Content API changes to improve DOM stitching in ThreatDetails code.

chrome/browser/safe_browsing/threat_details_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stdint.h>
 
 #include <algorithm>
 
 #include "base/bind.h"
 #include "base/macros.h"
 #include "base/pickle.h"
 #include "base/run_loop.h"
 #include "base/test/histogram_tester.h"
 #include "base/time/time.h"
 #include "chrome/browser/history/history_service_factory.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/safe_browsing/safe_browsing_service.h"
 #include "chrome/browser/safe_browsing/ui_manager.h"
 #include "chrome/test/base/chrome_render_view_host_test_harness.h"
 #include "chrome/test/base/testing_profile.h"
 #include "components/history/core/browser/history_backend.h"
 #include "components/history/core/browser/history_service.h"
 #include "components/safe_browsing/browser/threat_details.h"
 #include "components/safe_browsing/browser/threat_details_history.h"
 #include "components/safe_browsing/common/safebrowsing_messages.h"
 #include "components/safe_browsing/csd.pb.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/test/web_contents_tester.h"
+#include "content/test/test_render_frame_host.h"
 #include "net/base/io_buffer.h"
 #include "net/base/net_errors.h"
 #include "net/base/test_completion_callback.h"
 #include "net/disk_cache/disk_cache.h"
 #include "net/http/http_cache.h"
 #include "net/http/http_response_headers.h"
 #include "net/http/http_response_info.h"
 #include "net/http/http_util.h"
 #include "net/url_request/url_request_context.h"
 #include "net/url_request/url_request_context_getter.h"
@@ skipping 499 matching lines @@
 }
 
 // Tests creating a threat report when receiving data from multiple renderers.
 // We use three layers in this test:
 // kDOMParentURL
 //  \- <div id=outer>
 //    \- <iframe src=kDOMChildURL foo=bar>
 //      \- <div id=inner bar=baz/> - div and script are at the same level.
 //      \- <script src=kDOMChildURL2>
 TEST_F(ThreatDetailsTest, ThreatDOMDetails_MultipleFrames) {
+  // Create a child renderer inside the main frame to house the inner iframe.
+  // Perform the navigation first in order to manipulate the frame tree.
+  content::WebContentsTester::For(web_contents())
+      ->NavigateAndCommit(GURL(kLandingURL));
+  content::TestRenderFrameHost* test_main_rfh =

[Charlie Reis, 2017/05/12 21:40:50]

TestRenderFrameHost isn't a content/public class, so we can't use it directly
here.

It's a little convoluted, but you can say
RenderFrameHostTester::For(main_rfh())->AppendChild("subframe") instead.

Then you can declare child_rfh as a RenderFrameHost* as well.

[lpz, 2017/05/15 18:49:07]

Ahh great, thanks

+      static_cast<content::TestRenderFrameHost*>(main_rfh());
+  content::TestRenderFrameHost* child_rfh =
+      test_main_rfh->AppendChild("subframe");
+
   // Define two sets of DOM nodes - one for an outer page containing an iframe,
   // and then another for the inner page containing the contents of that iframe.
   std::vector<SafeBrowsingHostMsg_ThreatDOMDetails_Node> outer_params;
   SafeBrowsingHostMsg_ThreatDOMDetails_Node outer_child_div;
   outer_child_div.node_id = 1;
   outer_child_div.child_node_ids.push_back(2);
   outer_child_div.tag_name = "div";
   outer_child_div.parent = GURL(kDOMParentURL);
   outer_child_div.attributes.push_back(std::make_pair("id", "outer"));
   outer_params.push_back(outer_child_div);
 
   SafeBrowsingHostMsg_ThreatDOMDetails_Node outer_child_iframe;
   outer_child_iframe.node_id = 2;
   outer_child_iframe.parent_node_id = 1;
   outer_child_iframe.url = GURL(kDOMChildURL);
   outer_child_iframe.tag_name = "iframe";
   outer_child_iframe.parent = GURL(kDOMParentURL);
   outer_child_iframe.attributes.push_back(std::make_pair("src", kDOMChildURL));
   outer_child_iframe.attributes.push_back(std::make_pair("foo", "bar"));
+  outer_child_iframe.child_frame_routing_id = child_rfh->GetRoutingID();
   outer_params.push_back(outer_child_iframe);
 
   SafeBrowsingHostMsg_ThreatDOMDetails_Node outer_summary_node;
   outer_summary_node.url = GURL(kDOMParentURL);
   outer_summary_node.children.push_back(GURL(kDOMChildURL));
   outer_params.push_back(outer_summary_node);
 
   // Now define some more nodes for the body of the iframe.
   std::vector<SafeBrowsingHostMsg_ThreatDOMDetails_Node> inner_params;
   SafeBrowsingHostMsg_ThreatDOMDetails_Node inner_child_div;
@@ skipping 81 matching lines @@
   elem_dom_inner_div->add_attribute()->set_name("bar");
   elem_dom_inner_div->mutable_attribute(1)->set_value("baz");
 
