Lock down the registration of blob:chrome-extension:// URLs

chrome/browser/extensions/process_manager_browsertest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 
 #include <memory>
 #include <utility>
 
 #include "base/callback.h"
 #include "base/macros.h"
 #include "base/run_loop.h"
 #include "chrome/browser/extensions/browser_action_test_util.h"
 #include "chrome/browser/extensions/extension_browsertest.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/extensions/test_extension_dir.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/common/extensions/extension_process_policy.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
+#include "content/public/browser/child_process_security_policy.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/test_navigation_observer.h"
 #include "content/public/test/test_utils.h"
 #include "extensions/browser/process_manager.h"
 #include "extensions/common/value_builder.h"
 #include "extensions/test/background_page_watcher.h"
@@ skipping 635 matching lines @@
   // this will go into a new extension process.
   const GURL extension_url(extension->url().Resolve("empty.html"));
   EXPECT_TRUE(content::NavigateIframeToURL(tab, "frame1", extension_url));
   EXPECT_EQ(IfExtensionsIsolated(1, 0),
             pm->GetRenderFrameHostsForExtension(extension->id()).size());
   EXPECT_EQ(IfExtensionsIsolated(1, 0), pm->GetAllFrames().size());
 
   content::RenderFrameHost* main_frame = tab->GetMainFrame();
   content::RenderFrameHost* extension_frame = ChildFrameAt(main_frame, 0);
 
+  // Validate that permissions have been granted for the extension scheme
+  // to the process of the extension iframe.
+  content::ChildProcessSecurityPolicy* policy =
+      content::ChildProcessSecurityPolicy::GetInstance();
+  EXPECT_TRUE(policy->CanRequestURL(
+      extension_frame->GetProcess()->GetID(),
+      GURL("blob:chrome-extension://some-extension-id/some-guid")));

[Devlin, 2016/09/29 17:31:09]

nit: I'd recommend using some kind of valid id, because I could definitely see
us adding logic to disallow invalid ids (or even foreign ids).

[ncarter (slow), 2016/09/29 21:01:45]

Your point is good. It would actually be pretty straightforward to convert the
GrantScheme calls in this CL to be GrantOrigin() based: we already have a
particular extension in hand when we're doing the granting.

The only reason I haven't done this, is because I'm paranoid about whether we
have any races between the Grant() operations on the UI thread, and the
CanAccessWhatever checks on the IO thread, and making the grant be scheme-based
seemed harder to screw up (the risk being, I guess, if we ever have a case where
one extension can do a renderer-initiated, in-process navigation to another
extension? Like I said, I'm paranoid here.)

For now, though, I prefer this test to use invalid ids only; it makes it clearer
that the enforcement today is based simply on the scheme. And since this test
includes both EXPECT_TRUE and EXPECT_FALSE cases, I believe this test will start
failing if we add any kind of logic to disallow invalid ids. At that point, I'd
hope that we would expand this to include both valid and invalid ids.

+  EXPECT_TRUE(policy->CanRequestURL(
+      main_frame->GetProcess()->GetID(),
+      GURL("blob:chrome-extension://some-extension-id/some-guid")));
+  EXPECT_TRUE(policy->CanRequestURL(
+      extension_frame->GetProcess()->GetID(),
+      GURL("filesystem:chrome-extension://some-extension-id/some-path")));
+  EXPECT_TRUE(policy->CanRequestURL(
+      main_frame->GetProcess()->GetID(),
+      GURL("filesystem:chrome-extension://some-extension-id/some-path")));
+  EXPECT_TRUE(policy->CanRequestURL(
+      extension_frame->GetProcess()->GetID(),
+      GURL("chrome-extension://some-extension-id/resource.html")));
+  EXPECT_TRUE(policy->CanRequestURL(
+      main_frame->GetProcess()->GetID(),
+      GURL("chrome-extension://some-extension-id/resource.html")));
+  EXPECT_TRUE(policy->CanCommitURL(
+      extension_frame->GetProcess()->GetID(),
+      GURL("blob:chrome-extension://some-extension-id/some-guid")));
+  EXPECT_FALSE(policy->CanCommitURL(
+      main_frame->GetProcess()->GetID(),
+      GURL("blob:chrome-extension://some-extension-id/some-guid")));
+  EXPECT_TRUE(policy->CanCommitURL(
+      extension_frame->GetProcess()->GetID(),
+      GURL("chrome-extension://some-extension-id/resource.html")));
+  EXPECT_FALSE(policy->CanCommitURL(
+      main_frame->GetProcess()->GetID(),
+      GURL("chrome-extension://some-extension-id/resource.html")));
+  EXPECT_TRUE(policy->CanCommitURL(
+      extension_frame->GetProcess()->GetID(),
+      GURL("filesystem:chrome-extension://some-extension-id/some-path")));
+  EXPECT_FALSE(policy->CanCommitURL(
+      main_frame->GetProcess()->GetID(),
+      GURL("filesystem:chrome-extension://some-extension-id/some-path")));
+
   // Open a new about:blank popup from main frame.  This should stay in the web
   // process.
   content::WebContents* popup =
       OpenPopup(main_frame, GURL(url::kAboutBlankURL));
   EXPECT_NE(popup, tab);
   ASSERT_EQ(2, browser()->tab_strip_model()->count());
   EXPECT_EQ(IfExtensionsIsolated(1, 0),
             pm->GetRenderFrameHostsForExtension(extension->id()).size());
   EXPECT_EQ(IfExtensionsIsolated(1, 0), pm->GetAllFrames().size());
 
@@ skipping 103 matching lines @@
               popup->GetMainFrame()->GetLastCommittedOrigin());
     EXPECT_EQ("foo", GetTextContent(popup->GetMainFrame()));
 
     EXPECT_EQ(3 + i,
               pm->GetRenderFrameHostsForExtension(extension->id()).size());
     EXPECT_EQ(3 + i, pm->GetAllFrames().size());
   }
 }
 
 }  // namespace extensions