OLD | NEW |
---|---|
1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2013 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "base/command_line.h" | 5 #include "base/command_line.h" |
6 #include "base/containers/hash_tables.h" | 6 #include "base/containers/hash_tables.h" |
7 #include "base/strings/utf_string_conversions.h" | |
7 #include "content/browser/dom_storage/dom_storage_context_wrapper.h" | 8 #include "content/browser/dom_storage/dom_storage_context_wrapper.h" |
8 #include "content/browser/dom_storage/session_storage_namespace_impl.h" | 9 #include "content/browser/dom_storage/session_storage_namespace_impl.h" |
9 #include "content/browser/frame_host/navigator.h" | 10 #include "content/browser/frame_host/navigator.h" |
10 #include "content/browser/renderer_host/render_view_host_factory.h" | 11 #include "content/browser/renderer_host/render_view_host_factory.h" |
11 #include "content/browser/renderer_host/render_view_host_impl.h" | 12 #include "content/browser/renderer_host/render_view_host_impl.h" |
12 #include "content/browser/web_contents/web_contents_impl.h" | 13 #include "content/browser/web_contents/web_contents_impl.h" |
14 #include "content/common/frame_messages.h" | |
13 #include "content/common/view_messages.h" | 15 #include "content/common/view_messages.h" |
14 #include "content/public/browser/browser_context.h" | 16 #include "content/public/browser/browser_context.h" |
17 #include "content/public/browser/interstitial_page.h" | |
18 #include "content/public/browser/interstitial_page_delegate.h" | |
15 #include "content/public/browser/storage_partition.h" | 19 #include "content/public/browser/storage_partition.h" |
16 #include "content/public/common/content_switches.h" | 20 #include "content/public/common/content_switches.h" |
17 #include "content/public/test/browser_test_utils.h" | 21 #include "content/public/test/browser_test_utils.h" |
18 #include "content/public/test/content_browser_test.h" | 22 #include "content/public/test/content_browser_test.h" |
19 #include "content/public/test/content_browser_test_utils.h" | 23 #include "content/public/test/content_browser_test_utils.h" |
20 #include "content/public/test/test_utils.h" | 24 #include "content/public/test/test_utils.h" |
21 #include "content/shell/browser/shell.h" | 25 #include "content/shell/browser/shell.h" |
26 #include "ipc/ipc_security_test_util.h" | |
27 #include "net/dns/mock_host_resolver.h" | |
28 #include "net/test/embedded_test_server/embedded_test_server.h" | |
29 | |
30 using IPC::IpcSecurityTestUtil; | |
22 | 31 |
23 namespace content { | 32 namespace content { |
24 | 33 |
25 namespace { | 34 namespace { |
26 | 35 |
27 // This is a helper function for the tests which attempt to create a | 36 // This is a helper function for the tests which attempt to create a |
28 // duplicate RenderViewHost or RenderWidgetHost. It tries to create two objects | 37 // duplicate RenderViewHost or RenderWidgetHost. It tries to create two objects |
29 // with the same process and routing ids, which causes a collision. | 38 // with the same process and routing ids, which causes a collision. |
30 // It creates a couple of windows in process 1, which causes a few routing ids | 39 // It creates a couple of windows in process 1, which causes a few routing ids |
31 // to be allocated. Then a cross-process navigation is initiated, which causes a | 40 // to be allocated. Then a cross-process navigation is initiated, which causes a |
32 // new process 2 to be created and have a pending RenderViewHost for it. The | 41 // new process 2 to be created and have a pending RenderViewHost for it. The |
33 // routing id of the RenderViewHost which is target for a duplicate is set | 42 // routing id of the RenderViewHost which is target for a duplicate is set |
34 // into |target_routing_id| and the pending RenderViewHost which is used for | 43 // into |target_routing_id| and the pending RenderViewHost which is used for |
35 // the attempt is the return value. | 44 // the attempt is the return value. |
36 RenderViewHostImpl* PrepareToDuplicateHosts(Shell* shell, | 45 RenderViewHostImpl* PrepareToDuplicateHosts(Shell* shell, |
37 int* target_routing_id) { | 46 int* target_routing_id) { |
