CSP: Adding the 'upgrade-insecure-requests' directive.

Source/core/fetch/ResourceFetcherTest.cpp

 /*
  * Copyright (c) 2013, Google Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are
  * met:
  *
  *     * Redistributions of source code must retain the above copyright
  * notice, this list of conditions and the following disclaimer.
  *     * Redistributions in binary form must reproduce the above
@@ skipping 22 matching lines @@
 
 #include <gtest/gtest.h>
 #include "core/fetch/FetchInitiatorInfo.h"
 #include "core/fetch/FetchRequest.h"
 #include "core/fetch/ImageResource.h"
 #include "core/fetch/MemoryCache.h"
 #include "core/fetch/ResourcePtr.h"
 #include "core/html/HTMLDocument.h"
 #include "core/loader/DocumentLoader.h"
 #include "platform/network/ResourceRequest.h"
+#include "platform/weborigin/KURL.h"
+#include "platform/weborigin/SecurityOrigin.h"
 
-using namespace blink;
+namespace blink {
 
-namespace {
+class ResourceFetcherTest : public ::testing::Test {
+public:
+    ResourceFetcherTest()
+        : secureURL(ParsedURLString, "https://example.test/image.png")
+        , insecureURL(ParsedURLString, "http://example.test/image.png")
+        , secureOrigin(SecurityOrigin::create(secureURL))
+        , insecureOrigin(SecurityOrigin::create(insecureURL))
+    {
+    }
 
-TEST(ResourceFetcherTest, StartLoadAfterFrameDetach)
+protected:
+    virtual void SetUp()
+    {
+        // Create a ResourceFetcher that has a real DocumentLoader and Document, but is not attached to a LocalFrame.
+        // Technically, we're concerned about what happens after a LocalFrame is detached (rather than before
+        // any attach occurs), but ResourceFetcher can't tell the difference.
+        documentLoader = DocumentLoader::create(0, ResourceRequest(secureURL), SubstituteData());
+        document = Document::create();
+        fetcher = documentLoader->fetcher();
+        fetcher->setDocument(document.get());
+    }
+
+    void expectUpgrade(const char* input, const char* expected)
+    {
+        KURL inputURL(ParsedURLString, input);
+        KURL expectedURL(ParsedURLString, expected);
+
+        FetchRequest fetchRequest = FetchRequest(ResourceRequest(inputURL), FetchInitiatorInfo());
+        fetcher->maybeUpgradeInsecureRequestURL(fetchRequest);
+        EXPECT_STREQ(expectedURL.string().utf8().data(), fetchRequest.resourceRequest().url().string().utf8().data());
+        EXPECT_EQ(expectedURL.protocol(), fetchRequest.resourceRequest().url().protocol());
+        EXPECT_EQ(expectedURL.host(), fetchRequest.resourceRequest().url().host());
+        EXPECT_EQ(expectedURL.port(), fetchRequest.resourceRequest().url().port());
+        EXPECT_EQ(expectedURL.hasPort(), fetchRequest.resourceRequest().url().hasPort());
+        EXPECT_EQ(expectedURL.path(), fetchRequest.resourceRequest().url().path());
+    }
+
+    KURL secureURL;
+    KURL insecureURL;
+    RefPtr<SecurityOrigin> secureOrigin;
+    RefPtr<SecurityOrigin> insecureOrigin;

[Yoav Weiss, 2015/02/06 09:58:36]

Is insecureOrigin used anywhere?

+    RefPtr<DocumentLoader> documentLoader;

[Yoav Weiss, 2015/02/06 09:58:36]

documentLoader is a member only because we want to maintain it alive while
fetcher and document are used, right? Maybe add a comment to that effect, so it
won't get accidentally deleted in the future?

+    RefPtrWillBeRawPtr<ResourceFetcher> fetcher;
+
+    RefPtrWillBePersistent<Document> document;

[Yoav Weiss, 2015/02/06 09:58:36]

Not sure if it's a requirement or just commonly used pattern, but shouldn't
these members start with "m_"?

