Block renderer-initiated main frame navigations to data URLs

chrome/test/data/extensions/platform_apps/web_view/shim/main.js

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var util = {};
 var embedder = {};
 embedder.baseGuestURL = '';
 embedder.emptyGuestURL = '';
 embedder.windowOpenGuestURL = '';
 embedder.noReferrerGuestURL = '';
@@ skipping 412 matching lines @@
   webview.addEventListener('loadabort', function(e) {
     embedder.test.fail();
   });
   webview.addEventListener('loadstop', function(e) {
     embedder.test.succeed();
   });
   webview.setAttribute('src', 'guest_with_inline_script.html');
   document.body.appendChild(webview);
 }
 
+// This test verifies that guests are blocked from navigating the webview to a
+// data URL.
+function testContentInitiatedNavigationToDataUrlBlocked() {
+  var navUrl = "data:text/html,foo";
+  var webview = document.createElement('webview');
+  webview.addEventListener('consolemessage', function(e) {
+    if (e.message.startsWith(
+        'Not allowed to top-level navigate to resource:')) {
+      embedder.test.succeed();
+    }
+  });
+  webview.addEventListener('loadstop', function(e) {
+    if (webview.getAttribute('src') == navUrl) {
+      embedder.test.fail();
+    }
+  });
+  webview.setAttribute('src',
+      'data:text/html,<script>window.location.href = "' + navUrl +
+      '";</scr' + 'ipt>');
+  document.body.appendChild(webview);
+}
+
 // Tests that a <webview> that starts with "display: none" style loads
 // properly.
 function testDisplayNoneWebviewLoad() {
   var webview = document.createElement('webview');
   var visible = false;
   webview.style.display = 'none';
   // foobar is a privileged partition according to the manifest file.
   webview.partition = 'foobar';
   webview.addEventListener('loadabort', function(e) {
     embedder.test.fail();
@@ skipping 858 matching lines @@
         embedder.test.succeed();
       });
   });
   webview.setAttribute('src', 'data:text/html,trigger navigation');
   document.body.appendChild(webview);
 }
 
 // This test verifies that the call to executeScript will fail and return null
 // if the webview has been navigated between the time the call was made and the
 // time it arrives in the guest process.
 function testExecuteScriptIsAbortedWhenWebViewSourceIsChanged() {

[meacer, 2017/04/06 18:14:19]

This test is flaky and will be disabled in https://crrev.com/2803813002

   var webview = document.createElement('webview');
   webview.addEventListener('loadstop', function onLoadStop(e) {
     window.console.log('2. Inject script to trigger a guest-initiated ' +
         'navigation.');
-    var navUrl = 'data:text/html,trigger nav';
+    var navUrl = embedder.baseGuestURL + "/empty.html";
     webview.executeScript({
       code: 'window.location.href = "' + navUrl + '";'
     });
 
     window.console.log('3. Listening for the load that will be started as a ' +
         'result of 2.');
     webview.addEventListener('loadstart', function onLoadStart(e) {
       embedder.test.assertEq('about:blank', webview.src);
       window.console.log('4. Attempting to inject script into about:blank. ' +
           'This is expected to fail.');
@@ skipping 1718 matching lines @@
 embedder.test.testList = {
   'testAllowTransparencyAttribute': testAllowTransparencyAttribute,
   'testAutosizeHeight': testAutosizeHeight,
   'testAutosizeAfterNavigation': testAutosizeAfterNavigation,
   'testAutosizeBeforeNavigation': testAutosizeBeforeNavigation,
   'testAutosizeRemoveAttributes': testAutosizeRemoveAttributes,
   'testAutosizeWithPartialAttributes': testAutosizeWithPartialAttributes,
   'testAPIMethodExistence': testAPIMethodExistence,
   'testChromeExtensionURL': testChromeExtensionURL,
   'testChromeExtensionRelativePath': testChromeExtensionRelativePath,
+  'testContentInitiatedNavigationToDataUrlBlocked':
+      testContentInitiatedNavigationToDataUrlBlocked,
   'testDisplayNoneWebviewLoad': testDisplayNoneWebviewLoad,
   'testDisplayNoneWebviewRemoveChild': testDisplayNoneWebviewRemoveChild,
   'testInlineScriptFromAccessibleResources':
       testInlineScriptFromAccessibleResources,
   'testInvalidChromeExtensionURL': testInvalidChromeExtensionURL,
   'testWebRequestAPIExistence': testWebRequestAPIExistence,
   'testWebRequestAPIAddListener': testWebRequestAPIAddListener,
   'testEventName': testEventName,
   'testOnEventProperties': testOnEventProperties,
   'testLoadProgressEvent': testLoadProgressEvent,
@@ skipping 93 matching lines @@
        testRendererNavigationRedirectWhileUnattached,
   'testBlobURL': testBlobURL
 };
 
 onload = function() {
   chrome.test.getConfig(function(config) {
     embedder.setUp_(config);
     chrome.test.sendMessage("Launched");
   });
 };