OLD | NEW |
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. | 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. |
2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
4 | 4 |
5 #include "base/command_line.h" | 5 #include "base/command_line.h" |
6 #include "base/path_service.h" | 6 #include "base/path_service.h" |
7 #include "base/string_util.h" | 7 #include "base/string_util.h" |
8 #include "base/stringprintf.h" | 8 #include "base/stringprintf.h" |
9 #include "base/time.h" | 9 #include "base/time.h" |
10 #include "base/utf_string_conversions.h" | 10 #include "base/utf_string_conversions.h" |
(...skipping 162 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
173 void CheckWorkerLoadResult(WebContents* tab, bool expectLoaded) { | 173 void CheckWorkerLoadResult(WebContents* tab, bool expectLoaded) { |
174 // Workers are async and we don't have notifications for them passing | 174 // Workers are async and we don't have notifications for them passing |
175 // messages since they do it between renderer and worker processes. | 175 // messages since they do it between renderer and worker processes. |
176 // So have a polling loop, check every 200ms, timeout at 30s. | 176 // So have a polling loop, check every 200ms, timeout at 30s. |
177 const int timeout_ms = 200; | 177 const int timeout_ms = 200; |
178 base::Time timeToQuit = base::Time::Now() + | 178 base::Time timeToQuit = base::Time::Now() + |
179 base::TimeDelta::FromMilliseconds(30000); | 179 base::TimeDelta::FromMilliseconds(30000); |
180 | 180 |
181 while (base::Time::Now() < timeToQuit) { | 181 while (base::Time::Now() < timeToQuit) { |
182 bool workerFinished = false; | 182 bool workerFinished = false; |
183 ASSERT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 183 ASSERT_TRUE(content::ExecuteScriptAndExtractBool( |
184 tab->GetRenderViewHost(), | 184 tab, |
185 "", | |
186 "window.domAutomationController.send(IsWorkerFinished());", | 185 "window.domAutomationController.send(IsWorkerFinished());", |
187 &workerFinished)); | 186 &workerFinished)); |
188 | 187 |
189 if (workerFinished) | 188 if (workerFinished) |
190 break; | 189 break; |
191 | 190 |
192 // Wait a bit. | 191 // Wait a bit. |
193 MessageLoop::current()->PostDelayedTask( | 192 MessageLoop::current()->PostDelayedTask( |
194 FROM_HERE, | 193 FROM_HERE, |
195 MessageLoop::QuitClosure(), | 194 MessageLoop::QuitClosure(), |
196 base::TimeDelta::FromMilliseconds(timeout_ms)); | 195 base::TimeDelta::FromMilliseconds(timeout_ms)); |
197 content::RunMessageLoop(); | 196 content::RunMessageLoop(); |
198 } | 197 } |
199 | 198 |
200 bool actuallyLoadedContent = false; | 199 bool actuallyLoadedContent = false; |
201 ASSERT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 200 ASSERT_TRUE(content::ExecuteScriptAndExtractBool( |
202 tab->GetRenderViewHost(), | 201 tab, |
203 "", | |
204 "window.domAutomationController.send(IsContentLoaded());", | 202 "window.domAutomationController.send(IsContentLoaded());", |
205 &actuallyLoadedContent)); | 203 &actuallyLoadedContent)); |
206 EXPECT_EQ(expectLoaded, actuallyLoadedContent); | 204 EXPECT_EQ(expectLoaded, actuallyLoadedContent); |
207 } | 205 } |
208 | 206 |
209 void ProceedThroughInterstitial(WebContents* tab) { | 207 void ProceedThroughInterstitial(WebContents* tab) { |
210 InterstitialPage* interstitial_page = tab->GetInterstitialPage(); | 208 InterstitialPage* interstitial_page = tab->GetInterstitialPage(); |
