Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(155)

Issues Search
    My Issues | Starred     Open | Closed | All

Side by Side Diff: extensions/common/csp_validator_unittest.cc

Issue 747403002: Ignore insecure parts of CSP in extensions and allow extension to load (Closed) Base URL: https://chromium.googlesource.com/chromium/src.git@master
Patch Set: Fix test expectations Created 5 years, 12 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « extensions/common/csp_validator.cc ('k') | extensions/common/manifest_constants.h » ('j') | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright 2013 The Chromium Authors. All rights reserved. 1 // Copyright 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include "extensions/common/csp_validator.h" 5 #include "extensions/common/csp_validator.h"
6 #include "extensions/common/error_utils.h"
7 #include "extensions/common/install_warning.h"
8 #include "extensions/common/manifest_constants.h"
6 #include "testing/gtest/include/gtest/gtest.h" 9 #include "testing/gtest/include/gtest/gtest.h"
7 10
8 using extensions::csp_validator::ContentSecurityPolicyIsLegal; 11 using extensions::csp_validator::ContentSecurityPolicyIsLegal;
9 using extensions::csp_validator::ContentSecurityPolicyIsSecure; 12 using extensions::csp_validator::SanitizeContentSecurityPolicy;
10 using extensions::csp_validator::ContentSecurityPolicyIsSandboxed; 13 using extensions::csp_validator::ContentSecurityPolicyIsSandboxed;
11 using extensions::csp_validator::OPTIONS_NONE; 14 using extensions::csp_validator::OPTIONS_NONE;
12 using extensions::csp_validator::OPTIONS_ALLOW_UNSAFE_EVAL; 15 using extensions::csp_validator::OPTIONS_ALLOW_UNSAFE_EVAL;
13 using extensions::csp_validator::OPTIONS_ALLOW_INSECURE_OBJECT_SRC; 16 using extensions::csp_validator::OPTIONS_ALLOW_INSECURE_OBJECT_SRC;
17 using extensions::ErrorUtils;
18 using extensions::InstallWarning;
14 using extensions::Manifest; 19 using extensions::Manifest;
15 20
21 namespace {
22
23 std::string InsecureValueWarning(const std::string& directive,
24 const std::string& value) {
25 return ErrorUtils::FormatErrorMessage(
26 extensions::manifest_errors::kInvalidCSPInsecureValue, value, directive);
27 }
28
29 std::string MissingSecureSrcWarning(const std::string& directive) {
30 return ErrorUtils::FormatErrorMessage(
31 extensions::manifest_errors::kInvalidCSPMissingSecureSrc, directive);
32 }
33
34 testing::AssertionResult CheckSanitizeCSP(
35 const std::string& policy,
36 int options,
37 const std::string& expected_csp,
38 const std::vector<std::string>& expected_warnings) {
39 std::vector<InstallWarning> actual_warnings;
40 std::string actual_csp = SanitizeContentSecurityPolicy(policy,
41 options,
42 &actual_warnings);
43 if (actual_csp != expected_csp)
44 return testing::AssertionFailure()
45 << "SanitizeContentSecurityPolicy returned an unexpected CSP.\n"
46 << "Expected CSP: " << expected_csp << "\n"
47 << " Actual CSP: " << actual_csp;
48
49 if (expected_warnings.size() != actual_warnings.size()) {
50 testing::Message msg;
51 msg << "Expected " << expected_warnings.size()
52 << " warnings, but got " << actual_warnings.size();
53 for (size_t i = 0; i < actual_warnings.size(); ++i)
54 msg << "\nWarning " << i << " " << actual_warnings[i].message;
55 return testing::AssertionFailure() << msg;
56 }
57
58 for (size_t i = 0; i < expected_warnings.size(); ++i) {
59 if (expected_warnings[i] != actual_warnings[i].message)
60 return testing::AssertionFailure()
61 << "Unexpected warning from SanitizeContentSecurityPolicy.\n"
62 << "Expected warning[" << i << "]: " << expected_warnings[i]
63 << " Actual warning[" << i << "]: " << actual_warnings[i].message;
64 }
65 return testing::AssertionSuccess();
66 }
67
68 testing::AssertionResult CheckSanitizeCSP(const std::string& policy,
69 int options) {
