[Extensions] Don't show a blocked action for webRequest on subframes

chrome/browser/extensions/api/web_request/web_request_apitest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/command_line.h"
 #include "base/macros.h"
 #include "base/memory/ptr_util.h"
 #include "base/strings/stringprintf.h"
 #include "build/build_config.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/extensions/active_tab_permission_granter.h"
 #include "chrome/browser/extensions/extension_action_runner.h"
 #include "chrome/browser/extensions/extension_apitest.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/extensions/tab_helper.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/search_engines/template_url_service_factory.h"
 #include "chrome/browser/ui/browser.h"
 #include "chrome/browser/ui/browser_navigator_params.h"
 #include "chrome/browser/ui/login/login_handler.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/common/extensions/extension_process_policy.h"
 #include "chrome/test/base/search_test_utils.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "content/public/browser/notification_registrar.h"
 #include "content/public/browser/notification_service.h"
+#include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_view_host.h"
 #include "content/public/browser/render_widget_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/test/browser_test_utils.h"
 #include "extensions/browser/api/web_request/web_request_api.h"
 #include "extensions/browser/blocked_action_type.h"
 #include "extensions/browser/extension_system.h"
 #include "extensions/common/extension_builder.h"
 #include "extensions/common/features/feature.h"
 #include "extensions/test/extension_test_message_listener.h"
@@ skipping 39 matching lines @@
     "var xhr = new XMLHttpRequest();\n"
     "xhr.open('GET', url);\n"
     "xhr.onload = function() {\n"
     "  window.domAutomationController.send(true);\n"
     "};\n"
     "xhr.onerror = function() {\n"
     "  window.domAutomationController.send(false);\n"
     "};\n"
     "xhr.send();\n";
 
-// Performs an XHR in the given |web_contents|, replying when complete.
-void PerformXhrInPage(content::WebContents* web_contents,
+// Performs an XHR in the given |frame|, replying when complete.
+void PerformXhrInFrame(content::RenderFrameHost* frame,
                       const std::string& host,
                       int port,
                       const std::string& page) {
   bool success = false;
   EXPECT_TRUE(ExecuteScriptAndExtractBool(
-      web_contents,
+      frame,
       base::StringPrintf(kPerformXhrJs, host.c_str(), port, page.c_str()),
       &success));
   EXPECT_TRUE(success);
 }
 
 // Returns the current count of webRequests received by the |extension| in
 // the background page (assumes the extension stores a value on the window
 // object). Returns -1 if something goes awry.
 int GetWebRequestCountFromBackgroundPage(const Extension* extension,
                                          content::BrowserContext* context) {
@@ skipping 418 matching lines @@
 
   EXPECT_TRUE(listener1.WaitUntilSatisfied());
   EXPECT_TRUE(listener2.WaitUntilSatisfied());
 }
 
 // Tests that webRequest works with the --scripts-require-action feature.
 IN_PROC_BROWSER_TEST_F(ExtensionWebRequestApiTest,
                        WebRequestWithWithheldPermissions) {
   FeatureSwitch::ScopedOverride enable_scripts_require_action(
       FeatureSwitch::scripts_require_action(), true);
-  ASSERT_TRUE(StartEmbeddedTestServer());
+
+  host_resolver()->AddRule("*", "127.0.0.1");
+  ASSERT_TRUE(embedded_test_server()->Start());
+  content::SetupCrossSiteRedirector(embedded_test_server());
+
   // Load an extension that registers a listener for webRequest events, and
   // wait 'til it's initialized.
   ExtensionTestMessageListener listener("ready", false);
   const Extension* extension =
       LoadExtension(test_data_dir_.AppendASCII("webrequest_activetab"));
   ASSERT_TRUE(extension) << message_;
   EXPECT_TRUE(listener.WaitUntilSatisfied());
 
   // Navigate the browser to a page in a new tab.
-  const std::string kHost = "example.com";
-  GURL url = embedded_test_server()->GetURL(kHost, "/empty.html");
+  GURL url = embedded_test_server()->GetURL(
+                 "/cross-site/a.com/iframe_cross_site.html");
+  const std::string kHost = "a.com";
   chrome::NavigateParams params(browser(), url, ui::PAGE_TRANSITION_LINK);
   params.disposition = WindowOpenDisposition::NEW_FOREGROUND_TAB;
   ui_test_utils::NavigateToURL(&params);
 
   content::WebContents* web_contents =
       browser()->tab_strip_model()->GetActiveWebContents();
   ASSERT_TRUE(web_contents);
   ExtensionActionRunner* runner =
       ExtensionActionRunner::GetForWebContents(web_contents);
   ASSERT_TRUE(runner);
 
   int port = embedded_test_server()->port();
   const std::string kXhrPath = "simple.html";
 
