| // Copyright 2020 The Chromium Authors |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #include "content/browser/renderer_host/policy_container_host.h" |
| |
| #include "base/command_line.h" |
| #include "content/browser/renderer_host/navigation_request.h" |
| #include "content/browser/renderer_host/render_frame_host_impl.h" |
| #include "content/browser/web_contents/web_contents_impl.h" |
| #include "content/common/content_navigation_policy.h" |
| #include "content/public/test/browser_test.h" |
| #include "content/public/test/content_browser_test.h" |
| #include "content/public/test/content_browser_test_utils.h" |
| #include "content/public/test/test_navigation_observer.h" |
| #include "content/shell/browser/shell.h" |
| #include "content/test/content_browser_test_utils_internal.h" |
| #include "net/dns/mock_host_resolver.h" |
| #include "net/test/embedded_test_server/embedded_test_server.h" |
| #include "services/network/public/mojom/referrer_policy.mojom-shared.h" |
| #include "testing/gmock/include/gmock/gmock.h" |
| #include "testing/gtest/include/gtest/gtest.h" |
| |
| namespace content { |
| |
| using ::testing::ByRef; |
| using ::testing::Eq; |
| using ::testing::IsNull; |
| using ::testing::Pointee; |
| |
| namespace { |
| class PolicyContainerHostBrowserTest : public content::ContentBrowserTest { |
| protected: |
| void SetUpOnMainThread() override { |
| host_resolver()->AddRule("*", "127.0.0.1"); |
| SetupCrossSiteRedirector(embedded_test_server()); |
| ASSERT_TRUE(embedded_test_server()->Start()); |
| } |
| |
| WebContentsImpl* web_contents() const { |
| return static_cast<WebContentsImpl*>(shell()->web_contents()); |
| } |
| |
| RenderFrameHostImpl* current_frame_host() { |
| return web_contents()->GetPrimaryMainFrame(); |
| } |
| }; |
| } // namespace |
| |
| IN_PROC_BROWSER_TEST_F(PolicyContainerHostBrowserTest, |
| ReferrerPolicyFromHeader) { |
| using ReferrerPolicy = network::mojom::ReferrerPolicy; |
| const struct { |
| const char* headers; |
| ReferrerPolicy expected_referrer; |
| } kTestCases[] = { |
| {"", ReferrerPolicy::kDefault}, |
| {"Referrer-Policy: no-referrer", ReferrerPolicy::kNever}, |
| {"Referrer-Policy: no-referrer-when-downgrade", |
| ReferrerPolicy::kNoReferrerWhenDowngrade}, |
| {"Referrer-Policy: origin", ReferrerPolicy::kOrigin}, |
| {"Referrer-Policy: origin-when-cross-origin", |
| ReferrerPolicy::kOriginWhenCrossOrigin}, |
| {"Referrer-Policy: same-origin", ReferrerPolicy::kSameOrigin}, |
| {"Referrer-Policy: strict-origin", ReferrerPolicy::kStrictOrigin}, |
| {"Referrer-Policy: strict-origin-when-cross-origin", |
| ReferrerPolicy::kStrictOriginWhenCrossOrigin}, |
| {"Referrer-Policy: unsafe-url", ReferrerPolicy::kAlways}, |
| }; |
| for (const auto& test_case : kTestCases) { |
| GURL url = embedded_test_server()->GetURL( |
| "a.com", "/set-header?" + std::string(test_case.headers)); |
| ASSERT_TRUE(NavigateToURL(shell(), url)); |
| EXPECT_EQ(test_case.expected_referrer, |
| current_frame_host()->policy_container_host()->referrer_policy()); |
| } |
| } |
| |
| IN_PROC_BROWSER_TEST_F(PolicyContainerHostBrowserTest, |
| ReferrerPolicyMetaUpdates) { |
| GURL page = embedded_test_server()->GetURL("a.com", "/empty.html"); |
| ASSERT_TRUE(NavigateToURL(shell(), page)); |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kDefault, |
| current_frame_host()->policy_container_host()->referrer_policy()); |
| ASSERT_TRUE(ExecJs(current_frame_host(), |
| "var meta = document.createElement('meta');" |
| "meta.name = 'referrer';" |
| "meta.content = 'no-referrer';" |
| "document.head.appendChild(meta);")); |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kNever, |
| current_frame_host()->policy_container_host()->referrer_policy()); |
| } |
| |
| IN_PROC_BROWSER_TEST_F(PolicyContainerHostBrowserTest, CopiedFromPopupOpener) { |
| GURL policies_a_url = embedded_test_server()->GetURL( |
| "a.com", "/set-header?Referrer-Policy: no-referrer"); |
| GURL policies_b_url = embedded_test_server()->GetURL( |
| "a.com", |
| "/set-header?" |
| "Referrer-Policy: origin&" |
| "Content-Security-Policy: img-src 'self'; style-src 'self'"); |
| ASSERT_TRUE(NavigateToURL(shell(), policies_b_url)); |
| |
| PolicyContainerPolicies main_document_policies = |
| current_frame_host()->policy_container_host()->policies().Clone(); |
| |
| { |
| // Open a popup. It stays on the initial empty document. The |
| // PolicyContainerHost's policies must have been inherited from the opener. |
| ShellAddedObserver shell_observer; |
| ASSERT_TRUE(ExecJs(current_frame_host(), "window.open();")); |
| WebContentsImpl* popup_webcontents = static_cast<WebContentsImpl*>( |
| shell_observer.GetShell()->web_contents()); |
| RenderFrameHostImpl* popup_frame = |
| popup_webcontents->GetPrimaryFrameTree().root()->current_frame_host(); |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kOrigin, |
| popup_frame->policy_container_host()->referrer_policy()); |
| EXPECT_EQ(main_document_policies, |
| popup_frame->policy_container_host()->policies()); |
| } |
| { |
| // Open a popup that navigates to another document, the referrer policy |
| // of the current frame (referrer-policy: origin) should be applied, which |
| // induces on the following document the |document.referrer| value of |
| // |origin_referrer_page.GetWithEmptyPath()| as tested below. |
| // The document loaded in the popup should have |
| // referrer-policy: no-referrer and no CSPs from the response headers. |
| ShellAddedObserver shell_observer; |
| ASSERT_TRUE(ExecJs(current_frame_host(), |
| JsReplace("window.open($1);", policies_a_url))); |
| WebContentsImpl* popup_webcontents = static_cast<WebContentsImpl*>( |
| shell_observer.GetShell()->web_contents()); |
| WaitForLoadStop(popup_webcontents); |
| RenderFrameHostImpl* popup_frame = |
| popup_webcontents->GetPrimaryFrameTree().root()->current_frame_host(); |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kNever, |
