| // Copyright 2020 The Chromium Authors |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #include "base/containers/contains.h" |
| #include "base/strings/escape.h" |
| #include "base/strings/strcat.h" |
| #include "base/test/bind.h" |
| #include "content/public/browser/network_service_util.h" |
| #include "content/public/test/browser_test.h" |
| #include "content/public/test/browser_test_utils.h" |
| #include "content/public/test/content_browser_test.h" |
| #include "content/public/test/content_browser_test_utils.h" |
| #include "content/public/test/fenced_frame_test_util.h" |
| #include "content/public/test/url_loader_monitor.h" |
| #include "content/shell/browser/shell.h" |
| #include "content/shell/browser/shell_content_browser_client.h" |
| #include "net/dns/mock_host_resolver.h" |
| #include "services/network/public/cpp/resource_request.h" |
| #include "services/network/public/mojom/network_context.mojom.h" |
| #include "services/network/public/mojom/trust_tokens.mojom.h" |
| #include "services/network/public/mojom/url_loader.mojom-shared.h" |
| #include "services/network/test/trust_token_test_util.h" |
| #include "testing/gmock/include/gmock/gmock.h" |
| #include "testing/gtest/include/gtest/gtest.h" |
| |
| // These integration tests verify that calling the Fetch API with Trust Tokens |
| // parameters results in the parameters' counterparts appearing downstream in |
| // network::ResourceRequest. |
| // |
| // Separately, Blink layout tests check that the API correctly rejects invalid |
| // input. |
| |
| namespace content { |
| |
| class TrustTokenParametersBrowsertest |
| : public ::testing::WithParamInterface<network::TrustTokenTestParameters>, |
| public ContentBrowserTest { |
| public: |
| TrustTokenParametersBrowsertest() = default; |
| }; |
| |
| INSTANTIATE_TEST_SUITE_P( |
| WithIssuanceParameters, |
| TrustTokenParametersBrowsertest, |
| testing::ValuesIn(network::kIssuanceTrustTokenTestParameters)); |
| |
| INSTANTIATE_TEST_SUITE_P( |
| WithRedemptionParameters, |
| TrustTokenParametersBrowsertest, |
| testing::ValuesIn(network::kRedemptionTrustTokenTestParameters)); |
| |
| INSTANTIATE_TEST_SUITE_P( |
| WithSigningParameters, |
| TrustTokenParametersBrowsertest, |
| testing::ValuesIn(network::kSigningTrustTokenTestParameters)); |
| |
| IN_PROC_BROWSER_TEST_P(TrustTokenParametersBrowsertest, |
| PopulatesResourceRequestViaFetch) { |
| ASSERT_TRUE(embedded_test_server()->Start()); |
| |
| network::TrustTokenParametersAndSerialization |
| expected_params_and_serialization = |
| network::SerializeTrustTokenParametersAndConstructExpectation( |
| GetParam()); |
| |
| GURL url(embedded_test_server()->GetURL("/title1.html")); |
| GURL trust_token_url(embedded_test_server()->GetURL("/title2.html")); |
| |
| URLLoaderMonitor monitor({trust_token_url}); |
| |
| EXPECT_TRUE(NavigateToURL(shell(), url)); |
| |
| ExecuteScriptAsync( |
| shell(), JsReplace("fetch($1, {privateToken: ", trust_token_url) + |
| expected_params_and_serialization.serialized_params + "});"); |
| |
| monitor.WaitForUrls(); |
| std::optional<network::ResourceRequest> request = |
| monitor.GetRequestInfo(trust_token_url); |
| ASSERT_TRUE(request); |
