browser_test that creates filesystem resources in extension origin

content/public/test/browser_test_utils.h

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef CONTENT_PUBLIC_TEST_BROWSER_TEST_UTILS_H_
 #define CONTENT_PUBLIC_TEST_BROWSER_TEST_UTILS_H_
 
 #include <queue>
 #include <string>
 #include <vector>
 
 #include "base/callback.h"
 #include "base/compiler_specific.h"
 #include "base/files/scoped_temp_dir.h"
 #include "base/macros.h"
 #include "base/memory/ref_counted.h"
 #include "base/process/process.h"
 #include "base/strings/string16.h"
 #include "build/build_config.h"
 #include "cc/output/compositor_frame.h"
 #include "content/public/browser/browser_message_filter.h"
 #include "content/public/browser/notification_observer.h"
 #include "content/public/browser/notification_registrar.h"
 #include "content/public/browser/render_process_host_observer.h"
 #include "content/public/browser/web_contents_delegate.h"
 #include "content/public/browser/web_contents_observer.h"
 #include "content/public/common/page_type.h"
 #include "ipc/message_filter.h"
+#include "storage/common/fileapi/file_system_types.h"
 #include "third_party/WebKit/public/platform/WebInputEvent.h"
 #include "ui/accessibility/ax_node_data.h"
 #include "ui/accessibility/ax_tree_update.h"
 #include "ui/events/keycodes/dom/dom_code.h"
 #include "ui/events/keycodes/dom/dom_key.h"
 #include "ui/events/keycodes/keyboard_codes.h"
 #include "url/gurl.h"
 
 #if defined(OS_WIN)
 #include "base/win/scoped_handle.h"
@@ skipping 671 matching lines @@
   WebContents* web_contents_;
   std::string filter_;
   std::string message_;
 
   // The MessageLoopRunner used to spin the message loop.
   scoped_refptr<MessageLoopRunner> message_loop_runner_;
 
   DISALLOW_COPY_AND_ASSIGN(ConsoleObserverDelegate);
 };
 
+// Static methods that inject particular IPCs into the message pipe as if they
+// came from |process|. Used to simulate a compromised renderer.
+class PwnMessageHelper {
+ public:
+  // Sends BlobStorageMsg_RegisterBlobUUID and BlobStorageMsg_StartBuildingBlob.

[alexmos, 2016/12/02 00:01:56]

Seems like this actually sends BlobStorageMsg_RegisterBlob instead of those two
IPCs.  Should the comment have that instead?

[ncarter (slow), 2016/12/02 19:17:45]

Good catch. This comment was accurate when the function was written, but dmurph
merged the IPCs while this CL was sitting around.

+  static void CreateBlobWithPayload(RenderProcessHost* process,
+                                    std::string uuid,
+                                    std::string content_type,
+                                    std::string content_disposition,
+                                    std::string payload);
+
+  // Sends BlobHostMsg_RegisterPublicURL
+  static void RegisterBlobURL(RenderProcessHost* process,
+                              GURL url,
+                              std::string uuid);
+
+  // Sends FileSystemHostMsg_Create
+  static void FileSystemCreate(RenderProcessHost* process,
+                               int request_id,
+                               GURL path,
+                               bool exclusive,
+                               bool is_directory,
+                               bool recursive);
+
+  // Sends FileSystemHostMsg_Write
+  static void FileSystemWrite(RenderProcessHost* process,
+                              int request_id,
+                              GURL file_path,
+                              std::string blob_uuid,
+                              int64_t position);
+
+ private:
+  PwnMessageHelper();  // Not instantiable.
+
+  DISALLOW_COPY_AND_ASSIGN(PwnMessageHelper);
+};
+
 }  // namespace content
 
 #endif  // CONTENT_PUBLIC_TEST_BROWSER_TEST_UTILS_H_