content/browser/web_contents/web_contents_impl_browsertest.cc - Issue 2702503002: Block renderer-initiated main frame navigations to data URLs

Unified Diff: content/browser/web_contents/web_contents_impl_browsertest.cc

Issue 2702503002: Block renderer-initiated main frame navigations to data URLs (Closed)

Patch Set: dcheng comments - move checks to FrameLoader Created 3 years, 8 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View side-by-side diff with in-line comments

« content/browser/frame_host/data_url_navigation_throttle.h ('K') | « content/browser/frame_host/navigation_handle_impl.cc ('k') | content/child/runtime_features.cc » ('j') | third_party/WebKit/Source/core/loader/FrameLoader.cpp » ('J')
Expand Comments ('e') | Collapse Comments ('c') | Hide Comments ('s')

Index: content/browser/web_contents/web_contents_impl_browsertest.cc

diff --git a/content/browser/web_contents/web_contents_impl_browsertest.cc b/content/browser/web_contents/web_contents_impl_browsertest.cc

index 457ec145f602f5549c4c0022453208964cb3eb7d..cb7fccecf4dbbe6f119f7c56c64acb0c1430d56b 100644

--- a/content/browser/web_contents/web_contents_impl_browsertest.cc

+++ b/content/browser/web_contents/web_contents_impl_browsertest.cc

@@ -801,7 +801,7 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,

"window.open('" + kViewSourceURL.spec() + "');"));

Shell* new_shell = new_shell_observer.GetShell();

WaitForLoadStop(new_shell->web_contents());

- EXPECT_EQ("", new_shell->web_contents()->GetURL().spec());

+ EXPECT_TRUE(new_shell->web_contents()->GetURL().spec().empty());

// No navigation should commit.

EXPECT_FALSE(

new_shell->web_contents()->GetController().GetLastCommittedEntry());

@@ -848,90 +848,6 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, ViewSourceWebUI) {

->IsViewSourceMode());

}

-namespace {

-const char kDataUrlWarningPattern[] =

- "Upcoming versions will block content-initiated top frame navigations*";

-// This class listens for console messages other than the data: URL warning. It

-// fails the test if it sees a data: URL warning.

-class NoDataURLWarningConsoleObserverDelegate : public ConsoleObserverDelegate {

- public:

- using ConsoleObserverDelegate::ConsoleObserverDelegate;

- // WebContentsDelegate method:

- bool DidAddMessageToConsole(WebContents* source,

- int32_t level,

- const base::string16& message,

- int32_t line_no,

- const base::string16& source_id) override {

- std::string ascii_message = base::UTF16ToASCII(message);

- EXPECT_FALSE(base::MatchPattern(ascii_message, kDataUrlWarningPattern));

- return ConsoleObserverDelegate::DidAddMessageToConsole(

- source, level, message, line_no, source_id);

- }

-};

-} // namespace

-// Test that a direct navigation to a data URL doesn't show a console warning.

-IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, DataURLDirectNavigation) {

- ASSERT_TRUE(embedded_test_server()->Start());

- const GURL kUrl(embedded_test_server()->GetURL("/simple_page.html"));

- NoDataURLWarningConsoleObserverDelegate console_delegate(

- shell()->web_contents(), "FINISH");

- shell()->web_contents()->SetDelegate(&console_delegate);

- NavigateToURL(

- shell(),

- GURL("data:text/html,<html><script>console.log('FINISH');</script>"));

- console_delegate.Wait();

- EXPECT_TRUE(shell()->web_contents()->GetURL().SchemeIs(url::kDataScheme));

- EXPECT_FALSE(

- base::MatchPattern(console_delegate.message(), kDataUrlWarningPattern));

-// Test that window.open to a data URL shows a console warning.

-IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,

- DataURLWindowOpen_ShouldWarn) {

- ASSERT_TRUE(embedded_test_server()->Start());

- const GURL kUrl(embedded_test_server()->GetURL("/simple_page.html"));

- NavigateToURL(shell(), kUrl);

- ShellAddedObserver new_shell_observer;

- EXPECT_TRUE(ExecuteScript(shell()->web_contents(),

- "window.open('data:text/plain,test');"));

- Shell* new_shell = new_shell_observer.GetShell();

- ConsoleObserverDelegate console_delegate(

- new_shell->web_contents(),

- "Upcoming versions will block content-initiated top frame navigations*");

- new_shell->web_contents()->SetDelegate(&console_delegate);

- console_delegate.Wait();

- EXPECT_TRUE(new_shell->web_contents()->GetURL().SchemeIs(url::kDataScheme));

-// Test that a content initiated navigation to a data URL shows a console

-// warning.

-IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, DataURLRedirect_ShouldWarn) {

- ASSERT_TRUE(embedded_test_server()->Start());

- const GURL kUrl(embedded_test_server()->GetURL("/simple_page.html"));

- NavigateToURL(shell(), kUrl);

- ConsoleObserverDelegate console_delegate(

- shell()->web_contents(),

- "Upcoming versions will block content-initiated top frame navigations*");

- shell()->web_contents()->SetDelegate(&console_delegate);

- EXPECT_TRUE(ExecuteScript(shell()->web_contents(),

- "window.location.href = 'data:text/plain,test';"));

- console_delegate.Wait();

- EXPECT_TRUE(shell()

- ->web_contents()

- ->GetController()

- .GetLastCommittedEntry()

- ->GetURL()

- .SchemeIs(url::kDataScheme));

IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, NewNamedWindow) {

ASSERT_TRUE(embedded_test_server()->Start());