OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "base/command_line.h" | 5 #include "base/command_line.h" |
6 #include "base/path_service.h" | 6 #include "base/path_service.h" |
7 #include "base/string_util.h" | 7 #include "base/string_util.h" |
8 #include "base/stringprintf.h" | 8 #include "base/stringprintf.h" |
9 #include "base/time.h" | 9 #include "base/time.h" |
10 #include "base/utf_string_conversions.h" | 10 #include "base/utf_string_conversions.h" |
(...skipping 163 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
174 // Workers are async and we don't have notifications for them passing | 174 // Workers are async and we don't have notifications for them passing |
175 // messages since they do it between renderer and worker processes. | 175 // messages since they do it between renderer and worker processes. |
176 // So have a polling loop, check every 200ms, timeout at 30s. | 176 // So have a polling loop, check every 200ms, timeout at 30s. |
177 const int timeout_ms = 200; | 177 const int timeout_ms = 200; |
178 base::Time timeToQuit = base::Time::Now() + | 178 base::Time timeToQuit = base::Time::Now() + |
179 base::TimeDelta::FromMilliseconds(30000); | 179 base::TimeDelta::FromMilliseconds(30000); |
180 | 180 |
181 while (base::Time::Now() < timeToQuit) { | 181 while (base::Time::Now() < timeToQuit) { |
182 bool workerFinished = false; | 182 bool workerFinished = false; |
183 ASSERT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 183 ASSERT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
184 tab->GetRenderViewHost(), std::wstring(), | 184 tab->GetRenderViewHost(), |
185 L"window.domAutomationController.send(IsWorkerFinished());", | 185 "", |
| 186 "window.domAutomationController.send(IsWorkerFinished());", |
186 &workerFinished)); | 187 &workerFinished)); |
187 | 188 |
188 if (workerFinished) | 189 if (workerFinished) |
189 break; | 190 break; |
190 | 191 |
191 // Wait a bit. | 192 // Wait a bit. |
192 MessageLoop::current()->PostDelayedTask( | 193 MessageLoop::current()->PostDelayedTask( |
193 FROM_HERE, | 194 FROM_HERE, |
194 MessageLoop::QuitClosure(), | 195 MessageLoop::QuitClosure(), |
195 base::TimeDelta::FromMilliseconds(timeout_ms)); | 196 base::TimeDelta::FromMilliseconds(timeout_ms)); |
196 content::RunMessageLoop(); | 197 content::RunMessageLoop(); |
197 } | 198 } |
198 | 199 |
199 bool actuallyLoadedContent = false; | 200 bool actuallyLoadedContent = false; |
200 ASSERT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 201 ASSERT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
201 tab->GetRenderViewHost(), std::wstring(), | 202 tab->GetRenderViewHost(), |
202 L"window.domAutomationController.send(IsContentLoaded());", | 203 "", |
| 204 "window.domAutomationController.send(IsContentLoaded());", |
203 &actuallyLoadedContent)); | 205 &actuallyLoadedContent)); |
204 EXPECT_EQ(expectLoaded, actuallyLoadedContent); | 206 EXPECT_EQ(expectLoaded, actuallyLoadedContent); |
205 } | 207 } |
206 | 208 |
207 void ProceedThroughInterstitial(WebContents* tab) { | 209 void ProceedThroughInterstitial(WebContents* tab) { |
208 InterstitialPage* interstitial_page = tab->GetInterstitialPage(); | 210 InterstitialPage* interstitial_page = tab->GetInterstitialPage(); |
209 ASSERT_TRUE(interstitial_page); | 211 ASSERT_TRUE(interstitial_page); |
210 content::WindowedNotificationObserver observer( | 212 content::WindowedNotificationObserver observer( |
211 content::NOTIFICATION_LOAD_STOP, | 213 content::NOTIFICATION_LOAD_STOP, |
212 content::Source<NavigationController>(&tab->GetController())); | 214 content::Source<NavigationController>(&tab->GetController())); |
(...skipping 641 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
854 | 856 |
855 // Because of cross-frame scripting restrictions, we cannot access the iframe | 857 // Because of cross-frame scripting restrictions, we cannot access the iframe |
856 // content. So to know if the frame was loaded, we just check if a popup was | 858 // content. So to know if the frame was loaded, we just check if a popup was |
857 // opened (the iframe content opens one). | 859 // opened (the iframe content opens one). |