| ASSERT_TRUE(request->trust_token_params); |
| EXPECT_TRUE(request->trust_token_params.as_ptr().Equals( |
| expected_params_and_serialization.params)); |
| } |
| |
| IN_PROC_BROWSER_TEST_P(TrustTokenParametersBrowsertest, |
| PopulatesResourceRequestViaIframe) { |
| ASSERT_TRUE(embedded_test_server()->Start()); |
| |
| network::TrustTokenParametersAndSerialization |
| expected_params_and_serialization = |
| network::SerializeTrustTokenParametersAndConstructExpectation( |
| GetParam()); |
| |
| // In the iframe interface to private state tokens, we only accept the |
| // kSigning variant, i.e. the send-redemption-record operation. |
| if (expected_params_and_serialization.params->operation != |
| network::mojom::TrustTokenOperationType::kSigning) { |
| return; |
| } |
| |
| GURL url(embedded_test_server()->GetURL("/title1.html")); |
| GURL trust_token_url(embedded_test_server()->GetURL("/title2.html")); |
| |
| URLLoaderMonitor monitor({trust_token_url}); |
| |
| EXPECT_TRUE(NavigateToURL(shell(), url)); |
| |
| EXPECT_TRUE(ExecJs( |
| shell(), JsReplace("let iframe = document.createElement('iframe');" |
| "iframe.src = $1;" |
| "iframe.privateToken = $2;" |
| "document.body.appendChild(iframe);", |
| trust_token_url, |
| expected_params_and_serialization.serialized_params))); |
| |
| monitor.WaitForUrls(); |
| std::optional<network::ResourceRequest> request = |
| monitor.GetRequestInfo(trust_token_url); |
| ASSERT_TRUE(request); |
| ASSERT_TRUE(request->trust_token_params); |
| |
| EXPECT_TRUE(request->trust_token_params.as_ptr().Equals( |
| expected_params_and_serialization.params)); |
| } |
| |
| IN_PROC_BROWSER_TEST_P(TrustTokenParametersBrowsertest, |
| PopulatesResourceRequestViaXhr) { |
| ASSERT_TRUE(embedded_test_server()->Start()); |
| |
| network::TrustTokenParametersAndSerialization |
| expected_params_and_serialization = |
| network::SerializeTrustTokenParametersAndConstructExpectation( |
| GetParam()); |
| |
| GURL url(embedded_test_server()->GetURL("/title1.html")); |
| GURL trust_token_url(embedded_test_server()->GetURL("/title2.html")); |
| |
| URLLoaderMonitor monitor({trust_token_url}); |
| |
| EXPECT_TRUE(NavigateToURL(shell(), url)); |
| |
| EXPECT_TRUE(ExecJs( |
| shell(), |
| base::StrCat({"let request = new XMLHttpRequest(); ", |
| JsReplace("request.open(\"GET\", $1);", trust_token_url), |
| "request.setPrivateToken(", |
| expected_params_and_serialization.serialized_params, |
| "); request.send();"}))); |
| |
| monitor.WaitForUrls(); |
| std::optional<network::ResourceRequest> request = |
| monitor.GetRequestInfo(trust_token_url); |
| ASSERT_TRUE(request); |
| |
| EXPECT_TRUE(request->trust_token_params.as_ptr().Equals( |
| expected_params_and_serialization.params)); |
| } |
| |
| class TrustTokenPermissionsPolicyBrowsertest : public ContentBrowserTest { |
| public: |
| TrustTokenPermissionsPolicyBrowsertest() = default; |
| |
| void SetUpOnMainThread() override { |
| host_resolver()->AddRule("*", "127.0.0.1"); |
| } |
| }; |
| |
| IN_PROC_BROWSER_TEST_F(TrustTokenPermissionsPolicyBrowsertest, |
| PassesDefaultValueToFactoryParams) { |
| // Since the private-state-token-redemption Permissions Policy feature is |