   HTMLElement* elem_dom_inner_script = expected.add_dom();
   elem_dom_inner_script->set_id(3);
   elem_dom_inner_script->set_tag("SCRIPT");
   elem_dom_inner_script->set_resource_id(res_dom_child2->id());
   elem_dom_inner_script->add_attribute()->set_name("src");
   elem_dom_inner_script->mutable_attribute(0)->set_value(kDOMChildUrl2);
 
-  content::WebContentsTester::For(web_contents())
-      ->NavigateAndCommit(GURL(kLandingURL));
-
   UnsafeResource resource;
   InitResource(&resource, SB_THREAT_TYPE_URL_UNWANTED,
                true /* is_subresource */, GURL(kThreatURL));
 
   // Send both sets of nodes, from different render frames.
   {
     scoped_refptr<ThreatDetailsWrap> report = new ThreatDetailsWrap(
         ui_manager_.get(), web_contents(), resource, NULL, history_service());
 
-    // We call AddDOMDetails directly so we can specify different render frame
-    // IDs.
-    report->AddDOMDetails(100, GURL(kDOMParentURL), outer_params);
-    report->AddDOMDetails(200, GURL(kDOMChildURL), inner_params);
+    // Send both sets of nodes from different render frames.
+    report->OnReceivedThreatDOMDetails(main_rfh(), outer_params);
+    report->OnReceivedThreatDOMDetails(child_rfh, inner_params);
+
     std::string serialized = WaitForSerializedReport(
         report.get(), false /* did_proceed*/, 0 /* num_visit */);
     ClientSafeBrowsingReportRequest actual;
     actual.ParseFromString(serialized);
     VerifyResults(actual, expected);
   }
 
   // Try again but with the messages coming in a different order. The IDs change
   // slightly, but everything else remains the same.
   {
-    // Adjust the expected IDs: the inner params come first, so InnerScript and
-    // appear before DomParent
+    // Adjust the expected IDs: the inner params come first, so InnerScript
+    // and InnerDiv appear before DomParent
     res_dom_child2->set_id(2);
     res_dom_child2->set_parent_id(3);
     res_dom_child->set_id(3);
     res_dom_child->set_parent_id(4);
     res_dom_child->clear_child_ids();
     res_dom_child->add_child_ids(2);
     res_dom_parent->set_id(4);
     res_dom_parent->clear_child_ids();
     res_dom_parent->add_child_ids(3);
 
     // Also adjust the elements - they change order since InnerDiv and
     // InnerScript come in first.
     elem_dom_inner_div->set_id(0);
     elem_dom_inner_script->set_id(1);
     elem_dom_inner_script->set_resource_id(res_dom_child2->id());
 
     elem_dom_outer_div->set_id(2);
     elem_dom_outer_div->clear_child_ids();
     elem_dom_outer_div->add_child_ids(3);
     elem_dom_outer_iframe->set_id(3);
     elem_dom_outer_iframe->set_resource_id(res_dom_child->id());
     elem_dom_outer_iframe->clear_child_ids();
     elem_dom_outer_iframe->add_child_ids(0);
     elem_dom_outer_iframe->add_child_ids(1);
 
     scoped_refptr<ThreatDetailsWrap> report = new ThreatDetailsWrap(
         ui_manager_.get(), web_contents(), resource, NULL, history_service());
 
-    // We call AddDOMDetails directly so we can specify different render frame
-    // IDs.
-    report->AddDOMDetails(200, GURL(kDOMChildURL), inner_params);
-    report->AddDOMDetails(100, GURL(kDOMParentURL), outer_params);
+    // Send both sets of nodes from different render frames.
+    report->OnReceivedThreatDOMDetails(child_rfh, inner_params);
+    report->OnReceivedThreatDOMDetails(main_rfh(), outer_params);
+
     std::string serialized = WaitForSerializedReport(
         report.get(), false /* did_proceed*/, 0 /* num_visit */);
     ClientSafeBrowsingReportRequest actual;
     actual.ParseFromString(serialized);
     VerifyResults(actual, expected);
   }
 }
 
-// Tests an ambiguous DOM, meaning that an inner render frame has  URL that can
-// not be mapped to an iframe element in the parent frame with that same URL.
-// Typically this happens when the iframe tag has a data URL.
+// Tests an ambiguous DOM, meaning that an inner render frame can not be mapped
+// to an iframe element in the parent frame, which is a failure to lookup the
+// frames in the frame tree and should not happen.
 // We use three layers in this test:
 // kDOMParentURL
-//   \- <iframe src=kDataURL>
+//   \- <frame src=kDataURL>
 //        \- <script src=kDOMChildURL2>
 TEST_F(ThreatDetailsTest, ThreatDOMDetails_AmbiguousDOM) {
   const char kAmbiguousDomMetric[] = "SafeBrowsing.ThreatReport.DomIsAmbiguous";
 
-  // Define two sets of DOM nodes - one for an outer page containing an iframe,
-  // and then another for the inner page containing the contents of that iframe.
+  // Create a child renderer inside the main frame to house the inner iframe.
+  // Perform the navigation first in order to manipulate the frame tree.
+  content::WebContentsTester::For(web_contents())
+      ->NavigateAndCommit(GURL(kLandingURL));
+  content::TestRenderFrameHost* test_main_rfh =

[Charlie Reis, 2017/05/12 21:40:50]

Same here.

