OLD | NEW |
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include <stdint.h> | 5 #include <stdint.h> |
6 | 6 |
7 #include "base/command_line.h" | 7 #include "base/command_line.h" |
8 #include "base/containers/hash_tables.h" | 8 #include "base/containers/hash_tables.h" |
9 #include "base/macros.h" | 9 #include "base/macros.h" |
10 #include "base/strings/utf_string_conversions.h" | 10 #include "base/strings/utf_string_conversions.h" |
(...skipping 16 matching lines...) Expand all Loading... |
27 #include "content/public/browser/content_browser_client.h" | 27 #include "content/public/browser/content_browser_client.h" |
28 #include "content/public/browser/interstitial_page.h" | 28 #include "content/public/browser/interstitial_page.h" |
29 #include "content/public/browser/interstitial_page_delegate.h" | 29 #include "content/public/browser/interstitial_page_delegate.h" |
30 #include "content/public/browser/resource_context.h" | 30 #include "content/public/browser/resource_context.h" |
31 #include "content/public/browser/resource_dispatcher_host.h" | 31 #include "content/public/browser/resource_dispatcher_host.h" |
32 #include "content/public/browser/storage_partition.h" | 32 #include "content/public/browser/storage_partition.h" |
33 #include "content/public/common/appcache_info.h" | 33 #include "content/public/common/appcache_info.h" |
34 #include "content/public/common/browser_side_navigation_policy.h" | 34 #include "content/public/common/browser_side_navigation_policy.h" |
35 #include "content/public/common/content_switches.h" | 35 #include "content/public/common/content_switches.h" |
36 #include "content/public/common/file_chooser_params.h" | 36 #include "content/public/common/file_chooser_params.h" |
| 37 #include "content/public/common/resource_request_body.h" |
37 #include "content/public/test/browser_test_utils.h" | 38 #include "content/public/test/browser_test_utils.h" |
38 #include "content/public/test/content_browser_test.h" | 39 #include "content/public/test/content_browser_test.h" |
39 #include "content/public/test/content_browser_test_utils.h" | 40 #include "content/public/test/content_browser_test_utils.h" |
40 #include "content/public/test/test_utils.h" | 41 #include "content/public/test/test_utils.h" |
41 #include "content/shell/browser/shell.h" | 42 #include "content/shell/browser/shell.h" |
42 #include "content/test/content_browser_test_utils_internal.h" | 43 #include "content/test/content_browser_test_utils_internal.h" |
43 #include "content/test/test_content_browser_client.h" | 44 #include "content/test/test_content_browser_client.h" |
44 #include "ipc/ipc_security_test_util.h" | 45 #include "ipc/ipc_security_test_util.h" |
45 #include "net/dns/mock_host_resolver.h" | 46 #include "net/dns/mock_host_resolver.h" |
46 #include "net/test/embedded_test_server/embedded_test_server.h" | 47 #include "net/test/embedded_test_server/embedded_test_server.h" |
(...skipping 537 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
584 ASSERT_TRUE(temp_dir.CreateUniqueTempDir()); | 585 ASSERT_TRUE(temp_dir.CreateUniqueTempDir()); |
585 ASSERT_TRUE(base::CreateTemporaryFileInDir(temp_dir.GetPath(), &file_path)); | 586 ASSERT_TRUE(base::CreateTemporaryFileInDir(temp_dir.GetPath(), &file_path)); |
586 ASSERT_LT( | 587 ASSERT_LT( |
587 0, base::WriteFile(file_path, file_content.data(), file_content.size())); | 588 0, base::WriteFile(file_path, file_content.data(), file_content.size())); |
588 | 589 |
589 // Simulate an IPC message asking to POST a file that the renderer shouldn't | 590 // Simulate an IPC message asking to POST a file that the renderer shouldn't |
590 // have access to. | 591 // have access to. |
591 FrameHostMsg_OpenURL_Params params; | 592 FrameHostMsg_OpenURL_Params params; |
592 params.url = target_url; | 593 params.url = target_url; |
593 params.uses_post = true; | 594 params.uses_post = true; |
594 params.resource_request_body = new ResourceRequestBodyImpl; | 595 params.resource_request_body = new ResourceRequestBody; |
595 params.resource_request_body->AppendFileRange( | 596 params.resource_request_body->AppendFileRange( |
596 file_path, 0, file_content.size(), base::Time()); | 597 file_path, 0, file_content.size(), base::Time()); |
597 params.disposition = WindowOpenDisposition::CURRENT_TAB; | 598 params.disposition = WindowOpenDisposition::CURRENT_TAB; |
598 params.should_replace_current_entry = true; | 599 params.should_replace_current_entry = true; |
599 params.user_gesture = true; | 600 params.user_gesture = true; |
600 params.is_history_navigation_in_new_child = false; | 601 params.is_history_navigation_in_new_child = false; |
601 | 602 |
602 FrameHostMsg_OpenURL msg(root->current_frame_host()->routing_id(), params); | 603 FrameHostMsg_OpenURL msg(root->current_frame_host()->routing_id(), params); |
603 IPC::IpcSecurityTestUtil::PwnMessageReceived( | 604 IPC::IpcSecurityTestUtil::PwnMessageReceived( |
604 root->current_frame_host()->GetProcess()->GetChannel(), msg); | 605 root->current_frame_host()->GetProcess()->GetChannel(), msg); |
605 | 606 |
606 // Verify that the malicious navigation did not commit the navigation to | 607 // Verify that the malicious navigation did not commit the navigation to |
607 // |target_url|. | 608 // |target_url|. |
608 WaitForLoadStop(shell()->web_contents()); | 609 WaitForLoadStop(shell()->web_contents()); |
609 EXPECT_EQ(start_url, root->current_frame_host()->GetLastCommittedURL()); | 610 EXPECT_EQ(start_url, root->current_frame_host()->GetLastCommittedURL()); |
610 | 611 |
611 // Verify that the malicious renderer got killed. | 612 // Verify that the malicious renderer got killed. |
612 exit_observer.Wait(); | 613 exit_observer.Wait(); |
613 EXPECT_FALSE(exit_observer.did_exit_normally()); | 614 EXPECT_FALSE(exit_observer.did_exit_normally()); |
614 } | 615 } |
615 | 616 |
616 } // namespace content | 617 } // namespace content |
OLD | NEW |