+};
+
+TEST_F(ResourceFetcherTest, StartLoadAfterFrameDetach)
 {
-    KURL testURL(ParsedURLString, "http://www.test.com/cancelTest.jpg");
-
-    // Create a ResourceFetcher that has a real DocumentLoader and Document, but is not attached to a LocalFrame.
-    // Technically, we're concerned about what happens after a LocalFrame is detached (rather than before
-    // any attach occurs), but ResourceFetcher can't tell the difference.
-    RefPtr<DocumentLoader> documentLoader = DocumentLoader::create(0, ResourceRequest(testURL), SubstituteData());
-    RefPtrWillBeRawPtr<HTMLDocument> document = HTMLDocument::create();
-    RefPtrWillBeRawPtr<ResourceFetcher> fetcher(documentLoader->fetcher());
-    fetcher->setDocument(document.get());
     EXPECT_EQ(fetcher->frame(), static_cast<LocalFrame*>(0));
 
     // Try to request a url. The request should fail, no resource should be returned,
     // and no resource should be present in the cache.
-    FetchRequest fetchRequest = FetchRequest(ResourceRequest(testURL), FetchInitiatorInfo());
+    FetchRequest fetchRequest = FetchRequest(ResourceRequest(insecureURL), FetchInitiatorInfo());
     ResourcePtr<ImageResource> image = fetcher->fetchImage(fetchRequest);
     EXPECT_EQ(image.get(), static_cast<ImageResource*>(0));
-    EXPECT_EQ(memoryCache()->resourceForURL(testURL), static_cast<Resource*>(0));
+    EXPECT_EQ(memoryCache()->resourceForURL(insecureURL), static_cast<Resource*>(0));
+}
+
+TEST_F(ResourceFetcherTest, UpgradeInsecureResourceRequests)
+{
+    document->setSecurityOrigin(secureOrigin);
+    document->setInsecureContentPolicy(SecurityContext::InsecureContentUpgrade);
+
+    expectUpgrade("http://example.test/image.png", "https://example.test/image.png");
+    expectUpgrade("http://example.test:80/image.png", "https://example.test:443/image.png");
+    expectUpgrade("http://example.test:1212/image.png", "https://example.test:1212/image.png");
+
+    expectUpgrade("https://example.test/image.png", "https://example.test/image.png");
+    expectUpgrade("https://example.test:80/image.png", "https://example.test:80/image.png");
+    expectUpgrade("https://example.test:1212/image.png", "https://example.test:1212/image.png");
+
+    expectUpgrade("ftp://example.test/image.png", "ftp://example.test/image.png");
+    expectUpgrade("ftp://example.test:21/image.png", "ftp://example.test:21/image.png");
+    expectUpgrade("ftp://example.test:1212/image.png", "ftp://example.test:1212/image.png");
+}
+
+TEST_F(ResourceFetcherTest, DoNotUpgradeInsecureResourceRequests)
+{
+    document->setSecurityOrigin(secureOrigin);
+    document->setInsecureContentPolicy(SecurityContext::InsecureContentDoNotUpgrade);
+
+    expectUpgrade("http://example.test/image.png", "http://example.test/image.png");
+    expectUpgrade("http://example.test:80/image.png", "http://example.test:80/image.png");
+    expectUpgrade("http://example.test:1212/image.png", "http://example.test:1212/image.png");
+
+    expectUpgrade("https://example.test/image.png", "https://example.test/image.png");
+    expectUpgrade("https://example.test:80/image.png", "https://example.test:80/image.png");
+    expectUpgrade("https://example.test:1212/image.png", "https://example.test:1212/image.png");
+
+    expectUpgrade("ftp://example.test/image.png", "ftp://example.test/image.png");
+    expectUpgrade("ftp://example.test:21/image.png", "ftp://example.test:21/image.png");
+    expectUpgrade("ftp://example.test:1212/image.png", "ftp://example.test:1212/image.png");
+}
+
+TEST_F(ResourceFetcherTest, MonitorInsecureResourceRequests)
+{
+    document->setSecurityOrigin(secureOrigin);
+    document->setInsecureContentPolicy(SecurityContext::InsecureContentMonitor);
+
+    expectUpgrade("http://example.test/image.png", "http://example.test/image.png");
+    expectUpgrade("http://example.test:80/image.png", "http://example.test:80/image.png");
+    expectUpgrade("http://example.test:1212/image.png", "http://example.test:1212/image.png");
+
+    expectUpgrade("https://example.test/image.png", "https://example.test/image.png");
+    expectUpgrade("https://example.test:80/image.png", "https://example.test:80/image.png");
+    expectUpgrade("https://example.test:1212/image.png", "https://example.test:1212/image.png");
+
+    expectUpgrade("ftp://example.test/image.png", "ftp://example.test/image.png");
+    expectUpgrade("ftp://example.test:21/image.png", "ftp://example.test:21/image.png");
+    expectUpgrade("ftp://example.test:1212/image.png", "ftp://example.test:1212/image.png");
 }
 
 } // namespace