NoState Prefetch: CSP test

chrome/browser/prerender/prerender_nostate_prefetch_browsertest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/command_line.h"
 #include "base/strings/string16.h"
 #include "base/strings/string_split.h"
 #include "base/task_scheduler/post_task.h"
 #include "base/threading/platform_thread.h"  // For |Sleep()|.
 #include "chrome/browser/prerender/prerender_manager.h"
@@ skipping 59 matching lines @@
 }  // namespace
 
 namespace prerender {
 
 // These URLs used for test resources must be relative with the exception of
 // |PrefetchLoaderPath|, which is only used in |PrerenderTestURLImpl()|.
 const char kPrefetchImagePage[] = "prerender/prefetch_image.html";
 const char kPrefetchJpeg[] = "prerender/image.jpeg";
 const char kPrefetchLoaderPath[] = "/prerender/prefetch_loader.html";
 const char kPrefetchLoopPage[] = "prerender/prefetch_loop.html";
+const char kPrefetchMetaCSP[] = "prerender/prefetch_meta_csp.html";
 const char kPrefetchPage[] = "prerender/prefetch_page.html";
 const char kPrefetchPage2[] = "prerender/prefetch_page2.html";
 const char kPrefetchPng[] = "prerender/image.png";
+const char kPrefetchResponseHeaderCSP[] =
+    "prerender/prefetch_response_csp.html";
 const char kPrefetchScript[] = "prerender/prefetch.js";
 const char kPrefetchScript2[] = "prerender/prefetch2.js";
 const char kPrefetchSubresourceRedirectPage[] =
     "prerender/prefetch_subresource_redirect.html";
 
 const char kPageBool[] = "pageBool";
 const char kScriptBool[] = "scriptBool";
 
 class NoStatePrefetchBrowserTest
     : public test_utils::PrerenderInProcessBrowserTest {
@@ skipping 48 matching lines @@
     GetPrerenderManager()->SetTimeOverride(std::move(test_time));
   }
 
   // Set up a request counter for |path|, which is also the location of the data
   // served by the request.
   void CountRequestFor(const std::string& path_str, RequestCounter* counter) {
     url::StringPieceReplacements<base::FilePath::StringType> replacement;
     base::FilePath file_path = base::FilePath::FromUTF8Unsafe(path_str);
     replacement.SetPathStr(file_path.value());
     const GURL url = src_server()->base_url().ReplaceComponents(replacement);
-    CountRequestFor(url, path_str, counter);
+    CountRequestForUrl(url, path_str, counter);
   }
 
   // As above, but specify the data path and URL separately.
-  void CountRequestFor(const GURL& url,
-                       const std::string& path_str,
-                       RequestCounter* counter) {
+  void CountRequestForUrl(const GURL& url,
+                          const std::string& path_str,
+                          RequestCounter* counter) {
     base::FilePath url_file = ui_test_utils::GetTestFilePath(
         base::FilePath(), base::FilePath::FromUTF8Unsafe(path_str));
     content::BrowserThread::PostTask(
         content::BrowserThread::IO, FROM_HERE,
         base::Bind(&CreateCountingInterceptorOnIO, url, url_file,
                    counter->AsWeakPtr()));
   }
 
   BrowserTestTime* GetTimeOverride() const { return browser_test_time_; }
 
@@ skipping 97 matching lines @@
 }
 
 // Checks that a cross-domain prefetching works correctly.
 IN_PROC_BROWSER_TEST_F(NoStatePrefetchBrowserTest, PrefetchCrossDomain) {
   static const std::string secondary_domain = "www.foo.com";
   host_resolver()->AddRule(secondary_domain, "127.0.0.1");
   GURL cross_domain_url(base::StringPrintf(
       "http://%s:%d/%s", secondary_domain.c_str(),
       embedded_test_server()->host_port_pair().port(), kPrefetchPage));
   RequestCounter cross_domain_counter;
-  CountRequestFor(cross_domain_url, kPrefetchPage, &cross_domain_counter);
+  CountRequestForUrl(cross_domain_url, kPrefetchPage, &cross_domain_counter);
   PrerenderTestURL(cross_domain_url, FINAL_STATUS_APP_TERMINATING, 1);
   cross_domain_counter.WaitForCount(1);
 }
 
