| OLD | NEW |
|---|
| 1 // Copyright 2013 The Chromium Authors. All rights reserved. | 1 // Copyright 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <stddef.h> | 5 #include <stddef.h> |
| 6 | 6 |
| 7 #include <memory> | 7 #include <memory> |
| 8 #include <utility> | 8 #include <utility> |
| 9 | 9 |
| 10 #include "base/callback.h" | 10 #include "base/callback.h" |
| 11 #include "base/macros.h" | 11 #include "base/macros.h" |
| 12 #include "base/run_loop.h" | 12 #include "base/run_loop.h" |
| 13 #include "chrome/browser/extensions/browser_action_test_util.h" | 13 #include "chrome/browser/extensions/browser_action_test_util.h" |
| 14 #include "chrome/browser/extensions/extension_browsertest.h" | 14 #include "chrome/browser/extensions/extension_browsertest.h" |
| 15 #include "chrome/browser/extensions/extension_service.h" | 15 #include "chrome/browser/extensions/extension_service.h" |
| 16 #include "chrome/browser/extensions/test_extension_dir.h" | 16 #include "chrome/browser/extensions/test_extension_dir.h" |
| 17 #include "chrome/browser/ui/tabs/tab_strip_model.h" | 17 #include "chrome/browser/ui/tabs/tab_strip_model.h" |
| 18 #include "chrome/common/extensions/extension_process_policy.h" | 18 #include "chrome/common/extensions/extension_process_policy.h" |
| 19 #include "chrome/common/pref_names.h" |
| 19 #include "chrome/test/base/in_process_browser_test.h" | 20 #include "chrome/test/base/in_process_browser_test.h" |
| 20 #include "chrome/test/base/ui_test_utils.h" | 21 #include "chrome/test/base/ui_test_utils.h" |
| 21 #include "content/public/browser/notification_service.h" | 22 #include "content/public/browser/notification_service.h" |
| 22 #include "content/public/browser/render_frame_host.h" | 23 #include "content/public/browser/render_frame_host.h" |
| 23 #include "content/public/browser/render_process_host.h" | 24 #include "content/public/browser/render_process_host.h" |
| 24 #include "content/public/browser/web_contents.h" | 25 #include "content/public/browser/web_contents.h" |
| 25 #include "content/public/test/browser_test_utils.h" | 26 #include "content/public/test/browser_test_utils.h" |
| 27 #include "content/public/test/test_navigation_observer.h" |
| 26 #include "content/public/test/test_utils.h" | 28 #include "content/public/test/test_utils.h" |
| 27 #include "extensions/browser/process_manager.h" | 29 #include "extensions/browser/process_manager.h" |
| 28 #include "extensions/common/value_builder.h" | 30 #include "extensions/common/value_builder.h" |
| 29 #include "extensions/test/background_page_watcher.h" | 31 #include "extensions/test/background_page_watcher.h" |
| 30 #include "net/dns/mock_host_resolver.h" | 32 #include "net/dns/mock_host_resolver.h" |
| 31 #include "net/test/embedded_test_server/embedded_test_server.h" | 33 #include "net/test/embedded_test_server/embedded_test_server.h" |
| 32 | 34 |
| 33 namespace extensions { | 35 namespace extensions { |
| 34 | 36 |
| 35 namespace { | 37 namespace { |
| 36 | 38 |
| 37 void AddFrameToSet(std::set<content::RenderFrameHost*>* frames, | 39 void AddFrameToSet(std::set<content::RenderFrameHost*>* frames, |
| 38 content::RenderFrameHost* rfh) { | 40 content::RenderFrameHost* rfh) { |
| 39 if (rfh->IsRenderFrameLive()) | 41 if (rfh->IsRenderFrameLive()) |
| 40 frames->insert(rfh); | 42 frames->insert(rfh); |
| 41 } | 43 } |
| 42 | 44 |
| 45 GURL CreateBlobURL(content::RenderFrameHost* frame, |
| 46 const std::string& content) { |
| 47 std::string blob_url_string; |
| 48 EXPECT_TRUE(ExecuteScriptAndExtractString( |
