Only allow insecure object-src directives for whitelisted mime types

extensions/common/csp_validator_unittest.cc

 // Copyright 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "extensions/common/csp_validator.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 using extensions::csp_validator::ContentSecurityPolicyIsLegal;
 using extensions::csp_validator::ContentSecurityPolicyIsSecure;
 using extensions::csp_validator::ContentSecurityPolicyIsSandboxed;
@@ skipping 162 matching lines @@
       "default-src 'self' https://x.googleapis.com",
       OPTIONS_ALLOW_UNSAFE_EVAL));
   // "chrome-extension://" is an invalid CSP and ignored by Blink, but extension
   // authors have been using this string anyway, so we cannot refuse this string
   // until extensions can be loaded with an invalid CSP. http://crbug.com/434773
   EXPECT_TRUE(ContentSecurityPolicyIsSecure(
      "default-src 'self' chrome-extension://", OPTIONS_ALLOW_UNSAFE_EVAL));
 
   EXPECT_FALSE(ContentSecurityPolicyIsSecure(
      "script-src 'self'; object-src *", OPTIONS_NONE));
-  EXPECT_TRUE(ContentSecurityPolicyIsSecure(
+  EXPECT_FALSE(ContentSecurityPolicyIsSecure(
      "script-src 'self'; object-src *", OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
   EXPECT_TRUE(ContentSecurityPolicyIsSecure(
-     "script-src 'self'; object-src http://www.example.com",
+     "script-src 'self'; object-src *; plugin-types application/pdf",
+     OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
+  EXPECT_FALSE(ContentSecurityPolicyIsSecure(
+     "script-src 'self'; object-src *; "
+     "plugin-types application/x-shockwave-flash",
+     OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
+  EXPECT_FALSE(ContentSecurityPolicyIsSecure(
+     "script-src 'self'; object-src *; "
+     "plugin-types application/x-shockwave-flash application/pdf",
      OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
   EXPECT_TRUE(ContentSecurityPolicyIsSecure(
-     "object-src http://www.example.com blob:; script-src 'self'",
+     "script-src 'self'; object-src http://www.example.com; "
+     "plugin-types application/pdf",
      OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
   EXPECT_TRUE(ContentSecurityPolicyIsSecure(
-     "script-src 'self'; object-src http://*.example.com",
+     "object-src http://www.example.com blob:; script-src 'self'; "
+     "plugin-types application/pdf",
+     OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
+  EXPECT_TRUE(ContentSecurityPolicyIsSecure(
+     "script-src 'self'; object-src http://*.example.com; "
+     "plugin-types application/pdf",
      OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
   EXPECT_FALSE(ContentSecurityPolicyIsSecure(
-     "script-src *; object-src *;", OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
+     "script-src *; object-src *; plugin-types application/pdf",
+     OPTIONS_ALLOW_INSECURE_OBJECT_SRC));
 }
 
 TEST(ExtensionCSPValidator, IsSandboxed) {
   EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(std::string(),
                                                 Manifest::TYPE_EXTENSION));
   EXPECT_FALSE(ContentSecurityPolicyIsSandboxed("img-src https://google.com",
                                                 Manifest::TYPE_EXTENSION));
 
   // Sandbox directive is required.
   EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
@@ skipping 15 matching lines @@
       "sandbox allow-top-navigation", Manifest::TYPE_EXTENSION));
   EXPECT_FALSE(ContentSecurityPolicyIsSandboxed(
       "sandbox allow-top-navigation", Manifest::TYPE_PLATFORM_APP));
 
   // Popups are OK.
   EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
       "sandbox allow-popups", Manifest::TYPE_EXTENSION));
   EXPECT_TRUE(ContentSecurityPolicyIsSandboxed(
       "sandbox allow-popups", Manifest::TYPE_PLATFORM_APP));
 }