| // enabled by default in cross-site frames, the child's |
| // URLLoaderFactoryParams should be populated with |
| // TrustTokenOperationPolicyVerdict::kPotentiallyPermit. |
| |
| ASSERT_TRUE(embedded_test_server()->Start()); |
| GURL url(embedded_test_server()->GetURL( |
| "a.com", "/cross_site_iframe_factory.html?a(b)")); |
| |
| base::RunLoop run_loop; |
| ShellContentBrowserClient::Get()->set_url_loader_factory_params_callback( |
| base::BindLambdaForTesting( |
| [&](const network::mojom::URLLoaderFactoryParams* params, |
| const url::Origin& origin, bool unused_is_for_isolated_world, |
| bool unused_is_for_service_worker) { |
| if (base::Contains(origin.host(), 'b')) { |
| ASSERT_TRUE(params); |
| |
| ASSERT_THAT(params->trust_token_redemption_policy, |
| network::mojom::TrustTokenOperationPolicyVerdict:: |
| kPotentiallyPermit); |
| ASSERT_THAT(params->trust_token_issuance_policy, |
| network::mojom::TrustTokenOperationPolicyVerdict:: |
| kPotentiallyPermit); |
| run_loop.Quit(); |
| } |
| })); |
| |
| EXPECT_TRUE(NavigateToURL(shell(), url)); |
| |
| run_loop.Run(); |
| } |
| |
| IN_PROC_BROWSER_TEST_F(TrustTokenPermissionsPolicyBrowsertest, |
| PassesNegativeRedemptionValueToFactoryParams) { |
| // Even though the private-state-token-redemption Permissions Policy feature |
| // is enabled by default in cross-site frames, the allow attribute on the |
| // iframe can disable it for the b.com frame, so the child's |
| // URLLoaderFactoryParams should be populated with |
| // TrustTokenOperationPolicyVerdict::kForbid. |
| |
| ASSERT_TRUE(embedded_test_server()->Start()); |
| GURL url(embedded_test_server()->GetURL( |
| "a.com", |
| "/cross_site_iframe_factory.html?a(b{" |
| "disallow-private-state-token-redemption})")); |
| |
| base::RunLoop run_loop; |
| ShellContentBrowserClient::Get()->set_url_loader_factory_params_callback( |
| base::BindLambdaForTesting( |
| [&](const network::mojom::URLLoaderFactoryParams* params, |
| const url::Origin& origin, bool unused_is_for_isolated_world, |
| bool unused_is_for_service_worker) { |
| if (base::Contains(origin.host(), "b")) { |
| ASSERT_TRUE(params); |
| |
| ASSERT_THAT( |
| params->trust_token_redemption_policy, |
| network::mojom::TrustTokenOperationPolicyVerdict::kForbid); |
| ASSERT_THAT(params->trust_token_issuance_policy, |
| network::mojom::TrustTokenOperationPolicyVerdict:: |
| kPotentiallyPermit); |
| |
| run_loop.Quit(); |
| } |
| })); |
| |
| EXPECT_TRUE(NavigateToURL(shell(), url)); |
| |
| run_loop.Run(); |
| } |
| |
| IN_PROC_BROWSER_TEST_F(TrustTokenPermissionsPolicyBrowsertest, |
| PassesNegativeIssuanceValueToFactoryParams) { |
| // Even though the private-state-token-issuance Permissions Policy feature is |
| // enabled by default in cross-site frames, the allow attribute on the iframe |
| // can disable it for the b.com frame, so the child's URLLoaderFactoryParams |
| // should be populated with |
| // TrustTokenOperationPolicyVerdict::kForbid. |
| |
| ASSERT_TRUE(embedded_test_server()->Start()); |
| GURL url(embedded_test_server()->GetURL( |
| "a.com", |
| "/cross_site_iframe_factory.html?a(b{" |
| "disallow-private-state-token-issuance})")); |
| |
| base::RunLoop run_loop; |
