Moved all tests about bypassing CSP into csp-tests (content layer)

content/common/content_security_policy/content_security_policy_unittest.cc

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/common/content_security_policy/csp_context.h"
 #include "content/common/content_security_policy_header.h"
 #include "content/common/navigation_params.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace content {
 
 namespace {
 class CSPContextTest : public CSPContext {
  public:
   const std::string& LastConsoleMessage() { return console_message_; }
 
+  void AddSchemeToBypassCSP(const std::string& scheme) {
+    scheme_to_bypass_.push_back(scheme);
+  }
+
+  bool SchemeShouldBypassCSP(const base::StringPiece& scheme) override {
+    return std::find(scheme_to_bypass_.begin(), scheme_to_bypass_.end(),
+                     scheme) != scheme_to_bypass_.end();
+  }
+
  private:
   void ReportContentSecurityPolicyViolation(
       const CSPViolationParams& violation_params) override {
     console_message_ = violation_params.console_message;
   }
   std::string console_message_;
+  std::vector<std::string> scheme_to_bypass_;
 };

[jochen (gone - plz use gerrit), 2017/04/05 12:22:35]

please add DISALLOW_COPY_AND_ASSIGN(CSPContextTest);

[andypaicu, 2017/04/05 12:55:00]

Done

 
 ContentSecurityPolicyHeader EmptyCspHeader() {
   return ContentSecurityPolicyHeader(std::string(),
                                      blink::WebContentSecurityPolicyTypeEnforce,
                                      blink::WebContentSecurityPolicySourceHTTP);
 }
 
 }  // namespace
 
 TEST(ContentSecurityPolicy, NoDirective) {
@@ skipping 91 matching lines @@
                                               GURL("http://b.com"), false,
                                               &context, SourceLocation()));
     const char console_message[] =
         "Refused to frame 'http://b.com/' because it violates "
         "the following Content Security Policy directive: \"frame-src "
         "http://a.com\".\n";
     EXPECT_EQ(console_message, context.LastConsoleMessage());
   }
 }
 
+TEST(ContentSecurityPolicy, RequestsAllowedWhenBypassingCSP) {
+  CSPContextTest context;
+  std::vector<std::string> report_end_points;  // empty
+  CSPSource source("https", "example.com", false, url::PORT_UNSPECIFIED, false,
+                   "");
+  CSPSourceList source_list(false, false, {source});
+  ContentSecurityPolicy policy(
+      EmptyCspHeader(), {CSPDirective(CSPDirective::DefaultSrc, source_list)},
+      report_end_points);
+
+  EXPECT_TRUE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
+                                           GURL("https://example.com/"), false,
+                                           &context, SourceLocation()));
+  EXPECT_FALSE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
+                                            GURL("https://not-example.com/"),
+                                            false, &context, SourceLocation()));
+
+  // Register 'https' as bypassing CSP, which should now bypass is entirely.
+  context.AddSchemeToBypassCSP("https");
+
+  EXPECT_TRUE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
+                                           GURL("https://example.com/"), false,
+                                           &context, SourceLocation()));
+  EXPECT_TRUE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
+                                           GURL("https://not-example.com/"),
+                                           false, &context, SourceLocation()));
+}
+
+TEST(ContentSecurityPolicy, FilesystemAllowedWhenBypassingCSP) {
+  CSPContextTest context;
+  std::vector<std::string> report_end_points;  // empty
+  CSPSource source("https", "example.com", false, url::PORT_UNSPECIFIED, false,
+                   "");
+  CSPSourceList source_list(false, false, {source});
+  ContentSecurityPolicy policy(
+      EmptyCspHeader(), {CSPDirective(CSPDirective::DefaultSrc, source_list)},
+      report_end_points);
+
+  EXPECT_FALSE(ContentSecurityPolicy::Allow(
+      policy, CSPDirective::FrameSrc,
+      GURL("filesystem:https://example.com/file.txt"), false, &context,
+      SourceLocation()));
+  EXPECT_FALSE(ContentSecurityPolicy::Allow(
+      policy, CSPDirective::FrameSrc,
+      GURL("filesystem:https://not-example.com/file.txt"), false, &context,
+      SourceLocation()));
+
+  // Register 'https' as bypassing CSP, which should now bypass is entirely.
+  context.AddSchemeToBypassCSP("https");
+
+  EXPECT_TRUE(ContentSecurityPolicy::Allow(
+      policy, CSPDirective::FrameSrc,
+      GURL("filesystem:https://example.com/file.txt"), false, &context,
+      SourceLocation()));
+  EXPECT_TRUE(ContentSecurityPolicy::Allow(
+      policy, CSPDirective::FrameSrc,
+      GURL("filesystem:https://not-example.com/file.txt"), false, &context,
+      SourceLocation()));
+}
+
+TEST(ContentSecurityPolicy, BlobAllowedWhenBypassingCSP) {
+  CSPContextTest context;
+  std::vector<std::string> report_end_points;  // empty
+  CSPSource source("https", "example.com", false, url::PORT_UNSPECIFIED, false,
+                   "");
+  CSPSourceList source_list(false, false, {source});
+  ContentSecurityPolicy policy(
+      EmptyCspHeader(), {CSPDirective(CSPDirective::DefaultSrc, source_list)},
+      report_end_points);
+
+  EXPECT_FALSE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
+                                            GURL("blob:https://example.com/"),
+                                            false, &context, SourceLocation()));
+  EXPECT_FALSE(ContentSecurityPolicy::Allow(
+      policy, CSPDirective::FrameSrc, GURL("blob:https://not-example.com/"),
+      false, &context, SourceLocation()));
+
+  // Register 'https' as bypassing CSP, which should now bypass is entirely.
+  context.AddSchemeToBypassCSP("https");
+
+  EXPECT_TRUE(ContentSecurityPolicy::Allow(policy, CSPDirective::FrameSrc,
+                                           GURL("blob:https://example.com/"),
+                                           false, &context, SourceLocation()));
+  EXPECT_TRUE(ContentSecurityPolicy::Allow(
+      policy, CSPDirective::FrameSrc, GURL("blob:https://not-example.com/"),
+      false, &context, SourceLocation()));
+}
+
 }  // namespace content