| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include <stdint.h> | 5 #include <stdint.h> |
| 6 | 6 |
| 7 #include "base/command_line.h" | 7 #include "base/command_line.h" |
| 8 #include "base/containers/hash_tables.h" | 8 #include "base/containers/hash_tables.h" |
| 9 #include "base/macros.h" | 9 #include "base/macros.h" |
| 10 #include "base/strings/utf_string_conversions.h" | 10 #include "base/strings/utf_string_conversions.h" |
| 11 #include "build/build_config.h" | 11 #include "build/build_config.h" |
| 12 #include "content/browser/bad_message.h" | 12 #include "content/browser/bad_message.h" |
| 13 #include "content/browser/dom_storage/dom_storage_context_wrapper.h" | 13 #include "content/browser/dom_storage/dom_storage_context_wrapper.h" |
| 14 #include "content/browser/dom_storage/session_storage_namespace_impl.h" | 14 #include "content/browser/dom_storage/session_storage_namespace_impl.h" |
| 15 #include "content/browser/frame_host/navigator.h" | 15 #include "content/browser/frame_host/navigator.h" |
| 16 #include "content/browser/frame_host/render_frame_host_impl.h" | 16 #include "content/browser/frame_host/render_frame_host_impl.h" |
| 17 #include "content/browser/renderer_host/render_view_host_factory.h" | 17 #include "content/browser/renderer_host/render_view_host_factory.h" |
| 18 #include "content/browser/renderer_host/render_view_host_impl.h" | 18 #include "content/browser/renderer_host/render_view_host_impl.h" |
| 19 #include "content/browser/web_contents/web_contents_impl.h" | 19 #include "content/browser/web_contents/web_contents_impl.h" |
| 20 #include "content/common/frame_messages.h" | 20 #include "content/common/frame_messages.h" |
| 21 #include "content/common/render_message_filter.mojom.h" |
| 21 #include "content/common/resource_messages.h" | 22 #include "content/common/resource_messages.h" |
| 22 #include "content/common/resource_request.h" | 23 #include "content/common/resource_request.h" |
| 23 #include "content/common/view_messages.h" | 24 #include "content/common/view_messages.h" |
| 24 #include "content/public/browser/browser_context.h" | 25 #include "content/public/browser/browser_context.h" |
| 25 #include "content/public/browser/content_browser_client.h" | 26 #include "content/public/browser/content_browser_client.h" |
| 26 #include "content/public/browser/interstitial_page.h" | 27 #include "content/public/browser/interstitial_page.h" |
| 27 #include "content/public/browser/interstitial_page_delegate.h" | 28 #include "content/public/browser/interstitial_page_delegate.h" |
| 28 #include "content/public/browser/resource_context.h" | 29 #include "content/public/browser/resource_context.h" |
| 29 #include "content/public/browser/resource_dispatcher_host.h" | 30 #include "content/public/browser/resource_dispatcher_host.h" |
| 30 #include "content/public/browser/storage_partition.h" | 31 #include "content/public/browser/storage_partition.h" |
| (...skipping 221 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 252 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, | 253 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, |
| 253 AttemptDuplicateRenderViewHost) { | 254 AttemptDuplicateRenderViewHost) { |
| 254 int32_t duplicate_routing_id = MSG_ROUTING_NONE; | 255 int32_t duplicate_routing_id = MSG_ROUTING_NONE; |
| 255 RenderViewHostImpl* pending_rvh = | 256 RenderViewHostImpl* pending_rvh = |
| 256 PrepareToDuplicateHosts(shell(), &duplicate_routing_id); | 257 PrepareToDuplicateHosts(shell(), &duplicate_routing_id); |
| 257 EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id); | 258 EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id); |
| 258 | 259 |
| 259 // Since this test executes on the UI thread and hopping threads might cause | 260 // Since this test executes on the UI thread and hopping threads might cause |