   // The extension shouldn't have currently received any webRequest events,
   // since it doesn't have permission (and shouldn't receive any from an XHR).
   EXPECT_EQ(0, GetWebRequestCountFromBackgroundPage(extension, profile()));
-  PerformXhrInPage(web_contents, kHost, port, kXhrPath);
+
+  content::RenderFrameHost* main_frame = nullptr;
+  content::RenderFrameHost* child_frame = nullptr;
+  auto get_main_and_child_frame = [](content::WebContents* web_contents,
+                                     content::RenderFrameHost** main_frame,
+                                     content::RenderFrameHost** child_frame) {
+    *child_frame = nullptr;
+    *main_frame = web_contents->GetMainFrame();
+    std::vector<content::RenderFrameHost*> all_frames =
+        web_contents->GetAllFrames();
+    ASSERT_EQ(3u, all_frames.size());
+    *child_frame = all_frames[0] == *main_frame ? all_frames[1] : all_frames[0];
+    ASSERT_TRUE(*child_frame);
+  };
+
+  get_main_and_child_frame(web_contents, &main_frame, &child_frame);
+  const std::string kMainHost = main_frame->GetLastCommittedURL().host();
+  const std::string kChildHost = child_frame->GetLastCommittedURL().host();
+
+  PerformXhrInFrame(main_frame, kHost, port, kXhrPath);
+  PerformXhrInFrame(child_frame, kChildHost, port, kXhrPath);
   EXPECT_EQ(0, GetWebRequestCountFromBackgroundPage(extension, profile()));
+  EXPECT_EQ(BLOCKED_ACTION_WEB_REQUEST, runner->GetBlockedActions(extension));
 
   // Grant activeTab permission, and perform another XHR. The extension should
   // receive the event.
-  EXPECT_EQ(BLOCKED_ACTION_WEB_REQUEST, runner->GetBlockedActions(extension));
   runner->set_default_bubble_close_action_for_testing(
       base::WrapUnique(new ToolbarActionsBarBubbleDelegate::CloseAction(
           ToolbarActionsBarBubbleDelegate::CLOSE_EXECUTE)));
   runner->RunAction(extension, true);
   base::RunLoop().RunUntilIdle();
   EXPECT_TRUE(content::WaitForLoadStop(web_contents));
   // The runner will have refreshed the page...
+  get_main_and_child_frame(web_contents, &main_frame, &child_frame);
   EXPECT_EQ(BLOCKED_ACTION_NONE, runner->GetBlockedActions(extension));
+
   int xhr_count = GetWebRequestCountFromBackgroundPage(extension, profile());
-  // ... which means that we should have a non-zero xhr count.
+  // ... which means that we should have a non-zero xhr count...
   EXPECT_GT(xhr_count, 0);
-  // And the extension should receive future events.
-  PerformXhrInPage(web_contents, kHost, port, kXhrPath);
+  // ... and the extension should receive future events.
+  PerformXhrInFrame(main_frame, kHost, port, kXhrPath);
   ++xhr_count;
   EXPECT_EQ(xhr_count,
             GetWebRequestCountFromBackgroundPage(extension, profile()));
 
+  // However, activeTab only grants access to the main frame, not to child
+  // frames. As such, trying to XHR in the child frame should still fail.
+  PerformXhrInFrame(child_frame, kChildHost, port, kXhrPath);
+  EXPECT_EQ(xhr_count,
+            GetWebRequestCountFromBackgroundPage(extension, profile()));
+  // But since there's no way for the user to currently grant access to child
+  // frames, this shouldn't show up as a blocked action.
+  EXPECT_EQ(BLOCKED_ACTION_NONE, runner->GetBlockedActions(extension));
+
   // If we revoke the extension's tab permissions, it should no longer receive
   // webRequest events.
   ActiveTabPermissionGranter* granter =
       TabHelper::FromWebContents(web_contents)->active_tab_permission_granter();
   ASSERT_TRUE(granter);
   granter->RevokeForTesting();
   base::RunLoop().RunUntilIdle();
-  PerformXhrInPage(web_contents, kHost, port, kXhrPath);
+  PerformXhrInFrame(main_frame, kHost, port, kXhrPath);
   EXPECT_EQ(xhr_count,
             GetWebRequestCountFromBackgroundPage(extension, profile()));
   EXPECT_EQ(BLOCKED_ACTION_WEB_REQUEST, runner->GetBlockedActions(extension));
 }
 
 }  // namespace extensions