Disallow top-level navigation in gaia iframe

chrome/browser/ui/webui/signin/inline_login_ui_browsertest.cc

Index: chrome/browser/ui/webui/signin/inline_login_ui_browsertest.cc
diff --git a/chrome/browser/ui/webui/signin/inline_login_ui_browsertest.cc b/chrome/browser/ui/webui/signin/inline_login_ui_browsertest.cc
index 35469d9ad32cbf9777c14e4624349fde28691e29..420394f3c8fd98879f5ca4ea7a1c7533542c0f7b 100644
--- a/chrome/browser/ui/webui/signin/inline_login_ui_browsertest.cc
+++ b/chrome/browser/ui/webui/signin/inline_login_ui_browsertest.cc
@@ -18,6 +18,8 @@
 #include "content/public/browser/web_ui_controller.h"
 #include "content/public/common/url_constants.h"
 #include "content/public/test/browser_test_utils.h"
+#include "net/base/url_util.h"
+#include "net/test/embedded_test_server/embedded_test_server.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ -123,6 +125,25 @@ class InlineLoginUISafeIframeBrowserTest : public InProcessBrowserTest {
  public:
   FooWebUIProvider& foo_provider() { return foo_provider_; }
 
+  void WaitUntilUIReady() {
+    // TODO(guohui): fix the logic below for CrOS.
+#if !defined(OS_CHROMEOS)
+    ASSERT_TRUE(content::ExecuteScript(
+        browser()->tab_strip_model()->GetActiveWebContents(),
+        "if (!inline.login.getAuthExtHost())"
+        "  inline.login.initialize();"
+        "inline.login.getAuthExtHost().addEventListener('ready', function() {"
+        "  window.domAutomationController.setAutomationId(0);"
+        "  window.domAutomationController.send('ready');"
+        "});"));
+
+    content::DOMMessageQueue message_queue;
+    std::string message;
+    ASSERT_TRUE(message_queue.WaitForMessage(&message));

[xiyuan, 2014/04/17 15:04:15]

This is could timeout when 'ready' event is already fired. We probably need to
keep the 'ready' state in GaiaAuthHost and check the state also in addition to
the event listener. 

This might be the case on cros.

[guohui, 2014/04/17 15:08:31]

it seems on cros ready event is fired upon receiving clearOldAttempts message
from the gaia page, while on desktop ready event if fired upon load complete of
the gaia page. To fix the test for cros, i need to change cros code.  As
mentioned in an earlier comment, to minimize the risk, i prefer to disable
WaitUntilUIReady for cros, and fix it in a separate CL.

[guohui, 2014/04/17 15:28:49]

as clarified over chat, xiyuan is right, on desktop this may timeout if ready
event is already fired.  Fixed in a new patch.

+    EXPECT_EQ("\"ready\"", message);
+#endif // OS_CHROMEOS
+  }
+
  private:
   virtual void SetUpOnMainThread() OVERRIDE {
     content::WebUIControllerFactory::UnregisterFactoryForTesting(
@@ -160,4 +181,25 @@ IN_PROC_BROWSER_TEST_F(InlineLoginUISafeIframeBrowserTest, NoWebUIInIframe) {
       Resolve("?source=0&frameUrl=chrome://foo");
   EXPECT_CALL(foo_provider(), NewWebUI(_, _)).Times(0);
   ui_test_utils::NavigateToURL(browser(), url);
+  WaitUntilUIReady();
+}
+
+// Make sure that the gaia iframe cannot trigger top-frame navigation.
+IN_PROC_BROWSER_TEST_F(InlineLoginUISafeIframeBrowserTest,
+    TopFrameNavigationDisallowed) {
+  ASSERT_TRUE(embedded_test_server()->InitializeAndWaitUntilReady());
+  // Loads into gaia iframe a web page that attempts to deframe on load.
+  GURL deframe_url(embedded_test_server()->GetURL("/login/deframe.html"));
+  GURL url(net::AppendOrReplaceQueryParameter(
+      signin::GetPromoURL(signin::SOURCE_START_PAGE, false),
+      "frameUrl", deframe_url.spec()));
+  ui_test_utils::NavigateToURL(browser(), url);
+  WaitUntilUIReady();
+
+  content::WebContents* contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+  EXPECT_EQ(url, contents->GetVisibleURL());
+
+  content::NavigationController& controller = contents->GetController();
+  EXPECT_TRUE(controller.GetPendingEntry() == NULL);
 }