurityTestUtil::PwnMessageReceived( | 485 IPC::IpcSecurityTestUtil::PwnMessageReceived( |
471 web_rfh->GetProcess()->GetChannel(), | 486 web_rfh->GetProcess()->GetChannel(), |
(...skipping 78 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
550 // separate task of the message loop, so ensure that the process is still | 565 // separate task of the message loop, so ensure that the process is still |
551 // considered alive. | 566 // considered alive. |
552 EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection()); | 567 EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection()); |
553 | 568 |
554 exit_observer.Wait(); | 569 exit_observer.Wait(); |
555 EXPECT_FALSE(exit_observer.did_exit_normally()); | 570 EXPECT_FALSE(exit_observer.did_exit_normally()); |
556 ResourceDispatcherHost::Get()->SetDelegate(nullptr); | 571 ResourceDispatcherHost::Get()->SetDelegate(nullptr); |
557 } | 572 } |
558 | 573 |
559 } // namespace content | 574 } // namespace content |
OLD | NEW |