| OLD | NEW |
| 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "base/command_line.h" | 5 #include "base/command_line.h" |
| 6 #include "base/macros.h" | 6 #include "base/macros.h" |
| 7 #include "base/strings/utf_string_conversions.h" | 7 #include "base/strings/utf_string_conversions.h" |
| 8 #include "base/test/histogram_tester.h" | 8 #include "base/test/histogram_tester.h" |
| 9 #include "chrome/browser/ui/browser.h" | 9 #include "chrome/browser/ui/browser.h" |
| 10 #include "chrome/browser/ui/browser_commands.h" | 10 #include "chrome/browser/ui/browser_commands.h" |
| 11 #include "chrome/browser/ui/singleton_tabs.h" | 11 #include "chrome/browser/ui/singleton_tabs.h" |
| 12 #include "chrome/browser/ui/tabs/tab_strip_model.h" | 12 #include "chrome/browser/ui/tabs/tab_strip_model.h" |
| 13 #include "chrome/common/extensions/extension_process_policy.h" | |
| 14 #include "chrome/test/base/in_process_browser_test.h" | 13 #include "chrome/test/base/in_process_browser_test.h" |
| 15 #include "chrome/test/base/ui_test_utils.h" | 14 #include "chrome/test/base/ui_test_utils.h" |
| 16 #include "content/public/browser/notification_observer.h" | 15 #include "content/public/browser/notification_observer.h" |
| 17 #include "content/public/browser/notification_service.h" | 16 #include "content/public/browser/notification_service.h" |
| 18 #include "content/public/browser/notification_types.h" | 17 #include "content/public/browser/notification_types.h" |
| 19 #include "content/public/browser/render_frame_host.h" | 18 #include "content/public/browser/render_frame_host.h" |
| 20 #include "content/public/browser/render_process_host.h" | 19 #include "content/public/browser/render_process_host.h" |
| 21 #include "content/public/browser/resource_request_details.h" | 20 #include "content/public/browser/resource_request_details.h" |
| 22 #include "content/public/browser/web_contents_observer.h" | 21 #include "content/public/browser/web_contents_observer.h" |
| 23 #include "content/public/common/content_switches.h" | 22 #include "content/public/common/content_switches.h" |
| (...skipping 41 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 65 std::string status; | 64 std::string status; |
| 66 std::string expected_status("0"); | 65 std::string expected_status("0"); |
| 67 EXPECT_TRUE(msg_queue.WaitForMessage(&status)); | 66 EXPECT_TRUE(msg_queue.WaitForMessage(&status)); |
| 68 EXPECT_STREQ(status.c_str(), expected_status.c_str()); | 67 EXPECT_STREQ(status.c_str(), expected_status.c_str()); |
| 69 } | 68 } |
| 70 | 69 |
| 71 // Extension isolation prevents a normal renderer process from being able to | 70 // Extension isolation prevents a normal renderer process from being able to |
| 72 // create a "blob:chrome-extension://" resource. | 71 // create a "blob:chrome-extension://" resource. |
| 73 IN_PROC_BROWSER_TEST_F(ChromeSecurityExploitBrowserTest, | 72 IN_PROC_BROWSER_TEST_F(ChromeSecurityExploitBrowserTest, |
| 74 CreateBlobInExtensionOrigin) { | 73 CreateBlobInExtensionOrigin) { |
| 75 // This test relies on extensions documents running in extension processes, | |
| 76 // which is guaranteed with --isolate-extensions. Without it, the checks are | |
| 77 // not enforced and this test will time out waiting for the process to be | |
| 78 // killed. | |
| 79 if (!extensions::IsIsolateExtensionsEnabled()) | |
| 80 return; | |
| 81 | |
| 82 ui_test_utils::NavigateToURL( | 74 ui_test_utils::NavigateToURL( |
| 83 browser(), | 75 browser(), |
| 84 embedded_test_server()->GetURL("a.root-servers.net", "/title1.html")); | 76 embedded_test_server()->GetURL("a.root-servers.net", "/title1.html")); |
| 85 | 77 |
| 86 content::RenderFrameHost* rfh = | 78 content::RenderFrameHost* rfh = |
| 87 browser()->tab_strip_model()->GetActiveWebContents()->GetMainFrame(); | 79 browser()->tab_strip_model()->GetActiveWebContents()->GetMainFrame(); |
| 88 | 80 |
| 89 // All these are attacker controlled values. The UUID is arbitrary. | 81 // All these are attacker controlled values. The UUID is arbitrary. |
| 90 std::string blob_id = "2ce53a26-0409-45a3-86e5-f8fb9f5566d8"; | 82 std::string blob_id = "2ce53a26-0409-45a3-86e5-f8fb9f5566d8"; |
| 91 std::string blob_type = "text/html"; | 83 std::string blob_type = "text/html"; |
| (...skipping 85 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
| 177 content::WaitForLoadStop(browser()->tab_strip_model()->GetWebContentsAt(0)); | 169 content::WaitForLoadStop(browser()->tab_strip_model()->GetWebContentsAt(0)); |
| 178 rfh = browser()->tab_strip_model()->GetActiveWebContents()->GetMainFrame(); | 170 rfh = browser()->tab_strip_model()->GetActiveWebContents()->GetMainFrame(); |
| 179 EXPECT_EQ(GURL(target_origin), rfh->GetSiteInstance()->GetSiteURL()); | 171 EXPECT_EQ(GURL(target_origin), rfh->GetSiteInstance()->GetSiteURL()); |
| 180 std::string body; | 172 std::string body; |
| 181 std::string script = R"( | 173 std::string script = R"( |
| 182 var textContent = document.body.innerText.replace(/\n+/g, '\n'); | 174 var textContent = document.body.innerText.replace(/\n+/g, '\n'); |
| 183 window.domAutomationController.send(textContent); | 175 window.domAutomationController.send(textContent); |
| 184 )"; | 176 )"; |
| 185 | 177 |
| 186 EXPECT_TRUE(content::ExecuteScriptAndExtractString(rfh, script, &body)); | 178 EXPECT_TRUE(content::ExecuteScriptAndExtractString(rfh, script, &body)); |
| 187 if (extensions::IsIsolateExtensionsEnabled()) { | 179 EXPECT_EQ( |
| 188 EXPECT_EQ( | 180 "\nYour file was not found\n" |
| 189 "\nYour file was not found\n" | 181 "It may have been moved or deleted.\n" |
| 190 "It may have been moved or deleted.\n" | 182 "ERR_FILE_NOT_FOUND\n", |
| 191 "ERR_FILE_NOT_FOUND\n", | 183 body); |
| 192 body); | |
| 193 } else { | |
| 194 // Without --isolate-extensions, the above steps must succeed, since | |
| 195 // unblessed extension frames are allowed in ordinary renderer processes. | |
| 196 EXPECT_EQ("pwned.", body); | |
| 197 } | |
| 198 } | 184 } |
| OLD | NEW |