| popup_frame->policy_container_host()->referrer_policy()); |
| EXPECT_EQ(0u, popup_frame->policy_container_host() |
| ->policies() |
| .content_security_policies.size()); |
| EXPECT_EQ(policies_b_url.GetWithEmptyPath(), |
| EvalJs(popup_frame, "document.referrer;")); |
| } |
| } |
| |
| IN_PROC_BROWSER_TEST_F(PolicyContainerHostBrowserTest, CopiedFromParent) { |
| GURL policies_a_url = embedded_test_server()->GetURL( |
| "a.com", "/set-header?Referrer-Policy: no-referrer"); |
| GURL policies_b_url = embedded_test_server()->GetURL( |
| "a.com", |
| "/set-header?" |
| "Referrer-Policy: origin&" |
| "Content-Security-Policy: img-src 'self'; style-src 'self'"); |
| ASSERT_TRUE(NavigateToURL(shell(), policies_b_url)); |
| |
| PolicyContainerPolicies main_document_policies = |
| current_frame_host()->policy_container_host()->policies().Clone(); |
| |
| std::string create_srcdoc_iframe_script( |
| "var iframe = document.createElement('iframe');" |
| "iframe.srcdoc = '<p>hello world!</p>';" |
| "document.body.appendChild(iframe);"); |
| { |
| // Add an iframe and verify its policies. |
| ASSERT_TRUE(ExecJs(current_frame_host(), create_srcdoc_iframe_script)); |
| ASSERT_EQ(1U, current_frame_host()->child_count()); |
| WaitForLoadStop(web_contents()); |
| FrameTreeNode* iframe_node = |
| current_frame_host()->child_at(current_frame_host()->child_count() - 1); |
| EXPECT_TRUE(iframe_node->current_url().IsAboutSrcdoc()); |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kOrigin, |
| iframe_node->current_frame_host() |
| ->policy_container_host() |
| ->referrer_policy()); |
| EXPECT_EQ( |
| main_document_policies, |
| iframe_node->current_frame_host()->policy_container_host()->policies()); |
| |
| // Navigate the document and verify the policies are updated and the |
| // initiator referrer policy (referrer-policy: origin) is used which induces |
| // on the following document the |document.referrer| value of |
| // |origin_referrer_page.GetWithEmptyPath()| as tested below. |
| ASSERT_TRUE( |
| ExecJs(iframe_node->current_frame_host(), |
| JsReplace("document.location.href = $1", policies_a_url))); |
| WaitForLoadStop(web_contents()); |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kNever, |
| iframe_node->current_frame_host() |
| ->policy_container_host() |
| ->referrer_policy()); |
| EXPECT_EQ(0u, iframe_node->current_frame_host() |
| ->policy_container_host() |
| ->policies() |
| .content_security_policies.size()); |
| EXPECT_EQ(policies_b_url.GetWithEmptyPath(), |
| EvalJs(iframe_node->current_frame_host(), "document.referrer;")); |
| } |
| |
| // Taint the RFH Policy container with a value that will not be the same in |
| // the renderer (kOrigin). This is not possible in a normal situation, but |
| // could occur if the renderer was compromised. |
| // This will enable the following test, which verifies that the copied policy |
| // comes from the browser. |
| static_cast<blink::mojom::PolicyContainerHost*>( |
| current_frame_host()->policy_container_host()) |
| ->SetReferrerPolicy(network::mojom::ReferrerPolicy::kSameOrigin); |
| // Repeat the previous test with the tainted policy container: |
| { |
| // Add an iframe and verify its Policy Container value. |
| ASSERT_TRUE(ExecJs(current_frame_host(), create_srcdoc_iframe_script)); |
| // Check that the iframe was properly added. |
| ASSERT_EQ(2U, current_frame_host()->child_count()); |
| WaitForLoadStop(web_contents()); |
| FrameTreeNode* iframe_node = |
| current_frame_host()->child_at(current_frame_host()->child_count() - 1); |
| EXPECT_TRUE(iframe_node->current_url().IsAboutSrcdoc()); |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kSameOrigin, |
| iframe_node->current_frame_host() |
| ->policy_container_host() |
| ->referrer_policy()); |
| |
| ASSERT_TRUE( |
| ExecJs(iframe_node->current_frame_host(), |
| JsReplace("document.location.href = $1", policies_a_url))); |
| WaitForLoadStop(web_contents()); |
| // The referrer policy is the one of the newly loaded document: |
| // no_referrer_page. |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kNever, |
| iframe_node->current_frame_host() |
| ->policy_container_host() |
| ->referrer_policy()); |
| // The referrer is determined using the policy container inherited when the |
| // frame was created and navigated to the srcdoc. The tainted value, within |
| // the browser process, was inherited during the navigation, and is expected |
| // to be referrer-policy: same-origin, leading to the full url being used as |
| // a referrer. |
| EXPECT_EQ(policies_b_url, |
| EvalJs(iframe_node->current_frame_host(), "document.referrer;")); |
| } |
| } |
| |
| IN_PROC_BROWSER_TEST_F(PolicyContainerHostBrowserTest, |
| CopiedFromParentCreatedBySibling) { |
| GURL origin_referrer_page = embedded_test_server()->GetURL( |
| "a.com", |
| "/set-header?" |
| "Referrer-Policy: origin&" |
| "Content-Security-Policy: style-src-attr 'none'"); |
| GURL same_origin_referrer_page = embedded_test_server()->GetURL( |
| "a.com", "/set-header?Referrer-Policy: same-origin"); |
| GURL no_referrer_page = embedded_test_server()->GetURL( |
| "a.com", "/set-header?Referrer-Policy: no-referrer"); |
| ASSERT_TRUE(NavigateToURL(shell(), origin_referrer_page)); |
| |
| PolicyContainerPolicies main_document_policies = |
| current_frame_host()->policy_container_host()->policies().Clone(); |
| |
| { |
| // Add an iframe and verify its referrer policy. |
| ASSERT_TRUE( |
| ExecJs(current_frame_host(), |
| JsReplace("var iframe = document.createElement('iframe');" |
| "iframe.src = $1;" |
| "iframe.name = 'first';" |
| "document.body.appendChild(iframe);", |
| same_origin_referrer_page))); |
| ASSERT_EQ(1U, current_frame_host()->child_count()); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| FrameTreeNode* first_iframe_node = |
