chrome/browser/ssl/security_state_tab_helper_browser_tests.cc - Issue 2648353005: Display "Not secure" verbose state for data: URLs

Side by Side Diff: chrome/browser/ssl/security_state_tab_helper_browser_tests.cc

Issue 2648353005: Display "Not secure" verbose state for data: URLs (Closed)

Patch Set: Fix SSLUI test Created 3 years, 10 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

OLD	NEW
1 // Copyright 2015 The Chromium Authors. All rights reserved.	1 // Copyright 2015 The Chromium Authors. All rights reserved.

2 // Use of this source code is governed by a BSD-style license that can be	2 // Use of this source code is governed by a BSD-style license that can be

3 // found in the LICENSE file.	3 // found in the LICENSE file.

4	4

5 #include "chrome/browser/ssl/security_state_tab_helper.h"	5 #include "chrome/browser/ssl/security_state_tab_helper.h"

6	6

7 #include "base/command_line.h"	7 #include "base/command_line.h"

8 #include "base/files/file_path.h"	8 #include "base/files/file_path.h"

9 #include "base/macros.h"	9 #include "base/macros.h"

10 #include "base/strings/string_split.h"	10 #include "base/strings/string_split.h"

(...skipping 45 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
56 #include "third_party/boringssl/src/include/openssl/ssl.h"	56 #include "third_party/boringssl/src/include/openssl/ssl.h"

57 #include "ui/base/l10n/l10n_util.h"	57 #include "ui/base/l10n/l10n_util.h"

58	58

59 namespace {	59 namespace {

60	60

61 enum CertificateStatus { VALID_CERTIFICATE, INVALID_CERTIFICATE };	61 enum CertificateStatus { VALID_CERTIFICATE, INVALID_CERTIFICATE };

62	62

63 const base::FilePath::CharType kDocRoot[] =	63 const base::FilePath::CharType kDocRoot[] =

64 FILE_PATH_LITERAL("chrome/test/data");	64 FILE_PATH_LITERAL("chrome/test/data");

65	65

	66 // Inject a script into the page. Used by tests that check for visible

	67 // password fields to wait for notifications about these

	68 // fields. Notifications about visible password fields are queued at the

	69 // end of the event loop, so waiting for a dummy script to run ensures

	70 // that these notifcations have been sent.

	71 void InjectScript(content::WebContents* contents) {

	72 bool js_result = false;

	73 EXPECT_TRUE(content::ExecuteScriptAndExtractBool(

	74 contents, "window.domAutomationController.send(true);", &js_result));

	75 EXPECT_TRUE(js_result);

	76 }

	77

66 // A WebContentsObserver useful for testing the DidChangeVisibleSecurityState()	78 // A WebContentsObserver useful for testing the DidChangeVisibleSecurityState()

67 // method: it keeps track of the latest security style and explanation that was	79 // method: it keeps track of the latest security style and explanation that was

68 // fired.	80 // fired.

69 class SecurityStyleTestObserver : public content::WebContentsObserver {	81 class SecurityStyleTestObserver : public content::WebContentsObserver {

70 public:	82 public:

71 explicit SecurityStyleTestObserver(content::WebContents* web_contents)	83 explicit SecurityStyleTestObserver(content::WebContents* web_contents)

72 : content::WebContentsObserver(web_contents),	84 : content::WebContentsObserver(web_contents),

73 latest_security_style_(blink::WebSecurityStyleUnknown) {}	85 latest_security_style_(blink::WebSecurityStyleUnknown) {}

74 ~SecurityStyleTestObserver() override {}	86 ~SecurityStyleTestObserver() override {}

75	87

(...skipping 679 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
755 embedded_test_server()->host_port_pair(), &replacement_path);	767 embedded_test_server()->host_port_pair(), &replacement_path);

756 ui_test_utils::NavigateToURL(browser(),	768 ui_test_utils::NavigateToURL(browser(),

757 https_server_.GetURL(replacement_path));	769 https_server_.GetURL(replacement_path));

758 CheckSecurityInfoForSecure(	770 CheckSecurityInfoForSecure(

759 browser()->tab_strip_model()->GetActiveWebContents(),	771 browser()->tab_strip_model()->GetActiveWebContents(),

760 security_state::DANGEROUS, false,	772 security_state::DANGEROUS, false,

761 security_state::CONTENT_STATUS_DISPLAYED, false,	773 security_state::CONTENT_STATUS_DISPLAYED, false,

762 true /* expect cert status error */);	774 true /* expect cert status error */);

763 }	775 }

764	776

	777 // Tests that the security level of data: URLs is always downgraded to

	778 // HTTP_SHOW_WARNING.

	779 IN_PROC_BROWSER_TEST_F(SecurityStateTabHelperTest,

	780 SecurityLevelDowngradedOnDataUrl) {

	781 content::WebContents* contents =

	782 browser()->tab_strip_model()->GetActiveWebContents();

	783 ASSERT_TRUE(contents);

	784

	785 SecurityStateTabHelper* helper =

	786 SecurityStateTabHelper::FromWebContents(contents);

	787 ASSERT_TRUE(helper);

	788

	789 ui_test_utils::NavigateToURL(browser(), GURL("data:text/html,<html></html>"));

	790 InjectScript(contents);
	estark 2017/01/26 22:46:28 Is this necessary? I would think it's only necessa Is this necessary? I would think it's only necessary if HTTP_SHOW_WARNING is triggered by a password field. meacer 2017/01/26 23:49:24 Done. Show quoted text On 2017/01/26 22:46:28, estark wrote: > Is this necessary? I would think it's only necessary if HTTP_SHOW_WARNING is > triggered by a password field. Done.
	791 security_state::SecurityInfo security_info;

