Chromium Code Reviews Chromium Code Reviews
Issue 2761173002:
Disallow JS execution on WebUI pages. (Closed)
| OLD | NEW |
|---|---|
| 1 // Copyright 2012 The Chromium Authors. All rights reserved. | 1 // Copyright 2012 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #import "ios/web/web_state/ui/crw_web_controller.h" | 5 #import "ios/web/web_state/ui/crw_web_controller.h" |
| 6 | 6 |
| 7 #import <WebKit/WebKit.h> | 7 #import <WebKit/WebKit.h> |
| 8 | 8 |
| 9 #include <utility> | 9 #include <utility> |
| 10 | 10 |
| (...skipping 15 matching lines...) Expand all Loading... | |
| 26 #import "ios/web/public/web_state/crw_web_controller_observer.h" | 26 #import "ios/web/public/web_state/crw_web_controller_observer.h" |
| 27 #import "ios/web/public/web_state/ui/crw_content_view.h" | 27 #import "ios/web/public/web_state/ui/crw_content_view.h" |
| 28 #import "ios/web/public/web_state/ui/crw_native_content.h" | 28 #import "ios/web/public/web_state/ui/crw_native_content.h" |
| 29 #import "ios/web/public/web_state/ui/crw_native_content_provider.h" | 29 #import "ios/web/public/web_state/ui/crw_native_content_provider.h" |
| 30 #import "ios/web/public/web_state/ui/crw_web_view_content_view.h" | 30 #import "ios/web/public/web_state/ui/crw_web_view_content_view.h" |
| 31 #include "ios/web/public/web_state/url_verification_constants.h" | 31 #include "ios/web/public/web_state/url_verification_constants.h" |
| 32 #include "ios/web/public/web_state/web_state_observer.h" | 32 #include "ios/web/public/web_state/web_state_observer.h" |
| 33 #import "ios/web/test/web_test_with_web_controller.h" | 33 #import "ios/web/test/web_test_with_web_controller.h" |
| 34 #import "ios/web/test/wk_web_view_crash_utils.h" | 34 #import "ios/web/test/wk_web_view_crash_utils.h" |
| 35 #import "ios/web/web_state/ui/crw_web_controller_container_view.h" | 35 #import "ios/web/web_state/ui/crw_web_controller_container_view.h" |
| 36 #import "ios/web/web_state/ui/web_view_js_utils.h" | |
| 36 #import "ios/web/web_state/web_state_impl.h" | 37 #import "ios/web/web_state/web_state_impl.h" |
| 37 #import "ios/web/web_state/wk_web_view_security_util.h" | 38 #import "ios/web/web_state/wk_web_view_security_util.h" |
| 38 #import "net/base/mac/url_conversions.h" | 39 #import "net/base/mac/url_conversions.h" |
| 39 #include "net/ssl/ssl_info.h" | 40 #include "net/ssl/ssl_info.h" |
| 40 #include "net/test/cert_test_util.h" | 41 #include "net/test/cert_test_util.h" |
| 41 #include "net/test/test_data_directory.h" | 42 #include "net/test/test_data_directory.h" |
| 42 #include "testing/gtest/include/gtest/gtest.h" | 43 #include "testing/gtest/include/gtest/gtest.h" |
| 43 #import "testing/gtest_mac.h" | 44 #import "testing/gtest_mac.h" |
| 44 #include "third_party/ocmock/OCMock/OCMock.h" | 45 #include "third_party/ocmock/OCMock/OCMock.h" |
| 45 #include "third_party/ocmock/gtest_support.h" | 46 #include "third_party/ocmock/gtest_support.h" |
| (...skipping 821 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 867 // Expect at least one more TitleWasSet callback after changing title via | 868 // Expect at least one more TitleWasSet callback after changing title via |
| 868 // JavaScript. On iOS 10 WKWebView fires 3 callbacks after JS excucution | 869 // JavaScript. On iOS 10 WKWebView fires 3 callbacks after JS excucution |
| 869 // with the following title changes: "Title2", "" and "Title2". | 870 // with the following title changes: "Title2", "" and "Title2". |
| 870 // TODO(crbug.com/696104): There should be only 2 calls of TitleWasSet. | 871 // TODO(crbug.com/696104): There should be only 2 calls of TitleWasSet. |
| 871 // Fix expecteation when WKWebView stops sending extra KVO calls. | 872 // Fix expecteation when WKWebView stops sending extra KVO calls. |
| 872 ExecuteJavaScript(@"window.document.title = 'Title2';"); | 873 ExecuteJavaScript(@"window.document.title = 'Title2';"); |
| 873 EXPECT_EQ("Title2", base::UTF16ToUTF8(web_state()->GetTitle())); | 874 EXPECT_EQ("Title2", base::UTF16ToUTF8(web_state()->GetTitle())); |
| 874 EXPECT_GE(observer.title_change_count(), 2); | 875 EXPECT_GE(observer.title_change_count(), 2); |
| 875 }; | 876 }; |
| 876 | 877 |
| 878 // Test fixture for JavaScript execution. | |
| 879 class ScriptExecutionTest : public web::WebTestWithWebController { | |
| 880 protected: | |
| 881 // Calls |executeUserJavaScript:completionHandler:|, waits for script | |