| current_frame_host()->child_at(current_frame_host()->child_count() - 1); |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kSameOrigin, |
| first_iframe_node->current_frame_host() |
| ->policy_container_host() |
| ->referrer_policy()); |
| |
| // From the iframe, create a sibling. |
| ASSERT_TRUE(ExecJs(first_iframe_node->current_frame_host(), |
| "var iframe = document.createElement('iframe');" |
| "iframe.srcdoc = 'hello world';" |
| "iframe.name = 'second';" |
| "parent.document.body.appendChild(iframe);")); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| ASSERT_EQ(2U, current_frame_host()->child_count()); |
| FrameTreeNode* second_iframe_node = |
| current_frame_host()->child_at(current_frame_host()->child_count() - 1); |
| // The policies should be inherited from the creator of the iframe, which is |
| // the node to which the iframe is attached to, i.e. the parent, here the |
| // main document, which has referrer-policy: origin. |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kOrigin, |
| second_iframe_node->current_frame_host() |
| ->policy_container_host() |
| ->referrer_policy()) |
| << "Sibling policy container inherited from parent."; |
| EXPECT_EQ(main_document_policies, second_iframe_node->current_frame_host() |
| ->policy_container_host() |
| ->policies()); |
| |
| // The second iframe navigates its sibling, the first iframe, the inherited |
| // referrer policy of second (from the main frame) is applied. |
| // The document loaded in first is a local scheme, and as such inherits from |
| // the initiator, the second iframe. |
| ASSERT_TRUE(ExecJs(second_iframe_node->current_frame_host(), |
| "window.open('about:blank', 'first');")); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kOrigin, |
| first_iframe_node->current_frame_host() |
| ->policy_container_host() |
| ->referrer_policy()); |
| EXPECT_EQ(main_document_policies, first_iframe_node->current_frame_host() |
| ->policy_container_host() |
| ->policies()); |
| EXPECT_EQ( |
| origin_referrer_page.GetWithEmptyPath(), |
| EvalJs(first_iframe_node->current_frame_host(), "document.referrer;")) |
| << "Referrer obtained from applying same-origin referrer policy."; |
| |
| // Navigate the second iframe, verify the policies are updated from |
| // the response. The document.referrer comes from the application of the |
| // inherited referrer policy of the main frame |
| // (referrer-policy: same-origin). |
| ASSERT_TRUE( |
| ExecJs(second_iframe_node->current_frame_host(), |
| JsReplace("document.location.href = $1", no_referrer_page))); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kNever, |
| second_iframe_node->current_frame_host() |
| ->policy_container_host() |
| ->referrer_policy()); |
| EXPECT_EQ(0u, second_iframe_node->current_frame_host() |
| ->policy_container_host() |
| ->policies() |
| .content_security_policies.size()); |
| EXPECT_EQ( |
| origin_referrer_page.GetWithEmptyPath(), |
| EvalJs(second_iframe_node->current_frame_host(), "document.referrer;")) |
| << "Referrer obtained from applying same-origin referrer policy."; |
| } |
| } |
| |
| IN_PROC_BROWSER_TEST_F(PolicyContainerHostBrowserTest, HistoryForMainFrame) { |
| NavigationControllerImpl& controller = web_contents()->GetController(); |
| GURL policies_a_url(embedded_test_server()->GetURL( |
| "/set-header?" |
| "Referrer-Policy: no-referrer&" |
| "Content-Security-Policy: img-src 'none'")); |
| GURL policies_b_url(embedded_test_server()->GetURL( |
| "/set-header?" |
| "Referrer-Policy: unsafe-url&" |
| "Content-Security-Policy: style-src 'none'")); |
| |
| // Navigate to a page setting policies_a. |
| ASSERT_TRUE(NavigateToURL(shell(), policies_a_url)); |
| ASSERT_EQ(1, controller.GetEntryCount()); |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kNever, |
| current_frame_host()->policy_container_host()->referrer_policy()); |
| PolicyContainerPolicies policies_a = |
| current_frame_host()->policy_container_host()->policies().Clone(); |
| |
| // Now navigate to a local scheme. |
| ASSERT_TRUE(ExecJs(current_frame_host(), "window.location = 'about:blank'")); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| ASSERT_EQ(policies_a, |
| current_frame_host()->policy_container_host()->policies()); |
| |
| ASSERT_EQ(2, controller.GetEntryCount()); |
| NavigationEntryImpl* entry2 = controller.GetEntryAtIndex(1); |
| |
| // Check that RendererDidNavigateToNewEntry stored the correct policy |
| // container in the FrameNavigationEntry. |
| EXPECT_THAT(entry2->root_node()->frame_entry->policy_container_policies(), |
| Pointee(Eq(ByRef(policies_a)))); |
| |
| // Same document navigation. |
| ASSERT_TRUE(ExecJs(current_frame_host(), "window.location.href = '#top'")); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| EXPECT_EQ(policies_a, |
| current_frame_host()->policy_container_host()->policies()); |
| |
| ASSERT_EQ(3, controller.GetEntryCount()); |
| NavigationEntryImpl* entry3 = controller.GetEntryAtIndex(2); |
| EXPECT_THAT(entry3->root_node()->frame_entry->policy_container_policies(), |
| Pointee(Eq(ByRef(policies_a)))); |
| |
| // Navigate to a third page. |
| ASSERT_TRUE(NavigateToURL(shell(), policies_b_url)); |
| ASSERT_EQ(4, controller.GetEntryCount()); |
| ASSERT_EQ(network::mojom::ReferrerPolicy::kAlways, |
| current_frame_host()->policy_container_host()->referrer_policy()); |
| |
| // Go back to "about:blank#top" |
| controller.GoBack(); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| |
| // The correct policies should be restored from history. |
| EXPECT_EQ(policies_a, |
| current_frame_host()->policy_container_host()->policies()); |
| |
| // The function RendererDidNavigateToExistingEntry should not have changed |
| // anything. |
| EXPECT_THAT(entry3->root_node()->frame_entry->policy_container_policies(), |
| Pointee(Eq(ByRef(policies_a)))); |
| |
| // Go back to "about:blank". |
| controller.GoBack(); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| |