70 return CheckSanitizeCSP(policy, options, policy, std::vector<std::string>());
71 }
72
73 testing::AssertionResult CheckSanitizeCSP(const std::string& policy,
74 int options,
75 const std::string& expected_csp) {
76 std::vector<std::string> expected_warnings;
77 return CheckSanitizeCSP(policy, options, expected_csp, expected_warnings);
78 }
79
80 testing::AssertionResult CheckSanitizeCSP(const std::string& policy,
81 int options,
82 const std::string& expected_csp,
83 const std::string& warning1) {
84 std::vector<std::string> expected_warnings(1, warning1);
85 return CheckSanitizeCSP(policy, options, expected_csp, expected_warnings);
86 }
87
88 testing::AssertionResult CheckSanitizeCSP(const std::string& policy,
89 int options,
90 const std::string& expected_csp,
91 const std::string& warning1,
92 const std::string& warning2) {
93 std::vector<std::string> expected_warnings(1, warning1);
94 expected_warnings.push_back(warning2);
95 return CheckSanitizeCSP(policy, options, expected_csp, expected_warnings);
96 }
97
98 testing::AssertionResult CheckSanitizeCSP(const std::string& policy,
99 int options,
100 const std::string& expected_csp,
101 const std::string& warning1,
102 const std::string& warning2,
103 const std::string& warning3) {
104 std::vector<std::string> expected_warnings(1, warning1);
105 expected_warnings.push_back(warning2);
106 expected_warnings.push_back(warning3);
107 return CheckSanitizeCSP(policy, options, expected_csp, expected_warnings);
108 }
109
110 }; // namespace
111
16 TEST(ExtensionCSPValidator, IsLegal) { 112 TEST(ExtensionCSPValidator, IsLegal) {
17 EXPECT_TRUE(ContentSecurityPolicyIsLegal("foo")); 113 EXPECT_TRUE(ContentSecurityPolicyIsLegal("foo"));
18 EXPECT_TRUE(ContentSecurityPolicyIsLegal( 114 EXPECT_TRUE(ContentSecurityPolicyIsLegal(
19 "default-src 'self'; script-src http://www.google.com")); 115 "default-src 'self'; script-src http://www.google.com"));
20 EXPECT_FALSE(ContentSecurityPolicyIsLegal( 116 EXPECT_FALSE(ContentSecurityPolicyIsLegal(
21 "default-src 'self';\nscript-src http://www.google.com")); 117 "default-src 'self';\nscript-src http://www.google.com"));
22 EXPECT_FALSE(ContentSecurityPolicyIsLegal( 118 EXPECT_FALSE(ContentSecurityPolicyIsLegal(
23 "default-src 'self';\rscript-src http://www.google.com")); 119 "default-src 'self';\rscript-src http://www.google.com"));
24 EXPECT_FALSE(ContentSecurityPolicyIsLegal( 120 EXPECT_FALSE(ContentSecurityPolicyIsLegal(
25 "default-src 'self';,script-src http://www.google.com")); 121 "default-src 'self';,script-src http://www.google.com"));
26 } 122 }
27 123
28 TEST(ExtensionCSPValidator, IsSecure) { 124 TEST(ExtensionCSPValidator, IsSecure) {
29 EXPECT_FALSE( 125 EXPECT_TRUE(CheckSanitizeCSP(
30 ContentSecurityPolicyIsSecure(std::string(), OPTIONS_ALLOW_UNSAFE_EVAL)); 126 std::string(), OPTIONS_ALLOW_UNSAFE_EVAL,
31 EXPECT_FALSE(ContentSecurityPolicyIsSecure("img-src https://google.com", 127 "script-src 'self' chrome-extension-resource:; object-src 'self';",
32 OPTIONS_ALLOW_UNSAFE_EVAL)); 128 MissingSecureSrcWarning("script-src"),
33 129 MissingSecureSrcWarning("object-src")));
34 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 130 EXPECT_TRUE(CheckSanitizeCSP(
35 "default-src *", OPTIONS_ALLOW_UNSAFE_EVAL)); 131 "img-src https://google.com", OPTIONS_ALLOW_UNSAFE_EVAL,
36 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 132 "img-src https://google.com; script-src 'self'"
37 "default-src 'self'", OPTIONS_ALLOW_UNSAFE_EVAL)); 133 " chrome-extension-resource:; object-src 'self';",
38 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 134 MissingSecureSrcWarning("script-src"),
39 "default-src 'none'", OPTIONS_ALLOW_UNSAFE_EVAL)); 135 MissingSecureSrcWarning("object-src")));
40 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 136 EXPECT_TRUE(CheckSanitizeCSP(