| 49 frame, |
| 50 "var blob = new Blob(['<html><body>" + content + "</body></html>'],\n" |
| 51 " {type: 'text/html'});\n" |
| 52 "domAutomationController.send(URL.createObjectURL(blob));\n", |
| 53 &blob_url_string)); |
| 54 GURL blob_url(blob_url_string); |
| 55 EXPECT_TRUE(blob_url.is_valid()); |
| 56 EXPECT_TRUE(blob_url.SchemeIsBlob()); |
| 57 return blob_url; |
| 58 } |
| 59 |
| 60 GURL CreateFileSystemURL(content::RenderFrameHost* frame, |
| 61 const std::string& content) { |
| 62 std::string filesystem_url_string; |
| 63 EXPECT_TRUE(ExecuteScriptAndExtractString( |
| 64 frame, |
| 65 "var blob = new Blob(['<html><body>" + content + "</body></html>'],\n" |
| 66 " {type: 'text/html'});\n" |
| 67 "window.webkitRequestFileSystem(TEMPORARY, blob.size, fs => {\n" |
| 68 " fs.root.getFile('foo.html', {create: true}, file => {\n" |
| 69 " file.createWriter(writer => {\n" |
| 70 " writer.write(blob);\n" |
| 71 " writer.onwriteend = () => {\n" |
| 72 " domAutomationController.send(file.toURL());\n" |
| 73 " }\n" |
| 74 " });\n" |
| 75 " });\n" |
| 76 "});\n", |
| 77 &filesystem_url_string)); |
| 78 GURL filesystem_url(filesystem_url_string); |
| 79 EXPECT_TRUE(filesystem_url.is_valid()); |
| 80 EXPECT_TRUE(filesystem_url.SchemeIsFileSystem()); |
| 81 return filesystem_url; |
| 82 } |
| 83 |
| 84 std::string GetTextContent(content::RenderFrameHost* frame) { |
| 85 std::string result; |
| 86 EXPECT_TRUE(ExecuteScriptAndExtractString( |
| 87 frame, "domAutomationController.send(document.body.innerText)", &result)); |
| 88 return result; |
| 89 } |
| 90 |
| 43 } // namespace | 91 } // namespace |
| 44 | 92 |
| 45 // Takes a snapshot of all frames upon construction. When Wait() is called, a | 93 // Takes a snapshot of all frames upon construction. When Wait() is called, a |
| 46 // MessageLoop is created and Quit when all previously recorded frames are | 94 // MessageLoop is created and Quit when all previously recorded frames are |
| 47 // either present in the tab, or deleted. If a navigation happens between the | 95 // either present in the tab, or deleted. If a navigation happens between the |
| 48 // construction and the Wait() call, then this logic ensures that all obsolete | 96 // construction and the Wait() call, then this logic ensures that all obsolete |
| 49 // RenderFrameHosts have been destructed when Wait() returns. | 97 // RenderFrameHosts have been destructed when Wait() returns. |
| 50 // See also the comment at ProcessManagerBrowserTest::NavigateToURL. | 98 // See also the comment at ProcessManagerBrowserTest::NavigateToURL. |
| 51 class NavigationCompletedObserver : public content::WebContentsObserver { | 99 class NavigationCompletedObserver : public content::WebContentsObserver { |
| 52 public: | 100 public: |
| (...skipping 104 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 157 observer.Wait(); | 205 observer.Wait(); |
| 158 } | 206 } |
| 159 | 207 |
| 160 size_t IfExtensionsIsolated(size_t if_enabled, size_t if_disabled) { | 208 size_t IfExtensionsIsolated(size_t if_enabled, size_t if_disabled) { |
| 161 return content::AreAllSitesIsolatedForTesting() || | 209 return content::AreAllSitesIsolatedForTesting() || |
| 162 IsIsolateExtensionsEnabled() | 210 IsIsolateExtensionsEnabled() |
| 163 ? if_enabled | 211 ? if_enabled |
| 164 : if_disabled; | 212 : if_disabled; |
| 165 } | 213 } |
| 166 | 214 |
| 215 content::WebContents* OpenPopup(content::RenderFrameHost* opener, |
| 216 const GURL& url) { |
| 217 content::WindowedNotificationObserver popup_observer( |