| // The correct policies should be restored from history. |
| EXPECT_EQ(policies_a, |
| current_frame_host()->policy_container_host()->policies()); |
| |
| // The function RendererDidNavigateToExistingEntry should not have changed |
| // anything. |
| EXPECT_THAT(entry2->root_node()->frame_entry->policy_container_policies(), |
| Pointee(Eq(ByRef(policies_a)))); |
| |
| // Same URL navigation, which gets converted to a reload. |
| ASSERT_TRUE(NavigateFrameToURL(current_frame_host()->frame_tree_node(), |
| GURL("about:blank"))); |
| EXPECT_EQ(policies_a, |
| current_frame_host()->policy_container_host()->policies()); |
| |
| ASSERT_EQ(4, controller.GetEntryCount()); |
| |
| // Check that after RendererDidNavigateToExistingEntry the policy container in |
| // the FrameNavigationEntry is still correct. |
| EXPECT_THAT(entry2->root_node()->frame_entry->policy_container_policies(), |
| Pointee(Eq(ByRef(policies_a)))); |
| } |
| |
| namespace { |
| |
| bool EqualsExceptCOOPAndTopNavigation(const PolicyContainerPolicies& lhs, |
| const PolicyContainerPolicies& rhs) { |
| PolicyContainerPolicies rhs_modulo_coop = rhs.Clone(); |
| rhs_modulo_coop.cross_origin_opener_policy = lhs.cross_origin_opener_policy; |
| rhs_modulo_coop.can_navigate_top_without_user_gesture = |
| lhs.can_navigate_top_without_user_gesture; |
| |
| return lhs == rhs_modulo_coop; |
| } |
| |
| } // namespace |
| |
| IN_PROC_BROWSER_TEST_F(PolicyContainerHostBrowserTest, HistoryForChildFrame) { |
| NavigationControllerImpl& controller = web_contents()->GetController(); |
| GURL policies_a_url(embedded_test_server()->GetURL( |
| "/set-header?" |
| "Referrer-Policy: unsafe-url&" |
| "Content-Security-Policy: style-src 'none'")); |
| GURL strict_origin_when_cross_origin_referrer_url( |
| embedded_test_server()->GetURL( |
| "/set-header?Referrer-Policy: strict-origin-when-cross-origin")); |
| |
| GURL main_url(embedded_test_server()->GetURL("/page_with_blank_iframe.html")); |
| FrameTreeNode* root = web_contents()->GetPrimaryFrameTree().root(); |
| ASSERT_TRUE(NavigateToURL(shell(), main_url)); |
| |
| ASSERT_EQ(1U, root->child_count()); |
| FrameTreeNode* child = root->child_at(0); |
| ASSERT_NE(nullptr, child); |
| ASSERT_EQ(1, controller.GetEntryCount()); |
| |
| // The child has default policies (same as the parent). |
| EXPECT_EQ( |
| network::mojom::ReferrerPolicy::kDefault, |
| child->current_frame_host()->policy_container_host()->referrer_policy()); |
| EXPECT_EQ(0u, child->current_frame_host() |
| ->policy_container_host() |
| ->policies() |
| .content_security_policies.size()); |
| NavigationEntryImpl* entry1 = controller.GetEntryAtIndex(0); |
| EXPECT_THAT( |
| entry1->GetFrameEntry(child)->policy_container_policies(), |
| Pointee(Eq(ByRef( |
| child->current_frame_host()->policy_container_host()->policies())))); |
| |
| // Change policies of the main frame. |
| ASSERT_TRUE(ExecJs(current_frame_host(), |
| "var meta = document.createElement('meta');" |
| "meta.name = 'referrer';" |
| "meta.content = 'same-origin';" |
| "document.head.appendChild(meta);" |
| "var meta2 = document.createElement('meta');" |
| "meta2.httpEquiv = 'content-security-policy';" |
| "meta2.content = 'img-src';" |
| "document.head.appendChild(meta2);")); |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kSameOrigin, |
| current_frame_host()->policy_container_host()->referrer_policy()); |
| EXPECT_EQ(1u, current_frame_host() |
| ->policy_container_host() |
| ->policies() |
| .content_security_policies.size()); |
| PolicyContainerPolicies main_frame_new_policies = |
| current_frame_host()->policy_container_host()->policies().Clone(); |
| |
| // 1) Navigate the child frame to a local scheme url. |
| ASSERT_TRUE(ExecJs(current_frame_host(), |
| "window.open('data:text/html,Hello', 'test_iframe');")); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| |
| // The new document inherits from the navigation initiator, except for COOP. |
| EXPECT_TRUE(EqualsExceptCOOPAndTopNavigation( |
| main_frame_new_policies, |
| child->current_frame_host()->policy_container_host()->policies())); |
| |
| // The new page replaces the initial about:blank page in the subframe, so no |
| // new navigation entry is created. |
| ASSERT_EQ(1, controller.GetEntryCount()); |
| |
| // The policy container of the FrameNavigationEntry should have been |
| // updated. Test that the function RendererDidNavigateAutoSubframe updates the |
| // FrameNavigationEntry properly. |
| EXPECT_THAT( |
| entry1->GetFrameEntry(child)->policy_container_policies(), |
| Pointee(Eq(ByRef( |
| child->current_frame_host()->policy_container_host()->policies())))); |
| |
| // 2) Same document navigation. |
| ASSERT_TRUE( |
| ExecJs(child->current_frame_host(), "window.location.href = '#top';")); |
| ASSERT_TRUE(WaitForLoadStop(web_contents())); |
| |
| // The policies have not changed. |
| EXPECT_TRUE(EqualsExceptCOOPAndTopNavigation( |
| main_frame_new_policies, |
| child->current_frame_host()->policy_container_host()->policies())); |
| ASSERT_EQ(2, controller.GetEntryCount()); |
| NavigationEntryImpl* entry2 = controller.GetEntryAtIndex(1); |
| EXPECT_THAT( |
| entry1->GetFrameEntry(child)->policy_container_policies(), |
| Pointee(Eq(ByRef( |
| child->current_frame_host()->policy_container_host()->policies())))); |
| |
| // 3) Navigate the child frame to a network scheme url. |
| ASSERT_TRUE(NavigateFrameToURL(child, policies_a_url)); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| ASSERT_EQ(3, controller.GetEntryCount()); |
| EXPECT_EQ( |
| network::mojom::ReferrerPolicy::kAlways, |
| child->current_frame_host()->policy_container_host()->referrer_policy()); |
| PolicyContainerPolicies policies_a = |
| child->current_frame_host()->policy_container_host()->policies().Clone(); |
| |
| // 4) Navigate the child frame to another local scheme url. |
| ASSERT_TRUE(ExecJs(child->current_frame_host(), |