[lpz, 2017/05/15 18:49:07]

Done.

+      static_cast<content::TestRenderFrameHost*>(main_rfh());
+  content::TestRenderFrameHost* child_rfh =
+      test_main_rfh->AppendChild("subframe");
+
+  // Define two sets of DOM nodes - one for an outer page containing a frame,
+  // and then another for the inner page containing the contents of that frame.
   std::vector<SafeBrowsingHostMsg_ThreatDOMDetails_Node> outer_params;
   SafeBrowsingHostMsg_ThreatDOMDetails_Node outer_child_node;
   outer_child_node.url = GURL(kDataURL);
   outer_child_node.tag_name = "frame";
   outer_child_node.parent = GURL(kDOMParentURL);
   outer_child_node.attributes.push_back(std::make_pair("src", kDataURL));
   outer_params.push_back(outer_child_node);
   SafeBrowsingHostMsg_ThreatDOMDetails_Node outer_summary_node;
   outer_summary_node.url = GURL(kDOMParentURL);
   outer_summary_node.children.push_back(GURL(kDataURL));
+  // Set |child_frame_routing_id| for this node to something non-sensical so
+  // that the child frame lookup fails.
+  outer_summary_node.child_frame_routing_id = -100;
   outer_params.push_back(outer_summary_node);
 
-  // Now define some more nodes for the body of the iframe. The URL of this
+  // Now define some more nodes for the body of the frame. The URL of this
   // inner frame is "about:blank".
   std::vector<SafeBrowsingHostMsg_ThreatDOMDetails_Node> inner_params;
   SafeBrowsingHostMsg_ThreatDOMDetails_Node inner_child_node;
   inner_child_node.url = GURL(kDOMChildUrl2);
   inner_child_node.tag_name = "script";
   inner_child_node.parent = GURL(kBlankURL);
   inner_child_node.attributes.push_back(std::make_pair("src", kDOMChildUrl2));
   inner_params.push_back(inner_child_node);
   SafeBrowsingHostMsg_ThreatDOMDetails_Node inner_summary_node;
   inner_summary_node.url = GURL(kBlankURL);
@@ skipping 44 matching lines @@
   pb_element->add_attribute()->set_name("src");
   pb_element->mutable_attribute(0)->set_value(kDataURL);
 
   pb_element = expected.add_dom();
   pb_element->set_id(1);
   pb_element->set_tag("SCRIPT");
   pb_element->set_resource_id(4);
   pb_element->add_attribute()->set_name("src");
   pb_element->mutable_attribute(0)->set_value(kDOMChildUrl2);
 
-  content::WebContentsTester::For(web_contents())
-      ->NavigateAndCommit(GURL(kLandingURL));
-
   UnsafeResource resource;
   InitResource(&resource, SB_THREAT_TYPE_URL_UNWANTED,
                true /* is_subresource */, GURL(kThreatURL));
   scoped_refptr<ThreatDetailsWrap> report = new ThreatDetailsWrap(
       ui_manager_.get(), web_contents(), resource, NULL, history_service());
   base::HistogramTester histograms;
 
-  // Send both sets of nodes, from different render frames. We call
-  // AddDOMDetails directly so we can specify different render frame IDs.
-  report->AddDOMDetails(100, GURL(kDOMParentURL), outer_params);
-  // The inner frame was using a data URL so its last committed URL is empty.
-  report->AddDOMDetails(200, GURL(), inner_params);
+  // Send both sets of nodes from different render frames.
+  report->OnReceivedThreatDOMDetails(main_rfh(), outer_params);
+  report->OnReceivedThreatDOMDetails(child_rfh, inner_params);
 
   std::string serialized = WaitForSerializedReport(
       report.get(), false /* did_proceed*/, 0 /* num_visit */);
   ClientSafeBrowsingReportRequest actual;
   actual.ParseFromString(serialized);
   VerifyResults(actual, expected);
 
   // This DOM should be ambiguous, expect the UMA metric to be incremented.
   histograms.ExpectTotalCount(kAmbiguousDomMetric, 1);
 }
@@ skipping 478 matching lines @@
   pb_resource->set_parent_id(3);
   pb_resource->set_url(kSecondRedirectURL);
   pb_resource = expected.add_resources();
   pb_resource->set_id(3);
   pb_resource->set_url(kFirstRedirectURL);
 
   VerifyResults(actual, expected);
 }
 
 }  // namespace safe_browsing