41 "default-src 'self' ftp://google.com", OPTIONS_ALLOW_UNSAFE_EVAL)); 137 "script-src a b", OPTIONS_ALLOW_UNSAFE_EVAL,
42 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 138 "script-src; object-src 'self';",
43 "default-src 'self' https://google.com", OPTIONS_ALLOW_UNSAFE_EVAL)); 139 InsecureValueWarning("script-src", "a"),
44 140 InsecureValueWarning("script-src", "b"),
45 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 141 MissingSecureSrcWarning("object-src")));
46 "default-src *; default-src 'self'", OPTIONS_ALLOW_UNSAFE_EVAL)); 142
47 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 143 EXPECT_TRUE(CheckSanitizeCSP(
48 "default-src 'self'; default-src *", OPTIONS_ALLOW_UNSAFE_EVAL)); 144 "default-src *", OPTIONS_ALLOW_UNSAFE_EVAL,
49 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 145 "default-src;",
146 InsecureValueWarning("default-src", "*")));
147 EXPECT_TRUE(CheckSanitizeCSP(
148 "default-src 'self';", OPTIONS_ALLOW_UNSAFE_EVAL));
149 EXPECT_TRUE(CheckSanitizeCSP(
150 "default-src 'none';", OPTIONS_ALLOW_UNSAFE_EVAL));
151 EXPECT_TRUE(CheckSanitizeCSP(
152 "default-src 'self' ftp://google.com", OPTIONS_ALLOW_UNSAFE_EVAL,
153 "default-src 'self';",
154 InsecureValueWarning("default-src", "ftp://google.com")));
155 EXPECT_TRUE(CheckSanitizeCSP(
156 "default-src 'self' https://google.com;", OPTIONS_ALLOW_UNSAFE_EVAL));
157
158 EXPECT_TRUE(CheckSanitizeCSP(
159 "default-src *; default-src 'self'", OPTIONS_ALLOW_UNSAFE_EVAL,
160 "default-src; default-src 'self';",
161 InsecureValueWarning("default-src", "*")));
162 EXPECT_TRUE(CheckSanitizeCSP(
163 "default-src 'self'; default-src *;", OPTIONS_ALLOW_UNSAFE_EVAL,
164 "default-src 'self'; default-src;"));
165 EXPECT_TRUE(CheckSanitizeCSP(
50 "default-src 'self'; default-src *; script-src *; script-src 'self'", 166 "default-src 'self'; default-src *; script-src *; script-src 'self'",
51 OPTIONS_ALLOW_UNSAFE_EVAL)); 167 OPTIONS_ALLOW_UNSAFE_EVAL,
52 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 168 "default-src 'self'; default-src; script-src; script-src 'self';",
53 "default-src 'self'; default-src *; script-src 'self'; script-src *", 169 InsecureValueWarning("script-src", "*")));
54 OPTIONS_ALLOW_UNSAFE_EVAL)); 170 EXPECT_TRUE(CheckSanitizeCSP(
55 171 "default-src 'self'; default-src *; script-src 'self'; script-src *;",
56 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 172 OPTIONS_ALLOW_UNSAFE_EVAL,
57 "default-src *; script-src 'self'", OPTIONS_ALLOW_UNSAFE_EVAL)); 173 "default-src 'self'; default-src; script-src 'self'; script-src;"));
58 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 174 EXPECT_TRUE(CheckSanitizeCSP(
175 "default-src *; script-src 'self'", OPTIONS_ALLOW_UNSAFE_EVAL,
176 "default-src; script-src 'self';",
177 InsecureValueWarning("default-src", "*")));
178 EXPECT_TRUE(CheckSanitizeCSP(
59 "default-src *; script-src 'self'; img-src 'self'", 179 "default-src *; script-src 'self'; img-src 'self'",
60 OPTIONS_ALLOW_UNSAFE_EVAL)); 180 OPTIONS_ALLOW_UNSAFE_EVAL,
61 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 181 "default-src; script-src 'self'; img-src 'self';",
62 "default-src *; script-src 'self'; object-src 'self'", 182 InsecureValueWarning("default-src", "*")));
63 OPTIONS_ALLOW_UNSAFE_EVAL)); 183 EXPECT_TRUE(CheckSanitizeCSP(
64 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 184 "default-src *; script-src 'self'; object-src 'self';",
65 "script-src 'self'; object-src 'self'", OPTIONS_ALLOW_UNSAFE_EVAL)); 185 OPTIONS_ALLOW_UNSAFE_EVAL,
66 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 186 "default-src; script-src 'self'; object-src 'self';"));
67 "default-src 'unsafe-eval'", OPTIONS_ALLOW_UNSAFE_EVAL)); 187 EXPECT_TRUE(CheckSanitizeCSP(
68 188 "script-src 'self'; object-src 'self';", OPTIONS_ALLOW_UNSAFE_EVAL));