| "window.location = 'data:text/html,Hello2';")); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| |
| // The new document inherits from the navigation initiator. |
| EXPECT_TRUE(EqualsExceptCOOPAndTopNavigation( |
| policies_a, |
| child->current_frame_host()->policy_container_host()->policies())); |
| |
| // Now test that the function RendererDidNavigateNewSubframe properly stored |
| // the policy container in the FrameNavigationEntry. |
| ASSERT_EQ(4, controller.GetEntryCount()); |
| NavigationEntryImpl* entry4 = controller.GetEntryAtIndex(3); |
| EXPECT_THAT( |
| entry4->GetFrameEntry(child)->policy_container_policies(), |
| Pointee(Eq(ByRef( |
| child->current_frame_host()->policy_container_host()->policies())))); |
| |
| // 5) Navigate the child frame to another network scheme url. |
| ASSERT_TRUE( |
| NavigateFrameToURL(child, strict_origin_when_cross_origin_referrer_url)); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| ASSERT_EQ(5, controller.GetEntryCount()); |
| EXPECT_EQ( |
| network::mojom::ReferrerPolicy::kStrictOriginWhenCrossOrigin, |
| child->current_frame_host()->policy_container_host()->referrer_policy()); |
| EXPECT_EQ(0u, child->current_frame_host() |
| ->policy_container_host() |
| ->policies() |
| .content_security_policies.size()); |
| |
| // 6) Navigate the main frame cross-document to destroy the subframes. |
| GURL foo_url(embedded_test_server()->GetURL( |
| "foo.com", "/navigation_controller/simple_page_1.html")); |
| ASSERT_TRUE(NavigateToURL(shell(), foo_url)); |
| |
| // 7) Navigate all the way back and check that we properly reload the policy |
| // container from history. |
| controller.GoBack(); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| |
| controller.GoBack(); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| |
| child = web_contents()->GetPrimaryFrameTree().root()->child_at(0); |
| ASSERT_NE(nullptr, child); |
| |
| // The correct referrer policy should be restored from history. |
| EXPECT_TRUE(EqualsExceptCOOPAndTopNavigation( |
| policies_a, |
| child->current_frame_host()->policy_container_host()->policies())); |
| |
| // The frame entry should not have changed. |
| EXPECT_THAT( |
| entry4->GetFrameEntry(child)->policy_container_policies(), |
| Pointee(Eq(ByRef( |
| child->current_frame_host()->policy_container_host()->policies())))); |
| |
| controller.GoBack(); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| |
| controller.GoBack(); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| |
| // The correct referrer policy should be restored from history. |
| EXPECT_TRUE(EqualsExceptCOOPAndTopNavigation( |
| main_frame_new_policies, |
| child->current_frame_host()->policy_container_host()->policies())); |
| |
| // The frame entry should not have changed. |
| EXPECT_THAT( |
| entry2->GetFrameEntry(child)->policy_container_policies(), |
| Pointee(Eq(ByRef( |
| child->current_frame_host()->policy_container_host()->policies())))); |
| |
| controller.GoBack(); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| |
| // The correct referrer policy should be restored from history. |
| EXPECT_TRUE(EqualsExceptCOOPAndTopNavigation( |
| main_frame_new_policies, |
| child->current_frame_host()->policy_container_host()->policies())); |
| |
| // The frame entry should not have changed. |
| EXPECT_THAT( |
| entry1->GetFrameEntry(child)->policy_container_policies(), |
| Pointee(Eq(ByRef( |
| child->current_frame_host()->policy_container_host()->policies())))); |
| } |
| |
| // Test for https://crbug.com/364773822. |
| IN_PROC_BROWSER_TEST_F( |
| PolicyContainerHostBrowserTest, |
| PoliciesAreNotReloadedFromHistoryIfNavigationEncounteredError) { |
| NavigationControllerImpl& controller = web_contents()->GetController(); |
| GURL main_url(embedded_test_server()->GetURL("/page_with_blank_iframe.html")); |
| |
| FrameTreeNode* root = web_contents()->GetPrimaryFrameTree().root(); |
| ASSERT_TRUE(NavigateToURL(shell(), main_url)); |
| |
| ASSERT_EQ(1U, root->child_count()); |
| FrameTreeNode* child = root->child_at(0); |
| ASSERT_NE(nullptr, child); |
| |
| GURL child_frame_url( |
| embedded_test_server()->GetURL("/page_with_srcdoc_iframe_and_csp.html")); |
| ASSERT_TRUE(NavigateFrameToURL(child, child_frame_url)); |
| |
| ASSERT_EQ(1, controller.GetEntryCount()); |
| |
| PolicyContainerPolicies child_frame_policies = |
| child->current_frame_host()->policy_container_host()->policies().Clone(); |
| EXPECT_EQ(1u, child_frame_policies.content_security_policies.size()); |
| NavigationEntryImpl* entry1 = controller.GetEntryAtIndex(0); |
| EXPECT_THAT( |
| entry1->GetFrameEntry(child)->policy_container_policies(), |
| Pointee(Eq(ByRef( |
| child->current_frame_host()->policy_container_host()->policies())))); |
| |
| // The srcdoc document inherits from the parent, except for COOP. |
| ASSERT_EQ(1U, child->child_count()); |
| FrameTreeNode* grandchild = child->child_at(0); |
| ASSERT_NE(nullptr, grandchild); |
| EXPECT_TRUE(EqualsExceptCOOPAndTopNavigation( |
| child_frame_policies, |
| grandchild->current_frame_host()->policy_container_host()->policies())); |
| |
| ASSERT_EQ(1, controller.GetEntryCount()); |
| |
| GURL about_blank("about:blank#1"); |
| ASSERT_TRUE(NavigateFrameToURL(grandchild, about_blank)); |
| |
| // Add a sandbox to the child iframe and navigate away and back to recompute |
| // the sandbox flag, so that it gets reloaded with an opaque origin. |
| ASSERT_TRUE(ExecJs(current_frame_host(), R"( |
| document.getElementById('test_iframe').sandbox = 'allow-scripts'; |
| )")); |
| ASSERT_TRUE(NavigateFrameToURL(child, about_blank)); |
| controller.GoBack(); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| EXPECT_TRUE(child->current_origin().opaque()); |
| |
| // Trying to navigate the grandchild back to about:srcdoc is disallowed by |
