Replicate feature policy container policies.

third_party/WebKit/Source/core/html/HTMLIFrameElementTest.cpp

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "core/html/HTMLIFrameElement.h"
 
 #include "core/dom/Document.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace blink {
@@ skipping 11 matching lines @@
 
 // Test setting feature policy via the DOMTokenList (JS codepath).
 TEST(HTMLIFrameElementTest, SetAllowAttributeJS) {
   Document* document = Document::Create();
   HTMLIFrameElement* iframe = HTMLIFrameElement::Create(*document);
 
   iframe->allow()->setValue("fullscreen");
   EXPECT_EQ("fullscreen", iframe->getAttribute(HTMLNames::allowAttr));
 }
 
+// Test that the correct origin is used when constructing the container policy,
+// and that frames which should inherit their parent document's origin do so.
+TEST(HTMLIFrameElementTest, FramesUseCorrectOrigin) {
+  Document* document = Document::Create();
+  document->UpdateSecurityOrigin(
+      SecurityOrigin::Create(KURL(KURL(), "http://example.com")));
+
+  HTMLIFrameElement* frame_element = HTMLIFrameElement::Create(*document);
+
+  frame_element->setAttribute(HTMLNames::srcAttr, "about:blank");
+  RefPtr<SecurityOrigin> effective_origin =
+      frame_element->GetOriginForFeaturePolicy();
+  EXPECT_TRUE(
+      effective_origin->IsSameSchemeHostPort(document->GetSecurityOrigin()));
+
+  frame_element->setAttribute(HTMLNames::srcAttr, "http://example.net/");
+  effective_origin = frame_element->GetOriginForFeaturePolicy();
+  EXPECT_FALSE(
+      effective_origin->IsSameSchemeHostPort(document->GetSecurityOrigin()));
+}
+
+// Test that a unique origin is used when constructing the container policy in a
+// sandboxed iframe.
+TEST(HTMLIFrameElementTest, SandboxFramesUseCorrectOrigin) {
+  Document* document = Document::Create();
+  document->UpdateSecurityOrigin(
+      SecurityOrigin::Create(KURL(KURL(), "http://example.com")));
+
+  HTMLIFrameElement* frame_element = HTMLIFrameElement::Create(*document);
+
+  frame_element->setAttribute(HTMLNames::sandboxAttr, "sandbox");
+  frame_element->setAttribute(HTMLNames::srcAttr, "http://example.com/");
+  RefPtr<SecurityOrigin> effective_origin =
+      frame_element->GetOriginForFeaturePolicy();
+  EXPECT_FALSE(
+      effective_origin->IsSameSchemeHostPort(document->GetSecurityOrigin()));

[alexmos, 2017/04/13 02:09:15]

nit: I'd also check that effective_origin->IsUnique() is true (and similarly in
the sandbox srcdoc test)

[iclelland, 2017/04/13 19:05:31]

Done. (And I'd added that to the ContainerPolicy tests below in the latest patch
as well)

+
+  frame_element->setAttribute(HTMLNames::srcAttr, "http://example.net/");
+  effective_origin = frame_element->GetOriginForFeaturePolicy();
+  EXPECT_FALSE(
+      effective_origin->IsSameSchemeHostPort(document->GetSecurityOrigin()));
+}
+
+// Test that the parent document's origin is used when constructing the
+// container policy in a srcdoc iframe.
+TEST(HTMLIFrameElementTest, SrcdocFramesUseCorrectOrigin) {
+  Document* document = Document::Create();
+  document->UpdateSecurityOrigin(
+      SecurityOrigin::Create(KURL(KURL(), "http://example.com")));
+
+  HTMLIFrameElement* frame_element = HTMLIFrameElement::Create(*document);
+
+  frame_element->setAttribute(HTMLNames::srcdocAttr, "<title>title</title>");
+  RefPtr<SecurityOrigin> effective_origin =
+      frame_element->GetOriginForFeaturePolicy();
+  EXPECT_TRUE(
+      effective_origin->IsSameSchemeHostPort(document->GetSecurityOrigin()));
+}
+
+// Test that a unique origin is used when constructing the container policy in a
+// sandboxed iframe with a srcdoc.
+TEST(HTMLIFrameElementTest, SandboxedSrcdocFramesUseCorrectOrigin) {
+  Document* document = Document::Create();
+  document->UpdateSecurityOrigin(
+      SecurityOrigin::Create(KURL(KURL(), "http://example.com")));
+
+  HTMLIFrameElement* frame_element = HTMLIFrameElement::Create(*document);
+
+  frame_element->setAttribute(HTMLNames::sandboxAttr, "sandbox");
+  frame_element->setAttribute(HTMLNames::srcdocAttr, "<title>title</title>");
+  RefPtr<SecurityOrigin> effective_origin =
+      frame_element->GetOriginForFeaturePolicy();
+  EXPECT_FALSE(
+      effective_origin->IsSameSchemeHostPort(document->GetSecurityOrigin()));
+}
+
 }  // namespace blink