| ShellContentBrowserClient::Get()->set_url_loader_factory_params_callback( |
| base::BindLambdaForTesting( |
| [&](const network::mojom::URLLoaderFactoryParams* params, |
| const url::Origin& origin, bool unused_is_for_isolated_world, |
| bool unused_is_for_service_worker) { |
| if (base::Contains(origin.host(), "b")) { |
| ASSERT_TRUE(params); |
| |
| ASSERT_THAT(params->trust_token_redemption_policy, |
| network::mojom::TrustTokenOperationPolicyVerdict:: |
| kPotentiallyPermit); |
| ASSERT_THAT( |
| params->trust_token_issuance_policy, |
| network::mojom::TrustTokenOperationPolicyVerdict::kForbid); |
| |
| run_loop.Quit(); |
| } |
| })); |
| |
| EXPECT_TRUE(NavigateToURL(shell(), url)); |
| |
| run_loop.Run(); |
| } |
| |
| IN_PROC_BROWSER_TEST_F(TrustTokenPermissionsPolicyBrowsertest, |
| PassesDefaultValueToFactoryParamsAfterCrash) { |
| // Since the private-state-token-redemption Permissions Policy feature is |
| // enabled by default in cross-site frames, the child's |
| // URLLoaderFactoryParams should be populated with |
| // TrustTokenOperationPolicyVerdict::kPotentiallyPermit. |
| // |
| // In particular, this should be true for factory params repopulated after a |
| // network service crash! |
| |
| // Can't test this on bots that use an in-process network service. |
| if (IsInProcessNetworkService()) |
| return; |
| |
| ASSERT_TRUE(embedded_test_server()->Start()); |
| GURL url(embedded_test_server()->GetURL( |
| "a.com", "/cross_site_iframe_factory.html?a(b)")); |
| EXPECT_TRUE(NavigateToURL(shell(), url)); |
| |
| base::RunLoop run_loop; |
| ShellContentBrowserClient::Get()->set_url_loader_factory_params_callback( |
| base::BindLambdaForTesting( |
| [&](const network::mojom::URLLoaderFactoryParams* params, |
| const url::Origin& origin, bool unused_is_for_isolated_world, |
| bool unused_is_for_service_worker) { |
| if (base::Contains(origin.host(), 'b')) { |
| ASSERT_TRUE(params); |
| |
| ASSERT_THAT(params->trust_token_redemption_policy, |
| network::mojom::TrustTokenOperationPolicyVerdict:: |
| kPotentiallyPermit); |
| ASSERT_THAT(params->trust_token_issuance_policy, |
| network::mojom::TrustTokenOperationPolicyVerdict:: |
| kPotentiallyPermit); |
| run_loop.Quit(); |
| } |
| })); |
| |
| SimulateNetworkServiceCrash(); |
| run_loop.Run(); |
| } |
| |
| IN_PROC_BROWSER_TEST_F(TrustTokenPermissionsPolicyBrowsertest, |
| PassesNegativeRedemptionValueToFactoryParamsAfterCrash) { |
| // Even though the private-state-token-redemption Permissions Policy feature |
| // is enabled by default in cross-site frames, the allow attribute on the |
| // iframe can disable it for the b.com frame, so the child's |
| // URLLoaderFactoryParams should be populated with |
| // TrustTokenOperationPolicyVerdict::kForbid. |
| // |
| // In particular, this should be true for factory params repopulated after a |
| // network service crash! |
| |
| // Can't test this on bots that use an in-process network service. |
| if (IsInProcessNetworkService()) |
| return; |
| |
| ASSERT_TRUE(embedded_test_server()->Start()); |
| GURL url(embedded_test_server()->GetURL( |
| "a.com", |
| "/cross_site_iframe_factory.html?a(b{" |
| "disallow-private-state-token-redemption})")); |