| // https://source.chromium.org/chromium/chromium/src/+/main:content/browser/renderer_host/navigation_request.cc;l=6957-6967;drc=580a3da6e0ea94caa1f127e4455fbdbd05625065. |
| controller.GoBack(); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| EXPECT_TRUE(child->child_at(0)->current_frame_host()->IsErrorDocument()); |
| |
| // The error page should be loaded without inheriting the parent policies. |
| EXPECT_FALSE(EqualsExceptCOOPAndTopNavigation(child_frame_policies, |
| child->child_at(0) |
| ->current_frame_host() |
| ->policy_container_host() |
| ->policies())); |
| |
| // The policy container of the FrameNavigationEntry should have been cleared |
| // so that the error page's policies are not used on later successful loads. |
| EXPECT_THAT( |
| entry1->GetFrameEntry(child->child_at(0))->policy_container_policies(), |
| IsNull()); |
| |
| controller.GoForward(); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| controller.GoForward(); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| |
| // Remove the sandbox flag so that the srcdoc frame can successfully load |
| // again. |
| ASSERT_TRUE(ExecJs(current_frame_host(), R"( |
| document.getElementById('test_iframe').removeAttribute('sandbox'); |
| )")); |
| |
| controller.GoBack(); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| controller.GoBack(); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| |
| // The srcdoc document inherits again from the parent, except for COOP. |
| EXPECT_TRUE(EqualsExceptCOOPAndTopNavigation(child_frame_policies, |
| child->child_at(0) |
| ->current_frame_host() |
| ->policy_container_host() |
| ->policies())); |
| } |
| |
| // Check that the FrameNavigationEntry for the initial empty document is |
| // correctly populated, both for main frames and for subframes. |
| IN_PROC_BROWSER_TEST_F(PolicyContainerHostBrowserTest, |
| HistoryForInitialEmptyDocument) { |
| GURL policies_a_url = |
| embedded_test_server()->GetURL("a.com", |
| "/set-header?" |
| "Referrer-Policy: origin&" |
| "Content-Security-Policy: img-src 'none'"); |
| ASSERT_TRUE(NavigateToURL(shell(), policies_a_url)); |
| PolicyContainerPolicies policies_a = |
| current_frame_host()->policy_container_host()->policies().Clone(); |
| |
| { |
| // Open a subframe |
| ASSERT_TRUE(ExecJs(current_frame_host(), |
| "var frame = document.createElement('iframe');" |
| "frame.name = 'test_iframe';" |
| "document.body.appendChild(frame);")); |
| |
| FrameTreeNode* root = web_contents()->GetPrimaryFrameTree().root(); |
| ASSERT_EQ(1U, root->child_count()); |
| FrameTreeNode* child = root->child_at(0); |
| ASSERT_NE(nullptr, child); |
| // The child inherits from the parent. |
| EXPECT_EQ(policies_a, |
| child->current_frame_host()->policy_container_host()->policies()); |
| |
| // The right policy is stored in the FrameNavigationEntry. |
| NavigationControllerImpl& controller = web_contents()->GetController(); |
| ASSERT_EQ(1, controller.GetEntryCount()); |
| NavigationEntryImpl* entry1 = controller.GetEntryAtIndex(0); |
| EXPECT_THAT(entry1->GetFrameEntry(child)->policy_container_policies(), |
| Pointee(Eq(ByRef(policies_a)))); |
| } |
| |
| { |
| // Open a popup. |
| ShellAddedObserver shell_observer; |
| ASSERT_TRUE(ExecJs(current_frame_host(), "window.open('about:blank');")); |
| WebContentsImpl* popup_webcontents = static_cast<WebContentsImpl*>( |
| shell_observer.GetShell()->web_contents()); |
| RenderFrameHostImpl* popup_frame = |
| popup_webcontents->GetPrimaryFrameTree().root()->current_frame_host(); |
| |
| // The popup inherits from the creator. |
| EXPECT_EQ(policies_a, popup_frame->policy_container_host()->policies()); |
| |
| // The right policy is stored in the FrameNavigationEntry. |
| NavigationEntryImpl* entry1 = |
| popup_webcontents->GetController().GetEntryAtIndex(0); |
| EXPECT_THAT(entry1->root_node()->frame_entry->policy_container_policies(), |
| Pointee(Eq(ByRef(policies_a)))); |
| } |
| } |
| |
| // This test ensures that the document policies what we store in the |
| // FrameNavigationEntry are a snapshot of the document policies at |
| // CommitNavigation time, and do not include updates triggered by Blink. |
| IN_PROC_BROWSER_TEST_F(PolicyContainerHostBrowserTest, |
| BlinkModificationsDoNotAffectPolicyContainer) { |
| NavigationControllerImpl& controller = web_contents()->GetController(); |
| |
| GURL always_referrer_url(embedded_test_server()->GetURL( |
| "/set-header?Referrer-Policy: unsafe-url")); |
| ASSERT_TRUE(NavigateToURL(shell(), always_referrer_url)); |
| |
| FrameTreeNode* root = web_contents()->GetPrimaryFrameTree().root(); |
| |
| // Create child frame |
| ASSERT_TRUE(ExecJs(current_frame_host(), R"( |
| let frame = document.createElement('iframe'); |
| let content = '<head><meta name="referrer" content="no-referrer"></head>'; |
| frame.src = 'data:text/html,' + content; |
| document.body.appendChild(frame); |
| )")); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| |
| FrameTreeNode* child = root->child_at(0); |
| ASSERT_NE(nullptr, child); |
| |
| // Blink should have parsed Referrer-Policy from the meta tag and the |
| // information should have propagated to the PolicyContainerHost. |
| ASSERT_EQ( |
| network::mojom::ReferrerPolicy::kNever, |
| child->current_frame_host()->policy_container_host()->referrer_policy()); |
| ASSERT_EQ(1, controller.GetEntryCount()); |
| NavigationEntryImpl* entry1 = controller.GetEntryAtIndex(0); |
| |
| // Policies should be stored in the FrameNavigationEntry before any |
| // modification coming from blink. |
| ASSERT_EQ(network::mojom::ReferrerPolicy::kAlways, |
| entry1->GetFrameEntry(child) |
| ->policy_container_policies() |
| ->referrer_policy); |
| } |
| |
| // This is a regression test. A document navigates a remote subframe away from |
| // about:blank. The new FrameNavigationEntry used to wrongly inherit a |
| // policies from the about:blank document. |
| IN_PROC_BROWSER_TEST_F(PolicyContainerHostBrowserTest, |
