extensions/common/csp_validator_unittest.cc - Issue 481643002: Disallow non-subdomain wildcards in the extension's CSP

Side by Side Diff: extensions/common/csp_validator_unittest.cc

Issue 481643002: Disallow non-subdomain wildcards in the extension's CSP (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master

Patch Set: Created 6 years, 4 months ago

Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.

Jump to:

View unified diff | Download patch

« extensions/common/csp_validator.cc ('K') | « extensions/common/csp_validator.cc ('k') | no next file » | no next file with comments »

OLD	NEW
1 // Copyright 2013 The Chromium Authors. All rights reserved.	1 // Copyright 2013 The Chromium Authors. All rights reserved.

2 // Use of this source code is governed by a BSD-style license that can be	2 // Use of this source code is governed by a BSD-style license that can be

3 // found in the LICENSE file.	3 // found in the LICENSE file.

4	4

5 #include "extensions/common/csp_validator.h"	5 #include "extensions/common/csp_validator.h"

6 #include "testing/gtest/include/gtest/gtest.h"	6 #include "testing/gtest/include/gtest/gtest.h"

7	7

8 using extensions::csp_validator::ContentSecurityPolicyIsLegal;	8 using extensions::csp_validator::ContentSecurityPolicyIsLegal;

9 using extensions::csp_validator::ContentSecurityPolicyIsSecure;	9 using extensions::csp_validator::ContentSecurityPolicyIsSecure;

10 using extensions::csp_validator::ContentSecurityPolicyIsSandboxed;	10 using extensions::csp_validator::ContentSecurityPolicyIsSandboxed;

(...skipping 81 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
92	92

93 EXPECT_FALSE(ContentSecurityPolicyIsSecure(	93 EXPECT_FALSE(ContentSecurityPolicyIsSecure(

94 "default-src 'self' *", Manifest::TYPE_EXTENSION));	94 "default-src 'self' *", Manifest::TYPE_EXTENSION));

95 EXPECT_FALSE(ContentSecurityPolicyIsSecure(	95 EXPECT_FALSE(ContentSecurityPolicyIsSecure(

96 "default-src 'self' :", Manifest::TYPE_EXTENSION));	96 "default-src 'self' :", Manifest::TYPE_EXTENSION));

97 EXPECT_FALSE(ContentSecurityPolicyIsSecure(	97 EXPECT_FALSE(ContentSecurityPolicyIsSecure(

98 "default-src 'self' :/", Manifest::TYPE_EXTENSION));	98 "default-src 'self' :/", Manifest::TYPE_EXTENSION));

99 EXPECT_FALSE(ContentSecurityPolicyIsSecure(	99 EXPECT_FALSE(ContentSecurityPolicyIsSecure(

100 "default-src 'self' :/path", Manifest::TYPE_EXTENSION));	100 "default-src 'self' :/path", Manifest::TYPE_EXTENSION));

101 EXPECT_FALSE(ContentSecurityPolicyIsSecure(	101 EXPECT_FALSE(ContentSecurityPolicyIsSecure(

	102 "default-src 'self' https://", Manifest::TYPE_EXTENSION));

	103 EXPECT_FALSE(ContentSecurityPolicyIsSecure(

102 "default-src 'self' https://:", Manifest::TYPE_EXTENSION));	104 "default-src 'self' https://:", Manifest::TYPE_EXTENSION));

103 EXPECT_FALSE(ContentSecurityPolicyIsSecure(	105 EXPECT_FALSE(ContentSecurityPolicyIsSecure(

104 "default-src 'self' https://:/", Manifest::TYPE_EXTENSION));	106 "default-src 'self' https://:/", Manifest::TYPE_EXTENSION));

105 EXPECT_FALSE(ContentSecurityPolicyIsSecure(	107 EXPECT_FALSE(ContentSecurityPolicyIsSecure(

106 "default-src 'self' https://:/path", Manifest::TYPE_EXTENSION));	108 "default-src 'self' https://:/path", Manifest::TYPE_EXTENSION));

107	109

108 EXPECT_TRUE(ContentSecurityPolicyIsSecure(	110 EXPECT_TRUE(ContentSecurityPolicyIsSecure(

109 "default-src 'self' https://*.google.com", Manifest::TYPE_EXTENSION));	111 "default-src 'self' https://*.google.com", Manifest::TYPE_EXTENSION));

110 EXPECT_TRUE(ContentSecurityPolicyIsSecure(	112 EXPECT_TRUE(ContentSecurityPolicyIsSecure(

111 "default-src 'self' https://*.google.com:1", Manifest::TYPE_EXTENSION));	113 "default-src 'self' https://*.google.com:1", Manifest::TYPE_EXTENSION));

(...skipping 59 matching lines...) Expand 10 before \| Expand all \| Expand 10 after Loading...
171 "sandbox allow-top-navigation", Manifest::TYPE_EXTENSION));	173 "sandbox allow-top-navigation", Manifest::TYPE_EXTENSION));

172 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(	174 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(

173 "sandbox allow-top-navigation", Manifest::TYPE_PLATFORM_APP));	175 "sandbox allow-top-navigation", Manifest::TYPE_PLATFORM_APP));

174	176

175 // Popups are OK.	177 // Popups are OK.

176 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(	178 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(

177 "sandbox allow-popups", Manifest::TYPE_EXTENSION));	179 "sandbox allow-popups", Manifest::TYPE_EXTENSION));

178 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(	180 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(

179 "sandbox allow-popups", Manifest::TYPE_PLATFORM_APP));	181 "sandbox allow-popups", Manifest::TYPE_PLATFORM_APP));

180 }	182 }

OLD	NEW