Disallow top-level navigation in gaia iframe

chrome/browser/ui/webui/signin/inline_login_ui_browsertest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/signin/signin_promo.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/common/chrome_switches.h"
 #include "chrome/common/url_constants.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/test_chrome_web_ui_controller_factory.h"
 #include "chrome/test/base/testing_browser_process.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/session_storage_namespace.h"
 #include "content/public/browser/storage_partition.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/browser/web_ui_controller.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/browser_test_utils.h"
+#include "net/base/url_util.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using ::testing::_;
 
 namespace {
 
 struct ContentInfo {
   ContentInfo(int pid, content::StoragePartition* storage_partition) {
     this->pid = pid;
@@ skipping 123 matching lines @@
 }
 
 // Make sure that the foo webui handler does not get created when we try to
 // load it inside the iframe of the login ui.
 IN_PROC_BROWSER_TEST_F(InlineLoginUISafeIframeBrowserTest, NoWebUIInIframe) {
   GURL url = signin::GetPromoURL(signin::SOURCE_START_PAGE, false).
       Resolve("?source=0&frameUrl=chrome://foo");
   EXPECT_CALL(foo_provider(), NewWebUI(_, _)).Times(0);
   ui_test_utils::NavigateToURL(browser(), url);
 }
+
+// Make sure that the gaia iframe cannot trigger top-frame navigation.
+IN_PROC_BROWSER_TEST_F(InlineLoginUISafeIframeBrowserTest,
+    TopFrameNavigationDisallowed) {
+  ASSERT_TRUE(embedded_test_server()->InitializeAndWaitUntilReady());
+
+  // Loads into gaia iframe a web page that attempts to deframe on load.
+  GURL deframe_url(embedded_test_server()->GetURL("/login/deframe.html"));
+  GURL url(net::AppendOrReplaceQueryParameter(
+      signin::GetPromoURL(signin::SOURCE_START_PAGE, false),
+      "frameUrl", deframe_url.spec()));
+
+  ui_test_utils::NavigateToURL(browser(), url);

[xiyuan, 2014/04/17 01:15:29]

NavigateToURL waits for one LOAD_STOP notification. Would it reflect the loading
state in iframe?  If yes, would it be good enough for the deframe script to run
and finish?

[guohui, 2014/04/17 12:43:26]

it does, but the iframe is initially set to blank page, thus the test passes
without the fix in this CL...

Corrected in a new patch.

+  content::WebContents* contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  EXPECT_EQ(url, contents->GetURL());

[Charlie Reis, 2014/04/17 01:20:20]

GetLastCommittedURL()

[guohui, 2014/04/17 12:43:26]

GetLastCommittedURL returns the committed url, but in this case, even if top
frame navigation is allowed, the navigation would be pending, thus
GetLastCommittedURL would always return the old URL. Verified without the fix in
a local build.

Changed to GetVisibleURL.

+
+  content::NavigationController& controller = contents->GetController();
+  EXPECT_TRUE(controller.GetPendingEntry() == NULL);

[Charlie Reis, 2014/04/17 01:20:20]

This doesn't seem like a sufficient check to me.  We could have committed the
deframe navigation and this would pass.  Can you also check that
GetLastCommittedURL() is what we expect?

[guohui, 2014/04/17 12:43:26]

After i added the WaitForUIReady call above, both the GetVisibleURL check and
GetPendingEntry check fail without my fix.

+}