Kill renderers that dink with Service Workers from non-secure origins.

content/browser/service_worker/service_worker_dispatcher_host_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "content/browser/service_worker/service_worker_dispatcher_host.h"
 
 #include "base/command_line.h"
 #include "base/files/file_path.h"
 #include "base/run_loop.h"
 #include "content/browser/browser_thread_impl.h"
@@ skipping 106 matching lines @@
     EXPECT_TRUE(dispatcher_host_->ipc_sink()->GetUniqueMessageMatching(
         expected_message));
     dispatcher_host_->ipc_sink()->ClearMessages();
   }
 
   TestBrowserThreadBundle browser_thread_bundle_;
   scoped_ptr<EmbeddedWorkerTestHelper> helper_;
   scoped_refptr<TestingServiceWorkerDispatcherHost> dispatcher_host_;
 };
 
-TEST_F(ServiceWorkerDispatcherHostTest, Register_SameOrigin) {
+TEST_F(ServiceWorkerDispatcherHostTest, Register_HTTPS) {
   const int64 kProviderId = 99;  // Dummy value
   scoped_ptr<ServiceWorkerProviderHost> host(new ServiceWorkerProviderHost(
       kRenderProcessId, kProviderId, context()->AsWeakPtr(), NULL));
   host->SetDocumentUrl(GURL("https://www.example.com/foo"));
   base::WeakPtr<ServiceWorkerProviderHost> provider_host = host->AsWeakPtr();

[falken, 2014/10/02 06:23:59]

Not from your patch, but it looks like provider_host is never used (same with
all the ones below).

   context()->AddProviderHost(host.Pass());
 
   Register(kProviderId,
            GURL("https://www.example.com/"),
            GURL("https://www.example.com/bar"),
            ServiceWorkerMsg_ServiceWorkerRegistered::ID);
 }
 
-TEST_F(ServiceWorkerDispatcherHostTest, Register_CrossOrigin) {
+TEST_F(ServiceWorkerDispatcherHostTest, Register_NonSecureTransportLocalhost) {
   const int64 kProviderId = 99;  // Dummy value
   scoped_ptr<ServiceWorkerProviderHost> host(new ServiceWorkerProviderHost(
       kRenderProcessId, kProviderId, context()->AsWeakPtr(), NULL));
+  host->SetDocumentUrl(GURL("http://127.0.0.3:81/foo"));
+  base::WeakPtr<ServiceWorkerProviderHost> provider_host = host->AsWeakPtr();
+  context()->AddProviderHost(host.Pass());
+
+  Register(kProviderId,
+           GURL("http://127.0.0.3:81/bar"),
+           GURL("http://127.0.0.3:81/baz"),
+           ServiceWorkerMsg_ServiceWorkerRegistered::ID);
+}
+
+TEST_F(ServiceWorkerDispatcherHostTest, Register_NonSecureOriginShouldFail) {
+  const int64 kProviderId = 99;  // Dummy value
+  scoped_ptr<ServiceWorkerProviderHost> host(new ServiceWorkerProviderHost(
+      kRenderProcessId, kProviderId, context()->AsWeakPtr(), NULL));
+  host->SetDocumentUrl(GURL("http://www.example.com/foo"));
+  base::WeakPtr<ServiceWorkerProviderHost> provider_host = host->AsWeakPtr();
+  context()->AddProviderHost(host.Pass());
+
+  SendRegister(kProviderId,
+               GURL("http://www.example.com/"),
+               GURL("http://www.example.com/bar"));
+  EXPECT_EQ(1, dispatcher_host_->bad_messages_received_count_);
+}
+
+TEST_F(ServiceWorkerDispatcherHostTest, Register_CrossOriginShouldFail) {
+  const int64 kProviderId = 99;  // Dummy value
+  scoped_ptr<ServiceWorkerProviderHost> host(new ServiceWorkerProviderHost(
+      kRenderProcessId, kProviderId, context()->AsWeakPtr(), NULL));
   host->SetDocumentUrl(GURL("https://www.example.com/foo"));
   base::WeakPtr<ServiceWorkerProviderHost> provider_host = host->AsWeakPtr();
   context()->AddProviderHost(host.Pass());
 
