(re-land) Disallow navigations to blob URLs with non-canonical origins.

content/browser/child_process_security_policy_unittest.cc

Index: content/browser/child_process_security_policy_unittest.cc
diff --git a/content/browser/child_process_security_policy_unittest.cc b/content/browser/child_process_security_policy_unittest.cc
index 24aa45bc21f050f00bea4642e7f5fe50674589a6..ea722fcd95416cf168ffc1e2745896126ea56bfc 100644
--- a/content/browser/child_process_security_policy_unittest.cc
+++ b/content/browser/child_process_security_policy_unittest.cc
@@ -186,6 +186,58 @@ TEST_F(ChildProcessSecurityPolicyTest, StandardSchemesTest) {
   p->Remove(kRendererID);
 }
 
+TEST_F(ChildProcessSecurityPolicyTest, BlobSchemeTest) {
+  ChildProcessSecurityPolicyImpl* p =
+      ChildProcessSecurityPolicyImpl::GetInstance();
+
+  p->Add(kRendererID);
+
+  EXPECT_TRUE(
+      p->CanRequestURL(kRendererID, GURL("blob:http://localhost/some-guid")));
+  EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("blob:null/some-guid")));
+  EXPECT_TRUE(
+      p->CanRequestURL(kRendererID, GURL("blob:http://localhost/some-guid")));
+  EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("blob:NulL/some-guid")));
+  EXPECT_TRUE(
+      p->CanRequestURL(kRendererID, GURL("blob:NulL/some-guid#fragment")));
+  EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("blob:NulL/some-guid?query")));
+  EXPECT_TRUE(
+      p->CanRequestURL(kRendererID, GURL("blob:blobinternal://some-guid")));
+  EXPECT_FALSE(p->CanRequestURL(
+      kRendererID, GURL("blob:http://username@localhost/some-guid")));
+  EXPECT_FALSE(p->CanRequestURL(
+      kRendererID, GURL("blob:http://username     @localhost/some-guid")));
+  EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("blob:blob:some-guid")));
+  EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("blob:some-guid")));
+  EXPECT_FALSE(p->CanRequestURL(kRendererID,
+                                GURL("blob:filesystem:http://localhost/path")));
+  EXPECT_FALSE(p->CanRequestURL(kRendererID,
+                                GURL("filesystem:blob:http://localhost/guid")));
+
+  EXPECT_TRUE(
+      p->CanCommitURL(kRendererID, GURL("blob:http://localhost/some-guid")));
+  EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("blob:null/some-guid")));
+  EXPECT_TRUE(
+      p->CanCommitURL(kRendererID, GURL("blob:http://localhost/some-guid")));
+  EXPECT_TRUE(p->CanCommitURL(kRendererID, GURL("blob:NulL/some-guid")));
+  EXPECT_TRUE(
+      p->CanCommitURL(kRendererID, GURL("blob:NulL/some-guid#fragment")));
+  EXPECT_TRUE(
+      p->CanCommitURL(kRendererID, GURL("blob:blobinternal://some-guid")));
+  EXPECT_FALSE(p->CanCommitURL(
+      kRendererID, GURL("blob:http://username@localhost/some-guid")));
+  EXPECT_FALSE(p->CanCommitURL(
+      kRendererID, GURL("blob:http://username     @localhost/some-guid")));
+  EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("blob:blob:some-guid")));
+  EXPECT_FALSE(p->CanCommitURL(kRendererID, GURL("blob:some-guid")));
+  EXPECT_FALSE(p->CanCommitURL(kRendererID,
+                               GURL("blob:filesystem:http://localhost/path")));
+  EXPECT_FALSE(p->CanCommitURL(kRendererID,
+                               GURL("filesystem:blob:http://localhost/guid")));
+
+  p->Remove(kRendererID);
+}
+
 TEST_F(ChildProcessSecurityPolicyTest, AboutTest) {
   ChildProcessSecurityPolicyImpl* p =
       ChildProcessSecurityPolicyImpl::GetInstance();