858 // Note: because of bug 1115868, no constrained window is opened right now. | 860 // Note: because of bug 1115868, no constrained window is opened right now. |
859 // Once the bug is fixed, this will do the real check. | 861 // Once the bug is fixed, this will do the real check. |
860 EXPECT_EQ(0U, GetConstrainedWindowCount()); | 862 EXPECT_EQ(0U, GetConstrainedWindowCount()); |
861 | 863 |
862 int img_width; | 864 int img_width; |
863 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractInt( | 865 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractInt( |
864 tab->GetRenderViewHost(), std::wstring(), | 866 tab->GetRenderViewHost(), |
865 L"window.domAutomationController.send(ImageWidth());", &img_width)); | 867 "", |
| 868 "window.domAutomationController.send(ImageWidth());", |
| 869 &img_width)); |
866 // In order to check that the image was not loaded, we check its width. | 870 // In order to check that the image was not loaded, we check its width. |
867 // The actual image (Google logo) is 114 pixels wide, we assume the broken | 871 // The actual image (Google logo) is 114 pixels wide, we assume the broken |
868 // image is less than 100. | 872 // image is less than 100. |
869 EXPECT_LT(img_width, 100); | 873 EXPECT_LT(img_width, 100); |
870 | 874 |
871 bool js_result = false; | 875 bool js_result = false; |
872 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 876 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
873 tab->GetRenderViewHost(), std::wstring(), | 877 tab->GetRenderViewHost(), |
874 L"window.domAutomationController.send(IsFooSet());", &js_result)); | 878 "", |
| 879 "window.domAutomationController.send(IsFooSet());", |
| 880 &js_result)); |
875 EXPECT_FALSE(js_result); | 881 EXPECT_FALSE(js_result); |
876 } | 882 } |
877 | 883 |
878 // Visits a page with insecure content loaded by JS (after the initial page | 884 // Visits a page with insecure content loaded by JS (after the initial page |
879 // load). | 885 // load). |
880 IN_PROC_BROWSER_TEST_F(SSLUITest, TestDisplaysInsecureContentLoadedFromJS) { | 886 IN_PROC_BROWSER_TEST_F(SSLUITest, TestDisplaysInsecureContentLoadedFromJS) { |
881 ASSERT_TRUE(test_server()->Start()); | 887 ASSERT_TRUE(test_server()->Start()); |
882 ASSERT_TRUE(https_server_.Start()); | 888 ASSERT_TRUE(https_server_.Start()); |
883 | 889 |
884 std::string replacement_path; | 890 std::string replacement_path; |
885 ASSERT_TRUE(GetFilePathWithHostAndPortReplacement( | 891 ASSERT_TRUE(GetFilePathWithHostAndPortReplacement( |
886 "files/ssl/page_with_dynamic_insecure_content.html", | 892 "files/ssl/page_with_dynamic_insecure_content.html", |
887 test_server()->host_port_pair(), | 893 test_server()->host_port_pair(), |
888 &replacement_path)); | 894 &replacement_path)); |
889 ui_test_utils::NavigateToURL(browser(), https_server_.GetURL( | 895 ui_test_utils::NavigateToURL(browser(), https_server_.GetURL( |
890 replacement_path)); | 896 replacement_path)); |
891 | 897 |
892 WebContents* tab = chrome::GetActiveWebContents(browser()); | 898 WebContents* tab = chrome::GetActiveWebContents(browser()); |
893 CheckAuthenticatedState(tab, false); | 899 CheckAuthenticatedState(tab, false); |
894 | 900 |
895 // Load the insecure image. | 901 // Load the insecure image. |
896 bool js_result = false; | 902 bool js_result = false; |
897 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 903 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
898 tab->GetRenderViewHost(), std::wstring(), L"loadBadImage();", | 904 tab->GetRenderViewHost(), |
| 905 "", |
| 906 "loadBadImage();", |
899 &js_result)); | 907 &js_result)); |
900 EXPECT_TRUE(js_result); | 908 EXPECT_TRUE(js_result); |
901 | 909 |
902 // We should now have insecure content. | 910 // We should now have insecure content. |
903 CheckAuthenticatedState(tab, true); | 911 CheckAuthenticatedState(tab, true); |
904 } | 912 } |
905 | 913 |
906 // Visits two pages from the same origin: one that displays insecure content and | 914 // Visits two pages from the same origin: one that displays insecure content and |