| PoliciesNotInheritedForRemoteNonLocalScheme) { |
| NavigationControllerImpl& controller = web_contents()->GetController(); |
| |
| // Create a main frame with referrer policy 'unsafe-url'. |
| GURL always_referrer_url(embedded_test_server()->GetURL( |
| "/set-header?Referrer-Policy: unsafe-url")); |
| ASSERT_TRUE(NavigateToURL(shell(), always_referrer_url)); |
| |
| // Create a cross-origin child frame with referrer policy 'no-referrer'. |
| GURL cross_origin_no_referrer_url(embedded_test_server()->GetURL( |
| "b.com", "/set-header?Referrer-Policy: no-referrer")); |
| EXPECT_TRUE( |
| ExecJs(current_frame_host(), JsReplace(R"( |
| child_frame = document.createElement('iframe'); |
| child_frame.src = $1; |
| document.body.appendChild(child_frame); |
| )", |
| cross_origin_no_referrer_url))); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| |
| FrameTreeNode* child = current_frame_host()->child_at(0); |
| EXPECT_NE(nullptr, child); |
| |
| // Navigate the child frame to "about:blank", but keep it in a remote frame |
| // w.r.t. the main frame. |
| EXPECT_TRUE(ExecJs(child->current_frame_host(), R"( |
| location.href = "about:blank"; |
| )")); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| |
| EXPECT_EQ( |
| network::mojom::ReferrerPolicy::kNever, |
| child->current_frame_host()->policy_container_host()->referrer_policy()); |
| EXPECT_EQ(2, controller.GetEntryCount()); |
| NavigationEntryImpl* entry1 = controller.GetEntryAtIndex(1); |
| |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kNever, |
| entry1->GetFrameEntry(child) |
| ->policy_container_policies() |
| ->referrer_policy); |
| |
| // Now navigate the child from the main frame to another empty url. |
| GURL empty_url(embedded_test_server()->GetURL("c.com", "/empty.html")); |
| EXPECT_TRUE(ExecJs(current_frame_host(), JsReplace(R"( |
| child_frame.src = $1; |
| )", |
| empty_url))); |
| EXPECT_TRUE(WaitForLoadStop(web_contents())); |
| |
| // The child should have default referrer policy. |
| EXPECT_EQ( |
| network::mojom::ReferrerPolicy::kDefault, |
| child->current_frame_host()->policy_container_host()->referrer_policy()); |
| } |
| |
| // The following tests shows the behavior of the policy container during the |
| // early commit following a crashed frame: If an embedder pauses the navigation |
| // that causing the early commit, they can then execute javascript in the |
| // committed frame and blink's PolicyContainer would not be connected to |
| // browser's PolicyContainerHost. This has limited impact in practice. |
| IN_PROC_BROWSER_TEST_F(PolicyContainerHostBrowserTest, |
| CheckRendererPolicyContainerAccessesAfterCrash) { |
| GURL url_a(embedded_test_server()->GetURL("a.com", "/title1.html")); |
| GURL url_b(embedded_test_server()->GetURL("b.com", "/title2.html")); |
| IsolateAllSitesForTesting(base::CommandLine::ForCurrentProcess()); |
| |
| std::string add_referrer_script = R"( |
| new Promise(async resolve => { |
| // Make sure the DOM is ready before modifying <header>. |
| if (document.readyState !== "complete") |
| await new Promise(r => addEventListener("DOMContentLoaded", r)); |
| |
| // Add <meta name="referrer" content=$1> |
| let meta = document.createElement("meta"); |
| meta.name = "referrer"; |
| meta.content= $1; |
| document.head.append(meta); |
| resolve(true); |
| }) |
| )"; |
| |
| // Navigate to A. |
| EXPECT_TRUE(NavigateToURL(shell(), url_a)); |
| |
| // The referrer policy is initially default. |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kDefault, |
| current_frame_host()->policy_container_host()->referrer_policy()); |
| |
| // Deliver a new referrer policy in the renderer with |
| // <meta name="referrer" content="none">. |
| EXPECT_EQ(true, EvalJs(current_frame_host(), |
| content::JsReplace(add_referrer_script, "none"))); |
| // The policy is propagated to the browser by policy container. |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kNever, |
| current_frame_host()->policy_container_host()->referrer_policy()); |
| |
| // Crash the renderer. |
| RenderProcessHost* renderer_process = current_frame_host()->GetProcess(); |
| RenderProcessHostWatcher crash_observer( |
| renderer_process, RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); |
| renderer_process->Shutdown(0); |
| crash_observer.Wait(); |
| |
| // Start navigation to B, but don't commit yet. |
| TestNavigationManager manager(web_contents(), url_b); |
| shell()->LoadURL(url_b); |
| EXPECT_TRUE(manager.WaitForRequestStart()); |
| |
| NavigationRequest* navigation_request = |
| NavigationRequest::From(manager.GetNavigationHandle()); |
| if (ShouldSkipEarlyCommitPendingForCrashedFrame()) { |
| EXPECT_EQ(navigation_request->GetAssociatedRFHType(), |
| NavigationRequest::AssociatedRenderFrameHostType::SPECULATIVE); |
| } else { |
| // Policy container is properly initialized in the early committed |
| // RenderFrameHost. |
| EXPECT_TRUE(current_frame_host()->policy_container_host()); |
| EXPECT_EQ(navigation_request->GetAssociatedRFHType(), |
| NavigationRequest::AssociatedRenderFrameHostType::CURRENT); |
| |
| // The policy is copied from the previous RFH following the crash. |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kNever, |
| current_frame_host()->policy_container_host()->referrer_policy()); |
| |
| // Deliver a new referrer policy in the renderer with |
| // <meta name="referrer" content="origin">. Using "origin" to differ from |
| // previous "none" and "default". |
| |
| EXPECT_EQ(true, EvalJs(current_frame_host(), |
| content::JsReplace(add_referrer_script, "origin"))); |
| // The previous referrer policy is not propagated to the browser since |
| // blink's policy container is not linked with browser's policy container |
| // host. Never (a.k.a. "None") is copied from the previous RFH. |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kNever, |
