Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(60)

Side by Side Diff: content/browser/security_exploit_browsertest.cc

Issue 2353003004: Move ViewHostMsg_CreateWindow to mojom (Closed)
Patch Set: . Created 4 years, 2 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
OLDNEW
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include <stdint.h> 5 #include <stdint.h>
6 6
7 #include "base/command_line.h" 7 #include "base/command_line.h"
8 #include "base/containers/hash_tables.h" 8 #include "base/containers/hash_tables.h"
9 #include "base/macros.h" 9 #include "base/macros.h"
10 #include "base/strings/utf_string_conversions.h" 10 #include "base/strings/utf_string_conversions.h"
11 #include "build/build_config.h" 11 #include "build/build_config.h"
12 #include "content/browser/bad_message.h" 12 #include "content/browser/bad_message.h"
13 #include "content/browser/dom_storage/dom_storage_context_wrapper.h" 13 #include "content/browser/dom_storage/dom_storage_context_wrapper.h"
14 #include "content/browser/dom_storage/session_storage_namespace_impl.h" 14 #include "content/browser/dom_storage/session_storage_namespace_impl.h"
15 #include "content/browser/frame_host/navigator.h" 15 #include "content/browser/frame_host/navigator.h"
16 #include "content/browser/frame_host/render_frame_host_impl.h" 16 #include "content/browser/frame_host/render_frame_host_impl.h"
17 #include "content/browser/renderer_host/render_view_host_factory.h" 17 #include "content/browser/renderer_host/render_view_host_factory.h"
18 #include "content/browser/renderer_host/render_view_host_impl.h" 18 #include "content/browser/renderer_host/render_view_host_impl.h"
19 #include "content/browser/web_contents/web_contents_impl.h" 19 #include "content/browser/web_contents/web_contents_impl.h"
20 #include "content/common/frame_messages.h" 20 #include "content/common/frame_messages.h"
21 #include "content/common/render_message_filter.mojom.h"
21 #include "content/common/resource_messages.h" 22 #include "content/common/resource_messages.h"
22 #include "content/common/resource_request.h" 23 #include "content/common/resource_request.h"
23 #include "content/common/view_messages.h" 24 #include "content/common/view_messages.h"
24 #include "content/public/browser/browser_context.h" 25 #include "content/public/browser/browser_context.h"
25 #include "content/public/browser/content_browser_client.h" 26 #include "content/public/browser/content_browser_client.h"
26 #include "content/public/browser/interstitial_page.h" 27 #include "content/public/browser/interstitial_page.h"
27 #include "content/public/browser/interstitial_page_delegate.h" 28 #include "content/public/browser/interstitial_page_delegate.h"
28 #include "content/public/browser/resource_context.h" 29 #include "content/public/browser/resource_context.h"
29 #include "content/public/browser/resource_dispatcher_host.h" 30 #include "content/public/browser/resource_dispatcher_host.h"
30 #include "content/public/browser/storage_partition.h" 31 #include "content/public/browser/storage_partition.h"
(...skipping 221 matching lines...) Expand 10 before | Expand all | Expand 10 after
252 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, 253 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
253 AttemptDuplicateRenderViewHost) { 254 AttemptDuplicateRenderViewHost) {
254 int32_t duplicate_routing_id = MSG_ROUTING_NONE; 255 int32_t duplicate_routing_id = MSG_ROUTING_NONE;
255 RenderViewHostImpl* pending_rvh = 256 RenderViewHostImpl* pending_rvh =
256 PrepareToDuplicateHosts(shell(), &duplicate_routing_id); 257 PrepareToDuplicateHosts(shell(), &duplicate_routing_id);
257 EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id); 258 EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id);
258 259
259 // Since this test executes on the UI thread and hopping threads might cause 260 // Since this test executes on the UI thread and hopping threads might cause
260 // different timing in the test, let's simulate a CreateNewWindow call coming 261 // different timing in the test, let's simulate a CreateNewWindow call coming
261 // from the IO thread. 262 // from the IO thread.
262 ViewHostMsg_CreateWindow_Params params;
263 DOMStorageContextWrapper* dom_storage_context = 263 DOMStorageContextWrapper* dom_storage_context =
264 static_cast<DOMStorageContextWrapper*>( 264 static_cast<DOMStorageContextWrapper*>(
265 BrowserContext::GetStoragePartition( 265 BrowserContext::GetStoragePartition(
266 shell()->web_contents()->GetBrowserContext(), 266 shell()->web_contents()->GetBrowserContext(),
267 pending_rvh->GetSiteInstance())->GetDOMStorageContext()); 267 pending_rvh->GetSiteInstance())->GetDOMStorageContext());
268 scoped_refptr<SessionStorageNamespaceImpl> session_storage( 268 scoped_refptr<SessionStorageNamespaceImpl> session_storage(
269 new SessionStorageNamespaceImpl(dom_storage_context)); 269 new SessionStorageNamespaceImpl(dom_storage_context));
270 // Cause a deliberate collision in routing ids. 270 // Cause a deliberate collision in routing ids.
271 int32_t main_frame_routing_id = duplicate_routing_id + 1; 271 int32_t main_frame_routing_id = duplicate_routing_id + 1;
272 // TODO(avi): This should be made unique from the view routing ID once 272 // TODO(avi): This should be made unique from the view routing ID once
273 // RenderViewHostImpl has-a RenderWidgetHostImpl. https://crbug.com/545684 273 // RenderViewHostImpl has-a RenderWidgetHostImpl. https://crbug.com/545684
274 int32_t main_frame_widget_routing_id = duplicate_routing_id; 274 int32_t main_frame_widget_routing_id = duplicate_routing_id;
275 pending_rvh->CreateNewWindow(duplicate_routing_id, main_frame_routing_id, 275 pending_rvh->CreateNewWindow(duplicate_routing_id, main_frame_routing_id,
276 main_frame_widget_routing_id, params, 276 main_frame_widget_routing_id,
277 mojom::CreateWindowParams(),
277 session_storage.get()); 278 session_storage.get());
278 279
279 // If the above operation doesn't cause a crash, the test has succeeded! 280 // If the above operation doesn't cause a crash, the test has succeeded!
280 } 281 }
281 282
282 // This is a test for crbug.com/312016. It tries to create two RenderWidgetHosts 283 // This is a test for crbug.com/312016. It tries to create two RenderWidgetHosts
283 // with the same process and routing ids, which causes a collision. It is almost 284 // with the same process and routing ids, which causes a collision. It is almost
284 // identical to the AttemptDuplicateRenderViewHost test case. 285 // identical to the AttemptDuplicateRenderViewHost test case.
285 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, 286 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
286 AttemptDuplicateRenderWidgetHost) { 287 AttemptDuplicateRenderWidgetHost) {
(...skipping 264 matching lines...) Expand 10 before | Expand all | Expand 10 after
551 // separate task of the message loop, so ensure that the process is still 552 // separate task of the message loop, so ensure that the process is still
552 // considered alive. 553 // considered alive.
553 EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection()); 554 EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection());
554 555
555 exit_observer.Wait(); 556 exit_observer.Wait();
556 EXPECT_FALSE(exit_observer.did_exit_normally()); 557 EXPECT_FALSE(exit_observer.did_exit_normally());
557 ResourceDispatcherHost::Get()->SetDelegate(nullptr); 558 ResourceDispatcherHost::Get()->SetDelegate(nullptr);
558 } 559 }
559 560
560 } // namespace content 561 } // namespace content
OLDNEW
« no previous file with comments | « content/browser/renderer_host/render_widget_helper.cc ('k') | content/browser/web_contents/web_contents_impl.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698