907 // one that doesn't. The test checks that we do not propagate the insecure | 915 // one that doesn't. The test checks that we do not propagate the insecure |
908 // content state from one to the other. | 916 // content state from one to the other. |
(...skipping 381 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1290 | 1298 |
1291 CheckAuthenticatedState(tab, false); | 1299 CheckAuthenticatedState(tab, false); |
1292 | 1300 |
1293 bool success = false; | 1301 bool success = false; |
1294 // Now navigate inside the frame. | 1302 // Now navigate inside the frame. |
1295 { | 1303 { |
1296 content::WindowedNotificationObserver observer( | 1304 content::WindowedNotificationObserver observer( |
1297 content::NOTIFICATION_LOAD_STOP, | 1305 content::NOTIFICATION_LOAD_STOP, |
1298 content::Source<NavigationController>(&tab->GetController())); | 1306 content::Source<NavigationController>(&tab->GetController())); |
1299 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1307 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
1300 tab->GetRenderViewHost(), std::wstring(), | 1308 tab->GetRenderViewHost(), |
1301 L"window.domAutomationController.send(clickLink('goodHTTPSLink'));", | 1309 "", |
| 1310 "window.domAutomationController.send(clickLink('goodHTTPSLink'));", |
1302 &success)); | 1311 &success)); |
1303 ASSERT_TRUE(success); | 1312 ASSERT_TRUE(success); |
1304 observer.Wait(); | 1313 observer.Wait(); |
1305 } | 1314 } |
1306 | 1315 |
1307 // We should still be fine. | 1316 // We should still be fine. |
1308 CheckAuthenticatedState(tab, false); | 1317 CheckAuthenticatedState(tab, false); |
1309 | 1318 |
1310 // Now let's hit a bad page. | 1319 // Now let's hit a bad page. |
1311 { | 1320 { |
1312 content::WindowedNotificationObserver observer( | 1321 content::WindowedNotificationObserver observer( |
1313 content::NOTIFICATION_LOAD_STOP, | 1322 content::NOTIFICATION_LOAD_STOP, |
1314 content::Source<NavigationController>(&tab->GetController())); | 1323 content::Source<NavigationController>(&tab->GetController())); |
1315 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1324 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
1316 tab->GetRenderViewHost(), std::wstring(), | 1325 tab->GetRenderViewHost(), |
1317 L"window.domAutomationController.send(clickLink('badHTTPSLink'));", | 1326 "", |
| 1327 "window.domAutomationController.send(clickLink('badHTTPSLink'));", |
1318 &success)); | 1328 &success)); |
1319 ASSERT_TRUE(success); | 1329 ASSERT_TRUE(success); |
1320 observer.Wait(); | 1330 observer.Wait(); |
1321 } | 1331 } |
1322 | 1332 |
1323 // The security style should still be secure. | 1333 // The security style should still be secure. |
1324 CheckAuthenticatedState(tab, false); | 1334 CheckAuthenticatedState(tab, false); |
1325 | 1335 |
1326 // And the frame should be blocked. | 1336 // And the frame should be blocked. |
1327 bool is_content_evil = true; | 1337 bool is_content_evil = true; |
1328 std::wstring content_frame_xpath(L"html/frameset/frame[2]"); | 1338 std::string content_frame_xpath("html/frameset/frame[2]"); |
1329 std::wstring is_evil_js(L"window.domAutomationController.send(" | 1339 std::string is_evil_js("window.domAutomationController.send(" |
1330 L"document.getElementById('evilDiv') != null);"); | 1340 "document.getElementById('evilDiv') != null);"); |
1331 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1341 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
1332 tab->GetRenderViewHost(), content_frame_xpath, is_evil_js, | 1342 tab->GetRenderViewHost(), |
| 1343 content_frame_xpath, |
| 1344 is_evil_js, |
1333 &is_content_evil)); | 1345 &is_content_evil)); |
1334 EXPECT_FALSE(is_content_evil); | 1346 EXPECT_FALSE(is_content_evil); |
1335 | 1347 |
1336 // Now go back, our state should still be OK. | 1348 // Now go back, our state should still be OK. |
1337 { | 1349 { |
1338 content::WindowedNotificationObserver observer( | 1350 content::WindowedNotificationObserver observer( |
1339 content::NOTIFICATION_LOAD_STOP, | 1351 content::NOTIFICATION_LOAD_STOP, |
1340 content::Source<NavigationController>(&tab->GetController())); | 1352 content::Source<NavigationController>(&tab->GetController())); |
