NoState Prefetch: CSP test

chrome/browser/prerender/prerender_nostate_prefetch_test.cc

Index: chrome/browser/prerender/prerender_nostate_prefetch_test.cc
diff --git a/chrome/browser/prerender/prerender_nostate_prefetch_test.cc b/chrome/browser/prerender/prerender_nostate_prefetch_test.cc
index 610b7752392778e235ec7d6c695fdc91e56fdf44..0ffce022cf5718c7963c53de07f17533130c1cdd 100644
--- a/chrome/browser/prerender/prerender_nostate_prefetch_test.cc
+++ b/chrome/browser/prerender/prerender_nostate_prefetch_test.cc
@@ -40,9 +40,12 @@ const char kPrefetchImagePage[] = "prerender/prefetch_image.html";
 const char kPrefetchLoopPage[] = "prerender/prefetch_loop.html";
 const char kPrefetchJpeg[] = "prerender/image.jpeg";
 const char kPrefetchLoaderPath[] = "/prerender/prefetch_loader.html";
+const char kPrefetchMetaCSP[] = "prerender/prefetch_meta_csp.html";

[pasko, 2016/10/05 14:09:55]

I liked how you sorted these before, what made you undo it?

[mattcary, 2016/10/12 15:09:10]

There may be a merge thing here: the names are sorted alphabetically, and I
(hopefully) maintained that.

[pasko, 2016/10/12 15:48:55]

kPrefetchLoopPage[] looks misordered ..

[mattcary, 2016/10/13 08:44:27]

Gah, thanks. Rebasing is hard.

 const char kPrefetchPage[] = "prerender/prefetch_page.html";
 const char kPrefetchPage2[] = "prerender/prefetch_page2.html";
 const char kPrefetchPng[] = "prerender/image.png";
+const char kPrefetchResponseHeaderCSP[] =
+    "prerender/prefetch_response_csp.html";
 const char kPrefetchScript[] = "prerender/prefetch.js";
 const char kPrefetchScript2[] = "prerender/prefetch2.js";
 const char kPrefetchSubresourceRedirectPage[] =
@@ -62,11 +65,19 @@ class NoStatePrefetchBrowserTest
         switches::kPrerenderMode, switches::kPrerenderModeSwitchValuePrefetch);
   }
 
-  // Set up a request counter for the path.
+  // Set up a request counter for a path. The url used will be derived from
+  // |path|, which also provides that data served.
   void CountRequestFor(const std::string& path, RequestCounter* counter) {
     GURL::Replacements replacement;
     replacement.SetPathStr(path);
     const GURL url = src_server()->base_url().ReplaceComponents(replacement);
+    CountRequestForUrl(url, path, counter);
+  }
+
+  // Set up a request counter for a specific URL, serving data from |path|.
+  void CountRequestForUrl(const GURL& url,
+                       const std::string& path,
+                       RequestCounter* counter) {
     base::FilePath url_file =
         ui_test_utils::GetTestFilePath(base::FilePath(), base::FilePath(path));
     content::BrowserThread::PostTask(
@@ -253,6 +264,48 @@ IN_PROC_BROWSER_TEST_F(NoStatePrefetchBrowserTest, PrefetchCrossDomain) {
       "Prerender.webcross_PrerenderNotSwappedInPLT", 1);
 }
 
+// Check that response header CSP is handled correctly.

[pasko, 2016/10/05 14:09:55]

Preferable: s/is handled correctly/prevents fetching a script from disallowed
domain/.

[mattcary, 2016/10/12 15:09:10]

Done.

+IN_PROC_BROWSER_TEST_F(NoStatePrefetchBrowserTest, ResponseHeaderCSP) {
+  static const std::string secondary_domain = "foo.bar";
+  host_resolver()->AddRule(secondary_domain, "127.0.0.1");
+  RequestCounter main_page;
+  CountRequestFor(kPrefetchResponseHeaderCSP, &main_page);
+  RequestCounter first_script;
+  CountRequestFor(kPrefetchScript, &first_script);
+  RequestCounter second_script;
+  GURL second_script_url(std::string("http://foo.bar/") + kPrefetchScript2);
+  CountRequestForUrl(second_script_url, kPrefetchScript2, &second_script);
+  PrerenderTestURL(kPrefetchResponseHeaderCSP, FINAL_STATUS_APP_TERMINATING, 1);
+  // The second script is in the correct domain for CSP, but the first script is
+  // not.
+  main_page.WaitForCount(1);
+  second_script.WaitForCount(1);
+  first_script.WaitForCount(0);
+}
+
+// Check CSP in the meta tag cancels the prefetch.
+
+// TODO(mattcary): probably this behavior should be consistent with
+// response-header CSP. See crbug/XXX.
+IN_PROC_BROWSER_TEST_F(NoStatePrefetchBrowserTest, MetaTagCSP) {
+  static const std::string secondary_domain = "foo.bar";
+  host_resolver()->AddRule(secondary_domain, "127.0.0.1");
+  RequestCounter main_page;
+  CountRequestFor(kPrefetchMetaCSP, &main_page);
+  RequestCounter first_script;
+  CountRequestFor(kPrefetchScript, &first_script);
+  RequestCounter second_script;
+  GURL second_script_url(std::string("http://foo.bar/") + kPrefetchScript2);
+  CountRequestForUrl(second_script_url, kPrefetchScript2, &second_script);
+  PrerenderTestURL(kPrefetchMetaCSP, FINAL_STATUS_APP_TERMINATING, 1);
+  // TODO(mattcary): See test comment above. If the meta CSP tag were parsed,
+  // |second_script| would be loaded. Instead as the background scanner bails as
+  // soon as the meta CSP tag is seen, only |main_page| is fetched.
+  main_page.WaitForCount(1);
+  second_script.WaitForCount(0);
+  first_script.WaitForCount(0);
+}
+
 // Check that we support simultaneous prefetch.
 IN_PROC_BROWSER_TEST_F(NoStatePrefetchBrowserTest, PrefetchSimultaneous) {
   RequestCounter first_main_counter;