| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "base/command_line.h" | 5 #include "base/command_line.h" |
| 6 #include "base/macros.h" | 6 #include "base/macros.h" |
| 7 #include "base/strings/stringprintf.h" | 7 #include "base/strings/stringprintf.h" |
| 8 #include "base/strings/utf_string_conversions.h" | 8 #include "base/strings/utf_string_conversions.h" |
| 9 #include "chrome/browser/ui/browser.h" | 9 #include "chrome/browser/ui/browser.h" |
| 10 #include "chrome/browser/ui/browser_commands.h" | 10 #include "chrome/browser/ui/browser_commands.h" |
| (...skipping 81 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 92 std::string blob_contents = "<script>chrome.extensions</script>"; | 92 std::string blob_contents = "<script>chrome.extensions</script>"; |
| 93 std::string blob_path = "5881f76e-10d2-410d-8c61-ef210502acfd"; | 93 std::string blob_path = "5881f76e-10d2-410d-8c61-ef210502acfd"; |
| 94 | 94 |
| 95 // Target the bookmark manager extension. | 95 // Target the bookmark manager extension. |
| 96 std::string target_origin = | 96 std::string target_origin = |
| 97 "chrome-extension://eemcgdkfndhakfknompkggombfjjjeno"; | 97 "chrome-extension://eemcgdkfndhakfknompkggombfjjjeno"; |
| 98 | 98 |
| 99 std::vector<storage::DataElement> data_elements(1); | 99 std::vector<storage::DataElement> data_elements(1); |
| 100 data_elements[0].SetToBytes(blob_contents.c_str(), blob_contents.size()); | 100 data_elements[0].SetToBytes(blob_contents.c_str(), blob_contents.size()); |
| 101 | 101 |
| 102 // Set up a blob ID and populate it with attacker-controlled value. These two | 102 // Set up a blob ID and populate it with attacker-controlled value. This |
| 103 // messages are allowed, because this data is not in any origin. | 103 // message is allowed, because this data is not in any origin. |
| 104 IPC::IpcSecurityTestUtil::PwnMessageReceived( | 104 IPC::IpcSecurityTestUtil::PwnMessageReceived( |
| 105 rfh->GetProcess()->GetChannel(), | 105 rfh->GetProcess()->GetChannel(), |
| 106 BlobStorageMsg_RegisterBlobUUID(blob_id, blob_type, "", | 106 BlobStorageMsg_RegisterBlob(blob_id, blob_type, "", data_elements)); |
| 107 std::set<std::string>())); | |
| 108 | |
| 109 IPC::IpcSecurityTestUtil::PwnMessageReceived( | |
| 110 rfh->GetProcess()->GetChannel(), | |
| 111 BlobStorageMsg_StartBuildingBlob(blob_id, data_elements)); | |
| 112 | 107 |
| 113 // This IPC should result in a kill because |target_origin| is not commitable | 108 // This IPC should result in a kill because |target_origin| is not commitable |
| 114 // in |rfh->GetProcess()|. | 109 // in |rfh->GetProcess()|. |
| 115 content::RenderProcessHostWatcher crash_observer( | 110 content::RenderProcessHostWatcher crash_observer( |
| 116 rfh->GetProcess(), | 111 rfh->GetProcess(), |
| 117 content::RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); | 112 content::RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); |
| 118 IPC::IpcSecurityTestUtil::PwnMessageReceived( | 113 IPC::IpcSecurityTestUtil::PwnMessageReceived( |
| 119 rfh->GetProcess()->GetChannel(), | 114 rfh->GetProcess()->GetChannel(), |
| 120 BlobHostMsg_RegisterPublicURL( | 115 BlobHostMsg_RegisterPublicURL( |
| 121 GURL("blob:" + target_origin + "/" + blob_path), blob_id)); | 116 GURL("blob:" + target_origin + "/" + blob_path), blob_id)); |
| 122 crash_observer.Wait(); // If the process is killed, this test passes. | 117 crash_observer.Wait(); // If the process is killed, this test passes. |
| 123 } | 118 } |
| OLD | NEW |