| 882 // execution completion, and synchronously returns the result. | |
| 883 id ExecuteUserJavaScript(NSString* java_script, NSError** error) { | |
| 884 __block id script_result = nil; | |
| 885 __block NSError* script_error = nil; | |
| 886 __block bool script_executed = false; | |
| 887 [web_controller() | |
| 888 executeUserJavaScript:java_script | |
| 889 completionHandler:^(id local_result, NSError* local_error) { | |
| 890 script_result = [local_result retain]; | |
| 891 script_error = [local_error retain]; | |
| 892 script_executed = true; | |
| 893 }]; | |
| 894 | |
| 895 WaitForCondition(^{ | |
| 896 return script_executed; | |
| 897 }); | |
| 898 | |
| 899 if (error) { | |
| 900 *error = script_error; | |
| 901 } | |
| 902 [script_error autorelease]; | |
| 903 return [script_result autorelease]; | |
| 904 } | |
| 905 }; | |
| 906 | |
| 907 // Tests evaluating user script on an http page. | |
| 908 TEST_F(ScriptExecutionTest, UserScriptOnHttpPage) { | |
| 909 LoadHtml(@"<html></html>", GURL(kTestURLString)); | |
| 910 NSError* error = nil; | |
| 911 EXPECT_NSEQ(@0, ExecuteUserJavaScript(@"window.w = 0;", &error)); | |
| 912 EXPECT_FALSE(error); | |
| 913 | |
| 914 EXPECT_NSEQ(@0, ExecuteJavaScript(@"window.w")); | |
| 915 }; | |
| 916 | |
| 917 // Tests evaluating user script on app-specific page. Pages with app-specific | |
| 918 // URLs have elevatied previledges and JavaScript execution should not be | |
|
lpromero
2017/03/23 12:43:48
nit: elevated privileges
Eugene But (OOO till 7-30)
2017/03/23 17:45:08
Done.
| |
| 919 // allowed for them. | |
| 920 TEST_F(ScriptExecutionTest, UserScriptOnAppSpecificPage) { | |
| 921 LoadHtml(@"<html></html>", GURL(kTestURLString)); | |
| 922 | |
| 923 // Change last committed URL to app-specific URL. | |
| 924 web::NavigationManagerImpl& nav_manager = | |
| 925 [web_controller() webStateImpl]->GetNavigationManagerImpl(); | |
| 926 nav_manager.AddPendingItem(GURL(kTestAppSpecificURL), web::Referrer(), | |
| 927 ui::PAGE_TRANSITION_TYPED, | |
| 928 web::NavigationInitiationType::USER_INITIATED); | |
| 929 [nav_manager.GetSessionController() commitPendingItem]; | |
| 930 | |
| 931 NSError* error = nil; | |
| 932 EXPECT_FALSE(ExecuteUserJavaScript(@"window.w = 0;", &error)); | |
| 933 ASSERT_TRUE(error); | |
| 934 EXPECT_NSEQ(web::kJSEvaluationErrorDomain, error.domain); | |
| 935 EXPECT_EQ(web::JS_EVALUATION_ERROR_CODE_NO_WEB_VIEW, error.code); | |
| 936 | |
| 937 EXPECT_FALSE(ExecuteJavaScript(@"window.w")); | |
| 938 }; | |
| 939 | |
| 877 // Fixture class to test WKWebView crashes. | 940 // Fixture class to test WKWebView crashes. |
| 878 class CRWWebControllerWebProcessTest : public web::WebTestWithWebController { | 941 class CRWWebControllerWebProcessTest : public web::WebTestWithWebController { |
| 879 protected: | 942 protected: |
| 880 void SetUp() override { | 943 void SetUp() override { |
| 881 web::WebTestWithWebController::SetUp(); | 944 web::WebTestWithWebController::SetUp(); |
| 882 webView_.reset([web::BuildTerminatedWKWebView() retain]); | 945 webView_.reset([web::BuildTerminatedWKWebView() retain]); |
| 883 base::scoped_nsobject<TestWebViewContentView> webViewContentView( | 946 base::scoped_nsobject<TestWebViewContentView> webViewContentView( |
| 884 [[TestWebViewContentView alloc] | 947 [[TestWebViewContentView alloc] |
| 885 initWithMockWebView:webView_ | 948 initWithMockWebView:webView_ |
| 886 scrollView:[webView_ scrollView]]); | 949 scrollView:[webView_ scrollView]]); |
| (...skipping 12 matching lines...) Expand all Loading... | |
| 899 web::TestWebStateObserver* observer_ptr = &observer; | 962 web::TestWebStateObserver* observer_ptr = &observer; |
| 900 web::SimulateWKWebViewCrash(webView_); | 963 web::SimulateWKWebViewCrash(webView_); |
| 901 base::test::ios::WaitUntilCondition(^bool() { | 964 base::test::ios::WaitUntilCondition(^bool() { |
| 902 return observer_ptr->render_process_gone_info(); | 965 return observer_ptr->render_process_gone_info(); |
| 903 }); | 966 }); |
| 904 EXPECT_EQ(web_state(), observer.render_process_gone_info()->web_state); | 967 EXPECT_EQ(web_state(), observer.render_process_gone_info()->web_state); |
| 905 EXPECT_FALSE([web_controller() isViewAlive]); | 968 EXPECT_FALSE([web_controller() isViewAlive]); |
| 906 }; | 969 }; |
| 907 | 970 |
| 908 } // namespace | 971 } // namespace |
| OLD | NEW |