1341 tab->GetController().GoBack(); | 1353 tab->GetController().GoBack(); |
1342 observer.Wait(); | 1354 observer.Wait(); |
1343 } | 1355 } |
1344 CheckAuthenticatedState(tab, false); | 1356 CheckAuthenticatedState(tab, false); |
1345 | 1357 |
1346 // Navigate to a page served over HTTP. | 1358 // Navigate to a page served over HTTP. |
1347 { | 1359 { |
1348 content::WindowedNotificationObserver observer( | 1360 content::WindowedNotificationObserver observer( |
1349 content::NOTIFICATION_LOAD_STOP, | 1361 content::NOTIFICATION_LOAD_STOP, |
1350 content::Source<NavigationController>(&tab->GetController())); | 1362 content::Source<NavigationController>(&tab->GetController())); |
1351 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1363 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
1352 tab->GetRenderViewHost(), std::wstring(), | 1364 tab->GetRenderViewHost(), |
1353 L"window.domAutomationController.send(clickLink('HTTPLink'));", | 1365 "", |
| 1366 "window.domAutomationController.send(clickLink('HTTPLink'));", |
1354 &success)); | 1367 &success)); |
1355 ASSERT_TRUE(success); | 1368 ASSERT_TRUE(success); |
1356 observer.Wait(); | 1369 observer.Wait(); |
1357 } | 1370 } |
1358 | 1371 |
1359 // Our state should be insecure. | 1372 // Our state should be insecure. |
1360 CheckAuthenticatedState(tab, true); | 1373 CheckAuthenticatedState(tab, true); |
1361 | 1374 |
1362 // Go back, our state should be unchanged. | 1375 // Go back, our state should be unchanged. |
1363 { | 1376 { |
(...skipping 25 matching lines...) Expand all Loading... |
1389 true); // Interstitial showing | 1402 true); // Interstitial showing |
1390 | 1403 |
1391 ProceedThroughInterstitial(tab); | 1404 ProceedThroughInterstitial(tab); |
1392 | 1405 |
1393 // Navigate to a good frame. | 1406 // Navigate to a good frame. |
1394 bool success = false; | 1407 bool success = false; |
1395 content::WindowedNotificationObserver observer( | 1408 content::WindowedNotificationObserver observer( |
1396 content::NOTIFICATION_LOAD_STOP, | 1409 content::NOTIFICATION_LOAD_STOP, |
1397 content::Source<NavigationController>(&tab->GetController())); | 1410 content::Source<NavigationController>(&tab->GetController())); |
1398 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1411 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
1399 tab->GetRenderViewHost(), std::wstring(), | 1412 tab->GetRenderViewHost(), |
1400 L"window.domAutomationController.send(clickLink('goodHTTPSLink'));", | 1413 "", |
| 1414 "window.domAutomationController.send(clickLink('goodHTTPSLink'));", |
1401 &success)); | 1415 &success)); |
1402 ASSERT_TRUE(success); | 1416 ASSERT_TRUE(success); |
1403 observer.Wait(); | 1417 observer.Wait(); |
1404 | 1418 |
1405 // We should still be authentication broken. | 1419 // We should still be authentication broken. |
1406 CheckAuthenticationBrokenState(tab, net::CERT_STATUS_DATE_INVALID, false, | 1420 CheckAuthenticationBrokenState(tab, net::CERT_STATUS_DATE_INVALID, false, |
1407 false); | 1421 false); |
1408 } | 1422 } |
1409 | 1423 |
1410 // From an HTTP top frame, navigate to good and bad HTTPS (security state should | 1424 // From an HTTP top frame, navigate to good and bad HTTPS (security state should |
(...skipping 15 matching lines...) Expand all Loading... |
1426 test_server()->GetURL(top_frame_path)); | 1440 test_server()->GetURL(top_frame_path)); |
1427 CheckUnauthenticatedState(tab); | 1441 CheckUnauthenticatedState(tab); |
1428 | 1442 |
1429 // Now navigate inside the frame to a secure HTTPS frame. | 1443 // Now navigate inside the frame to a secure HTTPS frame. |
1430 { | 1444 { |
1431 bool success = false; | 1445 bool success = false; |
1432 content::WindowedNotificationObserver observer( | 1446 content::WindowedNotificationObserver observer( |
1433 content::NOTIFICATION_LOAD_STOP, | 1447 content::NOTIFICATION_LOAD_STOP, |
1434 content::Source<NavigationController>(&tab->GetController())); | 1448 content::Source<NavigationController>(&tab->GetController())); |
1435 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1449 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