69 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 189 EXPECT_TRUE(CheckSanitizeCSP(
70 "default-src 'unsafe-eval'", OPTIONS_NONE)); 190 "default-src 'unsafe-eval';", OPTIONS_ALLOW_UNSAFE_EVAL));
71 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 191
72 "default-src 'unsafe-inline'", OPTIONS_ALLOW_UNSAFE_EVAL)); 192 EXPECT_TRUE(CheckSanitizeCSP(
73 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 193 "default-src 'unsafe-eval'", OPTIONS_NONE,
74 "default-src 'unsafe-inline' 'none'", OPTIONS_ALLOW_UNSAFE_EVAL)); 194 "default-src;",
75 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 195 InsecureValueWarning("default-src", "'unsafe-eval'")));
76 "default-src 'self' http://google.com", OPTIONS_ALLOW_UNSAFE_EVAL)); 196 EXPECT_TRUE(CheckSanitizeCSP(
77 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 197 "default-src 'unsafe-inline'", OPTIONS_ALLOW_UNSAFE_EVAL,
78 "default-src 'self' https://google.com", OPTIONS_ALLOW_UNSAFE_EVAL)); 198 "default-src;",
79 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 199 InsecureValueWarning("default-src", "'unsafe-inline'")));
80 "default-src 'self' chrome://resources", OPTIONS_ALLOW_UNSAFE_EVAL)); 200 EXPECT_TRUE(CheckSanitizeCSP(
81 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 201 "default-src 'unsafe-inline' 'none'", OPTIONS_ALLOW_UNSAFE_EVAL,
82 "default-src 'self' chrome-extension://aabbcc", 202 "default-src 'none';",
83 OPTIONS_ALLOW_UNSAFE_EVAL)); 203 InsecureValueWarning("default-src", "'unsafe-inline'")));
84 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 204 EXPECT_TRUE(CheckSanitizeCSP(
85 "default-src 'self' chrome-extension-resource://aabbcc", 205 "default-src 'self' http://google.com", OPTIONS_ALLOW_UNSAFE_EVAL,
86 OPTIONS_ALLOW_UNSAFE_EVAL)); 206 "default-src 'self';",
87 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 207 InsecureValueWarning("default-src", "http://google.com")));
88 "default-src 'self' https:", OPTIONS_ALLOW_UNSAFE_EVAL)); 208 EXPECT_TRUE(CheckSanitizeCSP(
89 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 209 "default-src 'self' https://google.com;", OPTIONS_ALLOW_UNSAFE_EVAL));
90 "default-src 'self' http:", OPTIONS_ALLOW_UNSAFE_EVAL)); 210 EXPECT_TRUE(CheckSanitizeCSP(
91 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 211 "default-src 'self' chrome://resources;", OPTIONS_ALLOW_UNSAFE_EVAL));
92 "default-src 'self' google.com", OPTIONS_ALLOW_UNSAFE_EVAL)); 212 EXPECT_TRUE(CheckSanitizeCSP(
93 213 "default-src 'self' chrome-extension://aabbcc;",
94 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 214 OPTIONS_ALLOW_UNSAFE_EVAL));
95 "default-src 'self' *", OPTIONS_ALLOW_UNSAFE_EVAL)); 215 EXPECT_TRUE(CheckSanitizeCSP(
96 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 216 "default-src 'self' chrome-extension-resource://aabbcc;",
97 "default-src 'self' *:*", OPTIONS_ALLOW_UNSAFE_EVAL)); 217 OPTIONS_ALLOW_UNSAFE_EVAL));
98 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 218 EXPECT_TRUE(CheckSanitizeCSP(
99 "default-src 'self' *:*/", OPTIONS_ALLOW_UNSAFE_EVAL)); 219 "default-src 'self' https:", OPTIONS_ALLOW_UNSAFE_EVAL,
100 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 220 "default-src 'self';",
101 "default-src 'self' *:*/path", OPTIONS_ALLOW_UNSAFE_EVAL)); 221 InsecureValueWarning("default-src", "https:")));
102 // "https://" is an invalid CSP, so it will be ignored by Blink. 222 EXPECT_TRUE(CheckSanitizeCSP(
103 // TODO(robwu): Change to EXPECT_FALSE once http://crbug.com/434773 is fixed. 223 "default-src 'self' http:", OPTIONS_ALLOW_UNSAFE_EVAL,
104 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 224 "default-src 'self';",
105 "default-src 'self' https://", OPTIONS_ALLOW_UNSAFE_EVAL)); 225 InsecureValueWarning("default-src", "http:")));
106 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 226 EXPECT_TRUE(CheckSanitizeCSP(
