Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(120)

Unified Diff: content/child/site_isolation_policy_browsertest.cc

Issue 22876029: Revert 219383 "UMA data collector for cross-site documents(XSD)" (Closed) Base URL: svn://svn.chromium.org/chrome/branches/1610/src/
Patch Set: Created 7 years, 4 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « content/child/site_isolation_policy.cc ('k') | content/child/site_isolation_policy_unittest.cc » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: content/child/site_isolation_policy_browsertest.cc
===================================================================
--- content/child/site_isolation_policy_browsertest.cc (revision 219467)
+++ content/child/site_isolation_policy_browsertest.cc (working copy)
@@ -1,106 +0,0 @@
-// Copyright 2013 The Chromium Authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-#include "base/command_line.h"
-#include "content/public/common/content_switches.h"
-#include "content/public/test/browser_test_utils.h"
-#include "content/test/content_browser_test.h"
-#include "content/test/content_browser_test_utils.h"
-
-namespace content {
-
-// These tests simulate exploited renderer processes, which can fetch arbitrary
-// resources from other websites, not constrained by the Same Origin Policy. We
-// are trying to verify that the renderer cannot fetch any cross-site document
-// responses even when the Same Origin Policy is turned off inside the renderer.
-class SiteIsolationPolicyBrowserTest : public ContentBrowserTest {
- public:
- SiteIsolationPolicyBrowserTest() {}
- virtual ~SiteIsolationPolicyBrowserTest() {}
-
- virtual void SetUpCommandLine(CommandLine* command_line) OVERRIDE {
- ASSERT_TRUE(test_server()->Start());
- net::SpawnedTestServer https_server(
- net::SpawnedTestServer::TYPE_HTTPS,
- net::SpawnedTestServer::kLocalhost,
- base::FilePath(FILE_PATH_LITERAL("content/test/data")));
- ASSERT_TRUE(https_server.Start());
-
- // Add a host resolver rule to map all outgoing requests to the test server.
- // This allows us to use "real" hostnames in URLs, which we can use to
- // create arbitrary SiteInstances.
- command_line->AppendSwitchASCII(
- switches::kHostResolverRules,
- "MAP * " + test_server()->host_port_pair().ToString() +
- ",EXCLUDE localhost");
-
- // Since we assume exploited renderer process, it can bypass the same origin
- // policy at will. Simulate that by passing the disable-web-security flag.
- command_line->AppendSwitch(switches::kDisableWebSecurity);
-
- // We assume that we're using our cross-site document blocking logic which
- // is turned on even when the Same Origin Policy is turned off.
- command_line->AppendSwitch(switches::kBlockCrossSiteDocuments);
- }
-
- private:
- DISALLOW_COPY_AND_ASSIGN(SiteIsolationPolicyBrowserTest);
-};
-
-// TODO(dsjang): we cannot run these tests on Android since SetUpCommandLine()
-// is executed before the I/O thread is created on Android. After this bug
-// (crbug.com/278425) is resolved, we can enable this test case on Android.
-#if defined(OS_ANDROID)
-#define MAYBE_CrossSiteDocumentBlockingForMimeType \
- DISABLED_CrossSiteDocumentBlockingForMimeType
-#else
-#define MAYBE_CrossSiteDocumentBlockingForMimeType \
- CrossSiteDocumentBlockingForMimeType
-#endif
-
-IN_PROC_BROWSER_TEST_F(SiteIsolationPolicyBrowserTest,
- MAYBE_CrossSiteDocumentBlockingForMimeType) {
- // Load a page that issues illegal cross-site document requests to bar.com.
- // The page uses XHR to request HTML/XML/JSON documents from bar.com, and
- // inspects if any of them were successfully received. The XHR requests will
- // get a one character string ' ' for a blocked response. This test is only
- // possible since we run the browser without the same origin policy.
- GURL foo("http://foo.com/files/cross_site_document_request.html");
-
- content::DOMMessageQueue msg_queue;
-
- NavigateToURL(shell(), foo);
-
- std::string status;
- // The page will return 1 from the DOMAutomationController if it succeeds,
- // otherwise it will return 0.
- std::string expected_status("1");
- EXPECT_TRUE(msg_queue.WaitForMessage(&status));
- EXPECT_STREQ(status.c_str(), expected_status.c_str());
-}
-
-// TODO(dsjang): we cannot run these tests on Android since SetUpCommandLine()
-// is executed before the I/O thread is created on Android. After this bug
-// (crbug.com/278425) is resolved, we can enable this test case on Android.
-#if defined(OS_ANDROID)
-#define MAYBE_CrossSiteDocumentBlockingForDifferentTargets \
- DISABLED_CrossSiteDocumentBlockingForDifferentTargets
-#else
-#define MAYBE_CrossSiteDocumentBlockingForDifferentTargets \
- CrossSiteDocumentBlockingForDifferentTargets
-#endif
-
-IN_PROC_BROWSER_TEST_F(SiteIsolationPolicyBrowserTest,
- MAYBE_CrossSiteDocumentBlockingForDifferentTargets) {
- // This webpage loads a cross-site HTML page in different targets such as
- // <img>,<link>,<embed>, etc. Since the requested document is blocked, and one
- // character string (' ') is returned instead, this tests that the renderer
- // does not crash even when it receives a response body which is " ", whose
- // length is different from what's described in "content-length" for such
- // different targets.
- GURL foo("http://foo.com/files/cross_site_document_request_target.html");
- NavigateToURL(shell(), foo);
-}
-
-}
« no previous file with comments | « content/child/site_isolation_policy.cc ('k') | content/child/site_isolation_policy_unittest.cc » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698