	792 helper->GetSecurityInfo(&security_info);

	793 EXPECT_EQ(security_state::HTTP_SHOW_WARNING, security_info.security_level);

	794

	795 content::NavigationEntry* entry = contents->GetController().GetVisibleEntry();

	796 ASSERT_TRUE(entry);

	797 EXPECT_EQ(content::SSLStatus::NORMAL_CONTENT, entry->GetSSL().content_status);

	798 }

	799

765 const char kReportURI[] = "https://report-hpkp.test";	800 const char kReportURI[] = "https://report-hpkp.test";

766	801

767 class PKPModelClientTest : public SecurityStateTabHelperTest {	802 class PKPModelClientTest : public SecurityStateTabHelperTest {

768 public:	803 public:

769 void SetUpOnMainThread() override {	804 void SetUpOnMainThread() override {

770 ASSERT_TRUE(https_server_.Start());	805 ASSERT_TRUE(https_server_.Start());

771 url_request_context_getter_ = browser()->profile()->GetRequestContext();	806 url_request_context_getter_ = browser()->profile()->GetRequestContext();

772 content::BrowserThread::PostTask(	807 content::BrowserThread::PostTask(

773 content::BrowserThread::IO, FROM_HERE,	808 content::BrowserThread::IO, FROM_HERE,

774 base::Bind(&PKPModelClientTest::SetUpOnIOThread,	809 base::Bind(&PKPModelClientTest::SetUpOnIOThread,

(...skipping 134 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
909	944

910 // Navigate to a page that doesn't finish loading. Test that the	945 // Navigate to a page that doesn't finish loading. Test that the

911 // security state is neutral while the page is loading.	946 // security state is neutral while the page is loading.

912 browser()->OpenURL(content::OpenURLParams(	947 browser()->OpenURL(content::OpenURLParams(

913 embedded_test_server()->GetURL("/title1.html"), content::Referrer(),	948 embedded_test_server()->GetURL("/title1.html"), content::Referrer(),

914 WindowOpenDisposition::CURRENT_TAB, ui::PAGE_TRANSITION_TYPED, false));	949 WindowOpenDisposition::CURRENT_TAB, ui::PAGE_TRANSITION_TYPED, false));

915 CheckSecurityInfoForNonSecure(	950 CheckSecurityInfoForNonSecure(

916 browser()->tab_strip_model()->GetActiveWebContents());	951 browser()->tab_strip_model()->GetActiveWebContents());

917 }	952 }

918	953

919 // Inject a script into the page. Used by tests that check for visible

920 // password fields to wait for notifications about these

921 // fields. Notifications about visible password fields are queued at the

922 // end of the event loop, so waiting for a dummy script to run ensures

923 // that these notifcations have been sent.

924 void InjectScript(content::WebContents* contents) {

925 bool js_result = false;

926 EXPECT_TRUE(content::ExecuteScriptAndExtractBool(

927 contents, "window.domAutomationController.send(true);", &js_result));

928 EXPECT_TRUE(js_result);

929 }

930

931 // Tests that when a visible password field is detected on an HTTP page	954 // Tests that when a visible password field is detected on an HTTP page

932 // load, and when the command-line flag is set, the security level is	955 // load, and when the command-line flag is set, the security level is

933 // downgraded to HTTP_SHOW_WARNING.	956 // downgraded to HTTP_SHOW_WARNING.

934 IN_PROC_BROWSER_TEST_F(SecurityStateTabHelperTestWithPasswordCcSwitch,	957 IN_PROC_BROWSER_TEST_F(SecurityStateTabHelperTestWithPasswordCcSwitch,

935 PasswordSecurityLevelDowngraded) {	958 PasswordSecurityLevelDowngraded) {

936 content::WebContents* contents =	959 content::WebContents* contents =

937 browser()->tab_strip_model()->GetActiveWebContents();	960 browser()->tab_strip_model()->GetActiveWebContents();

938 ASSERT_TRUE(contents);	961 ASSERT_TRUE(contents);

939	962

940 SecurityStateTabHelper* helper =	963 SecurityStateTabHelper* helper =

(...skipping 1080 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
2021 SecurityStateTabHelper* helper =	2044 SecurityStateTabHelper* helper =

2022 SecurityStateTabHelper::FromWebContents(web_contents);	2045 SecurityStateTabHelper::FromWebContents(web_contents);

2023 ASSERT_TRUE(helper);	2046 ASSERT_TRUE(helper);

2024 security_state::SecurityInfo security_info;	2047 security_state::SecurityInfo security_info;

2025 helper->GetSecurityInfo(&security_info);	2048 helper->GetSecurityInfo(&security_info);

2026 EXPECT_EQ(security_state::SECURE, security_info.security_level);	2049 EXPECT_EQ(security_state::SECURE, security_info.security_level);

2027 EXPECT_EQ(kTestSCTStatuses, security_info.sct_verify_statuses);	2050 EXPECT_EQ(kTestSCTStatuses, security_info.sct_verify_statuses);

2028 }	2051 }

2029	2052

2030 } // namespace	2053 } // namespace

OLD	NEW

« no previous file with comments | « no previous file | chrome/browser/ssl/ssl_browser_tests.cc » ('j') | components/security_state/core/security_state.cc » ('J')