1436 tab->GetRenderViewHost(), std::wstring(), | 1450 tab->GetRenderViewHost(), |
1437 L"window.domAutomationController.send(clickLink('goodHTTPSLink'));", | 1451 "", |
| 1452 "window.domAutomationController.send(clickLink('goodHTTPSLink'));", |
1438 &success)); | 1453 &success)); |
1439 ASSERT_TRUE(success); | 1454 ASSERT_TRUE(success); |
1440 observer.Wait(); | 1455 observer.Wait(); |
1441 } | 1456 } |
1442 | 1457 |
1443 // We should still be unauthenticated. | 1458 // We should still be unauthenticated. |
1444 CheckUnauthenticatedState(tab); | 1459 CheckUnauthenticatedState(tab); |
1445 | 1460 |
1446 // Now navigate to a bad HTTPS frame. | 1461 // Now navigate to a bad HTTPS frame. |
1447 { | 1462 { |
1448 bool success = false; | 1463 bool success = false; |
1449 content::WindowedNotificationObserver observer( | 1464 content::WindowedNotificationObserver observer( |
1450 content::NOTIFICATION_LOAD_STOP, | 1465 content::NOTIFICATION_LOAD_STOP, |
1451 content::Source<NavigationController>(&tab->GetController())); | 1466 content::Source<NavigationController>(&tab->GetController())); |
1452 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1467 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
1453 tab->GetRenderViewHost(), std::wstring(), | 1468 tab->GetRenderViewHost(), |
1454 L"window.domAutomationController.send(clickLink('badHTTPSLink'));", | 1469 "", |
| 1470 "window.domAutomationController.send(clickLink('badHTTPSLink'));", |
1455 &success)); | 1471 &success)); |
1456 ASSERT_TRUE(success); | 1472 ASSERT_TRUE(success); |
1457 observer.Wait(); | 1473 observer.Wait(); |
1458 } | 1474 } |
1459 | 1475 |
1460 // State should not have changed. | 1476 // State should not have changed. |
1461 CheckUnauthenticatedState(tab); | 1477 CheckUnauthenticatedState(tab); |
1462 | 1478 |
1463 // And the frame should have been blocked (see bug #2316). | 1479 // And the frame should have been blocked (see bug #2316). |
1464 bool is_content_evil = true; | 1480 bool is_content_evil = true; |
1465 std::wstring content_frame_xpath(L"html/frameset/frame[2]"); | 1481 std::string content_frame_xpath("html/frameset/frame[2]"); |
1466 std::wstring is_evil_js(L"window.domAutomationController.send(" | 1482 std::string is_evil_js("window.domAutomationController.send(" |
1467 L"document.getElementById('evilDiv') != null);"); | 1483 "document.getElementById('evilDiv') != null);"); |
1468 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1484 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( |
1469 tab->GetRenderViewHost(), content_frame_xpath, is_evil_js, | 1485 tab->GetRenderViewHost(), |
| 1486 content_frame_xpath, |
| 1487 is_evil_js, |
1470 &is_content_evil)); | 1488 &is_content_evil)); |
1471 EXPECT_FALSE(is_content_evil); | 1489 EXPECT_FALSE(is_content_evil); |
1472 } | 1490 } |
1473 | 1491 |
1474 IN_PROC_BROWSER_TEST_F(SSLUITest, TestUnsafeContentsInWorkerFiltered) { | 1492 IN_PROC_BROWSER_TEST_F(SSLUITest, TestUnsafeContentsInWorkerFiltered) { |
1475 ASSERT_TRUE(https_server_.Start()); | 1493 ASSERT_TRUE(https_server_.Start()); |
1476 ASSERT_TRUE(https_server_expired_.Start()); | 1494 ASSERT_TRUE(https_server_expired_.Start()); |
1477 | 1495 |
1478 // This page will spawn a Worker which will try to load content from | 1496 // This page will spawn a Worker which will try to load content from |
1479 // BadCertServer. | 1497 // BadCertServer. |
(...skipping 127 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1607 | 1625 |
1608 // Visit a page over https that contains a frame with a redirect. | 1626 // Visit a page over https that contains a frame with a redirect. |
1609 | 1627 |
1610 // XMLHttpRequest insecure content in synchronous mode. | 1628 // XMLHttpRequest insecure content in synchronous mode. |
1611 | 1629 |
1612 // XMLHttpRequest insecure content in asynchronous mode. | 1630 // XMLHttpRequest insecure content in asynchronous mode. |
1613 | 1631 |
1614 // XMLHttpRequest over bad ssl in synchronous mode. | 1632 // XMLHttpRequest over bad ssl in synchronous mode. |
1615 | 1633 |
1616 // XMLHttpRequest over OK ssl in synchronous mode. | 1634 // XMLHttpRequest over OK ssl in synchronous mode. |
OLD | NEW |