+// Checks that response header CSP is respected.
+IN_PROC_BROWSER_TEST_F(NoStatePrefetchBrowserTest, ResponseHeaderCSP) {
+  static const std::string secondary_domain = "foo.bar";
+  host_resolver()->AddRule(secondary_domain, "127.0.0.1");
+  RequestCounter main_page;
+  CountRequestFor(kPrefetchResponseHeaderCSP, &main_page);
+  RequestCounter first_script;
+  CountRequestFor(kPrefetchScript, &first_script);
+  RequestCounter second_script;
+  GURL second_script_url(std::string("http://foo.bar/") + kPrefetchScript2);
+  CountRequestForUrl(second_script_url, kPrefetchScript2, &second_script);
+  PrerenderTestURL(kPrefetchResponseHeaderCSP, FINAL_STATUS_APP_TERMINATING, 1);
+  // The second script is in the correct domain for CSP, but the first script is
+  // not.
+  main_page.WaitForCount(1);
+  second_script.WaitForCount(1);
+  // TODO(pasko): wait for prefetch to be finished before checking the counts.
+  first_script.WaitForCount(0);
+}
+
+// Checks that CSP in the meta tag cancels the prefetch.
+// TODO(mattcary): probably this behavior should be consistent with
+// response-header CSP. See crbug/XXX.

[pasko, 2016/10/17 11:23:18]

nit: please substitute the XXX appropriately

[mattcary, 2016/10/17 11:32:08]

Oops, bug created and this comment updated, thanks.

[pasko, 2016/10/17 11:39:26]

.. and uploaded?

+IN_PROC_BROWSER_TEST_F(NoStatePrefetchBrowserTest, MetaTagCSP) {
+  static const std::string secondary_domain = "foo.bar";
+  host_resolver()->AddRule(secondary_domain, "127.0.0.1");
+  RequestCounter main_page;
+  CountRequestFor(kPrefetchMetaCSP, &main_page);
+  RequestCounter first_script;
+  CountRequestFor(kPrefetchScript, &first_script);
+  RequestCounter second_script;
+  GURL second_script_url(std::string("http://foo.bar/") + kPrefetchScript2);
+  CountRequestForUrl(second_script_url, kPrefetchScript2, &second_script);
+  PrerenderTestURL(kPrefetchMetaCSP, FINAL_STATUS_APP_TERMINATING, 1);
+  // TODO(mattcary): See test comment above. If the meta CSP tag were parsed,
+  // |second_script| would be loaded. Instead as the background scanner bails as
+  // soon as the meta CSP tag is seen, only |main_page| is fetched.
+  main_page.WaitForCount(1);
+  // TODO(pasko): wait for prefetch to be finished before checking the counts.
+  second_script.WaitForCount(0);
+  first_script.WaitForCount(0);
+}
+
 // Checks simultaneous prefetch.
 IN_PROC_BROWSER_TEST_F(NoStatePrefetchBrowserTest, PrefetchSimultaneous) {
   RequestCounter first_main_counter;
   CountRequestFor(kPrefetchPage, &first_main_counter);
   RequestCounter second_main_counter;
   CountRequestFor(kPrefetchPage2, &second_main_counter);
   RequestCounter first_script_counter;
   CountRequestFor(kPrefetchScript, &first_script_counter);
   RequestCounter second_script_counter;
   CountRequestFor(kPrefetchScript2, &second_script_counter);
@@ skipping 197 matching lines @@
   // special way.
   // TODO(mattcary): since the prerender will count itself as loaded even if the
   // fetch of the main resource fails, the test doesn't actually confirm what we
   // want it to confirm. This may be fixed by planned changes to the prerender
   // lifecycle.
   std::unique_ptr<TestPrerender> prerender =
       PrerenderTestURL(kPrefetchPage, FINAL_STATUS_SAFE_BROWSING, 1);
 }
 
 }  // namespace prerender