38 GURL foo("http://foo.com/files/simple_page.html"); | 47 GURL foo("http://foo.com/simple_page.html"); |
39 | 48 |
40 // Start off with initial navigation, so we get the first process allocated. | 49 // Start off with initial navigation, so we get the first process allocated. |
41 NavigateToURL(shell, foo); | 50 NavigateToURL(shell, foo); |
51 EXPECT_EQ(base::ASCIIToUTF16("OK"), shell->web_contents()->GetTitle()); | |
Charlie Reis
2014/11/14 00:13:27
I think we can put EXPECT_TRUE on the NavigateToUR
| |
42 | 52 |
43 // Open another window, so we generate some more routing ids. | 53 // Open another window, so we generate some more routing ids. |
44 ShellAddedObserver shell2_observer; | 54 ShellAddedObserver shell2_observer; |
45 EXPECT_TRUE(ExecuteScript( | 55 EXPECT_TRUE(ExecuteScript( |
46 shell->web_contents(), "window.open(document.URL + '#2');")); | 56 shell->web_contents(), "window.open(document.URL + '#2');")); |
47 Shell* shell2 = shell2_observer.GetShell(); | 57 Shell* shell2 = shell2_observer.GetShell(); |
48 | 58 |
49 // The new window must be in the same process, but have a new routing id. | 59 // The new window must be in the same process, but have a new routing id. |
50 EXPECT_EQ(shell->web_contents()->GetRenderViewHost()->GetProcess()->GetID(), | 60 EXPECT_EQ(shell->web_contents()->GetRenderViewHost()->GetProcess()->GetID(), |
51 shell2->web_contents()->GetRenderViewHost()->GetProcess()->GetID()); | 61 shell2->web_contents()->GetRenderViewHost()->GetProcess()->GetID()); |
52 *target_routing_id = | 62 *target_routing_id = |
53 shell2->web_contents()->GetRenderViewHost()->GetRoutingID(); | 63 shell2->web_contents()->GetRenderViewHost()->GetRoutingID(); |
54 EXPECT_NE(*target_routing_id, | 64 EXPECT_NE(*target_routing_id, |
55 shell->web_contents()->GetRenderViewHost()->GetRoutingID()); | 65 shell->web_contents()->GetRenderViewHost()->GetRoutingID()); |
56 | 66 |
57 // Now, simulate a link click coming from the renderer. | 67 // Now, simulate a link click coming from the renderer. |
58 GURL extension_url("https://bar.com/files/simple_page.html"); | 68 GURL extension_url("https://bar.com/simple_page.html"); |
59 WebContentsImpl* wc = static_cast<WebContentsImpl*>(shell->web_contents()); | 69 WebContentsImpl* wc = static_cast<WebContentsImpl*>(shell->web_contents()); |
60 wc->GetFrameTree()->root()->navigator()->RequestOpenURL( | 70 wc->GetFrameTree()->root()->navigator()->RequestOpenURL( |
61 wc->GetFrameTree()->root()->current_frame_host(), extension_url, | 71 wc->GetFrameTree()->root()->current_frame_host(), extension_url, |
62 Referrer(), CURRENT_TAB, | 72 Referrer(), CURRENT_TAB, |
63 false, true); | 73 false, true); |
64 | 74 |
65 // Since the navigation above requires a cross-process swap, there will be a | 75 // Since the navigation above requires a cross-process swap, there will be a |
66 // pending RenderViewHost. Ensure it exists and is in a different process | 76 // pending RenderViewHost. Ensure it exists and is in a different process |
67 // than the initial page. | 77 // than the initial page. |
68 RenderViewHostImpl* pending_rvh = | 78 RenderViewHostImpl* pending_rvh = |
69 wc->GetRenderManagerForTesting()->pending_render_view_host(); | 79 wc->GetRenderManagerForTesting()->pending_render_view_host(); |
70 EXPECT_TRUE(pending_rvh != NULL); | 80 EXPECT_TRUE(pending_rvh != NULL); |
71 EXPECT_NE(shell->web_contents()->GetRenderViewHost()->GetProcess()->GetID(), | 81 EXPECT_NE(shell->web_contents()->GetRenderViewHost()->GetProcess()->GetID(), |
72 pending_rvh->GetProcess()->GetID()); | 82 pending_rvh->GetProcess()->GetID()); |
73 | 83 |
74 return pending_rvh; | 84 return pending_rvh; |
75 } | 85 } |
76 | 86 |
77 } // namespace | 87 } // namespace |
78 | 88 |
79 | 89 |
80 // The goal of these tests will be to "simulate" exploited renderer processes, | 90 // The goal of these tests will be to "simulate" exploited renderer processes, |
81 // which can send arbitrary IPC messages and confuse browser process internal | 91 // which can send arbitrary IPC messages and confuse browser process internal |
82 // state, leading to security bugs. We are trying to verify that the browser | 92 // state, leading to security bugs. We are trying to verify that the browser |
