OLD | NEW |
(Empty) | |
| 1 // Copyright 2017 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. |
| 4 |
| 5 #include "content/common/content_security_policy/csp_context.h" |
| 6 #include "content/common/content_security_policy_header.h" |
| 7 #include "testing/gtest/include/gtest/gtest.h" |
| 8 |
| 9 namespace content { |
| 10 |
| 11 namespace { |
| 12 class CSPContextTest : public CSPContext { |
| 13 public: |
| 14 const std::string& LastConsoleMessage() { return console_message_; } |
| 15 |
| 16 private: |
| 17 void LogToConsole(const std::string& message) override { |
| 18 console_message_ = message; |
| 19 } |
| 20 std::string console_message_; |
| 21 }; |
| 22 |
| 23 } // namespace |
| 24 |
| 25 TEST(ContentSecurityPolicy, NoDirective) { |
| 26 CSPContextTest context; |
| 27 std::vector<std::string> report_end_points; // empty |
| 28 ContentSecurityPolicy policy(blink::WebContentSecurityPolicyTypeEnforce, |
| 29 blink::WebContentSecurityPolicySourceHTTP, |
| 30 std::vector<CSPDirective>(), report_end_points, |
| 31 "" /* header */); |
| 32 |
| 33 EXPECT_TRUE(ContentSecurityPolicy::Allow(policy, CSPDirective::FormAction, |
| 34 GURL("http://www.example.com"), |
| 35 &context)); |
| 36 EXPECT_EQ("", context.LastConsoleMessage()); |
| 37 } |
| 38 |
| 39 TEST(ContentSecurityPolicy, ReportViolation) { |
| 40 CSPContextTest context; |
| 41 |
| 42 // source = "www.example.com" |
| 43 CSPSource source("", "www.example.com", false, url::PORT_UNSPECIFIED, false, |
| 44 ""); |
| 45 CSPSourceList source_list(false, false, {source}); |
| 46 CSPDirective directive(CSPDirective::FormAction, source_list); |
| 47 std::vector<std::string> report_end_points; // empty |
| 48 ContentSecurityPolicy policy(blink::WebContentSecurityPolicyTypeEnforce, |
| 49 blink::WebContentSecurityPolicySourceHTTP, |
| 50 {directive}, report_end_points, "" /* header */); |
| 51 |
| 52 EXPECT_FALSE(ContentSecurityPolicy::Allow(policy, CSPDirective::FormAction, |
| 53 GURL("http://www.not-example.com"), |
| 54 &context)); |
| 55 |
| 56 const char console_message[] = |
| 57 "Refused to send form data to 'http://www.not-example.com/' because it " |
| 58 "violates the following Content Security Policy directive: \"form-action " |
| 59 "www.example.com\".\n"; |
| 60 EXPECT_EQ(console_message, context.LastConsoleMessage()); |
| 61 } |
| 62 |
| 63 TEST(ContentSecurityPolicy, DirectiveFallback) { |
| 64 CSPSource source_a("http", "a.com", false, url::PORT_UNSPECIFIED, false, ""); |
| 65 CSPSource source_b("http", "b.com", false, url::PORT_UNSPECIFIED, false, ""); |
| 66 CSPSourceList source_list_a(false, false, {source_a}); |
| 67 CSPSourceList source_list_b(false, false, {source_b}); |
| 68 |
| 69 std::vector<std::string> report_end_points; // Empty. |
| 70 |
| 71 { |
| 72 CSPContextTest context; |
| 73 ContentSecurityPolicy policy( |
| 74 blink::WebContentSecurityPolicyTypeEnforce, |
| 75 blink::WebContentSecurityPolicySourceHTTP, |
| 76 {CSPDirective(CSPDirective::DefaultSrc, source_list_a)}, |
| 77 report_end_points, "" /* header */); |
| 78 EXPECT_FALSE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc, |
| 79 GURL("http://b.com"), &context)); |
| 80 const char console_message[] = |
| 81 "Refused to frame 'http://b.com/' because it violates " |
| 82 "the following Content Security Policy directive: \"default-src " |
| 83 "http://a.com\". Note that 'frame-src' was not explicitly " |
| 84 "set, so 'default-src' is used as a fallback.\n"; |
| 85 EXPECT_EQ(console_message, context.LastConsoleMessage()); |
| 86 EXPECT_TRUE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc, |
| 87 GURL("http://a.com"), &context)); |
| 88 } |
| 89 { |
| 90 CSPContextTest context; |
| 91 ContentSecurityPolicy policy( |
| 92 blink::WebContentSecurityPolicyTypeEnforce, |
| 93 blink::WebContentSecurityPolicySourceHTTP, |
| 94 {CSPDirective(CSPDirective::ChildSrc, source_list_a)}, |
| 95 report_end_points, "" /* header */); |
| 96 EXPECT_FALSE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc, |
| 97 GURL("http://b.com"), &context)); |
| 98 const char console_message[] = |
| 99 "Refused to frame 'http://b.com/' because it violates " |
| 100 "the following Content Security Policy directive: \"child-src " |
| 101 "http://a.com\". Note that 'frame-src' was not explicitly " |
| 102 "set, so 'child-src' is used as a fallback.\n"; |
| 103 EXPECT_EQ(console_message, context.LastConsoleMessage()); |
| 104 EXPECT_TRUE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc, |
| 105 GURL("http://a.com"), &context)); |
| 106 } |
| 107 { |
| 108 CSPContextTest context; |
| 109 CSPSourceList source_list(false, false, {source_a, source_b}); |
| 110 ContentSecurityPolicy policy( |
| 111 blink::WebContentSecurityPolicyTypeEnforce, |
| 112 blink::WebContentSecurityPolicySourceHTTP, |
| 113 {CSPDirective(CSPDirective::FrameSrc, {source_list_a}), |
| 114 CSPDirective(CSPDirective::ChildSrc, {source_list_b})}, |
| 115 report_end_points, "" /* header */); |
| 116 EXPECT_TRUE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc, |
| 117 GURL("http://a.com"), &context)); |
| 118 EXPECT_FALSE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc, |
| 119 GURL("http://b.com"), &context)); |
| 120 const char console_message[] = |
| 121 "Refused to frame 'http://b.com/' because it violates " |
| 122 "the following Content Security Policy directive: \"frame-src " |
| 123 "http://a.com\".\n"; |
| 124 EXPECT_EQ(console_message, context.LastConsoleMessage()); |
| 125 } |
| 126 } |
| 127 |
| 128 } // namespace content |
OLD | NEW |