chrome/browser/extensions/process_manager_browsertest.cc - Issue 2345473003: Block top-level navigations to nested URLs with extension origins from non-extension processes.

Side by Side Diff: chrome/browser/extensions/process_manager_browsertest.cc

Issue 2345473003: Block top-level navigations to nested URLs with extension origins from non-extension processes. (Closed)

Patch Set: Cleanup Created 4 years, 3 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

OLD	NEW
1 // Copyright 2013 The Chromium Authors. All rights reserved.	1 // Copyright 2013 The Chromium Authors. All rights reserved.

2 // Use of this source code is governed by a BSD-style license that can be	2 // Use of this source code is governed by a BSD-style license that can be

3 // found in the LICENSE file.	3 // found in the LICENSE file.

4	4

5 #include <stddef.h>	5 #include <stddef.h>

6	6

7 #include <memory>	7 #include <memory>

8 #include <utility>	8 #include <utility>

9	9

10 #include "base/callback.h"	10 #include "base/callback.h"

11 #include "base/macros.h"	11 #include "base/macros.h"

12 #include "base/run_loop.h"	12 #include "base/run_loop.h"

13 #include "chrome/browser/extensions/browser_action_test_util.h"	13 #include "chrome/browser/extensions/browser_action_test_util.h"

14 #include "chrome/browser/extensions/extension_browsertest.h"	14 #include "chrome/browser/extensions/extension_browsertest.h"

15 #include "chrome/browser/extensions/extension_service.h"	15 #include "chrome/browser/extensions/extension_service.h"

16 #include "chrome/browser/extensions/test_extension_dir.h"	16 #include "chrome/browser/extensions/test_extension_dir.h"

17 #include "chrome/browser/ui/tabs/tab_strip_model.h"	17 #include "chrome/browser/ui/tabs/tab_strip_model.h"

18 #include "chrome/common/extensions/extension_process_policy.h"	18 #include "chrome/common/extensions/extension_process_policy.h"

	19 #include "chrome/common/pref_names.h"

19 #include "chrome/test/base/in_process_browser_test.h"	20 #include "chrome/test/base/in_process_browser_test.h"

20 #include "chrome/test/base/ui_test_utils.h"	21 #include "chrome/test/base/ui_test_utils.h"

21 #include "content/public/browser/notification_service.h"	22 #include "content/public/browser/notification_service.h"

22 #include "content/public/browser/render_frame_host.h"	23 #include "content/public/browser/render_frame_host.h"

23 #include "content/public/browser/render_process_host.h"	24 #include "content/public/browser/render_process_host.h"

24 #include "content/public/browser/web_contents.h"	25 #include "content/public/browser/web_contents.h"

25 #include "content/public/test/browser_test_utils.h"	26 #include "content/public/test/browser_test_utils.h"

	27 #include "content/public/test/test_navigation_observer.h"

26 #include "content/public/test/test_utils.h"	28 #include "content/public/test/test_utils.h"

27 #include "extensions/browser/process_manager.h"	29 #include "extensions/browser/process_manager.h"

28 #include "extensions/common/value_builder.h"	30 #include "extensions/common/value_builder.h"

29 #include "extensions/test/background_page_watcher.h"	31 #include "extensions/test/background_page_watcher.h"

30 #include "net/dns/mock_host_resolver.h"	32 #include "net/dns/mock_host_resolver.h"

31 #include "net/test/embedded_test_server/embedded_test_server.h"	33 #include "net/test/embedded_test_server/embedded_test_server.h"

32	34

33 namespace extensions {	35 namespace extensions {

34	36

35 namespace {	37 namespace {

36	38

37 void AddFrameToSet(std::set<content::RenderFrameHost> frames,	39 void AddFrameToSet(std::set<content::RenderFrameHost> frames,

38 content::RenderFrameHost* rfh) {	40 content::RenderFrameHost* rfh) {

39 if (rfh->IsRenderFrameLive())	41 if (rfh->IsRenderFrameLive())

40 frames->insert(rfh);	42 frames->insert(rfh);

41 }	43 }

42	44

	45 GURL CreateBlobURL(content::RenderFrameHost* frame,

	46 const std::string& content) {

	47 std::string blob_url_string;

	48 EXPECT_TRUE(ExecuteScriptAndExtractString(

	49 frame,

	50 "var blob = new Blob(['<html><body>" + content + "</body></html>'],"
	Devlin 2016/09/15 21:05:10 nit: \n at the end (everywhere like this) nit: \n at the end (everywhere like this) alexmos 2016/09/15 21:45:59 Done. Show quoted text On 2016/09/15 21:05:10, Devlin wrote: > nit: \n at the end (everywhere like this) Done.
	51 " {type: 'text/html'});"

