In extension messaging, use the sender frame's URL as the sender URL rather

chrome/browser/extensions/extension_messages_apitest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/files/file_path.h"
 #include "base/path_service.h"
 #include "base/strings/string_number_conversions.h"
 #include "base/strings/stringprintf.h"
 #include "base/values.h"
 #include "chrome/browser/chrome_notification_types.h"
@@ skipping 124 matching lines @@
   enum Result {
     OK = 0,
     NAMESPACE_NOT_DEFINED = 1,
     FUNCTION_NOT_DEFINED = 2,
     COULD_NOT_ESTABLISH_CONNECTION_ERROR = 3,
     OTHER_ERROR = 4,
     INCORRECT_RESPONSE_SENDER = 5,
     INCORRECT_RESPONSE_MESSAGE = 6,
   };
 
+  bool AppendIframe(const GURL& src) {
+    bool result;
+    CHECK(content::ExecuteScriptAndExtractBool(
+        browser()->tab_strip_model()->GetActiveWebContents(),
+        "actions.appendIframe('" + src.spec() + "');", &result));
+    return result;
+  }
+
   Result CanConnectAndSendMessages(const std::string& extension_id) {
-    return CanConnectAndSendMessages(browser(), extension_id);
+    return CanConnectAndSendMessages(browser(), extension_id, "");
   }
 
   Result CanConnectAndSendMessages(Browser* browser,
                                    const std::string& extension_id) {
+    return CanConnectAndSendMessages(browser, extension_id, "");
+  }
+
+  Result CanConnectAndSendMessages(const std::string& extension_id,
+                                   const char* frame_xpath) {
+    return CanConnectAndSendMessages(browser(), extension_id, frame_xpath);
+  }
+
+  Result CanConnectAndSendMessages(Browser* browser,
+                                   const std::string& extension_id,
+                                   const char* frame_xpath) {
     int result;
-    CHECK(content::ExecuteScriptAndExtractInt(
+    CHECK(content::ExecuteScriptInFrameAndExtractInt(
         browser->tab_strip_model()->GetActiveWebContents(),
+        frame_xpath,
         "assertions.canConnectAndSendMessages('" + extension_id + "')",
         &result));
     return static_cast<Result>(result);
   }
 
   testing::AssertionResult AreAnyNonWebApisDefined() {
+    return AreAnyNonWebApisDefined("");
+  }
+
+  testing::AssertionResult AreAnyNonWebApisDefined(const char* frame_xpath) {
     // All runtime API methods are non-web except for sendRequest and connect.
     const char* non_messaging_apis[] = {
         "getBackgroundPage",
         "getManifest",
         "getURL",
         "reload",
         "requestUpdateCheck",
         "connectNative",
         "sendNativeMessage",
         "onStartup",
@@ skipping 12 matching lines @@
 
     // Turn the array into a JS array, which effectively gets eval()ed.
     std::string as_js_array;
     for (size_t i = 0; i < arraysize(non_messaging_apis); ++i) {
       as_js_array += as_js_array.empty() ? "[" : ",";
       as_js_array += base::StringPrintf("'%s'", non_messaging_apis[i]);
     }
     as_js_array += "]";
 
     bool any_defined;
-    CHECK(content::ExecuteScriptAndExtractBool(
+    CHECK(content::ExecuteScriptInFrameAndExtractBool(
         browser()->tab_strip_model()->GetActiveWebContents(),
+        frame_xpath,
         "assertions.areAnyRuntimePropertiesDefined(" + as_js_array + ")",
         &any_defined));
     return any_defined ?
         testing::AssertionSuccess() : testing::AssertionFailure();
   }
 
   GURL GetURLForPath(const std::string& host, const std::string& path) {
     std::string port = base::IntToString(embedded_test_server()->port());
     GURL::Replacements replacements;
     replacements.SetHostStr(host);
     replacements.SetPortStr(port);
     return embedded_test_server()->GetURL(path).ReplaceComponents(replacements);
   }
 
   GURL chromium_org_url() {
     return GetURLForPath("www.chromium.org", "/chromium.org.html");
   }
 
   GURL google_com_url() {
     return GetURLForPath("www.google.com", "/google.com.html");
   }
 
   const Extension* LoadChromiumConnectableExtension() {
-    return LoadExtensionIntoDir(&web_connectable_dir_, base::StringPrintf(
-        "{"
-        "  \"name\": \"chromium_connectable\","
-        "  %s,"
-        "  \"externally_connectable\": {"
-        "    \"matches\": [\"*://*.chromium.org:*/*\"]"
-        "  }"
-        "}",
-        common_manifest()));
+    const Extension* extension =
+        LoadExtensionIntoDir(&web_connectable_dir_, base::StringPrintf(
+            "{"
+            "  \"name\": \"chromium_connectable\","
+            "  %s,"
+            "  \"externally_connectable\": {"
+            "    \"matches\": [\"*://*.chromium.org:*/*\"]"
+            "  }"
+            "}",
+            common_manifest()));
+    CHECK(extension);
+    return extension;
   }
 