   // Script has a different host
   SendRegister(kProviderId,
                GURL("https://www.example.com/"),
                GURL("https://foo.example.com/bar"));
   EXPECT_EQ(1, dispatcher_host_->bad_messages_received_count_);
 
   // Scope has a different host
   SendRegister(kProviderId,
                GURL("https://foo.example.com/"),
                GURL("https://www.example.com/bar"));
   EXPECT_EQ(2, dispatcher_host_->bad_messages_received_count_);
 
   // Script has a different port
   SendRegister(kProviderId,
                GURL("https://www.example.com/"),
                GURL("https://www.example.com:8080/bar"));
   EXPECT_EQ(3, dispatcher_host_->bad_messages_received_count_);
 
   // Scope has a different transport
   SendRegister(kProviderId,
                GURL("wss://www.example.com/"),
                GURL("https://www.example.com/bar"));
   EXPECT_EQ(4, dispatcher_host_->bad_messages_received_count_);
 
-  // Script and scope have different hosts
+  // Script and scope have a different host but match each other
   SendRegister(kProviderId,
                GURL("https://foo.example.com/"),
                GURL("https://foo.example.com/bar"));
   EXPECT_EQ(5, dispatcher_host_->bad_messages_received_count_);
 
   // Script and scope URLs are invalid
   SendRegister(kProviderId,
                GURL(),
                GURL("h@ttps://@"));
   EXPECT_EQ(6, dispatcher_host_->bad_messages_received_count_);
 }
 
-TEST_F(ServiceWorkerDispatcherHostTest, Unregister_SameOrigin) {
+TEST_F(ServiceWorkerDispatcherHostTest, Unregister_HTTPS) {
   const int64 kProviderId = 99;  // Dummy value
   scoped_ptr<ServiceWorkerProviderHost> host(new ServiceWorkerProviderHost(
       kRenderProcessId, kProviderId, context()->AsWeakPtr(), NULL));
-  host->SetDocumentUrl(GURL("http://www.example.com/foo"));
+  host->SetDocumentUrl(GURL("https://www.example.com/foo"));
   base::WeakPtr<ServiceWorkerProviderHost> provider_host = host->AsWeakPtr();
   context()->AddProviderHost(host.Pass());
 
   Unregister(kProviderId,
-             GURL("http://www.example.com/"),
+             GURL("https://www.example.com/"),
              ServiceWorkerMsg_ServiceWorkerUnregistered::ID);
 }
 
-TEST_F(ServiceWorkerDispatcherHostTest, Unregister_CrossOrigin) {
+TEST_F(ServiceWorkerDispatcherHostTest,
+       Unregister_NonSecureTransportLocalhost) {
   const int64 kProviderId = 99;  // Dummy value
   scoped_ptr<ServiceWorkerProviderHost> host(new ServiceWorkerProviderHost(
       kRenderProcessId, kProviderId, context()->AsWeakPtr(), NULL));
+  host->SetDocumentUrl(GURL("http://localhost/foo"));
+  base::WeakPtr<ServiceWorkerProviderHost> provider_host = host->AsWeakPtr();
+  context()->AddProviderHost(host.Pass());
+
+  Unregister(kProviderId,
+             GURL("http://localhost/"),
+             ServiceWorkerMsg_ServiceWorkerUnregistered::ID);
+}
+
+TEST_F(ServiceWorkerDispatcherHostTest, Unregister_CrossOriginShouldFail) {
+  const int64 kProviderId = 99;  // Dummy value
+  scoped_ptr<ServiceWorkerProviderHost> host(new ServiceWorkerProviderHost(
+      kRenderProcessId, kProviderId, context()->AsWeakPtr(), NULL));
+  host->SetDocumentUrl(GURL("https://www.example.com/foo"));
+  base::WeakPtr<ServiceWorkerProviderHost> provider_host = host->AsWeakPtr();
+  context()->AddProviderHost(host.Pass());
+
+  SendUnregister(kProviderId, GURL("https://foo.example.com/"));
+  EXPECT_EQ(1, dispatcher_host_->bad_messages_received_count_);
+}
+
+TEST_F(ServiceWorkerDispatcherHostTest, Unregister_NonSecureOriginShouldFail) {
+  const int64 kProviderId = 99;  // Dummy value
+  scoped_ptr<ServiceWorkerProviderHost> host(new ServiceWorkerProviderHost(
+      kRenderProcessId, kProviderId, context()->AsWeakPtr(), NULL));
   host->SetDocumentUrl(GURL("http://www.example.com/foo"));
   base::WeakPtr<ServiceWorkerProviderHost> provider_host = host->AsWeakPtr();
   context()->AddProviderHost(host.Pass());
 