107 "default-src 'self' https://*:*", OPTIONS_ALLOW_UNSAFE_EVAL)); 227 "default-src 'self' google.com", OPTIONS_ALLOW_UNSAFE_EVAL,
108 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 228 "default-src 'self';",
109 "default-src 'self' https://*:*/", OPTIONS_ALLOW_UNSAFE_EVAL)); 229 InsecureValueWarning("default-src", "google.com")));
110 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 230
111 "default-src 'self' https://*:*/path", OPTIONS_ALLOW_UNSAFE_EVAL)); 231 EXPECT_TRUE(CheckSanitizeCSP(
112 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 232 "default-src 'self' *", OPTIONS_ALLOW_UNSAFE_EVAL,
113 "default-src 'self' https://*.com", OPTIONS_ALLOW_UNSAFE_EVAL)); 233 "default-src 'self';",
114 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 234 InsecureValueWarning("default-src", "*")));
115 "default-src 'self' https://*.*.google.com/", OPTIONS_ALLOW_UNSAFE_EVAL)); 235 EXPECT_TRUE(CheckSanitizeCSP(
116 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 236 "default-src 'self' *:*", OPTIONS_ALLOW_UNSAFE_EVAL,
117 "default-src 'self' https://*.*.google.com:*/", 237 "default-src 'self';",
118 OPTIONS_ALLOW_UNSAFE_EVAL)); 238 InsecureValueWarning("default-src", "*:*")));
119 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 239 EXPECT_TRUE(CheckSanitizeCSP(
120 "default-src 'self' https://www.*.google.com/", 240 "default-src 'self' *:*/", OPTIONS_ALLOW_UNSAFE_EVAL,
121 OPTIONS_ALLOW_UNSAFE_EVAL)); 241 "default-src 'self';",
122 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 242 InsecureValueWarning("default-src", "*:*/")));
243 EXPECT_TRUE(CheckSanitizeCSP(
244 "default-src 'self' *:*/path", OPTIONS_ALLOW_UNSAFE_EVAL,
245 "default-src 'self';",
246 InsecureValueWarning("default-src", "*:*/path")));
247 EXPECT_TRUE(CheckSanitizeCSP(
248 "default-src 'self' https://", OPTIONS_ALLOW_UNSAFE_EVAL,
249 "default-src 'self';",
250 InsecureValueWarning("default-src", "https://")));
251 EXPECT_TRUE(CheckSanitizeCSP(
252 "default-src 'self' https://*:*", OPTIONS_ALLOW_UNSAFE_EVAL,
253 "default-src 'self';",
254 InsecureValueWarning("default-src", "https://*:*")));
255 EXPECT_TRUE(CheckSanitizeCSP(
256 "default-src 'self' https://*:*/", OPTIONS_ALLOW_UNSAFE_EVAL,
257 "default-src 'self';",
258 InsecureValueWarning("default-src", "https://*:*/")));
259 EXPECT_TRUE(CheckSanitizeCSP(
260 "default-src 'self' https://*:*/path", OPTIONS_ALLOW_UNSAFE_EVAL,
261 "default-src 'self';",
262 InsecureValueWarning("default-src", "https://*:*/path")));
263 EXPECT_TRUE(CheckSanitizeCSP(
264 "default-src 'self' https://*.com", OPTIONS_ALLOW_UNSAFE_EVAL,
265 "default-src 'self';",
266 InsecureValueWarning("default-src", "https://*.com")));
267 EXPECT_TRUE(CheckSanitizeCSP(
268 "default-src 'self' https://*.*.google.com/", OPTIONS_ALLOW_UNSAFE_EVAL,
269 "default-src 'self';",
270 InsecureValueWarning("default-src", "https://*.*.google.com/")));
271 EXPECT_TRUE(CheckSanitizeCSP(
272 "default-src 'self' https://*.*.google.com:*/", OPTIONS_ALLOW_UNSAFE_EVAL,
273 "default-src 'self';",
274 InsecureValueWarning("default-src", "https://*.*.google.com:*/")));
275 EXPECT_TRUE(CheckSanitizeCSP(
276 "default-src 'self' https://www.*.google.com/", OPTIONS_ALLOW_UNSAFE_EVAL,
277 "default-src 'self';",
278 InsecureValueWarning("default-src", "https://www.*.google.com/")));
279 EXPECT_TRUE(CheckSanitizeCSP(
123 "default-src 'self' https://www.*.google.com:*/", 280 "default-src 'self' https://www.*.google.com:*/",
124 OPTIONS_ALLOW_UNSAFE_EVAL)); 281 OPTIONS_ALLOW_UNSAFE_EVAL,
125 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 282 "default-src 'self';",
126 "default-src 'self' chrome://*", OPTIONS_ALLOW_UNSAFE_EVAL)); 283 InsecureValueWarning("default-src", "https://www.*.google.com:*/")));
