Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(165)

Issues Search
    My Issues | Starred     Open | Closed | All

Side by Side Diff: extensions/common/csp_validator_unittest.cc

Issue 722233004: Accept invalid chrome-extension:// and chrome:// CSP tokens (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Simplify patch - just accept any empty host Created 6 years, 1 month ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « extensions/common/csp_validator.cc ('k') | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2013 The Chromium Authors. All rights reserved. 1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "extensions/common/csp_validator.h" 5 #include "extensions/common/csp_validator.h"
6 #include "testing/gtest/include/gtest/gtest.h" 6 #include "testing/gtest/include/gtest/gtest.h"
7 7
8 using extensions::csp_validator::ContentSecurityPolicyIsLegal; 8 using extensions::csp_validator::ContentSecurityPolicyIsLegal;
9 using extensions::csp_validator::ContentSecurityPolicyIsSecure; 9 using extensions::csp_validator::ContentSecurityPolicyIsSecure;
10 using extensions::csp_validator::ContentSecurityPolicyIsSandboxed; 10 using extensions::csp_validator::ContentSecurityPolicyIsSandboxed;
(...skipping 80 matching lines...) Expand 10 before | Expand all | Expand 10 after
91 "default-src 'self' google.com", Manifest::TYPE_EXTENSION)); 91 "default-src 'self' google.com", Manifest::TYPE_EXTENSION));
92 92
93 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 93 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
94 "default-src 'self' *", Manifest::TYPE_EXTENSION)); 94 "default-src 'self' *", Manifest::TYPE_EXTENSION));
95 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 95 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
96 "default-src 'self' *:*", Manifest::TYPE_EXTENSION)); 96 "default-src 'self' *:*", Manifest::TYPE_EXTENSION));
97 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 97 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
98 "default-src 'self' *:*/", Manifest::TYPE_EXTENSION)); 98 "default-src 'self' *:*/", Manifest::TYPE_EXTENSION));
99 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 99 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
100 "default-src 'self' *:*/path", Manifest::TYPE_EXTENSION)); 100 "default-src 'self' *:*/path", Manifest::TYPE_EXTENSION));
101 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 101 EXPECT_TRUE(ContentSecurityPolicyIsSecure(
not at google - send to devlin 2014/11/19 17:36:55 Explain why this is secure (and link to the bug).
102 "default-src 'self' https://", Manifest::TYPE_EXTENSION)); 102 "default-src 'self' https://", Manifest::TYPE_EXTENSION));
103 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 103 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
104 "default-src 'self' https://*:*", Manifest::TYPE_EXTENSION)); 104 "default-src 'self' https://*:*", Manifest::TYPE_EXTENSION));
105 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 105 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
106 "default-src 'self' https://*:*/", Manifest::TYPE_EXTENSION)); 106 "default-src 'self' https://*:*/", Manifest::TYPE_EXTENSION));
107 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 107 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
108 "default-src 'self' https://*:*/path", Manifest::TYPE_EXTENSION)); 108 "default-src 'self' https://*:*/path", Manifest::TYPE_EXTENSION));
109 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 109 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
110 "default-src 'self' https://*.com", Manifest::TYPE_EXTENSION)); 110 "default-src 'self' https://*.com", Manifest::TYPE_EXTENSION));
111 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 111 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
(...skipping 48 matching lines...) Expand 10 before | Expand all | Expand 10 after
160 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 160 EXPECT_TRUE(ContentSecurityPolicyIsSecure(
161 "default-src 'self' filesystem:", Manifest::TYPE_EXTENSION)); 161 "default-src 'self' filesystem:", Manifest::TYPE_EXTENSION));
162 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 162 EXPECT_FALSE(ContentSecurityPolicyIsSecure(
163 "default-src 'self' filesystem:http://example.com/XXX", 163 "default-src 'self' filesystem:http://example.com/XXX",
164 Manifest::TYPE_EXTENSION)); 164 Manifest::TYPE_EXTENSION));
165 165
166 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 166 EXPECT_TRUE(ContentSecurityPolicyIsSecure(
167 "default-src 'self' https://*.googleapis.com", Manifest::TYPE_EXTENSION)); 167 "default-src 'self' https://*.googleapis.com", Manifest::TYPE_EXTENSION));
168 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 168 EXPECT_TRUE(ContentSecurityPolicyIsSecure(
169 "default-src 'self' https://x.googleapis.com", Manifest::TYPE_EXTENSION)); 169 "default-src 'self' https://x.googleapis.com", Manifest::TYPE_EXTENSION));
170 EXPECT_TRUE(ContentSecurityPolicyIsSecure(
not at google - send to devlin 2014/11/19 17:36:55 Ditto.
171 "default-src 'self' chrome-extension://", Manifest::TYPE_EXTENSION));
170 } 172 }
171 173
172 TEST(ExtensionCSPValidator, IsSandboxed) { 174 TEST(ExtensionCSPValidator, IsSandboxed) {
173 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(std::string(), 175 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(std::string(),
174 Manifest::TYPE_EXTENSION)); 176 Manifest::TYPE_EXTENSION));
175 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed("img-src https://google.com", 177 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed("img-src https://google.com",
176 Manifest::TYPE_EXTENSION)); 178 Manifest::TYPE_EXTENSION));
177 179
178 // Sandbox directive is required. 180 // Sandbox directive is required.
179 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( 181 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
(...skipping 15 matching lines...) Expand all
195 "sandbox allow-top-navigation", Manifest::TYPE_EXTENSION)); 197 "sandbox allow-top-navigation", Manifest::TYPE_EXTENSION));
196 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed( 198 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(
197 "sandbox allow-top-navigation", Manifest::TYPE_PLATFORM_APP)); 199 "sandbox allow-top-navigation", Manifest::TYPE_PLATFORM_APP));
198 200
199 // Popups are OK. 201 // Popups are OK.
200 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( 202 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
201 "sandbox allow-popups", Manifest::TYPE_EXTENSION)); 203 "sandbox allow-popups", Manifest::TYPE_EXTENSION));
202 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( 204 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
203 "sandbox allow-popups", Manifest::TYPE_PLATFORM_APP)); 205 "sandbox allow-popups", Manifest::TYPE_PLATFORM_APP));
204 } 206 }
OLDNEW
« no previous file with comments | « extensions/common/csp_validator.cc ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698