-  SendUnregister(kProviderId, GURL("http://foo.example.com/"));
+  SendUnregister(kProviderId, GURL("http://www.example.com/"));
   EXPECT_EQ(1, dispatcher_host_->bad_messages_received_count_);
 }
 
 TEST_F(ServiceWorkerDispatcherHostTest, EarlyContextDeletion) {
   helper_->ShutdownContext();
 
   // Let the shutdown reach the simulated IO thread.
   base::RunLoop().RunUntilIdle();
 
   Register(-1,
@@ skipping 39 matching lines @@
       kRenderProcessId, kProviderId, context()->AsWeakPtr(), NULL));
   host->SetDocumentUrl(GURL("https://www.example.com/foo"));
   base::WeakPtr<ServiceWorkerProviderHost> provider_host = host->AsWeakPtr();
   context()->AddProviderHost(host.Pass());
 
   GetRegistration(kProviderId,
                   GURL("https://www.example.com/"),
                   ServiceWorkerMsg_DidGetRegistration::ID);
 }
 
-TEST_F(ServiceWorkerDispatcherHostTest, GetRegistration_CrossOrigin) {
+TEST_F(ServiceWorkerDispatcherHostTest, GetRegistration_CrossOriginShouldFail) {
   const int64 kProviderId = 99;  // Dummy value
   scoped_ptr<ServiceWorkerProviderHost> host(new ServiceWorkerProviderHost(
       kRenderProcessId, kProviderId, context()->AsWeakPtr(), NULL));
   host->SetDocumentUrl(GURL("https://www.example.com/foo"));
   base::WeakPtr<ServiceWorkerProviderHost> provider_host = host->AsWeakPtr();
   context()->AddProviderHost(host.Pass());
 
   SendGetRegistration(kProviderId, GURL("https://foo.example.com/"));
   EXPECT_EQ(1, dispatcher_host_->bad_messages_received_count_);
 }
 
+TEST_F(ServiceWorkerDispatcherHostTest,
+       GetRegistration_NotSecureOriginShouldFail) {
+  const int64 kProviderId = 99;  // Dummy value
+  scoped_ptr<ServiceWorkerProviderHost> host(new ServiceWorkerProviderHost(
+      kRenderProcessId, kProviderId, context()->AsWeakPtr(), NULL));
+  host->SetDocumentUrl(GURL("http://www.example.com/foo"));
+  base::WeakPtr<ServiceWorkerProviderHost> provider_host = host->AsWeakPtr();
+  context()->AddProviderHost(host.Pass());
+
+  SendGetRegistration(kProviderId, GURL("http://www.example.com/"));
+  EXPECT_EQ(1, dispatcher_host_->bad_messages_received_count_);
+}
+
 TEST_F(ServiceWorkerDispatcherHostTest, GetRegistration_EarlyContextDeletion) {
   helper_->ShutdownContext();
 
   // Let the shutdown reach the simulated IO thread.
   base::RunLoop().RunUntilIdle();
 
   GetRegistration(-1,
                   GURL(),
                   ServiceWorkerMsg_ServiceWorkerGetRegistrationError::ID);
 }
 
 }  // namespace content