211 ASSERT_TRUE(interstitial_page); | 209 ASSERT_TRUE(interstitial_page); |
212 content::WindowedNotificationObserver observer( | 210 content::WindowedNotificationObserver observer( |
213 content::NOTIFICATION_LOAD_STOP, | 211 content::NOTIFICATION_LOAD_STOP, |
(...skipping 641 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
855 CheckAuthenticatedState(tab, false); | 853 CheckAuthenticatedState(tab, false); |
856 | 854 |
857 // Because of cross-frame scripting restrictions, we cannot access the iframe | 855 // Because of cross-frame scripting restrictions, we cannot access the iframe |
858 // content. So to know if the frame was loaded, we just check if a popup was | 856 // content. So to know if the frame was loaded, we just check if a popup was |
859 // opened (the iframe content opens one). | 857 // opened (the iframe content opens one). |
860 // Note: because of bug 1115868, no constrained window is opened right now. | 858 // Note: because of bug 1115868, no constrained window is opened right now. |
861 // Once the bug is fixed, this will do the real check. | 859 // Once the bug is fixed, this will do the real check. |
862 EXPECT_EQ(0U, GetConstrainedWindowCount()); | 860 EXPECT_EQ(0U, GetConstrainedWindowCount()); |
863 | 861 |
864 int img_width; | 862 int img_width; |
865 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractInt( | 863 EXPECT_TRUE(content::ExecuteScriptAndExtractInt( |
866 tab->GetRenderViewHost(), | 864 tab, |
867 "", | |
868 "window.domAutomationController.send(ImageWidth());", | 865 "window.domAutomationController.send(ImageWidth());", |
869 &img_width)); | 866 &img_width)); |
870 // In order to check that the image was not loaded, we check its width. | 867 // In order to check that the image was not loaded, we check its width. |
871 // The actual image (Google logo) is 114 pixels wide, we assume the broken | 868 // The actual image (Google logo) is 114 pixels wide, we assume the broken |
872 // image is less than 100. | 869 // image is less than 100. |
873 EXPECT_LT(img_width, 100); | 870 EXPECT_LT(img_width, 100); |
874 | 871 |
875 bool js_result = false; | 872 bool js_result = false; |
876 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 873 EXPECT_TRUE(content::ExecuteScriptAndExtractBool( |
877 tab->GetRenderViewHost(), | 874 tab, |
878 "", | |
879 "window.domAutomationController.send(IsFooSet());", | 875 "window.domAutomationController.send(IsFooSet());", |
880 &js_result)); | 876 &js_result)); |
881 EXPECT_FALSE(js_result); | 877 EXPECT_FALSE(js_result); |
882 } | 878 } |
883 | 879 |
884 // Visits a page with insecure content loaded by JS (after the initial page | 880 // Visits a page with insecure content loaded by JS (after the initial page |
885 // load). | 881 // load). |
886 IN_PROC_BROWSER_TEST_F(SSLUITest, TestDisplaysInsecureContentLoadedFromJS) { | 882 IN_PROC_BROWSER_TEST_F(SSLUITest, TestDisplaysInsecureContentLoadedFromJS) { |
887 ASSERT_TRUE(test_server()->Start()); | 883 ASSERT_TRUE(test_server()->Start()); |
888 ASSERT_TRUE(https_server_.Start()); | 884 ASSERT_TRUE(https_server_.Start()); |
889 | 885 |
890 std::string replacement_path; | 886 std::string replacement_path; |
891 ASSERT_TRUE(GetFilePathWithHostAndPortReplacement( | 887 ASSERT_TRUE(GetFilePathWithHostAndPortReplacement( |
