Experimental Feature: Allow-CSP-From header

third_party/WebKit/Source/core/frame/csp/ContentSecurityPolicyTest.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/frame/csp/ContentSecurityPolicy.h"
 
 #include "core/dom/Document.h"
 #include "core/fetch/IntegrityMetadata.h"
 #include "core/frame/csp/CSPDirectiveList.h"
 #include "core/loader/DocumentLoader.h"
@@ skipping 844 matching lines @@
                              ContentSecurityPolicyHeaderSourceHTTP);
     policy->didReceiveHeader(test.policy2,
                              ContentSecurityPolicyHeaderTypeReport,
                              ContentSecurityPolicyHeaderSourceHTTP);
     EXPECT_TRUE(policy->allowScriptFromSource(resource, String(test.nonce),
                                               ParserInserted));
     EXPECT_EQ(expectedReports, policy->m_violationReportsSent.size());
   }
 }
 
+TEST_F(ContentSecurityPolicyTest, ShouldEnforceEmbeddersPolicy) {
+  struct TestCase {
+    const char* resourceURL;
+    const bool inherits;
+  } cases[] = {
+      // Same-origin
+      {"https://example.test/index.html", true},
+      // Cross-origin
+      {"http://example.test/index.html", false},
+      {"http://example.test:8443/index.html", false},
+      {"https://example.test:8443/index.html", false},
+      {"http://not.example.test/index.html", false},
+      {"https://not.example.test/index.html", false},
+      {"https://not.example.test:8443/index.html", false},
+
+      // Inherit
+      {"about:blank", true},
+      {"data:text/html,yay", true},
+      {"blob:https://example.test/bbe708f3-defd-4852-93b6-cf94e032f08d", true},
+      {"filesystem:http://example.test/temporary/index.html", true},
+  };
+
+  for (const auto& test : cases) {
+    ResourceResponse response;
+    response.setURL(KURL(ParsedURLString, test.resourceURL));
+    EXPECT_EQ(ContentSecurityPolicy::shouldEnforceEmbeddersPolicy(
+                  response, secureOrigin.get()),
+              test.inherits);
+
+    response.setHTTPHeaderField(HTTPNames::Allow_CSP_From, AtomicString("*"));
+    EXPECT_TRUE(ContentSecurityPolicy::shouldEnforceEmbeddersPolicy(
+        response, secureOrigin.get()));
+
+    response.setHTTPHeaderField(HTTPNames::Allow_CSP_From,
+                                AtomicString("* not a valid header"));
+    EXPECT_EQ(ContentSecurityPolicy::shouldEnforceEmbeddersPolicy(
+                  response, secureOrigin.get()),
+              test.inherits);
+
+    response.setHTTPHeaderField(HTTPNames::Allow_CSP_From,
+                                AtomicString("http://example.test"));
+    EXPECT_EQ(ContentSecurityPolicy::shouldEnforceEmbeddersPolicy(
+                  response, secureOrigin.get()),
+              test.inherits);
+
+    response.setHTTPHeaderField(HTTPNames::Allow_CSP_From,
+                                AtomicString("https://example.test"));
+    EXPECT_TRUE(ContentSecurityPolicy::shouldEnforceEmbeddersPolicy(
+        response, secureOrigin.get()));
+  }
+}
+
 }  // namespace blink