| current_frame_host()->policy_container_host()->referrer_policy()); |
| } |
| |
| // Let the navigation finish. |
| ASSERT_TRUE(manager.WaitForNavigationFinished()); |
| |
| EXPECT_EQ(url_b, |
| web_contents()->GetPrimaryMainFrame()->GetLastCommittedURL()); |
| |
| // The referrer policy is initialized to default during the navigation (no |
| // referrer-policy header in the response). |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kDefault, |
| current_frame_host()->policy_container_host()->referrer_policy()); |
| |
| // Deliver a new referrer policy in the renderer with |
| // <meta name="referrer" content="strict-origin">. Using "strict-origin" to |
| // differ again from the previous uses. |
| EXPECT_EQ(true, |
| EvalJs(current_frame_host(), |
| content::JsReplace(add_referrer_script, "strict-origin"))); |
| // This time renderer's policy container properly propagates the referrer |
| // policy to the browser. |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kStrictOrigin, |
| current_frame_host()->policy_container_host()->referrer_policy()); |
| } |
| |
| // Test that chrome error pages are loaded with a default policy container and |
| // don't inherit policies. |
| IN_PROC_BROWSER_TEST_F(PolicyContainerHostBrowserTest, FailedNavigation) { |
| // Perform a navigation setting referrer policy. |
| GURL url = embedded_test_server()->GetURL( |
| "/set-header?Referrer-Policy: no-referrer"); |
| EXPECT_TRUE(NavigateToURL(shell(), url)); |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kNever, |
| current_frame_host()->policy_container_host()->referrer_policy()); |
| |
| // Now open a popup with an unreachable url. |
| GURL error_url = embedded_test_server()->GetURL("/close-socket"); |
| ShellAddedObserver shell_observer; |
| EXPECT_TRUE( |
| ExecJs(current_frame_host(), JsReplace("window.open($1)", error_url))); |
| WebContentsImpl* popup_webcontents = |
| static_cast<WebContentsImpl*>(shell_observer.GetShell()->web_contents()); |
| WaitForLoadStop(popup_webcontents); |
| |
| NavigationEntry* entry = |
| popup_webcontents->GetController().GetLastCommittedEntry(); |
| EXPECT_EQ(PAGE_TYPE_ERROR, entry->GetPageType()); |
| RenderFrameHostImpl* popup_frame = |
| popup_webcontents->GetPrimaryFrameTree().root()->current_frame_host(); |
| EXPECT_EQ(network::mojom::ReferrerPolicy::kDefault, |
| popup_frame->policy_container_host()->referrer_policy()); |
| } |
| |
| IN_PROC_BROWSER_TEST_F(PolicyContainerHostBrowserTest, |
| ContentSecurityPoliciesFromHeader) { |
| GURL url = embedded_test_server()->GetURL( |
| "a.com", "/set-header?Content-Security-Policy: img-src 'none'"); |
| ASSERT_TRUE(NavigateToURL(shell(), url)); |
| ASSERT_EQ(1u, current_frame_host() |
| ->policy_container_host() |
| ->policies() |
| .content_security_policies.size()); |
| auto& csp = current_frame_host() |
| ->policy_container_host() |
| ->policies() |
| .content_security_policies[0]; |
| EXPECT_EQ("img-src 'none'", csp->header->header_value); |
| EXPECT_TRUE(csp->directives.find(network::mojom::CSPDirectiveName::ImgSrc) != |
| csp->directives.end()); |
| EXPECT_EQ(0u, csp->directives.at(network::mojom::CSPDirectiveName::ImgSrc) |
| ->sources.size()); |
| } |
| |
| IN_PROC_BROWSER_TEST_F(PolicyContainerHostBrowserTest, |
| ContentSecurityPolicyFromMeta) { |
| GURL page = embedded_test_server()->GetURL("a.com", "/empty.html"); |
| ASSERT_TRUE(NavigateToURL(shell(), page)); |
| EXPECT_EQ(0u, current_frame_host() |
| ->policy_container_host() |
| ->policies() |
| .content_security_policies.size()); |
| ASSERT_TRUE(ExecJs(current_frame_host(), |
| "var meta = document.createElement('meta');" |
| "meta.httpEquiv = 'content-security-policy';" |
| "meta.content = \"img-src 'none'\";" |
| "document.head.appendChild(meta);")); |
| ASSERT_EQ(1u, current_frame_host() |
| ->policy_container_host() |
| ->policies() |
| .content_security_policies.size()); |
| auto& csp = current_frame_host() |
| ->policy_container_host() |
| ->policies() |
| .content_security_policies[0]; |
| EXPECT_EQ("img-src 'none'", csp->header->header_value); |
| EXPECT_TRUE(csp->directives.find(network::mojom::CSPDirectiveName::ImgSrc) != |
| csp->directives.end()); |
| EXPECT_EQ(0u, csp->directives.at(network::mojom::CSPDirectiveName::ImgSrc) |
| ->sources.size()); |
| } |
| |
| // Regression test for https://crbug.com/1196372. This test passes if the |
| // renderer does not crash. |
| IN_PROC_BROWSER_TEST_F(PolicyContainerHostBrowserTest, |
| PolicyContainerOnClonedDocumentNoCrash) { |
| GURL page = embedded_test_server()->GetURL("a.com", "/empty.html"); |
| GURL img_url = embedded_test_server()->GetURL("a.com", "/blank.jpg"); |
| ASSERT_TRUE(NavigateToURL(shell(), page)); |
| |
| // Create an empty iframe and clone its document. Then execute a javascript |
| // URL inside the iframe. This will create a new ExecutionContext, but with |
| // the same PolicyContainer. However, the clone we created is still around and |
| // still has an ExecutionContext, which has not PolicyContainer anymore. The |
| // following code used to trigger a nullptr dereference, while it should not. |
| ASSERT_TRUE(ExecJs(current_frame_host(), JsReplace(R"( |
| new Promise((resolve, reject) => { |
| let iframe = document.createElement('iframe'); |
| document.body.appendChild(iframe); |
| let d = iframe.contentDocument.cloneNode(true); |
| iframe.src = |
| 'javascript:"<script>top.postMessage(\'ready\',\'*\');</script>"'; |
| function addStyleSheet() { |
| let css = 'html { background: url($1); }'; |
| let style = d.createElement('style'); |
| d.head.appendChild(style); |
| style.type = 'text/css'; |
| style.appendChild(d.createTextNode(css)); |
| }; |
| window.addEventListener('message', e => { |
| if (e.source !== iframe.contentWindow) return; |
| if (e.data !== 'ready') return; |
| addStyleSheet(); |
| resolve(); |
| }); |
| }); |
| )", |
| img_url))); |
| } |
| |
| } // namespace content |