| 218 chrome::NOTIFICATION_TAB_ADDED, |
| 219 content::NotificationService::AllSources()); |
| 220 EXPECT_TRUE(ExecuteScript(opener, "window.open('" + url.spec() + "')")); |
| 221 popup_observer.Wait(); |
| 222 content::WebContents* popup = |
| 223 browser()->tab_strip_model()->GetActiveWebContents(); |
| 224 WaitForLoadStop(popup); |
| 225 EXPECT_EQ(url, popup->GetMainFrame()->GetLastCommittedURL()); |
| 226 return popup; |
| 227 } |
| 228 |
| 167 private: | 229 private: |
| 168 std::vector<std::unique_ptr<TestExtensionDir>> temp_dirs_; | 230 std::vector<std::unique_ptr<TestExtensionDir>> temp_dirs_; |
| 169 }; | 231 }; |
| 170 | 232 |
| 171 // Test that basic extension loading creates the appropriate ExtensionHosts | 233 // Test that basic extension loading creates the appropriate ExtensionHosts |
| 172 // and background pages. | 234 // and background pages. |
| 173 IN_PROC_BROWSER_TEST_F(ProcessManagerBrowserTest, | 235 IN_PROC_BROWSER_TEST_F(ProcessManagerBrowserTest, |
| 174 ExtensionHostCreation) { | 236 ExtensionHostCreation) { |
| 175 ProcessManager* pm = ProcessManager::Get(profile()); | 237 ProcessManager* pm = ProcessManager::Get(profile()); |
| 176 | 238 |
| (...skipping 391 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 568 ExecuteScriptInBackgroundPageNoWait( | 630 ExecuteScriptInBackgroundPageNoWait( |
| 569 extension->id(), | 631 extension->id(), |
| 570 "document.cookie = 'extension_cookie';" | 632 "document.cookie = 'extension_cookie';" |
| 571 "window.domAutomationController.send(document.cookie);"); | 633 "window.domAutomationController.send(document.cookie);"); |
| 572 std::string message; | 634 std::string message; |
| 573 ASSERT_TRUE(queue.WaitForMessage(&message)); | 635 ASSERT_TRUE(queue.WaitForMessage(&message)); |
| 574 EXPECT_EQ(message, "\"extension_cookie\""); | 636 EXPECT_EQ(message, "\"extension_cookie\""); |
| 575 } | 637 } |
| 576 } | 638 } |
| 577 | 639 |
| 640 // Test that navigations to blob: and filesystem: URLs with extension origins |
| 641 // are disallowed when initiated from non-extension processes. See |
| 642 // https://crbug.com/645028 and https://crbug.com/644426. |
| 643 IN_PROC_BROWSER_TEST_F(ProcessManagerBrowserTest, |
| 644 NestedURLNavigationsToExtensionBlocked) { |
| 645 // Disabling web security is necessary to test the browser enforcement; |
| 646 // without it, the loads in this test would be blocked by |
| 647 // SecurityOrigin::canDisplay() as invalid local resource loads. |
| 648 PrefService* prefs = browser()->profile()->GetPrefs(); |
| 649 prefs->SetBoolean(prefs::kWebKitWebSecurityEnabled, false); |
| 650 |
| 651 // Create a simple extension without a background page. |
| 652 const Extension* extension = CreateExtension("Extension", false); |
| 653 embedded_test_server()->ServeFilesFromDirectory(extension->path()); |
| 654 ASSERT_TRUE(embedded_test_server()->Start()); |
| 655 |
| 656 // Navigate main tab to a web page with two web iframes. There should be no |
| 657 // extension frames yet. |
| 658 NavigateToURL(embedded_test_server()->GetURL("/two_iframes.html")); |
| 659 ProcessManager* pm = ProcessManager::Get(profile()); |
| 660 EXPECT_EQ(0u, pm->GetAllFrames().size()); |
| 661 EXPECT_EQ(0u, pm->GetRenderFrameHostsForExtension(extension->id()).size()); |
| 662 |
| 663 content::WebContents* tab = |
| 664 browser()->tab_strip_model()->GetActiveWebContents(); |
| 665 |
| 666 // Navigate first subframe to an extension URL. With --isolate-extensions, |
| 667 // this will go into a new extension process. |
