extensions/common/csp_validator_unittest.cc - Issue 2574763003: Remove chrome-extension-resource:// scheme

Keyboard Shortcuts

	File
u :	up to issue
j / k :	jump to file after / before current file
J / K :	jump to next file with a comment after / before current file
	Side-by-side diff
i :	toggle intra-line diffs
e :	expand all comments
c :	collapse all comments
s :	toggle showing all comments
n / p :	next / previous diff chunk or comment
N / P :	next / previous comment
<Up> / <Down> :	next / previous line

	Issue
u :	up to list of issues
j / k :	jump to patch after / before current patch
o / <Enter> :	open current patch in side-by-side view
i :	open current patch in unified diff view

	Issue List
j / k :	jump to issue after / before current issue
o / <Enter> :	open current issue

Unified Diff: extensions/common/csp_validator_unittest.cc

Issue 2574763003: Remove chrome-extension-resource:// scheme (Closed)

Patch Set: Silently strip chrome-extension-resource:// from CSP directives. Created 4 years ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View side-by-side diff with in-line comments

Download patch

Index: extensions/common/csp_validator_unittest.cc

diff --git a/extensions/common/csp_validator_unittest.cc b/extensions/common/csp_validator_unittest.cc

index d9887412a00181d06514b1f0a34c01d9ad5fef12..6281000040397c230bca0c8b6594c53c4ad2d037 100644

--- a/extensions/common/csp_validator_unittest.cc

+++ b/extensions/common/csp_validator_unittest.cc

@@ -124,15 +124,13 @@ TEST(ExtensionCSPValidator, IsLegal) {

}

TEST(ExtensionCSPValidator, IsSecure) {

- EXPECT_TRUE(CheckSanitizeCSP(

- std::string(), OPTIONS_ALLOW_UNSAFE_EVAL,

- "script-src 'self' chrome-extension-resource:; object-src 'self';",

- MissingSecureSrcWarning("script-src"),

- MissingSecureSrcWarning("object-src")));

+ EXPECT_TRUE(CheckSanitizeCSP(std::string(), OPTIONS_ALLOW_UNSAFE_EVAL,

+ "script-src 'self'; object-src 'self';",

+ MissingSecureSrcWarning("script-src"),

+ MissingSecureSrcWarning("object-src")));

EXPECT_TRUE(CheckSanitizeCSP(

"img-src https://google.com", OPTIONS_ALLOW_UNSAFE_EVAL,

- "img-src https://google.com; script-src 'self'"

- " chrome-extension-resource:; object-src 'self';",

+ "img-src https://google.com; script-src 'self'; object-src 'self';",

MissingSecureSrcWarning("script-src"),

MissingSecureSrcWarning("object-src")));

EXPECT_TRUE(CheckSanitizeCSP(

@@ -214,13 +212,18 @@ TEST(ExtensionCSPValidator, IsSecure) {

EXPECT_TRUE(CheckSanitizeCSP(

"default-src 'self' chrome-extension://aabbcc;",

OPTIONS_ALLOW_UNSAFE_EVAL));

- EXPECT_TRUE(CheckSanitizeCSP(

- "default-src 'self' chrome-extension-resource://aabbcc;",

- OPTIONS_ALLOW_UNSAFE_EVAL));

- EXPECT_TRUE(CheckSanitizeCSP(

- "default-src 'self' https:", OPTIONS_ALLOW_UNSAFE_EVAL,

- "default-src 'self';",

- InsecureValueWarning("default-src", "https:")));

+ // chrome-extension-resource (which doesn't exist anymore) is quietly ignored.

+ EXPECT_TRUE(

+ CheckSanitizeCSP("default-src 'self' chrome-extension-resource://aabbcc;",

+ OPTIONS_ALLOW_UNSAFE_EVAL, "default-src 'self';"));

+ EXPECT_TRUE(

+ CheckSanitizeCSP("default-src 'self' chrome-extension-resource://aabbcc "

+ "chrome-extension://aabbcc;",

+ OPTIONS_ALLOW_UNSAFE_EVAL,

+ "default-src 'self' chrome-extension://aabbcc;"));

+ EXPECT_TRUE(CheckSanitizeCSP("default-src 'self' https:",

+ OPTIONS_ALLOW_UNSAFE_EVAL, "default-src 'self';",

+ InsecureValueWarning("default-src", "https:")));

EXPECT_TRUE(CheckSanitizeCSP(

"default-src 'self' http:", OPTIONS_ALLOW_UNSAFE_EVAL,

"default-src 'self';",

« no previous file with comments | « extensions/common/csp_validator.cc ('k') | extensions/common/file_util.h » ('j') | extensions/shell/common/shell_content_client.cc » ('J')