Implement CanRequest in BaseFetchContext

third_party/WebKit/Source/core/loader/BaseFetchContextTest.cpp

 /*
  * Copyright (c) 2015, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 19 matching lines @@
 
 #include "core/loader/BaseFetchContext.h"
 
 #include "core/testing/NullExecutionContext.h"
 #include "platform/RuntimeEnabledFeatures.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace blink {
 
+class MockBaseFetchContext final : public BaseFetchContext {
+ public:
+  explicit MockBaseFetchContext(ExecutionContext* execution_context)
+      : BaseFetchContext(execution_context) {}
+  ~MockBaseFetchContext() override {}
+
+  // BaseFetchContext overrides:
+  ContentSettingsClient* GetContentSettingsClient() const override {
+    return nullptr;
+  }
+  Settings* GetSettings() const override { return nullptr; }
+  SubresourceFilter* GetSubresourceFilter() const override { return nullptr; }
+  SecurityContext* GetMainResourceSecurityContext() const override {
+    return nullptr;
+  }
+  bool ShouldBlockRequestByInspector(const ResourceRequest&) const override {
+    return false;
+  }
+  void DispatchDidBlockRequest(const ResourceRequest&,
+                               const FetchInitiatorInfo&,
+                               ResourceRequestBlockedReason) const override {}
+  void ReportLocalLoadFailed(const KURL&) const override {}
+  bool ShouldBypassMainWorldCSP() const override { return false; }
+  bool IsSVGImageChromeClient() const override { return false; }
+  void CountUsage(UseCounter::Feature) const override {}
+  void CountDeprecation(UseCounter::Feature) const override {}
+  bool ShouldBlockFetchByMixedContentCheck(
+      const ResourceRequest&,
+      const KURL&,
+      SecurityViolationReportingPolicy) const override {
+    return false;
+  }
+};
+
 class BaseFetchContextTest : public ::testing::Test {
  protected:
   void SetUp() override {
     execution_context_ = new NullExecutionContext();
-    fetch_context_ = new BaseFetchContext(execution_context_);
+    static_cast<NullExecutionContext*>(execution_context_.Get())
+        ->SetUpSecurityContext();
+    fetch_context_ = new MockBaseFetchContext(execution_context_);
   }
 
   Persistent<ExecutionContext> execution_context_;
   Persistent<BaseFetchContext> fetch_context_;
 };
 
 TEST_F(BaseFetchContextTest, SetIsExternalRequestForPublicContext) {
   EXPECT_EQ(kWebAddressSpacePublic,
             execution_context_->GetSecurityContext().AddressSpace());
 
@@ skipping 121 matching lines @@
     fetch_context_->AddAdditionalRequestHeaders(main_request,
                                                 kFetchMainResource);
     EXPECT_EQ(test.is_external_expectation, main_request.IsExternalRequest());
 
     ResourceRequest sub_request(test.url);
     fetch_context_->AddAdditionalRequestHeaders(sub_request, kFetchSubresource);
     EXPECT_EQ(test.is_external_expectation, sub_request.IsExternalRequest());
   }
 }
 
+// Tests that CanFollowRedirect() checks both report-only and enforced CSP
+// headers.
+TEST_F(BaseFetchContextTest, RedirectChecksReportedAndEnforcedCSP) {
+  ContentSecurityPolicy* policy =
+      execution_context_->GetContentSecurityPolicy();
+  policy->DidReceiveHeader("script-src https://foo.test",
+                           kContentSecurityPolicyHeaderTypeEnforce,
+                           kContentSecurityPolicyHeaderSourceHTTP);
+  policy->DidReceiveHeader("script-src https://bar.test",
+                           kContentSecurityPolicyHeaderTypeReport,
+                           kContentSecurityPolicyHeaderSourceHTTP);
+  KURL url(KURL(), "http://baz.test");
+  ResourceRequest resource_request(url);
+  resource_request.SetRequestContext(WebURLRequest::kRequestContextScript);
+  EXPECT_EQ(
+      ResourceRequestBlockedReason::CSP,
+      fetch_context_->CanFollowRedirect(
+          Resource::kScript, resource_request, url, ResourceLoaderOptions(),
+          SecurityViolationReportingPolicy::kReport,
+          FetchParameters::kUseDefaultOriginRestrictionForType));
+  EXPECT_EQ(2u, policy->violation_reports_sent_.size());
+}
+
+// Tests that AllowResponse() checks both report-only and enforced CSP headers.
+TEST_F(BaseFetchContextTest, AllowResponseChecksReportedAndEnforcedCSP) {
+  ContentSecurityPolicy* policy =
+      execution_context_->GetContentSecurityPolicy();
+  policy->DidReceiveHeader("script-src https://foo.test",
+                           kContentSecurityPolicyHeaderTypeEnforce,
+                           kContentSecurityPolicyHeaderSourceHTTP);
+  policy->DidReceiveHeader("script-src https://bar.test",
+                           kContentSecurityPolicyHeaderTypeReport,
+                           kContentSecurityPolicyHeaderSourceHTTP);
+  KURL url(KURL(), "http://baz.test");
+  ResourceRequest resource_request(url);
+  resource_request.SetRequestContext(WebURLRequest::kRequestContextScript);
+  EXPECT_EQ(ResourceRequestBlockedReason::CSP,
+            fetch_context_->AllowResponse(Resource::kScript, resource_request,
+                                          url, ResourceLoaderOptions()));
+  EXPECT_EQ(2u, policy->violation_reports_sent_.size());
+}
+
 }  // namespace blink