892 "files/ssl/page_with_dynamic_insecure_content.html", | 888 "files/ssl/page_with_dynamic_insecure_content.html", |
893 test_server()->host_port_pair(), | 889 test_server()->host_port_pair(), |
894 &replacement_path)); | 890 &replacement_path)); |
895 ui_test_utils::NavigateToURL(browser(), https_server_.GetURL( | 891 ui_test_utils::NavigateToURL(browser(), https_server_.GetURL( |
896 replacement_path)); | 892 replacement_path)); |
897 | 893 |
898 WebContents* tab = chrome::GetActiveWebContents(browser()); | 894 WebContents* tab = chrome::GetActiveWebContents(browser()); |
899 CheckAuthenticatedState(tab, false); | 895 CheckAuthenticatedState(tab, false); |
900 | 896 |
901 // Load the insecure image. | 897 // Load the insecure image. |
902 bool js_result = false; | 898 bool js_result = false; |
903 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 899 EXPECT_TRUE(content::ExecuteScriptAndExtractBool( |
904 tab->GetRenderViewHost(), | 900 tab, |
905 "", | |
906 "loadBadImage();", | 901 "loadBadImage();", |
907 &js_result)); | 902 &js_result)); |
908 EXPECT_TRUE(js_result); | 903 EXPECT_TRUE(js_result); |
909 | 904 |
910 // We should now have insecure content. | 905 // We should now have insecure content. |
911 CheckAuthenticatedState(tab, true); | 906 CheckAuthenticatedState(tab, true); |
912 } | 907 } |
913 | 908 |
914 // Visits two pages from the same origin: one that displays insecure content and | 909 // Visits two pages from the same origin: one that displays insecure content and |
915 // one that doesn't. The test checks that we do not propagate the insecure | 910 // one that doesn't. The test checks that we do not propagate the insecure |
(...skipping 381 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1297 https_server_.GetURL(top_frame_path)); | 1292 https_server_.GetURL(top_frame_path)); |
1298 | 1293 |
1299 CheckAuthenticatedState(tab, false); | 1294 CheckAuthenticatedState(tab, false); |
1300 | 1295 |
1301 bool success = false; | 1296 bool success = false; |
1302 // Now navigate inside the frame. | 1297 // Now navigate inside the frame. |
1303 { | 1298 { |
1304 content::WindowedNotificationObserver observer( | 1299 content::WindowedNotificationObserver observer( |
1305 content::NOTIFICATION_LOAD_STOP, | 1300 content::NOTIFICATION_LOAD_STOP, |
1306 content::Source<NavigationController>(&tab->GetController())); | 1301 content::Source<NavigationController>(&tab->GetController())); |
1307 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1302 EXPECT_TRUE(content::ExecuteScriptAndExtractBool( |
1308 tab->GetRenderViewHost(), | 1303 tab, |
1309 "", | |
1310 "window.domAutomationController.send(clickLink('goodHTTPSLink'));", | 1304 "window.domAutomationController.send(clickLink('goodHTTPSLink'));", |
1311 &success)); | 1305 &success)); |
1312 ASSERT_TRUE(success); | 1306 ASSERT_TRUE(success); |
1313 observer.Wait(); | 1307 observer.Wait(); |
1314 } | 1308 } |
1315 | 1309 |
1316 // We should still be fine. | 1310 // We should still be fine. |
1317 CheckAuthenticatedState(tab, false); | 1311 CheckAuthenticatedState(tab, false); |
1318 | 1312 |
1319 // Now let's hit a bad page. | 1313 // Now let's hit a bad page. |
1320 { | 1314 { |
1321 content::WindowedNotificationObserver observer( | 1315 content::WindowedNotificationObserver observer( |
1322 content::NOTIFICATION_LOAD_STOP, | 1316 content::NOTIFICATION_LOAD_STOP, |
