Block renderer-initiated main frame navigations to data URLs

extensions/test/data/web_view/apitest/main.js

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 var embedder = {};
 
 // TODO(lfg) Move these functions to a common js.
 embedder.setUp_ = function(config) {
   if (!config || !config.testServer) {
     return;
   }
   embedder.baseGuestURL = 'http://localhost:' + config.testServer.port;
   embedder.closeSocketURL = embedder.baseGuestURL + '/close-socket';
   embedder.emptyGuestURL = embedder.baseGuestURL + '/empty_guest.html';
   embedder.noReferrerGuestURL =
       embedder.baseGuestURL + '/guest_noreferrer.html';
   embedder.detectUserAgentURL = embedder.baseGuestURL + '/detect-user-agent';
   embedder.redirectGuestURL = embedder.baseGuestURL + '/server-redirect';
   embedder.redirectGuestURLDest =
       embedder.baseGuestURL + '/guest_redirect.html';
   embedder.windowOpenGuestURL = embedder.baseGuestURL + '/guest.html';
+  embedder.windowOpenGuestDataURL =
+      embedder.baseGuestURL + '/guest_data_url.html';
   embedder.sameDocumentNavigationURL =
       embedder.baseGuestURL + '/guest_same_document_navigation.html';
 };
 
 window.runTest = function(testName) {
   if (!embedder.test.testList[testName]) {
     window.console.warn('Incorrect testName: ' + testName);
     embedder.test.fail();
     return;
   }
@@ skipping 426 matching lines @@
   webview.addEventListener('loadabort', function(e) {
     embedder.test.fail();
   });
   webview.addEventListener('loadstop', function(e) {
     embedder.test.succeed();
   });
   webview.setAttribute('src', localResource);
   document.body.appendChild(webview);
 }
 
+// This test verifies that guests are blocked from navigating the webview to a
+// data URL.
+function testContentInitiatedNavigationToDataUrlBlocked() {
+  var navUrl = "data:text/html,foo";
+  var webview = document.createElement('webview');
+  webview.addEventListener('consolemessage', function(e) {
+    if (e.message.startsWith(
+        'Not allowed to top-level navigate to resource:')) {
+      embedder.test.succeed();
+    }
+  });
+  webview.addEventListener('loadstop', function(e) {
+    if (webview.getAttribute('src') == navUrl) {
+      embedder.test.fail();
+    }
+  });
+  webview.setAttribute('src',
+      'data:text/html,<script>window.location.href = "' + navUrl +
+      '";</scr' + 'ipt>');
+  document.body.appendChild(webview);
+}
+
 // This test verifies that the load event fires when the a new page is
 // loaded.
 // TODO(fsamuel): Add a test to verify that subframe loads within a guest
 // do not fire the 'contentload' event.
 function testContentLoadEvent() {
   var webview = document.createElement('webview');
   webview.addEventListener('contentload', function(e) {
     embedder.test.succeed();
   });
   webview.setAttribute('src', 'data:text/html,trigger navigation');
@@ skipping 209 matching lines @@
 }
 
 // This test verifies that the call to executeScript will fail and return null
 // if the webview has been navigated between the time the call was made and the
 // time it arrives in the guest process.
 function testExecuteScriptIsAbortedWhenWebViewSourceIsChanged() {
   var webview = document.createElement('webview');
   webview.addEventListener('loadstop', function onLoadStop(e) {
     window.console.log('2. Inject script to trigger a guest-initiated ' +
         'navigation.');
-    var navUrl = 'data:text/html,trigger nav';
+    var navUrl = embedder.baseGuestURL + "/empty.html";
     webview.executeScript({
       code: 'window.location.href = "' + navUrl + '";'
     });
 
