| Index: content/common/content_security_policy/csp_context_unittest.cc
|
| diff --git a/content/common/content_security_policy/csp_context_unittest.cc b/content/common/content_security_policy/csp_context_unittest.cc
|
| new file mode 100644
|
| index 0000000000000000000000000000000000000000..5309b5d3ee712ae7e01a2fad5d9734879f35da9c
|
| --- /dev/null
|
| +++ b/content/common/content_security_policy/csp_context_unittest.cc
|
| @@ -0,0 +1,80 @@
|
| +// Copyright 2017 The Chromium Authors. All rights reserved.
|
| +// Use of this source code is governed by a BSD-style license that can be
|
| +// found in the LICENSE file.
|
| +
|
| +#include "content/common/content_security_policy/csp_context.h"
|
| +#include "content/common/content_security_policy_header.h"
|
| +#include "testing/gtest/include/gtest/gtest.h"
|
| +
|
| +namespace content {
|
| +
|
| +namespace {
|
| +
|
| +class CSPContextTest : public CSPContext {
|
| + public:
|
| + const std::string& LastConsoleMessage() { return console_message_; }
|
| +
|
| + void AddSchemeToBypassCSP(const std::string& scheme) {
|
| + scheme_to_bypass_.push_back(scheme);
|
| + }
|
| +
|
| + bool SchemeShouldBypassCSP(const base::StringPiece& scheme) override {
|
| + return std::find(scheme_to_bypass_.begin(), scheme_to_bypass_.end(),
|
| + scheme) != scheme_to_bypass_.end();
|
| + }
|
| +
|
| + private:
|
| + void LogToConsole(const std::string& message) override {
|
| + console_message_ = message;
|
| + }
|
| + std::string console_message_;
|
| + std::vector<std::string> scheme_to_bypass_;
|
| +};
|
| +
|
| +// Build a new policy made of only one directive and no report endpoints.
|
| +CSPPolicy BuildPolicy(CSPDirective::Name directive_name,
|
| + std::vector<CSPSource> sources) {
|
| + return CSPPolicy(
|
| + blink::WebContentSecurityPolicyTypeEnforce,
|
| + blink::WebContentSecurityPolicySourceHTTP,
|
| + {CSPDirective(directive_name, CSPSourceList(false, false, sources))},
|
| + std::vector<std::string>()); // report_end_points
|
| +}
|
| +
|
| +} // namespace;
|
| +
|
| +TEST(CSPContextTest, SchemeShouldBypassCSP) {
|
| + CSPContextTest context;
|
| + CSPSource source("", "example.com", false, url::PORT_UNSPECIFIED, false, "");
|
| + CSPPolicy policy = BuildPolicy(CSPDirective::DefaultSrc, {source});
|
| + EXPECT_FALSE(context.Allow({policy}, CSPDirective::FrameSrc,
|
| + GURL("data:text/html,<html></html>")));
|
| + context.AddSchemeToBypassCSP("data");
|
| + EXPECT_TRUE(context.Allow({policy}, CSPDirective::FrameSrc,
|
| + GURL("data:text/html,<html></html>")));
|
| +}
|
| +
|
| +TEST(CSPContextTest, MultiplePolicies) {
|
| + CSPContextTest context;
|
| + context.SetSelf(url::Origin(GURL("http://example.com")));
|
| +
|
| + CSPSource source_a("", "a.com", false, url::PORT_UNSPECIFIED, false, "");
|
| + CSPSource source_b("", "b.com", false, url::PORT_UNSPECIFIED, false, "");
|
| + CSPSource source_c("", "c.com", false, url::PORT_UNSPECIFIED, false, "");
|
| +
|
| + CSPPolicy policy1 = BuildPolicy(CSPDirective::FrameSrc, {source_a, source_b});
|
| + CSPPolicy policy2 = BuildPolicy(CSPDirective::FrameSrc, {source_a, source_c});
|
| +
|
| + std::vector<CSPPolicy> policies = {policy1, policy2};
|
| +
|
| + EXPECT_TRUE(
|
| + context.Allow(policies, CSPDirective::FrameSrc, GURL("http://a.com")));
|
| + EXPECT_FALSE(
|
| + context.Allow(policies, CSPDirective::FrameSrc, GURL("http://b.com")));
|
| + EXPECT_FALSE(
|
| + context.Allow(policies, CSPDirective::FrameSrc, GURL("http://c.com")));
|
| + EXPECT_FALSE(
|
| + context.Allow(policies, CSPDirective::FrameSrc, GURL("http://d.com")));
|
| +}
|
| +
|
| +} // namespace content
|
|
|
Chromium Code Reviews
Issue 2612793002:
Implement ContentSecurityPolicy on the browser-side. (Closed)