	52 "domAutomationController.send(URL.createObjectURL(blob));",

	53 &blob_url_string));

	54 GURL blob_url(blob_url_string);

	55 EXPECT_TRUE(blob_url.is_valid());

	56 EXPECT_TRUE(blob_url.SchemeIsBlob());

	57 return blob_url;

	58 }

	59

	60 GURL CreateFileSystemURL(content::RenderFrameHost* frame,

	61 const std::string& content) {

	62 std::string filesystem_url_string;

	63 EXPECT_TRUE(ExecuteScriptAndExtractString(

	64 frame,

	65 "var blob = new Blob(['<html><body>" + content + "</body></html>'],"

	66 " {type: 'text/html'});"

	67 "window.webkitRequestFileSystem(TEMPORARY, blob.size, fs => {"

	68 " fs.root.getFile('foo.html', {create: true}, file => {"

	69 " file.createWriter(writer => {"

	70 " writer.write(blob);"

	71 " writer.onwriteend = () => {"

	72 " domAutomationController.send(file.toURL());"

	73 " }"

	74 " });"

	75 " });"

	76 "});",

	77 &filesystem_url_string));

	78 GURL filesystem_url(filesystem_url_string);

	79 EXPECT_TRUE(filesystem_url.is_valid());

	80 EXPECT_TRUE(filesystem_url.SchemeIsFileSystem());

	81 return filesystem_url;

	82 }

	83

	84 std::string GetTextContent(content::RenderFrameHost* frame) {

	85 std::string result;

	86 EXPECT_TRUE(ExecuteScriptAndExtractString(

	87 frame, "domAutomationController.send(document.body.innerText)", &result));

	88 return result;

	89 }

	90

43 } // namespace	91 } // namespace

44	92

45 // Takes a snapshot of all frames upon construction. When Wait() is called, a	93 // Takes a snapshot of all frames upon construction. When Wait() is called, a

46 // MessageLoop is created and Quit when all previously recorded frames are	94 // MessageLoop is created and Quit when all previously recorded frames are

47 // either present in the tab, or deleted. If a navigation happens between the	95 // either present in the tab, or deleted. If a navigation happens between the

48 // construction and the Wait() call, then this logic ensures that all obsolete	96 // construction and the Wait() call, then this logic ensures that all obsolete

49 // RenderFrameHosts have been destructed when Wait() returns.	97 // RenderFrameHosts have been destructed when Wait() returns.

50 // See also the comment at ProcessManagerBrowserTest::NavigateToURL.	98 // See also the comment at ProcessManagerBrowserTest::NavigateToURL.

51 class NavigationCompletedObserver : public content::WebContentsObserver {	99 class NavigationCompletedObserver : public content::WebContentsObserver {

52 public:	100 public:

(...skipping 104 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
157 observer.Wait();	205 observer.Wait();

158 }	206 }

159	207

160 size_t IfExtensionsIsolated(size_t if_enabled, size_t if_disabled) {	208 size_t IfExtensionsIsolated(size_t if_enabled, size_t if_disabled) {

161 return content::AreAllSitesIsolatedForTesting() \|\|	209 return content::AreAllSitesIsolatedForTesting() \|\|

162 IsIsolateExtensionsEnabled()	210 IsIsolateExtensionsEnabled()

163 ? if_enabled	211 ? if_enabled

164 : if_disabled;	212 : if_disabled;

165 }	213 }

166	214

	215 content::WebContents* OpenPopup(content::RenderFrameHost* opener,

	216 const GURL& url) {

	217 content::WindowedNotificationObserver popup_observer(

	218 chrome::NOTIFICATION_TAB_ADDED,

	219 content::NotificationService::AllSources());

	220 EXPECT_TRUE(ExecuteScript(opener, "window.open('" + url.spec() + "')"));

	221 popup_observer.Wait();

	222 content::WebContents* popup =

	223 browser()->tab_strip_model()->GetActiveWebContents();

	224 WaitForLoadStop(popup);

	225 EXPECT_EQ(url, popup->GetMainFrame()->GetLastCommittedURL());

	226 return popup;

	227 }

	228

167 private:	229 private:

168 std::vector<std::unique_ptr<TestExtensionDir>> temp_dirs_;	230 std::vector<std::unique_ptr<TestExtensionDir>> temp_dirs_;

169 };	231 };

170	232

171 // Test that basic extension loading creates the appropriate ExtensionHosts	233 // Test that basic extension loading creates the appropriate ExtensionHosts

172 // and background pages.	234 // and background pages.

