Chromium Code Reviews| OLD | NEW |
|---|---|
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "core/frame/csp/CSPSource.h" | 5 #include "core/frame/csp/CSPSource.h" |
| 6 | 6 |
| 7 #include "core/dom/Document.h" | 7 #include "core/dom/Document.h" |
| 8 #include "core/frame/csp/ContentSecurityPolicy.h" | 8 #include "core/frame/csp/ContentSecurityPolicy.h" |
| 9 #include "platform/network/ResourceRequest.h" | 9 #include "platform/network/ResourceRequest.h" |
| 10 #include "platform/weborigin/KURL.h" | 10 #include "platform/weborigin/KURL.h" |
| (...skipping 169 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 180 EXPECT_TRUE(source.matches(KURL(base, "ftp://a.com"))); | 180 EXPECT_TRUE(source.matches(KURL(base, "ftp://a.com"))); |
| 181 } | 181 } |
| 182 | 182 |
| 183 // Self scheme is unique | 183 // Self scheme is unique |
| 184 { | 184 { |
| 185 Persistent<ContentSecurityPolicy> csp(ContentSecurityPolicy::create()); | 185 Persistent<ContentSecurityPolicy> csp(ContentSecurityPolicy::create()); |
| 186 csp->setupSelf( | 186 csp->setupSelf( |
| 187 *SecurityOrigin::createFromString("non-standard-scheme://a.com/")); | 187 *SecurityOrigin::createFromString("non-standard-scheme://a.com/")); |
| 188 CSPSource source(csp.get(), "", "a.com", 0, "/", CSPSource::NoWildcard, | 188 CSPSource source(csp.get(), "", "a.com", 0, "/", CSPSource::NoWildcard, |
| 189 CSPSource::NoWildcard); | 189 CSPSource::NoWildcard); |
| 190 // TODO(mkwst, arthursonzogni): This result might be wrong. | |
| 191 // See http://crbug.com/692449 | |
| 192 EXPECT_FALSE(source.matches(KURL(base, "http://a.com"))); | 190 EXPECT_FALSE(source.matches(KURL(base, "http://a.com"))); |
| 193 // TODO(mkwst, arthursonzogni): This result might be wrong. | 191 |
| 194 // See http://crbug.com/692449 | 192 // The reason matching fails is because the host is parsed as "" when |
| 193 // using a non standard scheme even though it should be parsed as "a.com" | |
| 194 // After adding it to the list of standard schemes it now gets parsed | |
| 195 // correctly. This does not matter in practice though because there is | |
| 196 // no way to render/load anything like "non-standard-scheme://a.com" | |
| 195 EXPECT_FALSE(source.matches(KURL(base, "non-standard-scheme://a.com"))); | 197 EXPECT_FALSE(source.matches(KURL(base, "non-standard-scheme://a.com"))); |
|
andypaicu
2017/02/22 10:03:11
Raised bug about this 694959
Mike West
2017/02/22 15:38:44
I'd suggest that you actually add the scheme as st
| |
| 196 } | 198 } |
| 197 } | 199 } |
| 198 | 200 |
| 199 TEST_F(CSPSourceTest, InsecureHostSchemePortMatchesSecurePort) { | 201 TEST_F(CSPSourceTest, InsecureHostSchemePortMatchesSecurePort) { |
| 200 KURL base; | 202 KURL base; |
| 201 | 203 |
| 202 // source scheme is "http" | 204 // source scheme is "http" |
| 203 { | 205 { |
| 204 CSPSource source(csp.get(), "http", "example.com", 80, "/", | 206 CSPSource source(csp.get(), "http", "example.com", 80, "/", |
| 205 CSPSource::NoWildcard, CSPSource::NoWildcard); | 207 CSPSource::NoWildcard, CSPSource::NoWildcard); |
| (...skipping 692 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 898 normalized = B->intersect(A); | 900 normalized = B->intersect(A); |
| 899 Source intersectBA = { | 901 Source intersectBA = { |
| 900 normalized->m_scheme, normalized->m_host, | 902 normalized->m_scheme, normalized->m_host, |
| 901 normalized->m_path, normalized->m_port, | 903 normalized->m_path, normalized->m_port, |
| 902 normalized->m_hostWildcard, normalized->m_portWildcard}; | 904 normalized->m_hostWildcard, normalized->m_portWildcard}; |
| 903 EXPECT_TRUE(equalSources(intersectBA, test.normalized)); | 905 EXPECT_TRUE(equalSources(intersectBA, test.normalized)); |
| 904 } | 906 } |
| 905 } | 907 } |
| 906 | 908 |
| 907 } // namespace blink | 909 } // namespace blink |
| OLD | NEW |