Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(275)

Issues Search
    My Issues | Starred     Open | Closed | All

Side by Side Diff: extensions/common/csp_validator_unittest.cc

Issue 722233004: Accept invalid chrome-extension:// and chrome:// CSP tokens (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Add extra comments Created 6 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « extensions/common/csp_validator.cc ('k') | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2013 The Chromium Authors. All rights reserved. 1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "extensions/common/csp_validator.h" 5 #include "extensions/common/csp_validator.h"
6 #include "testing/gtest/include/gtest/gtest.h" 6 #include "testing/gtest/include/gtest/gtest.h"
7 7
8 using extensions::csp_validator::ContentSecurityPolicyIsLegal; 8 using extensions::csp_validator::ContentSecurityPolicyIsLegal;
9 using extensions::csp_validator::ContentSecurityPolicyIsSecure; 9 using extensions::csp_validator::ContentSecurityPolicyIsSecure;
10 using extensions::csp_validator::ContentSecurityPolicyIsSandboxed; 10 using extensions::csp_validator::ContentSecurityPolicyIsSandboxed;
(...skipping 80 matching lines...) Expand 10 before | Expand all | Expand 10 after
91 "default-src 'self' google.com", Manifest::TYPE_EXTENSION)); 91 "default-src 'self' google.com", Manifest::TYPE_EXTENSION));
92 92
93 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 93 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
94 "default-src 'self' *", Manifest::TYPE_EXTENSION)); 94 "default-src 'self' *", Manifest::TYPE_EXTENSION));
95 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 95 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
96 "default-src 'self' *:*", Manifest::TYPE_EXTENSION)); 96 "default-src 'self' *:*", Manifest::TYPE_EXTENSION));
97 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 97 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
98 "default-src 'self' *:*/", Manifest::TYPE_EXTENSION)); 98 "default-src 'self' *:*/", Manifest::TYPE_EXTENSION));
99 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 99 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
100 "default-src 'self' *:*/path", Manifest::TYPE_EXTENSION)); 100 "default-src 'self' *:*/path", Manifest::TYPE_EXTENSION));
101 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 101 // "https://" is an invalid CSP, so it will be ignored by Blink.
102 // TODO(robwu): Change to EXPECT_FALSE once http://crbug.com/434773 is fixed.
103 EXPECT_TRUE(ContentSecurityPolicyIsSecure(
102 "default-src 'self' https://", Manifest::TYPE_EXTENSION)); 104 "default-src 'self' https://", Manifest::TYPE_EXTENSION));
103 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 105 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
104 "default-src 'self' https://*:*", Manifest::TYPE_EXTENSION)); 106 "default-src 'self' https://*:*", Manifest::TYPE_EXTENSION));
105 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 107 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
106 "default-src 'self' https://*:*/", Manifest::TYPE_EXTENSION)); 108 "default-src 'self' https://*:*/", Manifest::TYPE_EXTENSION));
107 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 109 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
108 "default-src 'self' https://*:*/path", Manifest::TYPE_EXTENSION)); 110 "default-src 'self' https://*:*/path", Manifest::TYPE_EXTENSION));
109 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 111 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
110 "default-src 'self' https://*.com", Manifest::TYPE_EXTENSION)); 112 "default-src 'self' https://*.com", Manifest::TYPE_EXTENSION));
111 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 113 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
(...skipping 48 matching lines...) Expand 10 before | Expand all | Expand 10 after
160 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 162 EXPECT_TRUE(ContentSecurityPolicyIsSecure(
161 "default-src 'self' filesystem:", Manifest::TYPE_EXTENSION)); 163 "default-src 'self' filesystem:", Manifest::TYPE_EXTENSION));
162 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 164 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
163 "default-src 'self' filesystem:http://example.com/XXX", 165 "default-src 'self' filesystem:http://example.com/XXX",
164 Manifest::TYPE_EXTENSION)); 166 Manifest::TYPE_EXTENSION));
165 167
166 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 168 EXPECT_TRUE(ContentSecurityPolicyIsSecure(
167 "default-src 'self' https://*.googleapis.com", Manifest::TYPE_EXTENSION)); 169 "default-src 'self' https://*.googleapis.com", Manifest::TYPE_EXTENSION));
168 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 170 EXPECT_TRUE(ContentSecurityPolicyIsSecure(
169 "default-src 'self' https://x.googleapis.com", Manifest::TYPE_EXTENSION)); 171 "default-src 'self' https://x.googleapis.com", Manifest::TYPE_EXTENSION));
172 // "chrome-extension://" is an invalid CSP and ignored by Blink, but extension
173 // authors have been using this string anyway, so we cannot refuse this string
174 // until extensions can be loaded with an invalid CSP. http://crbug.com/434773
175 EXPECT_TRUE(ContentSecurityPolicyIsSecure(
176 "default-src 'self' chrome-extension://", Manifest::TYPE_EXTENSION));
170 } 177 }
171 178
172 TEST(ExtensionCSPValidator, IsSandboxed) { 179 TEST(ExtensionCSPValidator, IsSandboxed) {
173 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(std::string(), 180 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(std::string(),
174 Manifest::TYPE_EXTENSION)); 181 Manifest::TYPE_EXTENSION));
175 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed("img-src https://google.com", 182 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed("img-src https://google.com",
176 Manifest::TYPE_EXTENSION)); 183 Manifest::TYPE_EXTENSION));
177 184
178 // Sandbox directive is required. 185 // Sandbox directive is required.
179 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( 186 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
(...skipping 15 matching lines...) Expand all
195 "sandbox allow-top-navigation", Manifest::TYPE_EXTENSION)); 202 "sandbox allow-top-navigation", Manifest::TYPE_EXTENSION));
196 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed( 203 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(
197 "sandbox allow-top-navigation", Manifest::TYPE_PLATFORM_APP)); 204 "sandbox allow-top-navigation", Manifest::TYPE_PLATFORM_APP));
198 205
199 // Popups are OK. 206 // Popups are OK.
200 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( 207 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
201 "sandbox allow-popups", Manifest::TYPE_EXTENSION)); 208 "sandbox allow-popups", Manifest::TYPE_EXTENSION));
202 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( 209 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
203 "sandbox allow-popups", Manifest::TYPE_PLATFORM_APP)); 210 "sandbox allow-popups", Manifest::TYPE_PLATFORM_APP));
204 } 211 }
OLDNEW
« no previous file with comments | « extensions/common/csp_validator.cc ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698