| 260 // different timing in the test, let's simulate a CreateNewWindow call coming | 261 // different timing in the test, let's simulate a CreateNewWindow call coming |
| 261 // from the IO thread. | 262 // from the IO thread. |
| 262 ViewHostMsg_CreateWindow_Params params; | |
| 263 DOMStorageContextWrapper* dom_storage_context = | 263 DOMStorageContextWrapper* dom_storage_context = |
| 264 static_cast<DOMStorageContextWrapper*>( | 264 static_cast<DOMStorageContextWrapper*>( |
| 265 BrowserContext::GetStoragePartition( | 265 BrowserContext::GetStoragePartition( |
| 266 shell()->web_contents()->GetBrowserContext(), | 266 shell()->web_contents()->GetBrowserContext(), |
| 267 pending_rvh->GetSiteInstance())->GetDOMStorageContext()); | 267 pending_rvh->GetSiteInstance())->GetDOMStorageContext()); |
| 268 scoped_refptr<SessionStorageNamespaceImpl> session_storage( | 268 scoped_refptr<SessionStorageNamespaceImpl> session_storage( |
| 269 new SessionStorageNamespaceImpl(dom_storage_context)); | 269 new SessionStorageNamespaceImpl(dom_storage_context)); |
| 270 // Cause a deliberate collision in routing ids. | 270 // Cause a deliberate collision in routing ids. |
| 271 int32_t main_frame_routing_id = duplicate_routing_id + 1; | 271 int32_t main_frame_routing_id = duplicate_routing_id + 1; |
| 272 // TODO(avi): This should be made unique from the view routing ID once | 272 // TODO(avi): This should be made unique from the view routing ID once |
| 273 // RenderViewHostImpl has-a RenderWidgetHostImpl. https://crbug.com/545684 | 273 // RenderViewHostImpl has-a RenderWidgetHostImpl. https://crbug.com/545684 |
| 274 int32_t main_frame_widget_routing_id = duplicate_routing_id; | 274 int32_t main_frame_widget_routing_id = duplicate_routing_id; |
| 275 pending_rvh->CreateNewWindow(duplicate_routing_id, main_frame_routing_id, | 275 pending_rvh->CreateNewWindow(duplicate_routing_id, main_frame_routing_id, |
| 276 main_frame_widget_routing_id, params, | 276 main_frame_widget_routing_id, |
| 277 mojom::CreateNewWindowParams(), |
| 277 session_storage.get()); | 278 session_storage.get()); |
| 278 | 279 |
| 279 // If the above operation doesn't cause a crash, the test has succeeded! | 280 // If the above operation doesn't cause a crash, the test has succeeded! |
| 280 } | 281 } |
| 281 | 282 |
| 282 // This is a test for crbug.com/312016. It tries to create two RenderWidgetHosts | 283 // This is a test for crbug.com/312016. It tries to create two RenderWidgetHosts |
| 283 // with the same process and routing ids, which causes a collision. It is almost | 284 // with the same process and routing ids, which causes a collision. It is almost |
| 284 // identical to the AttemptDuplicateRenderViewHost test case. | 285 // identical to the AttemptDuplicateRenderViewHost test case. |
| 285 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, | 286 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, |
| 286 AttemptDuplicateRenderWidgetHost) { | 287 AttemptDuplicateRenderWidgetHost) { |
| (...skipping 264 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 551 // separate task of the message loop, so ensure that the process is still | 552 // separate task of the message loop, so ensure that the process is still |
| 552 // considered alive. | 553 // considered alive. |
| 553 EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection()); | 554 EXPECT_TRUE(root->current_frame_host()->GetProcess()->HasConnection()); |
| 554 | 555 |
| 555 exit_observer.Wait(); | 556 exit_observer.Wait(); |
| 556 EXPECT_FALSE(exit_observer.did_exit_normally()); | 557 EXPECT_FALSE(exit_observer.did_exit_normally()); |
| 557 ResourceDispatcherHost::Get()->SetDelegate(nullptr); | 558 ResourceDispatcherHost::Get()->SetDelegate(nullptr); |
| 558 } | 559 } |
| 559 | 560 |
| 560 } // namespace content | 561 } // namespace content |
| OLD | NEW |