173 IN_PROC_BROWSER_TEST_F(ProcessManagerBrowserTest,	235 IN_PROC_BROWSER_TEST_F(ProcessManagerBrowserTest,

174 ExtensionHostCreation) {	236 ExtensionHostCreation) {

175 ProcessManager* pm = ProcessManager::Get(profile());	237 ProcessManager* pm = ProcessManager::Get(profile());

176	238

(...skipping 391 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
568 ExecuteScriptInBackgroundPageNoWait(	630 ExecuteScriptInBackgroundPageNoWait(

569 extension->id(),	631 extension->id(),

570 "document.cookie = 'extension_cookie';"	632 "document.cookie = 'extension_cookie';"

571 "window.domAutomationController.send(document.cookie);");	633 "window.domAutomationController.send(document.cookie);");

572 std::string message;	634 std::string message;

573 ASSERT_TRUE(queue.WaitForMessage(&message));	635 ASSERT_TRUE(queue.WaitForMessage(&message));

574 EXPECT_EQ(message, "\"extension_cookie\"");	636 EXPECT_EQ(message, "\"extension_cookie\"");

575 }	637 }

576 }	638 }

577	639

	640 // Test that navigations to blob: and filesystem: URLs with extension origins

	641 // are disallowed when initiated from non-extension processes. See

	642 // https://crbug.com/645028 and https://crbug.com/644426.

	643 IN_PROC_BROWSER_TEST_F(ProcessManagerBrowserTest,

	644 NestedURLNavigationsToExtensionBlocked) {

	645 // Disabling web security is necessary to test the browser enforcement;

	646 // without it, the loads in this test would be blocked by

	647 // SecurityOrigin::canDisplay() as invalid local resource loads.

	648 PrefService* prefs = browser()->profile()->GetPrefs();

	649 prefs->SetBoolean(prefs::kWebKitWebSecurityEnabled, false);

	650

	651 // Create a simple extension without a background page.

	652 const Extension* extension = CreateExtension("Extension", false);

	653 embedded_test_server()->ServeFilesFromDirectory(extension->path());

	654 ASSERT_TRUE(embedded_test_server()->Start());

	655

	656 // Navigate main tab to a web page with two web iframes. There should be no

	657 // extension frames yet.

	658 NavigateToURL(embedded_test_server()->GetURL("/two_iframes.html"));

	659 ProcessManager* pm = ProcessManager::Get(profile());

	660 EXPECT_EQ(0u, pm->GetAllFrames().size());

	661 EXPECT_EQ(0u, pm->GetRenderFrameHostsForExtension(extension->id()).size());

	662

	663 content::WebContents* tab =

	664 browser()->tab_strip_model()->GetActiveWebContents();

	665

	666 // Navigate first subframe to an extension URL. With --isolate-extensions,

	667 // this will go into a new extension process.

	668 const GURL extension_url(extension->url().Resolve("empty.html"));

	669 EXPECT_TRUE(content::NavigateIframeToURL(tab, "frame1", extension_url));

	670 EXPECT_EQ(IfExtensionsIsolated(1, 0),

	671 pm->GetRenderFrameHostsForExtension(extension->id()).size());

	672 EXPECT_EQ(IfExtensionsIsolated(1, 0), pm->GetAllFrames().size());
	nasko 2016/09/15 18:36:01 What about testing for not --isolate-extensions ca What about testing for not --isolate-extensions case? alexmos 2016/09/15 18:40:12 Oh yeah, I should've mentioned this. Up until upl Show quoted text On 2016/09/15 18:36:01, nasko (slow) wrote: > What about testing for not --isolate-extensions case? Oh yeah, I should've mentioned this. Up until uploading this, I tested both tests locally both with and without --isolate-extensions (by reverting IsIsolateExtensionsEnabled() to check the flag). I was going to rely on the M53 stable bots to check this when I merge the fix back to M53, but do you think I should find a way to turn off --isolate-extensions in the test itself and add that coverage? nasko 2016/09/15 18:50:03 I don't think you need to turn of --isolate-extens Show quoted text On 2016/09/15 18:40:12, alexmos wrote: > On 2016/09/15 18:36:01, nasko (slow) wrote: > > What about testing for not --isolate-extensions case? > > Oh yeah, I should've mentioned this. Up until uploading this, I tested both > tests locally both with and without --isolate-extensions (by reverting > IsIsolateExtensionsEnabled() to check the flag). I was going to rely on the M53 > stable bots to check this when I merge the fix back to M53, but do you think I > should find a way to turn off --isolate-extensions in the test itself and add > that coverage? I don't think you need to turn of --isolate-extensions at all. In M55 it will only test the --isolate-extensions case, but having the checks will allow M53 to test the default case of --isolate-extensions being off. Once backported, we can update the test to not even use IfExtensionsIsolated, since we know that is always true. alexmos 2016/09/15 20:51:42 Agreed, let's plan on doing that. Show quoted text On 2016/09/15 18:50:03, nasko (slow) wrote: > On 2016/09/15 18:40:12, alexmos wrote: > > On 2016/09/15 18:36:01, nasko (slow) wrote: > > > What about testing for not --isolate-extensions case? > > > > Oh yeah, I should've mentioned this. Up until uploading this, I tested both > > tests locally both with and without --isolate-extensions (by reverting > > IsIsolateExtensionsEnabled() to check the flag). I was going to rely on the > M53 > > stable bots to check this when I merge the fix back to M53, but do you think I > > should find a way to turn off --isolate-extensions in the test itself and add > > that coverage? > > I don't think you need to turn of --isolate-extensions at all. In M55 it will > only test the --isolate-extensions case, but having the checks will allow M53 to > test the default case of --isolate-extensions being off. Once backported, we can > update the test to not even use IfExtensionsIsolated, since we know that is > always true. Agreed, let's plan on doing that.
	673

