Kill renderers which try to register Service Workers across domains.

content/browser/service_worker/service_worker_dispatcher_host_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/service_worker/service_worker_dispatcher_host.h"
 
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/run_loop.h"
 #include "content/browser/browser_thread_impl.h"
@@ skipping 54 matching lines @@
 
   virtual void TearDown() {
     helper_.reset();
   }
 
   ServiceWorkerContextCore* context() { return helper_->context(); }
   ServiceWorkerContextWrapper* context_wrapper() {
     return helper_->context_wrapper();
   }
 
+  void SendRegister(int64 provider_id, GURL pattern, GURL worker_url) {
+    dispatcher_host_->OnMessageReceived(
+        ServiceWorkerHostMsg_RegisterServiceWorker(
+            -1, -1, provider_id, pattern, worker_url));
+    base::RunLoop().RunUntilIdle();
+  }
+
   void Register(int64 provider_id,
                 GURL pattern,
                 GURL worker_url,
                 uint32 expected_message) {
-    dispatcher_host_->OnMessageReceived(
-        ServiceWorkerHostMsg_RegisterServiceWorker(
-            -1, -1, provider_id, pattern, worker_url));
-    base::RunLoop().RunUntilIdle();
+    SendRegister(provider_id, pattern, worker_url);
     EXPECT_TRUE(dispatcher_host_->ipc_sink()->GetUniqueMessageMatching(
         expected_message));
     dispatcher_host_->ipc_sink()->ClearMessages();
   }
 
-  void Unregister(int64 provider_id, GURL pattern, uint32 expected_message) {
+  void SendUnregister(int64 provider_id, GURL pattern) {
     dispatcher_host_->OnMessageReceived(
         ServiceWorkerHostMsg_UnregisterServiceWorker(
             -1, -1, provider_id, pattern));
     base::RunLoop().RunUntilIdle();
+  }
+
+  void Unregister(int64 provider_id, GURL pattern, uint32 expected_message) {
+    SendUnregister(provider_id, pattern);
     EXPECT_TRUE(dispatcher_host_->ipc_sink()->GetUniqueMessageMatching(
         expected_message));
     dispatcher_host_->ipc_sink()->ClearMessages();
   }
 
   TestBrowserThreadBundle browser_thread_bundle_;
   scoped_ptr<EmbeddedWorkerTestHelper> helper_;
   scoped_refptr<TestingServiceWorkerDispatcherHost> dispatcher_host_;
 };
 
-TEST_F(ServiceWorkerDispatcherHostTest, RegisterSameOrigin) {
+TEST_F(ServiceWorkerDispatcherHostTest, Register_SameOrigin) {
   const int64 kProviderId = 99;  // Dummy value
   scoped_ptr<ServiceWorkerProviderHost> host(new ServiceWorkerProviderHost(
       kRenderProcessId, kProviderId, context()->AsWeakPtr(), NULL));
-  host->SetDocumentUrl(GURL("http://www.example.com/foo"));
+  host->SetDocumentUrl(GURL("https://www.example.com/foo"));
   base::WeakPtr<ServiceWorkerProviderHost> provider_host = host->AsWeakPtr();
   context()->AddProviderHost(host.Pass());
 
   Register(kProviderId,
-           GURL("http://www.example.com/*"),
-           GURL("http://foo.example.com/bar"),
-           ServiceWorkerMsg_ServiceWorkerRegistrationError::ID);
-  Register(kProviderId,
-           GURL("http://foo.example.com/*"),
-           GURL("http://www.example.com/bar"),
-           ServiceWorkerMsg_ServiceWorkerRegistrationError::ID);
-  Register(kProviderId,
-           GURL("http://foo.example.com/*"),
-           GURL("http://foo.example.com/bar"),
-           ServiceWorkerMsg_ServiceWorkerRegistrationError::ID);
-  Register(kProviderId,
-           GURL("http://www.example.com/*"),
-           GURL("http://www.example.com/bar"),
+           GURL("https://www.example.com/*"),
+           GURL("https://www.example.com/bar"),
            ServiceWorkerMsg_ServiceWorkerRegistered::ID);
 }
 