| 668 const GURL extension_url(extension->url().Resolve("empty.html")); |
| 669 EXPECT_TRUE(content::NavigateIframeToURL(tab, "frame1", extension_url)); |
| 670 EXPECT_EQ(IfExtensionsIsolated(1, 0), |
| 671 pm->GetRenderFrameHostsForExtension(extension->id()).size()); |
| 672 EXPECT_EQ(IfExtensionsIsolated(1, 0), pm->GetAllFrames().size()); |
| 673 |
| 674 content::RenderFrameHost* main_frame = tab->GetMainFrame(); |
| 675 content::RenderFrameHost* extension_frame = ChildFrameAt(main_frame, 0); |
| 676 |
| 677 // Open a new about:blank popup from main frame. This should stay in the web |
| 678 // process. |
| 679 content::WebContents* popup = |
| 680 OpenPopup(main_frame, GURL(url::kAboutBlankURL)); |
| 681 EXPECT_NE(popup, tab); |
| 682 ASSERT_EQ(2, browser()->tab_strip_model()->count()); |
| 683 EXPECT_EQ(IfExtensionsIsolated(1, 0), |
| 684 pm->GetRenderFrameHostsForExtension(extension->id()).size()); |
| 685 EXPECT_EQ(IfExtensionsIsolated(1, 0), pm->GetAllFrames().size()); |
| 686 |
| 687 // Create valid blob and filesystem URLs in the extension's origin. |
| 688 url::Origin extension_origin(extension_frame->GetLastCommittedOrigin()); |
| 689 GURL blob_url(CreateBlobURL(extension_frame, "foo")); |
| 690 EXPECT_EQ(extension_origin, url::Origin(blob_url)); |
| 691 GURL filesystem_url(CreateFileSystemURL(extension_frame, "foo")); |
| 692 EXPECT_EQ(extension_origin, url::Origin(filesystem_url)); |
| 693 |
| 694 // Navigate the popup to each nested URL with extension origin. |
| 695 GURL nested_urls[] = {blob_url, filesystem_url}; |
| 696 for (size_t i = 0; i < arraysize(nested_urls); i++) { |
| 697 content::TestNavigationObserver observer(popup); |
| 698 EXPECT_TRUE(ExecuteScript( |
| 699 popup, "location.href = '" + nested_urls[i].spec() + "';")); |
| 700 observer.Wait(); |
| 701 |
| 702 // This is a top-level navigation that should be blocked since it |
| 703 // originates from a non-extension process. Ensure that the error page |
| 704 // doesn't commit an extension URL or origin. |
| 705 EXPECT_NE(nested_urls[i], popup->GetLastCommittedURL()); |
| 706 EXPECT_FALSE(extension_origin.IsSameOriginWith( |
| 707 popup->GetMainFrame()->GetLastCommittedOrigin())); |
| 708 EXPECT_NE("foo", GetTextContent(popup->GetMainFrame())); |
| 709 |
| 710 EXPECT_EQ(IfExtensionsIsolated(1, 0), |
| 711 pm->GetRenderFrameHostsForExtension(extension->id()).size()); |
| 712 EXPECT_EQ(IfExtensionsIsolated(1, 0), pm->GetAllFrames().size()); |
| 713 } |
| 714 |
| 715 // Navigate second subframe to each nested URL from the main frame (i.e., |
| 716 // from non-extension process). |
| 717 // |
| 718 // TODO(alexmos): Currently, this is still allowed due to unblessed extension |
| 719 // contexts, but in the future such subframe navigations from non-extension |
| 720 // processes should be blocked when unblessed contexts go away with |
| 721 // --isolate-extensions. |
| 722 for (size_t i = 0; i < arraysize(nested_urls); i++) { |
| 723 EXPECT_TRUE(content::NavigateIframeToURL(tab, "frame2", nested_urls[i])); |
| 724 content::RenderFrameHost* second_frame = ChildFrameAt(main_frame, 1); |
| 725 EXPECT_EQ(nested_urls[i], second_frame->GetLastCommittedURL()); |
| 726 EXPECT_EQ(extension_origin, second_frame->GetLastCommittedOrigin()); |
| 727 EXPECT_EQ("foo", GetTextContent(second_frame)); |
| 728 EXPECT_EQ(IfExtensionsIsolated(2, 0), |
| 729 pm->GetRenderFrameHostsForExtension(extension->id()).size()); |
| 730 EXPECT_EQ(IfExtensionsIsolated(2, 0), pm->GetAllFrames().size()); |
| 731 } |
| 732 } |
| 733 |
