[Extensions Bindings] Check availability of custom API properties

extensions/renderer/bindings/api_binding_unittest.cc

Index: extensions/renderer/bindings/api_binding_unittest.cc
diff --git a/extensions/renderer/bindings/api_binding_unittest.cc b/extensions/renderer/bindings/api_binding_unittest.cc
index 9f43d1aa5b47efda7a9c325969b8ecebefdc6cb6..2e3450c4b361c7de21434a7aaac7e8da1c270638 100644
--- a/extensions/renderer/bindings/api_binding_unittest.cc
+++ b/extensions/renderer/bindings/api_binding_unittest.cc
@@ -2,12 +2,13 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+#include "extensions/renderer/bindings/api_binding.h"
+
 #include "base/bind.h"
 #include "base/memory/ptr_util.h"
 #include "base/stl_util.h"
 #include "base/strings/stringprintf.h"
 #include "base/values.h"
-#include "extensions/renderer/bindings/api_binding.h"
 #include "extensions/renderer/bindings/api_binding_hooks.h"
 #include "extensions/renderer/bindings/api_binding_hooks_test_delegate.h"
 #include "extensions/renderer/bindings/api_binding_test.h"
@@ -19,6 +20,7 @@
 #include "extensions/renderer/bindings/binding_access_checker.h"
 #include "gin/arguments.h"
 #include "gin/converter.h"
+#include "gin/data_object_builder.h"
 #include "gin/public/context_holder.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "third_party/WebKit/public/web/WebScopedUserGesture.h"
@@ -629,6 +631,10 @@ TEST_F(APIBindingUnittest, TestRefProperties) {
       "  'beta': {"
       "    '$ref': 'BetaRef',"
       "    'value': ['b']"
+      "  },"
+      "  'restricted': {"
+      "    '$ref': 'RestrictedRef',"
+      "    'value': ['r']"
       "  }"
       "}");
   auto create_custom_type = [](v8::Isolate* isolate,
@@ -659,6 +665,12 @@ TEST_F(APIBindingUnittest, TestRefProperties) {
 
   SetCreateCustomType(base::Bind(create_custom_type));
 
+  auto is_available = [](v8::Local<v8::Context> context,
+                         const std::string& name) {
+    return name != "test.restricted";
+  };
+  SetAvailabilityCallback(base::Bind(is_available));
+
   InitializeBinding();
 
   v8::HandleScope handle_scope(isolate());
@@ -669,6 +681,66 @@ TEST_F(APIBindingUnittest, TestRefProperties) {
   EXPECT_EQ(
       R"({"betaProp":"betaVal"})",
       GetStringPropertyFromObject(binding_object, context, "beta"));
+  EXPECT_EQ("undefined",
+            GetStringPropertyFromObject(binding_object, context, "restricted"));
+}
+
+// Test that created subproperties are only exposed if they are available to
+// the context.
+TEST_F(APIBindingUnittest, RestrictedReferenceProperties) {
+  SetProperties(
+      "{"
+      "  'alpha': {"
+      "    'type': 'object',"
+      "    'properties': {"
+      "      'allowed': {"
+      "        '$ref': 'PropType',"
+      "        'value': []"
+      "      },"
+      "      'disallowed': {"
+      "        '$ref': 'PropType',"
+      "        'value': []"
+      "      }"
+      "    }"
+      "  }"
+      "}");
+
+  auto create_custom_type = [](v8::Isolate* isolate,
+                               const std::string& type_name,
+                               const std::string& property_name,
+                               const base::ListValue* property_values) {
+    EXPECT_EQ("allowed", property_name);
+    return gin::DataObjectBuilder(isolate)
+        .Set("prop", std::string("val"))
+        .Build();
+  };
+  SetCreateCustomType(base::Bind(create_custom_type));
+
+  auto is_available = [](v8::Local<v8::Context> context,
+                         const std::string& name) {
+    if (name == "test.alpha.allowed")
+      return true;
+    if (name == "test.alpha.disallowed")
+      return false;
+    ADD_FAILURE() << name;
+    return false;
+  };
+  SetAvailabilityCallback(base::Bind(is_available));
+
+  InitializeBinding();
+
+  v8::HandleScope handle_scope(isolate());
+  v8::Local<v8::Context> context = MainContext();
+  v8::Local<v8::Object> binding_object = binding()->CreateInstance(context);
+  v8::Local<v8::Value> alpha =
+      GetPropertyFromObject(binding_object, context, "alpha");
+  ASSERT_FALSE(alpha.IsEmpty());
+  ASSERT_TRUE(alpha->IsObject());
+  v8::Local<v8::Object> alpha_obj = alpha.As<v8::Object>();
+  EXPECT_EQ(R"({"prop":"val"})",
+            GetStringPropertyFromObject(alpha_obj, context, "allowed"));
+  EXPECT_EQ("undefined",
+            GetStringPropertyFromObject(alpha_obj, context, "disallowed"));
 }
 
 TEST_F(APIBindingUnittest, TestDisposedContext) {