127 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 284 EXPECT_TRUE(CheckSanitizeCSP(
128 "default-src 'self' chrome-extension://*", OPTIONS_ALLOW_UNSAFE_EVAL)); 285 "default-src 'self' chrome://*", OPTIONS_ALLOW_UNSAFE_EVAL,
129 286 "default-src 'self';",
130 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 287 InsecureValueWarning("default-src", "chrome://*")));
131 "default-src 'self' https://*.google.com", OPTIONS_ALLOW_UNSAFE_EVAL)); 288 EXPECT_TRUE(CheckSanitizeCSP(
132 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 289 "default-src 'self' chrome-extension://*", OPTIONS_ALLOW_UNSAFE_EVAL,
133 "default-src 'self' https://*.google.com:1", OPTIONS_ALLOW_UNSAFE_EVAL)); 290 "default-src 'self';",
134 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 291 InsecureValueWarning("default-src", "chrome-extension://*")));
135 "default-src 'self' https://*.google.com:*", OPTIONS_ALLOW_UNSAFE_EVAL)); 292 EXPECT_TRUE(CheckSanitizeCSP(
136 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 293 "default-src 'self' chrome-extension://", OPTIONS_ALLOW_UNSAFE_EVAL,
137 "default-src 'self' https://*.google.com:1/", OPTIONS_ALLOW_UNSAFE_EVAL)); 294 "default-src 'self';",
138 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 295 InsecureValueWarning("default-src", "chrome-extension://")));
139 "default-src 'self' https://*.google.com:*/", OPTIONS_ALLOW_UNSAFE_EVAL)); 296
140 297 EXPECT_TRUE(CheckSanitizeCSP(
141 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 298 "default-src 'self' https://*.google.com;", OPTIONS_ALLOW_UNSAFE_EVAL));
142 "default-src 'self' http://127.0.0.1", OPTIONS_ALLOW_UNSAFE_EVAL)); 299 EXPECT_TRUE(CheckSanitizeCSP(
143 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 300 "default-src 'self' https://*.google.com:1;", OPTIONS_ALLOW_UNSAFE_EVAL));
144 "default-src 'self' http://localhost", OPTIONS_ALLOW_UNSAFE_EVAL)); 301 EXPECT_TRUE(CheckSanitizeCSP(
145 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 302 "default-src 'self' https://*.google.com:*;", OPTIONS_ALLOW_UNSAFE_EVAL));
146 "default-src 'self' http://lOcAlHoSt", OPTIONS_ALLOW_UNSAFE_EVAL)); 303 EXPECT_TRUE(CheckSanitizeCSP(
147 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 304 "default-src 'self' https://*.google.com:1/;",
148 "default-src 'self' http://127.0.0.1:9999", OPTIONS_ALLOW_UNSAFE_EVAL)); 305 OPTIONS_ALLOW_UNSAFE_EVAL));
149 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 306 EXPECT_TRUE(CheckSanitizeCSP(
150 "default-src 'self' http://localhost:8888", OPTIONS_ALLOW_UNSAFE_EVAL)); 307 "default-src 'self' https://*.google.com:*/;",
151 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 308 OPTIONS_ALLOW_UNSAFE_EVAL));
309
310 EXPECT_TRUE(CheckSanitizeCSP(
311 "default-src 'self' http://127.0.0.1;", OPTIONS_ALLOW_UNSAFE_EVAL));
312 EXPECT_TRUE(CheckSanitizeCSP(
313 "default-src 'self' http://localhost;", OPTIONS_ALLOW_UNSAFE_EVAL));
314 EXPECT_TRUE(CheckSanitizeCSP(
315 "default-src 'self' http://lOcAlHoSt;", OPTIONS_ALLOW_UNSAFE_EVAL,
316 "default-src 'self' http://localhost;"));
317 EXPECT_TRUE(CheckSanitizeCSP(
318 "default-src 'self' http://127.0.0.1:9999;", OPTIONS_ALLOW_UNSAFE_EVAL));
319 EXPECT_TRUE(CheckSanitizeCSP(
320 "default-src 'self' http://localhost:8888;", OPTIONS_ALLOW_UNSAFE_EVAL));
321 EXPECT_TRUE(CheckSanitizeCSP(
152 "default-src 'self' http://127.0.0.1.example.com", 322 "default-src 'self' http://127.0.0.1.example.com",
153 OPTIONS_ALLOW_UNSAFE_EVAL)); 323 OPTIONS_ALLOW_UNSAFE_EVAL,
154 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 324 "default-src 'self';",
325 InsecureValueWarning("default-src", "http://127.0.0.1.example.com")));
326 EXPECT_TRUE(CheckSanitizeCSP(
155 "default-src 'self' http://localhost.example.com", 327 "default-src 'self' http://localhost.example.com",
156 OPTIONS_ALLOW_UNSAFE_EVAL)); 328 OPTIONS_ALLOW_UNSAFE_EVAL,