     window.console.log('3. Listening for the load that will be started as a ' +
         'result of 2.');
     webview.addEventListener('loadstart', function onLoadStart(e) {
-      embedder.test.assertEq('about:blank', webview.src);
+      embedder.test.assertEq('data:text/html, initial page', webview.src);
       window.console.log('4. Attempting to inject script into about:blank. ' +
           'This is expected to fail.');
       webview.executeScript(
         { code: 'document.body.style.backgroundColor = "red";' },
         function(results) {
           window.console.log(
               '5. Verify that executeScript has, indeed, failed.');
           embedder.test.assertEq(null, results);
           embedder.test.assertEq(navUrl, webview.src);
           embedder.test.succeed();
         }
       );
       webview.removeEventListener('loadstart', onLoadStart);
     });
     webview.removeEventListener('loadstop', onLoadStop);
   });
 
   window.console.log('1. Performing initial navigation.');
-  webview.setAttribute('src', 'about:blank');
+  webview.setAttribute('src', 'data:text/html, initial page');
   document.body.appendChild(webview);
 }
 
 function testFindAPI() {
   var webview = new WebView();
   webview.src = 'data:text/html,Dog dog dog Dog dog dogcatDog dogDogdog<br>' +
       'Dog dog dog Dog dog dogcatDog dogDogdog<br>' +
       'Dog dog dog Dog dog dogcatDog dogDogdog<br>' +
       'Dog dog dog Dog dog dogcatDog dogDogdog<br>' +
       'Dog dog dog Dog dog dogcatDog dogDogdog<br>' +
@@ skipping 487 matching lines @@
       embedder.test.fail();
     } else {
       webview.src = tests[loadCommitCount];
     }
   });
   webview.src = tests[0];
   document.body.appendChild(webview);
 }
 
 // This test verifies that new window attachment functions as expected.
+//
+// TODO(crbug.com/594215) Test that opening a new window with a data URL is
+// blocked. There is currently no way to test this, as the block message is
+// printed on the new window which never gets created, so the message is lost.
+// Also test that opening a new window with a data URL when the webview is
+// already on a data URL is allowed.
 function testNewWindow() {
   var webview = document.createElement('webview');
   webview.addEventListener('newwindow', function(e) {
     e.preventDefault();
     var newwebview = document.createElement('webview');
     newwebview.addEventListener('loadstop', function(evt) {
       // If the new window finishes loading, the test is successful.
       embedder.test.succeed();
     });
     document.body.appendChild(newwebview);
@@ skipping 504 matching lines @@
   'testAPIMethodExistence': testAPIMethodExistence,
   'testAssignSrcAfterCrash': testAssignSrcAfterCrash,
   'testAutosizeAfterNavigation': testAutosizeAfterNavigation,
   'testAutosizeBeforeNavigation': testAutosizeBeforeNavigation,
   'testAutosizeHeight': testAutosizeHeight,
   'testAutosizeRemoveAttributes': testAutosizeRemoveAttributes,
   'testAutosizeWithPartialAttributes': testAutosizeWithPartialAttributes,
   'testCannotMutateEventName': testCannotMutateEventName,
   'testChromeExtensionRelativePath': testChromeExtensionRelativePath,
   'testChromeExtensionURL': testChromeExtensionURL,
+  'testContentInitiatedNavigationToDataUrlBlocked':
+      testContentInitiatedNavigationToDataUrlBlocked,
   'testContentLoadEvent': testContentLoadEvent,
   'testDeclarativeWebRequestAPI': testDeclarativeWebRequestAPI,
   'testDeclarativeWebRequestAPISendMessage':
       testDeclarativeWebRequestAPISendMessage,
   'testDestroyOnEventListener': testDestroyOnEventListener,
   'testDisplayNoneWebviewLoad': testDisplayNoneWebviewLoad,
   'testDisplayNoneWebviewRemoveChild': testDisplayNoneWebviewRemoveChild,
   'testEventName': testEventName,
   'testExecuteScript': testExecuteScript,
   'testExecuteScriptFail': testExecuteScriptFail,
@@ skipping 44 matching lines @@
   'testWebRequestAPIGoogleProperty': testWebRequestAPIGoogleProperty,
   'testCaptureVisibleRegion': testCaptureVisibleRegion
 };
 
 onload = function() {
   chrome.test.getConfig(function(config) {
     embedder.setUp_(config);
     chrome.test.sendMessage('LAUNCHED');
   });
 };