	674 content::RenderFrameHost* main_frame = tab->GetMainFrame();

	675 content::RenderFrameHost* extension_frame = ChildFrameAt(main_frame, 0);

	676

	677 // Open a new about:blank popup from main frame. This should stay in the web

	678 // process.

	679 content::WebContents* popup =

	680 OpenPopup(main_frame, GURL(url::kAboutBlankURL));

	681 EXPECT_NE(popup, tab);

	682 ASSERT_EQ(2, browser()->tab_strip_model()->count());

	683 EXPECT_EQ(IfExtensionsIsolated(1, 0),

	684 pm->GetRenderFrameHostsForExtension(extension->id()).size());

	685 EXPECT_EQ(IfExtensionsIsolated(1, 0), pm->GetAllFrames().size());

	686

	687 // Create valid blob and filesystem URLs in the extension's origin.

	688 url::Origin extension_origin(extension_frame->GetLastCommittedOrigin());

	689 GURL blob_url(CreateBlobURL(extension_frame, "foo"));

	690 EXPECT_EQ(extension_origin, url::Origin(blob_url));

	691 GURL filesystem_url(CreateFileSystemURL(extension_frame, "foo"));

	692 EXPECT_EQ(extension_origin, url::Origin(filesystem_url));

	693

	694 // Navigate the popup to each nested URL with extension origin.

	695 GURL nested_urls[] = {blob_url, filesystem_url};

	696 for (size_t i = 0; i < arraysize(nested_urls); i++) {

	697 content::TestNavigationObserver observer(popup);

	698 EXPECT_TRUE(ExecuteScript(

	699 popup, "location.href = '" + nested_urls[i].spec() + "';"));

	700 observer.Wait();

	701

	702 // This is a top-level navigation that should be blocked since it

	703 // originates from a non-extension process. Ensure that the error page

	704 // doesn't commit an extension URL or origin.

	705 EXPECT_NE(nested_urls[i], popup->GetLastCommittedURL());

	706 EXPECT_FALSE(extension_origin.IsSameOriginWith(

	707 popup->GetMainFrame()->GetLastCommittedOrigin()));

	708 EXPECT_NE("foo", GetTextContent(popup->GetMainFrame()));

	709

	710 EXPECT_EQ(IfExtensionsIsolated(1, 0),

	711 pm->GetRenderFrameHostsForExtension(extension->id()).size());

	712 EXPECT_EQ(IfExtensionsIsolated(1, 0), pm->GetAllFrames().size());

	713 }

	714

	715 // Navigate second subframe to each nested URL from the main frame (i.e.,

	716 // from non-extension process).

	717 //

	718 // TODO(alexmos): Currently, this is still allowed due to unblessed extension

	719 // contexts, but in the future such subframe navigations from non-extension

	720 // processes should be blocked when unblessed contexts go away with

	721 // --isolate-extensions.

