Limit PDF helper extension to print preview only

chrome/browser/pdf/pdf_extension_test.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 
 #include <vector>
 
 #include "base/base_paths.h"
 #include "base/files/file_enumerator.h"
@@ skipping 446 matching lines @@
       "</body></html>";
   TestGetSelectedTextReply(GURL(data_url), false);
 }
 
 // Ensure same-origin replies do work for getSelectedText.
 IN_PROC_BROWSER_TEST_F(PDFExtensionTest, EnsureSameOriginRepliesAllowed) {
   TestGetSelectedTextReply(embedded_test_server()->GetURL("/pdf/test.pdf"),
                            true);
 }
 
+// Ensure that the PDF component extension cannot be loaded directly.
+IN_PROC_BROWSER_TEST_F(PDFExtensionTest, BlockDirectAccess) {
+  content::WebContents* web_contents =
+      browser()->tab_strip_model()->GetActiveWebContents();
+
+  std::unique_ptr<content::ConsoleObserverDelegate> console_delegate(
+      new content::ConsoleObserverDelegate(
+          web_contents, "*Refused to load the standalone extension.*"));
+  web_contents->SetDelegate(console_delegate.get());
+  GURL forbiddenUrl(
+      "chrome-extension://mhjfbmdgcfjbbpaeojofohoefgiehjai/index.html?"
+      "https://example.com/notrequested.pdf");
+  ui_test_utils::NavigateToURL(browser(), forbiddenUrl);
+
+  console_delegate->Wait();

[raymes, 2016/10/12 02:08:52]

It could be good to verify that the plugin element isn't even created. Take a
look at EnsureInternalPluginDisabled, I think it should just be a matter of
checking something similar.

[robwu, 2016/10/12 11:33:28]

The actual plugin is created asynchronously. I added the following:

  bool plugin_loaded = false;                                                  
  ASSERT_TRUE(content::ExecuteScriptAndExtractBool(                            
      web_contents,                                                            
      "var plugin_selector = 'embed[type=\"application/x-google-chrome-pdf\"]';"
      "var plugin_loaded = document.querySelector(plugin_selector) !== null;"  
      "window.domAutomationController.send(plugin_loaded);",                   
      &plugin_loaded));                                                        
  ASSERT_FALSE(plugin_loaded);                                                 

... but this did not fail without my patch, so it is useless.
I think that checking for the expected error message is sufficient. After all,
even if the plugin were to be loaded somehow, it cannot be scripted by the
parent frame.

[raymes, 2016/10/13 00:43:22]

Ah right. Ok - yeah testing the absence of success is hard.

+}
+
 // This test ensures that PDF can be loaded from local file
 IN_PROC_BROWSER_TEST_F(PDFExtensionTest, EnsurePDFFromLocalFileLoads) {
   base::FilePath test_data_dir;
   ASSERT_TRUE(PathService::Get(chrome::DIR_TEST_DATA, &test_data_dir));
   test_data_dir = test_data_dir.Append(FILE_PATH_LITERAL("pdf"));
   base::FilePath test_data_file = test_data_dir.AppendASCII("test.pdf");
   ASSERT_TRUE(PathExists(test_data_file));
   GURL test_pdf_url("file://" + test_data_file.MaybeAsASCII());
   content::WebContents* guest_contents = LoadPdfGetGuestContents(test_pdf_url);
   ASSERT_TRUE(guest_contents);
@@ skipping 407 matching lines @@
 
   ASSERT_EQ(2U, chrome::GetTotalBrowserCount());
 
   content::WebContents* active_web_contents =
       chrome::FindLastActive()->tab_strip_model()->GetActiveWebContents();
   ASSERT_NE(web_contents, active_web_contents);
 
   const GURL& url = active_web_contents->GetURL();
   ASSERT_EQ(std::string("http://www.example.com/"), url.spec());
 }