nav timing 2 redirect allow opt-in

third_party/WebKit/Source/core/timing/PerformanceBaseTest.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/timing/Performance.h"
 
 #include "bindings/core/v8/PerformanceObserverCallback.h"
 #include "bindings/core/v8/V8BindingForTesting.h"
 #include "core/testing/DummyPageHolder.h"
+#include "core/testing/NullExecutionContext.h"
 #include "core/timing/PerformanceBase.h"
 #include "core/timing/PerformanceLongTaskTiming.h"
 #include "core/timing/PerformanceObserver.h"
 #include "core/timing/PerformanceObserverInit.h"
+#include "platform/network/ResourceResponse.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace blink {
 
 class TestPerformanceBase : public PerformanceBase {
  public:
   TestPerformanceBase() : PerformanceBase(0) {}
   ~TestPerformanceBase() {}
 
   ExecutionContext* getExecutionContext() const override { return nullptr; }
@@ skipping 27 matching lines @@
   int numPerformanceEntriesInObserver() {
     return m_observer->m_performanceEntries.size();
   }
 
   PerformanceNavigationTiming::NavigationType getNavigationType(
       NavigationType type,
       Document* document) {
     return PerformanceBase::getNavigationType(type, document);
   }
 
+  static bool allowsTimingRedirect(
+      const Vector<ResourceResponse>& redirectChain,
+      const ResourceResponse& finalResponse,
+      const SecurityOrigin& initiatorSecurityOrigin,
+      ExecutionContext* context) {
+    return PerformanceBase::allowsTimingRedirect(
+        redirectChain, finalResponse, initiatorSecurityOrigin, context);
+  }
+
   Persistent<TestPerformanceBase> m_base;
   Persistent<PerformanceObserver> m_observer;
   std::unique_ptr<DummyPageHolder> m_pageHolder;
   Persistent<PerformanceObserverCallback> m_cb;
 };
 
 TEST_F(PerformanceBaseTest, Register) {
   V8TestingScope scope;
   initialize(scope.getScriptState());
 
@@ skipping 66 matching lines @@
       getNavigationType(NavigationTypeBackForward, &m_pageHolder->document());
   EXPECT_EQ(returnedType,
             PerformanceNavigationTiming::NavigationType::BackForward);
 
   m_pageHolder->page().setVisibilityState(PageVisibilityStateVisible, false);
   returnedType = getNavigationType(NavigationTypeFormResubmitted,
                                    &m_pageHolder->document());
   EXPECT_EQ(returnedType,
             PerformanceNavigationTiming::NavigationType::Navigate);
 }
+
+TEST_F(PerformanceBaseTest, AllowsTimingRedirect) {
+  // When there are no cross-origin redirects.
+  AtomicString originDomain = "http://127.0.0.1:8000";
+  Vector<ResourceResponse> redirectChain;
+  KURL url(ParsedURLString, originDomain + "/foo.html");
+  ResourceResponse finalResponse;
+  finalResponse.setURL(url);
+  ResourceResponse redirectResponse1;
+  redirectResponse1.setURL(url);
+  ResourceResponse redirectResponse2;
+  redirectResponse2.setURL(url);
+  redirectChain.append(redirectResponse1);
+  redirectChain.append(redirectResponse2);
+  RefPtr<SecurityOrigin> securityOrigin = SecurityOrigin::create(url);
+  NullExecutionContext nullExecutionContext;

[panicker, 2016/12/07 00:40:52]

Nit: Make this a member in PerformanceBaseTest?
In setUp you can: m_executionContext = new NullExecutionContext();
also avoid the const_casts.

[sunjian, 2016/12/07 20:10:32]

Done.

+  const ExecutionContext* context = &nullExecutionContext;
+  EXPECT_TRUE(allowsTimingRedirect(redirectChain, finalResponse,
+                                   *securityOrigin.get(),
+                                   const_cast<ExecutionContext*>(context)));
+  // When there exist cross-origin redirects.
+  AtomicString crossOriginDomain = "http://126.0.0.1:8000";
+  KURL redirectUrl(ParsedURLString, crossOriginDomain + "/bar.html");
+  ResourceResponse redirectResponse3;
+  redirectResponse3.setURL(redirectUrl);
+  redirectChain.append(redirectResponse3);
+  EXPECT_FALSE(allowsTimingRedirect(redirectChain, finalResponse,
+                                    *securityOrigin.get(),
+                                    const_cast<ExecutionContext*>(context)));
+
+  // When cross-origin redirect opts in.
+  redirectChain.back().setHTTPHeaderField(HTTPNames::Timing_Allow_Origin,
+                                          originDomain);
+  EXPECT_TRUE(allowsTimingRedirect(redirectChain, finalResponse,
+                                   *securityOrigin.get(),
+                                   const_cast<ExecutionContext*>(context)));
+}
+
 }  // namespace blink