83 // doesn't perform any dangerous operations in such cases. | 93 // doesn't perform any dangerous operations in such cases. |
84 class SecurityExploitBrowserTest : public ContentBrowserTest { | 94 class SecurityExploitBrowserTest : public ContentBrowserTest { |
85 public: | 95 public: |
86 SecurityExploitBrowserTest() {} | 96 SecurityExploitBrowserTest() {} |
97 | |
87 void SetUpCommandLine(CommandLine* command_line) override { | 98 void SetUpCommandLine(CommandLine* command_line) override { |
88 ASSERT_TRUE(test_server()->Start()); | 99 ASSERT_TRUE(embedded_test_server()->InitializeAndWaitUntilReady()); |
89 | 100 |
90 // Add a host resolver rule to map all outgoing requests to the test server. | 101 // Add a host resolver rule to map all outgoing requests to the test server. |
91 // This allows us to use "real" hostnames in URLs, which we can use to | 102 // This allows us to use "real" hostnames in URLs, which we can use to |
92 // create arbitrary SiteInstances. | 103 // create arbitrary SiteInstances. |
93 command_line->AppendSwitchASCII( | 104 command_line->AppendSwitchASCII( |
94 switches::kHostResolverRules, | 105 switches::kHostResolverRules, |
95 "MAP * " + test_server()->host_port_pair().ToString() + | 106 "MAP * " + |
107 net::HostPortPair::FromURL(embedded_test_server()->base_url()) | |
108 .ToString() + | |
96 ",EXCLUDE localhost"); | 109 ",EXCLUDE localhost"); |
97 } | 110 } |
98 }; | 111 }; |
99 | 112 |
113 // Fails because the process kill on Android does not succeed. | |
114 // http://crbug.com/433068 | |
115 #if defined(OS_ANDROID) | |
116 #define MAYBE_SetWebUIProperty DISABLED_SetWebUIProperty | |
117 #else | |
118 #define MAYBE_SetWebUIProperty SetWebUIProperty | |
119 #endif | |
120 | |
100 // Ensure that we kill the renderer process if we try to give it WebUI | 121 // Ensure that we kill the renderer process if we try to give it WebUI |
101 // properties and it doesn't have enabled WebUI bindings. | 122 // properties and it doesn't have enabled WebUI bindings. |
102 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, SetWebUIProperty) { | 123 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, MAYBE_SetWebUIProperty) { |
103 GURL foo("http://foo.com/files/simple_page.html"); | 124 GURL foo("http://foo.com/simple_page.html"); |
104 | 125 |
105 NavigateToURL(shell(), foo); | 126 NavigateToURL(shell(), foo); |
127 EXPECT_EQ(base::ASCIIToUTF16("OK"), shell()->web_contents()->GetTitle()); | |
106 EXPECT_EQ(0, | 128 EXPECT_EQ(0, |
107 shell()->web_contents()->GetRenderViewHost()->GetEnabledBindings()); | 129 shell()->web_contents()->GetRenderViewHost()->GetEnabledBindings()); |
108 | 130 |
109 content::RenderProcessHostWatcher terminated( | 131 content::RenderProcessHostWatcher terminated( |
110 shell()->web_contents(), | 132 shell()->web_contents(), |
111 content::RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); | 133 content::RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); |
112 shell()->web_contents()->GetRenderViewHost()->SetWebUIProperty( | 134 shell()->web_contents()->GetRenderViewHost()->SetWebUIProperty( |
113 "toolkit", "views"); | 135 "toolkit", "views"); |
114 terminated.Wait(); | 136 terminated.Wait(); |
115 } | 137 } |
(...skipping 43 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
159 | 181 |
160 // Since this test executes on the UI thread and hopping threads might cause | 182 // Since this test executes on the UI thread and hopping threads might cause |
161 // different timing in the test, let's simulate a CreateNewWidget call coming | 183 // different timing in the test, let's simulate a CreateNewWidget call coming |
162 // from the IO thread. Use the existing window routing id to cause a | 184 // from the IO thread. Use the existing window routing id to cause a |
163 // deliberate collision. | 185 // deliberate collision. |
164 pending_rvh->CreateNewWidget(duplicate_routing_id, blink::WebPopupTypeSelect); | 186 pending_rvh->CreateNewWidget(duplicate_routing_id, blink::WebPopupTypeSelect); |
165 | 187 |
166 // If the above operation doesn't crash, the test has succeeded! | 188 // If the above operation doesn't crash, the test has succeeded! |
167 } | 189 } |
168 | 190 |
191 class SecurityExploitTestInterstitialPage : public InterstitialPageDelegate { | |