157 329 "default-src 'self';",
158 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 330 InsecureValueWarning("default-src", "http://localhost.example.com")));
159 "default-src 'self' blob:", OPTIONS_ALLOW_UNSAFE_EVAL)); 331
160 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 332 EXPECT_TRUE(CheckSanitizeCSP(
333 "default-src 'self' blob:;", OPTIONS_ALLOW_UNSAFE_EVAL));
334 EXPECT_TRUE(CheckSanitizeCSP(
161 "default-src 'self' blob:http://example.com/XXX", 335 "default-src 'self' blob:http://example.com/XXX",
162 OPTIONS_ALLOW_UNSAFE_EVAL)); 336 OPTIONS_ALLOW_UNSAFE_EVAL,
163 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 337 "default-src 'self';",
164 "default-src 'self' filesystem:", OPTIONS_ALLOW_UNSAFE_EVAL)); 338 InsecureValueWarning("default-src", "blob:http://example.com/xxx")));
165 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 339 EXPECT_TRUE(CheckSanitizeCSP(
166 "default-src 'self' filesystem:http://example.com/XXX", 340 "default-src 'self' filesystem:;", OPTIONS_ALLOW_UNSAFE_EVAL));
167 OPTIONS_ALLOW_UNSAFE_EVAL)); 341 EXPECT_TRUE(CheckSanitizeCSP(
168 342 "default-src 'self' filesystem:http://example.com/XX",
169 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 343 OPTIONS_ALLOW_UNSAFE_EVAL,
170 "default-src 'self' https://*.googleapis.com", 344 "default-src 'self';",
171 OPTIONS_ALLOW_UNSAFE_EVAL)); 345 InsecureValueWarning("default-src", "filesystem:http://example.com/xx")));
172 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 346
173 "default-src 'self' https://x.googleapis.com", 347 EXPECT_TRUE(CheckSanitizeCSP(
174 OPTIONS_ALLOW_UNSAFE_EVAL)); 348 "default-src 'self' https://*.googleapis.com;",
175 // "chrome-extension://" is an invalid CSP and ignored by Blink, but extension 349 OPTIONS_ALLOW_UNSAFE_EVAL));
176 // authors have been using this string anyway, so we cannot refuse this string 350 EXPECT_TRUE(CheckSanitizeCSP(
177 // until extensions can be loaded with an invalid CSP. http://crbug.com/434773 351 "default-src 'self' https://x.googleapis.com;",
178 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 352 OPTIONS_ALLOW_UNSAFE_EVAL));
179 "default-src 'self' chrome-extension://", OPTIONS_ALLOW_UNSAFE_EVAL)); 353
180 354 EXPECT_TRUE(CheckSanitizeCSP(
181 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 355 "script-src 'self'; object-src *", OPTIONS_NONE,
182 "script-src 'self'; object-src *", OPTIONS_NONE)); 356 "script-src 'self'; object-src;",
183 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 357 InsecureValueWarning("object-src", "*")));
184 "script-src 'self'; object-src *", OPTIONS_ALLOW_INSECURE_OBJECT_SRC)); 358 EXPECT_TRUE(CheckSanitizeCSP(
185 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 359 "script-src 'self'; object-src *", OPTIONS_ALLOW_INSECURE_OBJECT_SRC,
186 "script-src 'self'; object-src *; plugin-types application/pdf", 360 "script-src 'self'; object-src;",
187 OPTIONS_ALLOW_INSECURE_OBJECT_SRC)); 361 InsecureValueWarning("object-src", "*")));
188 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 362 EXPECT_TRUE(CheckSanitizeCSP(
189 "script-src 'self'; object-src *; " 363 "script-src 'self'; object-src *; plugin-types application/pdf;",
190 "plugin-types application/x-shockwave-flash", 364 OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
191 OPTIONS_ALLOW_INSECURE_OBJECT_SRC)); 365 EXPECT_TRUE(CheckSanitizeCSP(
192 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 366 "script-src 'self'; object-src *; "
193 "script-src 'self'; object-src *; " 367 "plugin-types application/x-shockwave-flash",
194 "plugin-types application/x-shockwave-flash application/pdf", 368 OPTIONS_ALLOW_INSECURE_OBJECT_SRC,
195 OPTIONS_ALLOW_INSECURE_OBJECT_SRC)); 369 "script-src 'self'; object-src; "
196 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 370 "plugin-types application/x-shockwave-flash;",
