Restrict app sandbox's CSP to disallow loading web content in them.

extensions/common/csp_validator_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 
+#include "base/strings/string_split.h"
 #include "extensions/common/csp_validator.h"
 #include "extensions/common/error_utils.h"
 #include "extensions/common/install_warning.h"
 #include "extensions/common/manifest_constants.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using extensions::csp_validator::ContentSecurityPolicyIsLegal;
+using extensions::csp_validator::GetEffectiveSandoxedPageCSP;
 using extensions::csp_validator::SanitizeContentSecurityPolicy;
 using extensions::csp_validator::ContentSecurityPolicyIsSandboxed;
 using extensions::csp_validator::OPTIONS_NONE;
 using extensions::csp_validator::OPTIONS_ALLOW_UNSAFE_EVAL;
 using extensions::csp_validator::OPTIONS_ALLOW_INSECURE_OBJECT_SRC;
 using extensions::ErrorUtils;
 using extensions::InstallWarning;
 using extensions::Manifest;
 
 namespace {
@@ skipping 78 matching lines @@
                                           const std::string& expected_csp,
                                           const std::string& warning1,
                                           const std::string& warning2,
                                           const std::string& warning3) {
   std::vector<std::string> expected_warnings(1, warning1);
   expected_warnings.push_back(warning2);
   expected_warnings.push_back(warning3);
   return CheckSanitizeCSP(policy, options, expected_csp, expected_warnings);
 }
 
+bool CSPEquals(const std::string& csp1, const std::string& csp2) {
+  std::vector<std::string> csp1_parts = base::SplitString(
+      csp1, ";", base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY);
+  std::sort(csp1_parts.begin(), csp1_parts.end());
+  std::vector<std::string> csp2_parts = base::SplitString(
+      csp2, ";", base::TRIM_WHITESPACE, base::SPLIT_WANT_NONEMPTY);
+  std::sort(csp2_parts.begin(), csp2_parts.end());
+  return csp1_parts == csp2_parts;
+}
+
 };  // namespace
 
 TEST(ExtensionCSPValidator, IsLegal) {
   EXPECT_TRUE(ContentSecurityPolicyIsLegal("foo"));
   EXPECT_TRUE(ContentSecurityPolicyIsLegal(
       "default-src 'self'; script-src http://www.google.com"));
   EXPECT_FALSE(ContentSecurityPolicyIsLegal(
       "default-src 'self';\nscript-src http://www.google.com"));
   EXPECT_FALSE(ContentSecurityPolicyIsLegal(
       "default-src 'self';\rscript-src http://www.google.com"));
@@ skipping 325 matching lines @@
       "sandbox allow-top-navigation", Manifest::TYPE_EXTENSION));
   EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(
       "sandbox allow-top-navigation", Manifest::TYPE_PLATFORM_APP));
 
   // Popups are OK.
   EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
       "sandbox allow-popups", Manifest::TYPE_EXTENSION));
   EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
       "sandbox allow-popups", Manifest::TYPE_PLATFORM_APP));
 }
+
+// TODO(lazyboy): Add comprehensive test cases.

[Devlin, 2016/12/09 15:46:01]

Can we address this TODO before landing? ;)

[lazyboy, 2016/12/14 00:49:05]

I've expanded the tests a bit and added an api_test

+TEST(ExtensionCSPValidator, EffectiveSandboxedPageCSP) {
+  EXPECT_TRUE(CSPEquals("child-src 'self'; script-src 'self';",
+                        GetEffectiveSandoxedPageCSP("")));
+  EXPECT_TRUE(CSPEquals(
+      "child-src 'self'; script-src 'self';",
+      GetEffectiveSandoxedPageCSP("child-src http://www.google.com")));
+  EXPECT_TRUE(CSPEquals("child-src 'none'; script-src 'self';",
+                        GetEffectiveSandoxedPageCSP("child-src 'none'")));
+
+  // Directive values of 'none' and 'self' are preserved.
+  EXPECT_TRUE(CSPEquals(
+      "frame-src 'self'; script-src 'none';",
+      GetEffectiveSandoxedPageCSP("script-src 'none'; frame-src 'self';")));
+  EXPECT_TRUE(CSPEquals(
+      "frame-src 'self'; script-src 'none';",
+      GetEffectiveSandoxedPageCSP(
+          "script-src 'none'; frame-src 'self' http://www.google.com;")));
+
+  // child-src and frame-src are handled correctly.
+  EXPECT_TRUE(CSPEquals(
+      "frame-src 'self'; script-src 'none';",
+      GetEffectiveSandoxedPageCSP(
+          "script-src 'none'; frame-src 'self' http://www.google.com;")));
+}