192 public: | |
193 explicit SecurityExploitTestInterstitialPage(WebContents* contents) { | |
194 InterstitialPage* interstitial = InterstitialPage::Create( | |
195 contents, true, contents->GetLastCommittedURL(), this); | |
196 interstitial->Show(); | |
197 } | |
198 | |
199 // InterstitialPageDelegate implementation. | |
200 void CommandReceived(const std::string& command) override { | |
201 last_command_ = command; | |
202 } | |
203 | |
204 std::string GetHTMLContents() override { | |
205 return "<html><head><script>" | |
206 "window.domAutomationController.setAutomationId(1);" | |
207 "window.domAutomationController.send(\"okay\");" | |
208 "</script></head>" | |
209 "<body>this page is an interstitial</body></html>"; | |
210 } | |
211 | |
212 std::string last_command() { return last_command_; } | |
213 | |
214 private: | |
215 std::string last_command_; | |
216 DISALLOW_COPY_AND_ASSIGN(SecurityExploitTestInterstitialPage); | |
217 }; | |
218 | |
219 // Fails due to InterstitialPage's reliance on PostNonNestableTask | |
220 // http://crbug.com/432737 | |
221 #if defined(OS_ANDROID) | |
222 #define MAYBE_InterstitialCommandFromUnderlyingContent \ | |
223 DISABLED_InterstitialCommandFromUnderlyingContent | |
224 #else | |
225 #define MAYBE_InterstitialCommandFromUnderlyingContent \ | |
226 InterstitialCommandFromUnderlyingContent | |
227 #endif | |
228 | |
229 // The interstitial should not be controllable by the underlying content. | |
230 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, | |
231 MAYBE_InterstitialCommandFromUnderlyingContent) { | |
232 // Start off with initial navigation, to allocate the process. | |
233 GURL foo("http://foo.com/simple_page.html"); | |
234 NavigateToURL(shell(), foo); | |
235 EXPECT_EQ(base::ASCIIToUTF16("OK"), shell()->web_contents()->GetTitle()); | |
236 | |
237 DOMMessageQueue message_queue; | |
238 | |
239 // Install and show an interstitial page. | |
240 SecurityExploitTestInterstitialPage* interstitial = | |
241 new SecurityExploitTestInterstitialPage(shell()->web_contents()); | |
242 | |
243 ASSERT_EQ("", interstitial->last_command()); | |
244 content::WaitForInterstitialAttach(shell()->web_contents()); | |
245 | |
246 InterstitialPage* interstitial_page = | |
247 shell()->web_contents()->GetInterstitialPage(); | |
248 ASSERT_TRUE(interstitial_page != NULL); | |
249 ASSERT_TRUE(shell()->web_contents()->ShowingInterstitialPage()); | |
250 ASSERT_TRUE(interstitial_page->GetDelegateForTesting() == interstitial); | |
Charlie Reis
2014/11/14 00:13:27
nit: ASSERT_EQ
| |
251 | |
252 // The interstitial page ought to be able to send a message. | |
253 std::string message; | |
254 ASSERT_TRUE(message_queue.WaitForMessage(&message)); | |
255 ASSERT_EQ("\"okay\"", message); | |
256 ASSERT_EQ("\"okay\"", interstitial->last_command()); | |
257 | |
258 // Send an automation message from the underlying content and wait for it to | |
259 // be dispatched on this thread. This message should not be received by the | |
260 // interstitial. | |
261 content::RenderFrameHost* compromised_renderer = | |
262 shell()->web_contents()->GetMainFrame(); | |
263 FrameHostMsg_DomOperationResponse evil(compromised_renderer->GetRoutingID(), | |
264 "evil", MSG_ROUTING_NONE); | |
265 IpcSecurityTestUtil::PwnMessageReceived( | |
266 compromised_renderer->GetProcess()->GetChannel(), evil); | |
267 | |
268 ASSERT_TRUE(message_queue.WaitForMessage(&message)); | |
269 ASSERT_EQ("evil", message) | |
270 << "Automation message should be received by WebContents."; | |
271 ASSERT_EQ("\"okay\"", interstitial->last_command()) | |
272 << "Interstitial should not be affected."; | |
273 | |
274 // Send a second message from the interstitial page, and make sure that the | |
275 // "evil" message doesn't arrive in the intervening period. | |
276 ASSERT_TRUE(content::ExecuteScript( | |
277 interstitial_page->GetRenderViewHostForTesting(), | |
278 "window.domAutomationController.send(\"okay2\");")); | |
279 ASSERT_TRUE(message_queue.WaitForMessage(&message)); | |
280 ASSERT_EQ("\"okay2\"", message); | |
281 ASSERT_EQ("\"okay2\"", interstitial->last_command()); | |
282 } | |
283 | |
169 } // namespace content | 284 } // namespace content |
OLD | NEW |