Block navigations to hosted apps non-icon resources with PlzNavigate.

chrome/browser/extensions/process_manager_browsertest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <stddef.h>
 
 #include <memory>
 #include <utility>
 
 #include "base/callback.h"
 #include "base/macros.h"
 #include "base/path_service.h"
 #include "base/run_loop.h"
 #include "base/test/histogram_tester.h"
 #include "chrome/browser/chrome_notification_types.h"
 #include "chrome/browser/extensions/browser_action_test_util.h"
 #include "chrome/browser/extensions/extension_browsertest.h"
 #include "chrome/browser/extensions/extension_service.h"
 #include "chrome/browser/extensions/test_extension_dir.h"
 #include "chrome/browser/ui/browser_commands.h"
 #include "chrome/browser/ui/tabs/tab_strip_model.h"
 #include "chrome/common/chrome_paths.h"
 #include "chrome/common/extensions/extension_process_policy.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/test/base/in_process_browser_test.h"
 #include "chrome/test/base/ui_test_utils.h"
 #include "components/guest_view/browser/test_guest_view_manager.h"
 #include "content/public/browser/child_process_security_policy.h"
+#include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/notification_service.h"
 #include "content/public/browser/render_frame_host.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/common/browser_side_navigation_policy.h"
 #include "content/public/test/browser_test_utils.h"
 #include "content/public/test/test_navigation_observer.h"
 #include "content/public/test/test_utils.h"
 #include "extensions/browser/app_window/app_window.h"
 #include "extensions/browser/app_window/app_window_registry.h"
@@ skipping 1187 matching lines @@
   // frame's (a.com) process.
   GURL b_url(embedded_test_server()->GetURL("b.com", "/empty.html"));
   EXPECT_TRUE(content::NavigateIframeToURL(tab, "frame0", b_url));
   {
     content::RenderFrameHost* subframe = ChildFrameAt(main_frame, 0);
     EXPECT_EQ(subframe->GetProcess(), main_frame->GetProcess());
     EXPECT_EQ(subframe->GetSiteInstance(), main_frame->GetSiteInstance());
   }
 }
 
+// Test to verify that loading a resource other than an icon file is
+// disallowed for hosted apps, while icons are allowed.
+// See https://crbug.com/717626.
+IN_PROC_BROWSER_TEST_F(ProcessManagerBrowserTest, HostedAppFilesAccess) {
+  // Load an extension with a background page.
+  scoped_refptr<const Extension> extension =
+      LoadExtension(test_data_dir_.AppendASCII("hosted_app"));
+  ASSERT_TRUE(extension);
+
+  content::WebContents* tab =
+      browser()->tab_strip_model()->GetActiveWebContents();
+
+  // Navigating to the manifest should be blocked with an error page.
+  {
+    content::TestNavigationObserver observer(tab);
+    NavigateToURL(extension->GetResourceURL("/manifest.json"));
+    EXPECT_FALSE(observer.last_navigation_succeeded());
+    EXPECT_EQ(tab->GetController().GetLastCommittedEntry()->GetPageType(),
+              content::PAGE_TYPE_ERROR);
+  }
+
+  // Navigation to the icon file should succeed.
+  {
+    content::TestNavigationObserver observer(tab);
+    NavigateToURL(extension->GetResourceURL("/icon.png"));
+    EXPECT_TRUE(observer.last_navigation_succeeded());
+    EXPECT_EQ(tab->GetController().GetLastCommittedEntry()->GetPageType(),
+              content::PAGE_TYPE_NORMAL);
+  }
+}
+
 }  // namespace extensions