1323 content::Source<NavigationController>(&tab->GetController())); | 1317 content::Source<NavigationController>(&tab->GetController())); |
1324 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1318 EXPECT_TRUE(content::ExecuteScriptAndExtractBool( |
1325 tab->GetRenderViewHost(), | 1319 tab, |
1326 "", | |
1327 "window.domAutomationController.send(clickLink('badHTTPSLink'));", | 1320 "window.domAutomationController.send(clickLink('badHTTPSLink'));", |
1328 &success)); | 1321 &success)); |
1329 ASSERT_TRUE(success); | 1322 ASSERT_TRUE(success); |
1330 observer.Wait(); | 1323 observer.Wait(); |
1331 } | 1324 } |
1332 | 1325 |
1333 // The security style should still be secure. | 1326 // The security style should still be secure. |
1334 CheckAuthenticatedState(tab, false); | 1327 CheckAuthenticatedState(tab, false); |
1335 | 1328 |
1336 // And the frame should be blocked. | 1329 // And the frame should be blocked. |
1337 bool is_content_evil = true; | 1330 bool is_content_evil = true; |
1338 std::string content_frame_xpath("html/frameset/frame[2]"); | 1331 std::string content_frame_xpath("html/frameset/frame[2]"); |
1339 std::string is_evil_js("window.domAutomationController.send(" | 1332 std::string is_evil_js("window.domAutomationController.send(" |
1340 "document.getElementById('evilDiv') != null);"); | 1333 "document.getElementById('evilDiv') != null);"); |
1341 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1334 EXPECT_TRUE(content::ExecuteScriptInFrameAndExtractBool( |
1342 tab->GetRenderViewHost(), | 1335 tab, |
1343 content_frame_xpath, | 1336 content_frame_xpath, |
1344 is_evil_js, | 1337 is_evil_js, |
1345 &is_content_evil)); | 1338 &is_content_evil)); |
1346 EXPECT_FALSE(is_content_evil); | 1339 EXPECT_FALSE(is_content_evil); |
1347 | 1340 |
1348 // Now go back, our state should still be OK. | 1341 // Now go back, our state should still be OK. |
1349 { | 1342 { |
1350 content::WindowedNotificationObserver observer( | 1343 content::WindowedNotificationObserver observer( |
1351 content::NOTIFICATION_LOAD_STOP, | 1344 content::NOTIFICATION_LOAD_STOP, |
1352 content::Source<NavigationController>(&tab->GetController())); | 1345 content::Source<NavigationController>(&tab->GetController())); |
1353 tab->GetController().GoBack(); | 1346 tab->GetController().GoBack(); |
1354 observer.Wait(); | 1347 observer.Wait(); |
1355 } | 1348 } |
1356 CheckAuthenticatedState(tab, false); | 1349 CheckAuthenticatedState(tab, false); |
1357 | 1350 |
1358 // Navigate to a page served over HTTP. | 1351 // Navigate to a page served over HTTP. |
1359 { | 1352 { |
1360 content::WindowedNotificationObserver observer( | 1353 content::WindowedNotificationObserver observer( |
1361 content::NOTIFICATION_LOAD_STOP, | 1354 content::NOTIFICATION_LOAD_STOP, |
1362 content::Source<NavigationController>(&tab->GetController())); | 1355 content::Source<NavigationController>(&tab->GetController())); |
1363 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1356 EXPECT_TRUE(content::ExecuteScriptAndExtractBool( |
1364 tab->GetRenderViewHost(), | 1357 tab, |
1365 "", | |
1366 "window.domAutomationController.send(clickLink('HTTPLink'));", | 1358 "window.domAutomationController.send(clickLink('HTTPLink'));", |
1367 &success)); | 1359 &success)); |
1368 ASSERT_TRUE(success); | 1360 ASSERT_TRUE(success); |
1369 observer.Wait(); | 1361 observer.Wait(); |
1370 } | 1362 } |
1371 | 1363 |