| EXPECT_TRUE(NavigateToURL(shell(), url)); |
| |
| base::RunLoop run_loop; |
| ShellContentBrowserClient::Get()->set_url_loader_factory_params_callback( |
| base::BindLambdaForTesting( |
| [&](const network::mojom::URLLoaderFactoryParams* params, |
| const url::Origin& origin, bool unused_is_for_isolated_world, |
| bool unused_is_for_service_worker) { |
| if (base::Contains(origin.host(), "b")) { |
| ASSERT_TRUE(params); |
| |
| ASSERT_THAT( |
| params->trust_token_redemption_policy, |
| network::mojom::TrustTokenOperationPolicyVerdict::kForbid); |
| ASSERT_THAT(params->trust_token_issuance_policy, |
| network::mojom::TrustTokenOperationPolicyVerdict:: |
| kPotentiallyPermit); |
| |
| run_loop.Quit(); |
| } |
| })); |
| |
| SimulateNetworkServiceCrash(); |
| run_loop.Run(); |
| } |
| |
| IN_PROC_BROWSER_TEST_F(TrustTokenPermissionsPolicyBrowsertest, |
| PassesNegativeIssuanceValueToFactoryParamsAfterCrash) { |
| // Even though the private-state-token-issuance Permissions Policy feature is |
| // enabled by default in cross-site frames, the allow attribute on the iframe |
| // can disable it for the b.com frame, so the child's URLLoaderFactoryParams |
| // should be populated with |
| // TrustTokenOperationPolicyVerdict::kForbid. |
| // |
| // In particular, this should be true for factory params repopulated after a |
| // network service crash! |
| |
| // Can't test this on bots that use an in-process network service. |
| if (IsInProcessNetworkService()) { |
| return; |
| } |
| |
| ASSERT_TRUE(embedded_test_server()->Start()); |
| GURL url(embedded_test_server()->GetURL( |
| "a.com", |
| "/cross_site_iframe_factory.html?a(b{" |
| "disallow-private-state-token-issuance})")); |
| EXPECT_TRUE(NavigateToURL(shell(), url)); |
| |
| base::RunLoop run_loop; |
| ShellContentBrowserClient::Get()->set_url_loader_factory_params_callback( |
| base::BindLambdaForTesting( |
| [&](const network::mojom::URLLoaderFactoryParams* params, |
| const url::Origin& origin, bool unused_is_for_isolated_world, |
| bool unused_is_for_service_worker) { |
| if (base::Contains(origin.host(), "b")) { |
| ASSERT_TRUE(params); |
| |
| ASSERT_THAT(params->trust_token_redemption_policy, |
| network::mojom::TrustTokenOperationPolicyVerdict:: |
| kPotentiallyPermit); |
| ASSERT_THAT( |
| params->trust_token_issuance_policy, |
| network::mojom::TrustTokenOperationPolicyVerdict::kForbid); |
| |
| run_loop.Quit(); |
| } |
| })); |
| |
| SimulateNetworkServiceCrash(); |
| run_loop.Run(); |
| } |
| |
| constexpr char kPrivateStateTokenRedemptionPolicyHeader[] = |
| "/set-header?Feature-Policy: private-state-token-redemption 'self'"; |
| |
| constexpr char kPrivateStateTokenIssuancePolicyHeader[] = |
| "/set-header?Feature-Policy: private-state-token-issuance 'self'"; |
| |
| class TrustTokenPermissionsPolicyFencedFrameTest |
| : public TrustTokenPermissionsPolicyBrowsertest, |
| public ::testing::WithParamInterface<std::tuple<bool, bool>> { |
| public: |
| TrustTokenPermissionsPolicyFencedFrameTest() |
| : policy_header_in_primary_page_(std::get<0>(GetParam())), |
| policy_header_in_fenced_frame_page_(std::get<1>(GetParam())) {} |
| |