	722 for (size_t i = 0; i < arraysize(nested_urls); i++) {

	723 EXPECT_TRUE(content::NavigateIframeToURL(tab, "frame2", nested_urls[i]));

	724 content::RenderFrameHost* second_frame = ChildFrameAt(main_frame, 1);

	725 EXPECT_EQ(nested_urls[i], second_frame->GetLastCommittedURL());

	726 EXPECT_EQ(extension_origin, second_frame->GetLastCommittedOrigin());

	727 EXPECT_EQ("foo", GetTextContent(second_frame));

	728 EXPECT_EQ(IfExtensionsIsolated(2, 0),

	729 pm->GetRenderFrameHostsForExtension(extension->id()).size());

	730 EXPECT_EQ(IfExtensionsIsolated(2, 0), pm->GetAllFrames().size());

	731 }

	732 }

	733

	734 // Test that navigations to blob: and filesystem: URLs with extension origins

	735 // are allowed when initiated from extension processes. See

	736 // https://crbug.com/645028 and https://crbug.com/644426.

	737 IN_PROC_BROWSER_TEST_F(ProcessManagerBrowserTest,

	738 NestedURLNavigationsToExtensionAllowed) {

	739 // Create a simple extension without a background page.

	740 const Extension* extension = CreateExtension("Extension", false);

	741 embedded_test_server()->ServeFilesFromDirectory(extension->path());

	742 ASSERT_TRUE(embedded_test_server()->Start());

	743

	744 // Navigate main tab to an extension URL with a blank subframe.

	745 const GURL extension_url(extension->url().Resolve("blank_iframe.html"));

	746 NavigateToURL(extension_url);

	747 ProcessManager* pm = ProcessManager::Get(profile());

	748 EXPECT_EQ(2u, pm->GetAllFrames().size());

	749 EXPECT_EQ(2u, pm->GetRenderFrameHostsForExtension(extension->id()).size());

	750

	751 content::WebContents* tab =

	752 browser()->tab_strip_model()->GetActiveWebContents();

	753 content::RenderFrameHost* main_frame = tab->GetMainFrame();

	754

	755 // Create blob and filesystem URLs in the extension's origin.

	756 url::Origin extension_origin(main_frame->GetLastCommittedOrigin());

	757 GURL blob_url(CreateBlobURL(main_frame, "foo"));

	758 EXPECT_EQ(extension_origin, url::Origin(blob_url));

	759 GURL filesystem_url(CreateFileSystemURL(main_frame, "foo"));

	760 EXPECT_EQ(extension_origin, url::Origin(filesystem_url));

	761

	762 // From the main frame, navigate its subframe to each nested URL. This

	763 // should be allowed and should stay in the extension process.

	764 GURL nested_urls[] = {blob_url, filesystem_url};

	765 for (size_t i = 0; i < arraysize(nested_urls); i++) {

	766 EXPECT_TRUE(content::NavigateIframeToURL(tab, "frame0", nested_urls[i]));

	767 content::RenderFrameHost* child = ChildFrameAt(main_frame, 0);

	768 EXPECT_EQ(nested_urls[i], child->GetLastCommittedURL());

	769 EXPECT_EQ(extension_origin, child->GetLastCommittedOrigin());

	770 EXPECT_EQ("foo", GetTextContent(child));

	771 EXPECT_EQ(2u, pm->GetRenderFrameHostsForExtension(extension->id()).size());

	772 EXPECT_EQ(2u, pm->GetAllFrames().size());

	773 }

	774

	775 // From the main frame, create a blank popup and navigate it to each nested

	776 // URL. This should also be allowed, since the navigation originated from an

	777 // extension process.

	778 for (size_t i = 0; i < arraysize(nested_urls); i++) {

	779 content::WebContents* popup =

	780 OpenPopup(main_frame, GURL(url::kAboutBlankURL));
	alexmos 2016/09/15 17:43:02 Unfortunately, I couldn't just pass the nested URL Unfortunately, I couldn't just pass the nested URL into window.open due to https://crbug.com/644966#c4.
	781 EXPECT_NE(popup, tab);

	782

	783 content::TestNavigationObserver observer(popup);

	784 EXPECT_TRUE(ExecuteScript(

	785 popup, "location.href = '" + nested_urls[i].spec() + "';"));

	786 observer.Wait();

	787

	788 EXPECT_EQ(nested_urls[i], popup->GetLastCommittedURL());

	789 EXPECT_EQ(extension_origin,

	790 popup->GetMainFrame()->GetLastCommittedOrigin());

	791 EXPECT_EQ("foo", GetTextContent(popup->GetMainFrame()));

	792

	793 EXPECT_EQ(3 + i,

	794 pm->GetRenderFrameHostsForExtension(extension->id()).size());

	795 EXPECT_EQ(3 + i, pm->GetAllFrames().size());

	796 }

	797 }

	798

578 } // namespace extensions	799 } // namespace extensions

OLD	NEW

« no previous file with comments | « no previous file | chrome/browser/net/chrome_extensions_network_delegate.cc » ('j') | chrome/browser/net/chrome_extensions_network_delegate.cc » ('J')