1372 // Our state should be insecure. | 1364 // Our state should be insecure. |
1373 CheckAuthenticatedState(tab, true); | 1365 CheckAuthenticatedState(tab, true); |
1374 | 1366 |
1375 // Go back, our state should be unchanged. | 1367 // Go back, our state should be unchanged. |
(...skipping 25 matching lines...) Expand all Loading... |
1401 CheckAuthenticationBrokenState(tab, net::CERT_STATUS_DATE_INVALID, false, | 1393 CheckAuthenticationBrokenState(tab, net::CERT_STATUS_DATE_INVALID, false, |
1402 true); // Interstitial showing | 1394 true); // Interstitial showing |
1403 | 1395 |
1404 ProceedThroughInterstitial(tab); | 1396 ProceedThroughInterstitial(tab); |
1405 | 1397 |
1406 // Navigate to a good frame. | 1398 // Navigate to a good frame. |
1407 bool success = false; | 1399 bool success = false; |
1408 content::WindowedNotificationObserver observer( | 1400 content::WindowedNotificationObserver observer( |
1409 content::NOTIFICATION_LOAD_STOP, | 1401 content::NOTIFICATION_LOAD_STOP, |
1410 content::Source<NavigationController>(&tab->GetController())); | 1402 content::Source<NavigationController>(&tab->GetController())); |
1411 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1403 EXPECT_TRUE(content::ExecuteScriptAndExtractBool( |
1412 tab->GetRenderViewHost(), | 1404 tab, |
1413 "", | |
1414 "window.domAutomationController.send(clickLink('goodHTTPSLink'));", | 1405 "window.domAutomationController.send(clickLink('goodHTTPSLink'));", |
1415 &success)); | 1406 &success)); |
1416 ASSERT_TRUE(success); | 1407 ASSERT_TRUE(success); |
1417 observer.Wait(); | 1408 observer.Wait(); |
1418 | 1409 |
1419 // We should still be authentication broken. | 1410 // We should still be authentication broken. |
1420 CheckAuthenticationBrokenState(tab, net::CERT_STATUS_DATE_INVALID, false, | 1411 CheckAuthenticationBrokenState(tab, net::CERT_STATUS_DATE_INVALID, false, |
1421 false); | 1412 false); |
1422 } | 1413 } |
1423 | 1414 |
(...skipping 15 matching lines...) Expand all Loading... |
1439 ui_test_utils::NavigateToURL(browser(), | 1430 ui_test_utils::NavigateToURL(browser(), |
1440 test_server()->GetURL(top_frame_path)); | 1431 test_server()->GetURL(top_frame_path)); |
1441 CheckUnauthenticatedState(tab); | 1432 CheckUnauthenticatedState(tab); |
1442 | 1433 |
1443 // Now navigate inside the frame to a secure HTTPS frame. | 1434 // Now navigate inside the frame to a secure HTTPS frame. |
1444 { | 1435 { |
1445 bool success = false; | 1436 bool success = false; |
1446 content::WindowedNotificationObserver observer( | 1437 content::WindowedNotificationObserver observer( |
1447 content::NOTIFICATION_LOAD_STOP, | 1438 content::NOTIFICATION_LOAD_STOP, |
1448 content::Source<NavigationController>(&tab->GetController())); | 1439 content::Source<NavigationController>(&tab->GetController())); |
1449 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1440 EXPECT_TRUE(content::ExecuteScriptAndExtractBool( |
1450 tab->GetRenderViewHost(), | 1441 tab, |
1451 "", | |
1452 "window.domAutomationController.send(clickLink('goodHTTPSLink'));", | 1442 "window.domAutomationController.send(clickLink('goodHTTPSLink'));", |
1453 &success)); | 1443 &success)); |
1454 ASSERT_TRUE(success); | 1444 ASSERT_TRUE(success); |
1455 observer.Wait(); | 1445 observer.Wait(); |
1456 } | 1446 } |
1457 | 1447 |
1458 // We should still be unauthenticated. | 1448 // We should still be unauthenticated. |