| content::test::FencedFrameTestHelper& fenced_frame_test_helper() { |
| return fenced_frame_helper_; |
| } |
| |
| protected: |
| const bool policy_header_in_primary_page_; |
| const bool policy_header_in_fenced_frame_page_; |
| |
| private: |
| content::test::FencedFrameTestHelper fenced_frame_helper_; |
| }; |
| |
| INSTANTIATE_TEST_SUITE_P(All, |
| TrustTokenPermissionsPolicyFencedFrameTest, |
| ::testing::Combine(::testing::Bool(), |
| ::testing::Bool())); |
| |
| IN_PROC_BROWSER_TEST_P(TrustTokenPermissionsPolicyFencedFrameTest, |
| PassesNegativeRedemptionValueToFactoryParams) { |
| ASSERT_TRUE(embedded_test_server()->Start()); |
| |
| GURL primary_url(embedded_test_server()->GetURL( |
| "a.com", policy_header_in_primary_page_ |
| ? kPrivateStateTokenRedemptionPolicyHeader |
| : "/title1.html")); |
| |
| GURL fenced_frame_url(embedded_test_server()->GetURL( |
| "b.com", policy_header_in_fenced_frame_page_ |
| ? std::string(kPrivateStateTokenRedemptionPolicyHeader) + |
| "&Supports-Loading-Mode: fenced-frame" |
| : "/fenced_frames/title1.html")); |
| |
| EXPECT_TRUE(NavigateToURL(shell(), primary_url)); |
| |
| base::RunLoop run_loop; |
| ShellContentBrowserClient::Get()->set_url_loader_factory_params_callback( |
| base::BindLambdaForTesting( |
| [&](const network::mojom::URLLoaderFactoryParams* params, |
| const url::Origin& origin, bool unused_is_for_isolated_world, |
| bool unused_is_for_service_worker) { |
| if (origin.host() != "b.com") |
| return; |
| EXPECT_TRUE(params); |
| EXPECT_THAT( |
| params->trust_token_redemption_policy, |
| network::mojom::TrustTokenOperationPolicyVerdict::kForbid); |
| run_loop.Quit(); |
| })); |
| |
| ASSERT_TRUE(fenced_frame_test_helper().CreateFencedFrame( |
| shell()->web_contents()->GetPrimaryMainFrame(), fenced_frame_url)); |
| |
| run_loop.Run(); |
| } |
| |
| IN_PROC_BROWSER_TEST_P(TrustTokenPermissionsPolicyFencedFrameTest, |
| PassesNegativeIssuanceValueToFactoryParams) { |
| ASSERT_TRUE(embedded_test_server()->Start()); |
| |
| GURL primary_url(embedded_test_server()->GetURL( |
| "a.com", policy_header_in_primary_page_ |
| ? kPrivateStateTokenIssuancePolicyHeader |
| : "/title1.html")); |
| |
| GURL fenced_frame_url(embedded_test_server()->GetURL( |
| "b.com", policy_header_in_fenced_frame_page_ |
| ? std::string(kPrivateStateTokenIssuancePolicyHeader) + |
| "&Supports-Loading-Mode: fenced-frame" |
| : "/fenced_frames/title1.html")); |
| |
| EXPECT_TRUE(NavigateToURL(shell(), primary_url)); |
| |
| base::RunLoop run_loop; |
| ShellContentBrowserClient::Get()->set_url_loader_factory_params_callback( |
| base::BindLambdaForTesting( |
| [&](const network::mojom::URLLoaderFactoryParams* params, |
| const url::Origin& origin, bool unused_is_for_isolated_world, |
| bool unused_is_for_service_worker) { |
| if (origin.host() != "b.com") { |
| return; |
| } |
| EXPECT_TRUE(params); |
| EXPECT_THAT( |
| params->trust_token_issuance_policy, |
| network::mojom::TrustTokenOperationPolicyVerdict::kForbid); |
| run_loop.Quit(); |
| })); |
| |
| ASSERT_TRUE(fenced_frame_test_helper().CreateFencedFrame( |
| shell()->web_contents()->GetPrimaryMainFrame(), fenced_frame_url)); |
| |
| run_loop.Run(); |
| } |
| |
| } // namespace content |
