Enable SRI only for same origin and CORS content.

Source/core/frame/SubresourceIntegrityTest.cpp

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "config.h"
 #include "core/frame/SubresourceIntegrity.h"
 
 #include "core/HTMLNames.h"
 #include "core/dom/Document.h"
+#include "core/fetch/Resource.h"
+#include "core/fetch/ResourcePtr.h"
 #include "core/html/HTMLScriptElement.h"
 #include "platform/Crypto.h"
 #include "platform/weborigin/KURL.h"
 #include "platform/weborigin/SecurityOrigin.h"
 #include "wtf/RefPtr.h"
 #include "wtf/text/WTFString.h"
 #include <gtest/gtest.h>
 
 namespace blink {
 
@@ skipping 109 matching lines @@
 
     void expectParseFailure(const char* integrityAttribute)
     {
         String digest;
         HashAlgorithm algorithm;
         String type;
 
         EXPECT_FALSE(SubresourceIntegrity::parseIntegrityAttribute(integrityAttribute, digest, algorithm, type, *document));
     }
 
-    void expectIntegrity(const char* integrity, const char* script, const KURL& url, const String& mimeType = String())
+    void expectIntegrity(const char* integrity, const char* script, const KURL& url, const KURL& requestorUrl, const String& mimeType = String())
     {
         scriptElement->setAttribute(HTMLNames::integrityAttr, integrity);
-        EXPECT_TRUE(SubresourceIntegrity::CheckSubresourceIntegrity(*scriptElement, script, url, mimeType));
+        EXPECT_TRUE(SubresourceIntegrity::CheckSubresourceIntegrity(*scriptElement, script, url, mimeType, *createTestResource(url, requestorUrl).get()));
     }
 
-    void expectIntegrityFailure(const char* integrity, const char* script, const KURL& url, const String& mimeType = String())
+    void expectIntegrityFailure(const char* integrity, const char* script, const KURL& url, const KURL& requestorUrl, const String& mimeType = String())
     {
         scriptElement->setAttribute(HTMLNames::integrityAttr, integrity);
-        EXPECT_FALSE(SubresourceIntegrity::CheckSubresourceIntegrity(*scriptElement, script, url, mimeType));
+        EXPECT_FALSE(SubresourceIntegrity::CheckSubresourceIntegrity(*scriptElement, script, url, mimeType, *createTestResource(url, requestorUrl).get()));
+    }
+
+    ResourcePtr<Resource> createTestResource(const KURL& url, const KURL& allowOriginUrl)
+    {
+        OwnPtr<ResourceResponse> response = adoptPtr(new ResourceResponse);
+        response->setURL(url);
+        response->setHTTPStatusCode(200);
+        response->setHTTPHeaderField("access-control-allow-origin", SecurityOrigin::create(allowOriginUrl)->toAtomicString());

[Mike West, 2015/03/06 03:19:37]

It would be nice if this bit was parameterized; right now you're testing that
CORS headers allow a resource to be integrity-checked cross-origin, but you're
not yet verifying that lacking CORS headers blocks integrity checking.

[jww, 2015/03/06 08:24:21]

Done.

+        response->setHTTPHeaderField("access-control-allow-credentials", "true");
+        ResourcePtr<Resource> resource = new Resource(ResourceRequest(response->url()), Resource::Raw);
+        resource->setResponse(*response);
+        return resource;
     }
 
     KURL secureURL;
     KURL insecureURL;
     RefPtr<SecurityOrigin> secureOrigin;
     RefPtr<SecurityOrigin> insecureOrigin;
 
     RefPtrWillBePersistent<Document> document;
     RefPtrWillBePersistent<HTMLScriptElement> scriptElement;
 };
@@ skipping 107 matching lines @@
 
 //
 // End-to-end tests of ::CheckSubresourceIntegrity.
 //
 
 TEST_F(SubresourceIntegrityTest, CheckSubresourceIntegrityInSecureOrigin)
 {
     document->updateSecurityOrigin(secureOrigin->isolatedCopy());
 
     // Verify basic sha256, sha384, and sha512 integrity checks.
-    expectIntegrity(kSha256Integrity, kBasicScript, secureURL);
-    expectIntegrity(kSha384Integrity, kBasicScript, secureURL);
-    expectIntegrity(kSha512Integrity, kBasicScript, secureURL);
+    expectIntegrity(kSha256Integrity, kBasicScript, secureURL, secureURL);
+    expectIntegrity(kSha384Integrity, kBasicScript, secureURL, secureURL);
+    expectIntegrity(kSha512Integrity, kBasicScript, secureURL, secureURL);
 
     // The hash label must match the hash value.
-    expectIntegrityFailure(kSha384IntegrityLabeledAs256, kBasicScript, secureURL);
+    expectIntegrityFailure(kSha384IntegrityLabeledAs256, kBasicScript, secureURL, secureURL);
 
     // Unsupported hash functions should fail.
-    expectIntegrityFailure(kUnsupportedHashFunctionIntegrity, kBasicScript, secureURL);
+    expectIntegrityFailure(kUnsupportedHashFunctionIntegrity, kBasicScript, secureURL, secureURL);
 }
 
 TEST_F(SubresourceIntegrityTest, CheckSubresourceIntegrityInInsecureOrigin)
 {
     // The same checks as CheckSubresourceIntegrityInSecureOrigin should pass here.
     document->updateSecurityOrigin(insecureOrigin->isolatedCopy());
 
-    expectIntegrity(kSha256Integrity, kBasicScript, secureURL);
-    expectIntegrity(kSha384Integrity, kBasicScript, secureURL);
-    expectIntegrity(kSha512Integrity, kBasicScript, secureURL);
-    expectIntegrityFailure(kSha384IntegrityLabeledAs256, kBasicScript, secureURL);
-    expectIntegrityFailure(kUnsupportedHashFunctionIntegrity, kBasicScript, secureURL);
+    expectIntegrity(kSha256Integrity, kBasicScript, secureURL, insecureURL);
+    expectIntegrity(kSha384Integrity, kBasicScript, secureURL, insecureURL);
+    expectIntegrity(kSha512Integrity, kBasicScript, secureURL, insecureURL);
+    expectIntegrityFailure(kSha384IntegrityLabeledAs256, kBasicScript, secureURL, insecureURL);
+    expectIntegrityFailure(kUnsupportedHashFunctionIntegrity, kBasicScript, secureURL, insecureURL);
 }
 
 } // namespace blink