1459 CheckUnauthenticatedState(tab); | 1449 CheckUnauthenticatedState(tab); |
1460 | 1450 |
1461 // Now navigate to a bad HTTPS frame. | 1451 // Now navigate to a bad HTTPS frame. |
1462 { | 1452 { |
1463 bool success = false; | 1453 bool success = false; |
1464 content::WindowedNotificationObserver observer( | 1454 content::WindowedNotificationObserver observer( |
1465 content::NOTIFICATION_LOAD_STOP, | 1455 content::NOTIFICATION_LOAD_STOP, |
1466 content::Source<NavigationController>(&tab->GetController())); | 1456 content::Source<NavigationController>(&tab->GetController())); |
1467 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1457 EXPECT_TRUE(content::ExecuteScriptAndExtractBool( |
1468 tab->GetRenderViewHost(), | 1458 tab, |
1469 "", | |
1470 "window.domAutomationController.send(clickLink('badHTTPSLink'));", | 1459 "window.domAutomationController.send(clickLink('badHTTPSLink'));", |
1471 &success)); | 1460 &success)); |
1472 ASSERT_TRUE(success); | 1461 ASSERT_TRUE(success); |
1473 observer.Wait(); | 1462 observer.Wait(); |
1474 } | 1463 } |
1475 | 1464 |
1476 // State should not have changed. | 1465 // State should not have changed. |
1477 CheckUnauthenticatedState(tab); | 1466 CheckUnauthenticatedState(tab); |
1478 | 1467 |
1479 // And the frame should have been blocked (see bug #2316). | 1468 // And the frame should have been blocked (see bug #2316). |
1480 bool is_content_evil = true; | 1469 bool is_content_evil = true; |
1481 std::string content_frame_xpath("html/frameset/frame[2]"); | 1470 std::string content_frame_xpath("html/frameset/frame[2]"); |
1482 std::string is_evil_js("window.domAutomationController.send(" | 1471 std::string is_evil_js("window.domAutomationController.send(" |
1483 "document.getElementById('evilDiv') != null);"); | 1472 "document.getElementById('evilDiv') != null);"); |
1484 EXPECT_TRUE(content::ExecuteJavaScriptAndExtractBool( | 1473 EXPECT_TRUE(content::ExecuteScriptInFrameAndExtractBool( |
1485 tab->GetRenderViewHost(), | 1474 tab, |
1486 content_frame_xpath, | 1475 content_frame_xpath, |
1487 is_evil_js, | 1476 is_evil_js, |
1488 &is_content_evil)); | 1477 &is_content_evil)); |
1489 EXPECT_FALSE(is_content_evil); | 1478 EXPECT_FALSE(is_content_evil); |
1490 } | 1479 } |
1491 | 1480 |
1492 IN_PROC_BROWSER_TEST_F(SSLUITest, TestUnsafeContentsInWorkerFiltered) { | 1481 IN_PROC_BROWSER_TEST_F(SSLUITest, TestUnsafeContentsInWorkerFiltered) { |
1493 ASSERT_TRUE(https_server_.Start()); | 1482 ASSERT_TRUE(https_server_.Start()); |
1494 ASSERT_TRUE(https_server_expired_.Start()); | 1483 ASSERT_TRUE(https_server_expired_.Start()); |
1495 | 1484 |
(...skipping 129 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... |
1625 | 1614 |
1626 // Visit a page over https that contains a frame with a redirect. | 1615 // Visit a page over https that contains a frame with a redirect. |
1627 | 1616 |
1628 // XMLHttpRequest insecure content in synchronous mode. | 1617 // XMLHttpRequest insecure content in synchronous mode. |
1629 | 1618 |
1630 // XMLHttpRequest insecure content in asynchronous mode. | 1619 // XMLHttpRequest insecure content in asynchronous mode. |
1631 | 1620 |
1632 // XMLHttpRequest over bad ssl in synchronous mode. | 1621 // XMLHttpRequest over bad ssl in synchronous mode. |
1633 | 1622 |
1634 // XMLHttpRequest over OK ssl in synchronous mode. | 1623 // XMLHttpRequest over OK ssl in synchronous mode. |
OLD | NEW |