[M54 merge] Lock down creation of blob:chrome-extension URLs from non-extension processes.

chrome/browser/extensions/process_manager_browsertest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 
 #include <memory>
 #include <utility>
 
 #include "base/callback.h"
 #include "base/macros.h"
 #include "base/run_loop.h"
 #include "chrome/browser/extensions/browser_action_test_util.h"
 #include "chrome/browser/extensions/extension_browsertest.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/extensions/test_extension_dir.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/common/extensions/extension_process_policy.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
+#include "content/public/browser/child_process_security_policy.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/test_navigation_observer.h"
 #include "content/public/test/test_utils.h"
 #include "extensions/browser/process_manager.h"
 #include "extensions/common/value_builder.h"
 #include "extensions/test/background_page_watcher.h"
@@ skipping 660 matching lines @@
   // this will go into a new extension process.
   const GURL extension_url(extension->url().Resolve("empty.html"));
   EXPECT_TRUE(content::NavigateIframeToURL(tab, "frame1", extension_url));
   EXPECT_EQ(IfExtensionsIsolated(1, 0),
             pm->GetRenderFrameHostsForExtension(extension->id()).size());
   EXPECT_EQ(IfExtensionsIsolated(1, 0), pm->GetAllFrames().size());
 
   content::RenderFrameHost* main_frame = tab->GetMainFrame();
   content::RenderFrameHost* extension_frame = ChildFrameAt(main_frame, 0);
 
+  // Validate that permissions have been granted for the extension scheme
+  // to the process of the extension iframe.
+  content::ChildProcessSecurityPolicy* policy =
+      content::ChildProcessSecurityPolicy::GetInstance();
+  EXPECT_TRUE(policy->CanRequestURL(
+      extension_frame->GetProcess()->GetID(),
+      GURL("blob:chrome-extension://some-extension-id/some-guid")));
+  EXPECT_TRUE(policy->CanRequestURL(
+      main_frame->GetProcess()->GetID(),
+      GURL("blob:chrome-extension://some-extension-id/some-guid")));
+  EXPECT_TRUE(policy->CanRequestURL(
+      extension_frame->GetProcess()->GetID(),
+      GURL("filesystem:chrome-extension://some-extension-id/some-path")));
+  EXPECT_TRUE(policy->CanRequestURL(
+      main_frame->GetProcess()->GetID(),
+      GURL("filesystem:chrome-extension://some-extension-id/some-path")));
+  EXPECT_TRUE(policy->CanRequestURL(
+      extension_frame->GetProcess()->GetID(),
+      GURL("chrome-extension://some-extension-id/resource.html")));
+  EXPECT_TRUE(policy->CanRequestURL(
+      main_frame->GetProcess()->GetID(),
+      GURL("chrome-extension://some-extension-id/resource.html")));
+
+  if (extensions::IsIsolateExtensionsEnabled()) {
+    EXPECT_TRUE(policy->CanCommitURL(
+        extension_frame->GetProcess()->GetID(),
+        GURL("blob:chrome-extension://some-extension-id/some-guid")));
+    EXPECT_FALSE(policy->CanCommitURL(
+        main_frame->GetProcess()->GetID(),
+        GURL("blob:chrome-extension://some-extension-id/some-guid")));
+    EXPECT_TRUE(policy->CanCommitURL(
+        extension_frame->GetProcess()->GetID(),
+        GURL("chrome-extension://some-extension-id/resource.html")));
+    EXPECT_FALSE(policy->CanCommitURL(
+        main_frame->GetProcess()->GetID(),
+        GURL("chrome-extension://some-extension-id/resource.html")));
+    EXPECT_TRUE(policy->CanCommitURL(
+        extension_frame->GetProcess()->GetID(),
+        GURL("filesystem:chrome-extension://some-extension-id/some-path")));
+    EXPECT_FALSE(policy->CanCommitURL(
+        main_frame->GetProcess()->GetID(),
+        GURL("filesystem:chrome-extension://some-extension-id/some-path")));
+  }
+
   // Open a new about:blank popup from main frame.  This should stay in the web
   // process.
   content::WebContents* popup =
       OpenPopup(main_frame, GURL(url::kAboutBlankURL));
   EXPECT_NE(popup, tab);
   ASSERT_EQ(2, browser()->tab_strip_model()->count());
   EXPECT_EQ(IfExtensionsIsolated(1, 0),
             pm->GetRenderFrameHostsForExtension(extension->id()).size());
   EXPECT_EQ(IfExtensionsIsolated(1, 0), pm->GetAllFrames().size());
 
@@ skipping 200 matching lines @@
   EXPECT_TRUE(ExecuteScriptAndExtractBool(
       popup, "window.domAutomationController.send(!!window.opener)",
       &is_opener_defined));
   EXPECT_TRUE(is_opener_defined);
 
   // Verify that postMessage to window.opener works.
   VerifyPostMessageToOpener(popup->GetMainFrame(), extension_frame);
 }
 
 }  // namespace extensions