-TEST_F(ServiceWorkerDispatcherHostTest, UnregisterSameOrigin) {
+TEST_F(ServiceWorkerDispatcherHostTest, Register_CrossOrigin) {
   const int64 kProviderId = 99;  // Dummy value
   scoped_ptr<ServiceWorkerProviderHost> host(new ServiceWorkerProviderHost(
       kRenderProcessId, kProviderId, context()->AsWeakPtr(), NULL));
+  host->SetDocumentUrl(GURL("https://www.example.com/foo"));
+  base::WeakPtr<ServiceWorkerProviderHost> provider_host = host->AsWeakPtr();
+  context()->AddProviderHost(host.Pass());
+
+  // Script has a different host
+  SendRegister(kProviderId,
+               GURL("https://www.example.com/*"),
+               GURL("https://foo.example.com/bar"));
+  EXPECT_EQ(1, dispatcher_host_->bad_messages_received_count_);
+
+  // Scope has a different host
+  SendRegister(kProviderId,
+               GURL("https://foo.example.com/*"),
+               GURL("https://www.example.com/bar"));
+  EXPECT_EQ(2, dispatcher_host_->bad_messages_received_count_);
+
+  // Script has a different port
+  SendRegister(kProviderId,
+               GURL("https://www.example.com/*"),
+               GURL("https://www.example.com:8080/bar"));
+  EXPECT_EQ(3, dispatcher_host_->bad_messages_received_count_);
+
+  // Scope has a different transport
+  SendRegister(kProviderId,
+               GURL("wss://www.example.com/*"),
+               GURL("https://www.example.com/bar"));
+  EXPECT_EQ(4, dispatcher_host_->bad_messages_received_count_);
+
+  // Script and scope have different hosts
+  SendRegister(kProviderId,
+               GURL("https://foo.example.com/*"),
+               GURL("https://foo.example.com/bar"));
+  EXPECT_EQ(5, dispatcher_host_->bad_messages_received_count_);
+
+  // Script and scope URLs are invalid
+  SendRegister(kProviderId,
+               GURL(),
+               GURL("h@ttps://@"));
+  EXPECT_EQ(6, dispatcher_host_->bad_messages_received_count_);
+}
+
+TEST_F(ServiceWorkerDispatcherHostTest, Unregister_SameOrigin) {
+  const int64 kProviderId = 99;  // Dummy value
+  scoped_ptr<ServiceWorkerProviderHost> host(new ServiceWorkerProviderHost(
+      kRenderProcessId, kProviderId, context()->AsWeakPtr(), NULL));
   host->SetDocumentUrl(GURL("http://www.example.com/foo"));
   base::WeakPtr<ServiceWorkerProviderHost> provider_host = host->AsWeakPtr();
   context()->AddProviderHost(host.Pass());
 
   Unregister(kProviderId,
-             GURL("http://foo.example.com/*"),
-             ServiceWorkerMsg_ServiceWorkerRegistrationError::ID);
-  Unregister(kProviderId,
              GURL("http://www.example.com/*"),
              ServiceWorkerMsg_ServiceWorkerUnregistered::ID);
 }
 
+TEST_F(ServiceWorkerDispatcherHostTest, Unregister_CrossOrigin) {
+  const int64 kProviderId = 99;  // Dummy value
+  scoped_ptr<ServiceWorkerProviderHost> host(new ServiceWorkerProviderHost(
+      kRenderProcessId, kProviderId, context()->AsWeakPtr(), NULL));
+  host->SetDocumentUrl(GURL("http://www.example.com/foo"));
+  base::WeakPtr<ServiceWorkerProviderHost> provider_host = host->AsWeakPtr();
+  context()->AddProviderHost(host.Pass());
+
+  SendUnregister(kProviderId, GURL("http://foo.example.com/*"));
+  EXPECT_EQ(1, dispatcher_host_->bad_messages_received_count_);
+}
+
 TEST_F(ServiceWorkerDispatcherHostTest, EarlyContextDeletion) {
   helper_->ShutdownContext();
 
   // Let the shutdown reach the simulated IO thread.
   base::RunLoop().RunUntilIdle();
 
-  dispatcher_host_->OnMessageReceived(
-      ServiceWorkerHostMsg_RegisterServiceWorker(-1, -1, -1, GURL(), GURL()));
-
-  // TODO(alecflett): Pump the message loop when this becomes async.
-  ASSERT_EQ(1UL, dispatcher_host_->ipc_sink()->message_count());
-  EXPECT_TRUE(dispatcher_host_->ipc_sink()->GetUniqueMessageMatching(
-      ServiceWorkerMsg_ServiceWorkerRegistrationError::ID));
+  Register(-1,
+           GURL(),
+           GURL(),
+           ServiceWorkerMsg_ServiceWorkerRegistrationError::ID);
 }
 
 TEST_F(ServiceWorkerDispatcherHostTest, ProviderCreatedAndDestroyed) {
   const int kProviderId = 1001;  // Test with a value != kRenderProcessId.
 
   dispatcher_host_->OnMessageReceived(
       ServiceWorkerHostMsg_ProviderCreated(kProviderId));
   EXPECT_TRUE(context()->GetProviderHost(kRenderProcessId, kProviderId));
 
   // Two with the same ID should be seen as a bad message.
@@ skipping 14 matching lines @@
   // process to get deleted as well.
   dispatcher_host_->OnMessageReceived(
       ServiceWorkerHostMsg_ProviderCreated(kProviderId));
   EXPECT_TRUE(context()->GetProviderHost(kRenderProcessId, kProviderId));
   EXPECT_TRUE(dispatcher_host_->HasOneRef());
   dispatcher_host_ = NULL;
   EXPECT_FALSE(context()->GetProviderHost(kRenderProcessId, kProviderId));
 }
 
 }  // namespace content