| 734 // Test that navigations to blob: and filesystem: URLs with extension origins |
| 735 // are allowed when initiated from extension processes. See |
| 736 // https://crbug.com/645028 and https://crbug.com/644426. |
| 737 IN_PROC_BROWSER_TEST_F(ProcessManagerBrowserTest, |
| 738 NestedURLNavigationsToExtensionAllowed) { |
| 739 // Create a simple extension without a background page. |
| 740 const Extension* extension = CreateExtension("Extension", false); |
| 741 embedded_test_server()->ServeFilesFromDirectory(extension->path()); |
| 742 ASSERT_TRUE(embedded_test_server()->Start()); |
| 743 |
| 744 // Navigate main tab to an extension URL with a blank subframe. |
| 745 const GURL extension_url(extension->url().Resolve("blank_iframe.html")); |
| 746 NavigateToURL(extension_url); |
| 747 ProcessManager* pm = ProcessManager::Get(profile()); |
| 748 EXPECT_EQ(2u, pm->GetAllFrames().size()); |
| 749 EXPECT_EQ(2u, pm->GetRenderFrameHostsForExtension(extension->id()).size()); |
| 750 |
| 751 content::WebContents* tab = |
| 752 browser()->tab_strip_model()->GetActiveWebContents(); |
| 753 content::RenderFrameHost* main_frame = tab->GetMainFrame(); |
| 754 |
| 755 // Create blob and filesystem URLs in the extension's origin. |
| 756 url::Origin extension_origin(main_frame->GetLastCommittedOrigin()); |
| 757 GURL blob_url(CreateBlobURL(main_frame, "foo")); |
| 758 EXPECT_EQ(extension_origin, url::Origin(blob_url)); |
| 759 GURL filesystem_url(CreateFileSystemURL(main_frame, "foo")); |
| 760 EXPECT_EQ(extension_origin, url::Origin(filesystem_url)); |
| 761 |
| 762 // From the main frame, navigate its subframe to each nested URL. This |
| 763 // should be allowed and should stay in the extension process. |
| 764 GURL nested_urls[] = {blob_url, filesystem_url}; |
| 765 for (size_t i = 0; i < arraysize(nested_urls); i++) { |
| 766 EXPECT_TRUE(content::NavigateIframeToURL(tab, "frame0", nested_urls[i])); |
| 767 content::RenderFrameHost* child = ChildFrameAt(main_frame, 0); |
| 768 EXPECT_EQ(nested_urls[i], child->GetLastCommittedURL()); |
| 769 EXPECT_EQ(extension_origin, child->GetLastCommittedOrigin()); |
| 770 EXPECT_EQ("foo", GetTextContent(child)); |
| 771 EXPECT_EQ(2u, pm->GetRenderFrameHostsForExtension(extension->id()).size()); |
| 772 EXPECT_EQ(2u, pm->GetAllFrames().size()); |
| 773 } |
| 774 |
| 775 // From the main frame, create a blank popup and navigate it to each nested |
| 776 // URL. This should also be allowed, since the navigation originated from an |
| 777 // extension process. |
| 778 for (size_t i = 0; i < arraysize(nested_urls); i++) { |
| 779 content::WebContents* popup = |
| 780 OpenPopup(main_frame, GURL(url::kAboutBlankURL)); |
| 781 EXPECT_NE(popup, tab); |
| 782 |
| 783 content::TestNavigationObserver observer(popup); |
| 784 EXPECT_TRUE(ExecuteScript( |
| 785 popup, "location.href = '" + nested_urls[i].spec() + "';")); |
| 786 observer.Wait(); |
| 787 |
| 788 EXPECT_EQ(nested_urls[i], popup->GetLastCommittedURL()); |
| 789 EXPECT_EQ(extension_origin, |
| 790 popup->GetMainFrame()->GetLastCommittedOrigin()); |
| 791 EXPECT_EQ("foo", GetTextContent(popup->GetMainFrame())); |
| 792 |
| 793 EXPECT_EQ(3 + i, |
| 794 pm->GetRenderFrameHostsForExtension(extension->id()).size()); |
| 795 EXPECT_EQ(3 + i, pm->GetAllFrames().size()); |
| 796 } |
| 797 } |
| 798 |
| 578 } // namespace extensions | 799 } // namespace extensions |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 2345473003:
Block top-level navigations to nested URLs with extension origins from non-extension processes. (Closed)