197 "script-src 'self'; object-src http://www.example.com; " 371 InsecureValueWarning("object-src", "*")));
198 "plugin-types application/pdf", 372 EXPECT_TRUE(CheckSanitizeCSP(
199 OPTIONS_ALLOW_INSECURE_OBJECT_SRC)); 373 "script-src 'self'; object-src *; "
200 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 374 "plugin-types application/x-shockwave-flash application/pdf;",
201 "object-src http://www.example.com blob:; script-src 'self'; " 375 OPTIONS_ALLOW_INSECURE_OBJECT_SRC,
202 "plugin-types application/pdf", 376 "script-src 'self'; object-src; "
203 OPTIONS_ALLOW_INSECURE_OBJECT_SRC)); 377 "plugin-types application/x-shockwave-flash application/pdf;",
204 EXPECT_TRUE(ContentSecurityPolicyIsSecure( 378 InsecureValueWarning("object-src", "*")));
205 "script-src 'self'; object-src http://*.example.com; " 379 EXPECT_TRUE(CheckSanitizeCSP(
206 "plugin-types application/pdf", 380 "script-src 'self'; object-src http://www.example.com; "
207 OPTIONS_ALLOW_INSECURE_OBJECT_SRC)); 381 "plugin-types application/pdf;",
208 EXPECT_FALSE(ContentSecurityPolicyIsSecure( 382 OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
209 "script-src *; object-src *; plugin-types application/pdf", 383 EXPECT_TRUE(CheckSanitizeCSP(
210 OPTIONS_ALLOW_INSECURE_OBJECT_SRC)); 384 "object-src http://www.example.com blob:; script-src 'self'; "
385 "plugin-types application/pdf;",
386 OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
387 EXPECT_TRUE(CheckSanitizeCSP(
388 "script-src 'self'; object-src http://*.example.com; "
389 "plugin-types application/pdf;",
390 OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
391 EXPECT_TRUE(CheckSanitizeCSP(
392 "script-src *; object-src *; plugin-types application/pdf;",
393 OPTIONS_ALLOW_INSECURE_OBJECT_SRC,
394 "script-src; object-src *; plugin-types application/pdf;",
395 InsecureValueWarning("script-src", "*")));
211 } 396 }
212 397
213 TEST(ExtensionCSPValidator, IsSandboxed) { 398 TEST(ExtensionCSPValidator, IsSandboxed) {
214 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(std::string(), 399 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(std::string(),
215 Manifest::TYPE_EXTENSION)); 400 Manifest::TYPE_EXTENSION));
216 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed("img-src https://google.com", 401 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed("img-src https://google.com",
217 Manifest::TYPE_EXTENSION)); 402 Manifest::TYPE_EXTENSION));
218 403
219 // Sandbox directive is required. 404 // Sandbox directive is required.
220 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( 405 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
(...skipping 15 matching lines...) Expand all
236 "sandbox allow-top-navigation", Manifest::TYPE_EXTENSION)); 421 "sandbox allow-top-navigation", Manifest::TYPE_EXTENSION));
237 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed( 422 EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(
238 "sandbox allow-top-navigation", Manifest::TYPE_PLATFORM_APP)); 423 "sandbox allow-top-navigation", Manifest::TYPE_PLATFORM_APP));
239 424
240 // Popups are OK. 425 // Popups are OK.
241 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( 426 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
242 "sandbox allow-popups", Manifest::TYPE_EXTENSION)); 427 "sandbox allow-popups", Manifest::TYPE_EXTENSION));
243 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed( 428 EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
244 "sandbox allow-popups", Manifest::TYPE_PLATFORM_APP)); 429 "sandbox allow-popups", Manifest::TYPE_PLATFORM_APP));
245 } 430 }
OLDNEW
« no previous file with comments | « extensions/common/csp_validator.cc ('k') | extensions/common/manifest_constants.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698