[Extensions Bindings] Check availability of custom API properties

extensions/renderer/bindings/api_binding_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "extensions/renderer/bindings/api_binding.h"
+
 #include "base/bind.h"
 #include "base/memory/ptr_util.h"
 #include "base/stl_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/values.h"
-#include "extensions/renderer/bindings/api_binding.h"
 #include "extensions/renderer/bindings/api_binding_hooks.h"
 #include "extensions/renderer/bindings/api_binding_hooks_test_delegate.h"
 #include "extensions/renderer/bindings/api_binding_test.h"
 #include "extensions/renderer/bindings/api_binding_test_util.h"
 #include "extensions/renderer/bindings/api_event_handler.h"
 #include "extensions/renderer/bindings/api_invocation_errors.h"
 #include "extensions/renderer/bindings/api_request_handler.h"
 #include "extensions/renderer/bindings/api_type_reference_map.h"
 #include "extensions/renderer/bindings/binding_access_checker.h"
 #include "gin/arguments.h"
 #include "gin/converter.h"
+#include "gin/data_object_builder.h"
 #include "gin/public/context_holder.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/WebKit/public/web/WebScopedUserGesture.h"
 #include "v8/include/v8.h"
 
 namespace extensions {
 
 using namespace api_errors;
 
 namespace {
@@ skipping 590 matching lines @@
 TEST_F(APIBindingUnittest, TestRefProperties) {
   SetProperties(
       "{"
       "  'alpha': {"
       "    '$ref': 'AlphaRef',"
       "    'value': ['a']"
       "  },"
       "  'beta': {"
       "    '$ref': 'BetaRef',"
       "    'value': ['b']"
+      "  },"
+      "  'restricted': {"
+      "    '$ref': 'RestrictedRef',"
+      "    'value': ['r']"
       "  }"
       "}");
   auto create_custom_type = [](v8::Isolate* isolate,
                                const std::string& type_name,
                                const std::string& property_name,
                                const base::ListValue* property_values) {
     v8::Local<v8::Context> context = isolate->GetCurrentContext();
     v8::Local<v8::Object> result = v8::Object::New(isolate);
     if (type_name == "AlphaRef") {
       EXPECT_EQ("alpha", property_name);
@@ skipping 10 matching lines @@
                 gin::StringToV8(isolate, "betaVal"))
           .ToChecked();
     } else {
       EXPECT_TRUE(false) << type_name;
     }
     return result;
   };
 
   SetCreateCustomType(base::Bind(create_custom_type));
 
+  auto is_available = [](v8::Local<v8::Context> context,
+                         const std::string& name) {
+    return name != "test.restricted";
+  };
+  SetAvailabilityCallback(base::Bind(is_available));
+
   InitializeBinding();
 
   v8::HandleScope handle_scope(isolate());
   v8::Local<v8::Context> context = MainContext();
   v8::Local<v8::Object> binding_object = binding()->CreateInstance(context);
   EXPECT_EQ(R"({"alphaProp":"alphaVal"})",
             GetStringPropertyFromObject(binding_object, context, "alpha"));
   EXPECT_EQ(
       R"({"betaProp":"betaVal"})",
       GetStringPropertyFromObject(binding_object, context, "beta"));
+  EXPECT_EQ("undefined",
+            GetStringPropertyFromObject(binding_object, context, "restricted"));
+}
+
+// Test that created subproperties are only exposed if they are available to
+// the context.
+TEST_F(APIBindingUnittest, RestrictedReferenceProperties) {
+  SetProperties(
+      "{"
+      "  'alpha': {"
+      "    'type': 'object',"
+      "    'properties': {"
+      "      'allowed': {"
+      "        '$ref': 'PropType',"
+      "        'value': []"
+      "      },"
+      "      'disallowed': {"
+      "        '$ref': 'PropType',"
+      "        'value': []"
+      "      }"
+      "    }"
+      "  }"
+      "}");
+
+  auto create_custom_type = [](v8::Isolate* isolate,
+                               const std::string& type_name,
+                               const std::string& property_name,
+                               const base::ListValue* property_values) {
+    EXPECT_EQ("allowed", property_name);
+    return gin::DataObjectBuilder(isolate)
+        .Set("prop", std::string("val"))
+        .Build();
+  };
+  SetCreateCustomType(base::Bind(create_custom_type));
+
+  auto is_available = [](v8::Local<v8::Context> context,
+                         const std::string& name) {
+    if (name == "test.alpha.allowed")
+      return true;
+    if (name == "test.alpha.disallowed")
+      return false;
+    ADD_FAILURE() << name;
+    return false;
+  };
+  SetAvailabilityCallback(base::Bind(is_available));
+
+  InitializeBinding();
+
+  v8::HandleScope handle_scope(isolate());
+  v8::Local<v8::Context> context = MainContext();
+  v8::Local<v8::Object> binding_object = binding()->CreateInstance(context);
+  v8::Local<v8::Value> alpha =
+      GetPropertyFromObject(binding_object, context, "alpha");
+  ASSERT_FALSE(alpha.IsEmpty());
+  ASSERT_TRUE(alpha->IsObject());
+  v8::Local<v8::Object> alpha_obj = alpha.As<v8::Object>();
+  EXPECT_EQ(R"({"prop":"val"})",
+            GetStringPropertyFromObject(alpha_obj, context, "allowed"));
+  EXPECT_EQ("undefined",
+            GetStringPropertyFromObject(alpha_obj, context, "disallowed"));
 }
 
 TEST_F(APIBindingUnittest, TestDisposedContext) {
   SetFunctions(kFunctions);
   InitializeBinding();
 
   v8::HandleScope handle_scope(isolate());
   v8::Local<v8::Context> context = MainContext();
 
   v8::Local<v8::Object> binding_object = binding()->CreateInstance(context);
@@ skipping 591 matching lines @@
 
   // The extra property should be present on the binding object.
   EXPECT_EQ("42", GetStringPropertyFromObject(binding_object, context,
                                               "hookedProperty"));
   // Sanity check: other values should still be there.
   EXPECT_EQ("function",
             GetStringPropertyFromObject(binding_object, context, "oneString"));
 }
 
 }  // namespace extensions