-  scoped_refptr<const Extension> LoadNotConnectableExtension() {
-    return LoadExtensionIntoDir(&not_connectable_dir_, base::StringPrintf(
-        "{"
-        "  \"name\": \"not_connectable\","
-        "  %s"
-        "}",
-        common_manifest()));
+  const Extension* LoadNotConnectableExtension() {
+    const Extension* extension =
+        LoadExtensionIntoDir(&not_connectable_dir_, base::StringPrintf(
+            "{"
+            "  \"name\": \"not_connectable\","
+            "  %s"
+            "}",
+            common_manifest()));
+    CHECK(extension);
+    return extension;
   }
 
   void InitializeTestServer() {
     base::FilePath test_data;
     EXPECT_TRUE(PathService::Get(chrome::DIR_TEST_DATA, &test_data));
     embedded_test_server()->ServeFilesFromDirectory(test_data.AppendASCII(
         "extensions/api_test/messaging/externally_connectable/sites"));
     ASSERT_TRUE(embedded_test_server()->InitializeAndWaitUntilReady());
     host_resolver()->AddRule("*", embedded_test_server()->base_url().host());
   }
@@ skipping 43 matching lines @@
 }
 
 // Tests two extensions on the same sites: one web connectable, one not.
 IN_PROC_BROWSER_TEST_F(ExternallyConnectableMessagingTest,
                        WebConnectableAndNotConnectable) {
   InitializeTestServer();
 
   // Install the web connectable extension. chromium.org can connect to it,
   // google.com can't.
   const Extension* chromium_connectable = LoadChromiumConnectableExtension();
-  ASSERT_TRUE(chromium_connectable);
 
   ui_test_utils::NavigateToURL(browser(), chromium_org_url());
   EXPECT_EQ(OK, CanConnectAndSendMessages(chromium_connectable->id()));
   EXPECT_FALSE(AreAnyNonWebApisDefined());
 
   ui_test_utils::NavigateToURL(browser(), google_com_url());
   EXPECT_EQ(NAMESPACE_NOT_DEFINED,
             CanConnectAndSendMessages(chromium_connectable->id()));
   EXPECT_FALSE(AreAnyNonWebApisDefined());
 
   // Install the non-connectable extension. Nothing can connect to it.
   const Extension* not_connectable = LoadNotConnectableExtension();
-  ASSERT_TRUE(not_connectable);
 
   ui_test_utils::NavigateToURL(browser(), chromium_org_url());
   // Namespace will be defined here because |chromium_connectable| can connect
   // to it - so this will be the "cannot establish connection" error.
   EXPECT_EQ(COULD_NOT_ESTABLISH_CONNECTION_ERROR,
             CanConnectAndSendMessages(not_connectable->id()));
   EXPECT_FALSE(AreAnyNonWebApisDefined());
 
   ui_test_utils::NavigateToURL(browser(), google_com_url());
   EXPECT_EQ(NAMESPACE_NOT_DEFINED,
             CanConnectAndSendMessages(not_connectable->id()));
   EXPECT_FALSE(AreAnyNonWebApisDefined());
 }
 
 // Tests that enabling and disabling an extension makes the runtime bindings
 // appear and disappear.
 //
 // TODO(kalman): Test with multiple extensions that can be accessed by the same
 // host.
 IN_PROC_BROWSER_TEST_F(ExternallyConnectableMessagingTest,
                        EnablingAndDisabling) {
   InitializeTestServer();
 
   const Extension* chromium_connectable = LoadChromiumConnectableExtension();
-  ASSERT_TRUE(chromium_connectable);
   const Extension* not_connectable = LoadNotConnectableExtension();
-  ASSERT_TRUE(not_connectable);
 
   ui_test_utils::NavigateToURL(browser(), chromium_org_url());
   EXPECT_EQ(OK, CanConnectAndSendMessages(chromium_connectable->id()));
   EXPECT_EQ(COULD_NOT_ESTABLISH_CONNECTION_ERROR,
             CanConnectAndSendMessages(not_connectable->id()));
 
   DisableExtension(chromium_connectable->id());
   EXPECT_EQ(COULD_NOT_ESTABLISH_CONNECTION_ERROR,
             CanConnectAndSendMessages(chromium_connectable->id()));
 
   EnableExtension(chromium_connectable->id());
   EXPECT_EQ(OK, CanConnectAndSendMessages(chromium_connectable->id()));
   EXPECT_EQ(COULD_NOT_ESTABLISH_CONNECTION_ERROR,
             CanConnectAndSendMessages(not_connectable->id()));
 }
 
 // Tests connection from incognito tabs. Spanning mode only.
 //
 // TODO(kalman): ensure that we exercise split vs spanning incognito logic
 // somewhere. This is a test that should be shared with the content script logic
 // so it's not really our specific concern for web connectable.
 IN_PROC_BROWSER_TEST_F(ExternallyConnectableMessagingTest, FromIncognito) {
   InitializeTestServer();
 
   const Extension* chromium_connectable = LoadChromiumConnectableExtension();
-  ASSERT_TRUE(chromium_connectable);
 
   Browser* incognito_browser = ui_test_utils::OpenURLOffTheRecord(
       profile()->GetOffTheRecordProfile(),
       chromium_org_url());
 
   // No connection because incognito enabled hasn't been set.
   const std::string& id = chromium_connectable->id();
   EXPECT_EQ(COULD_NOT_ESTABLISH_CONNECTION_ERROR,
             CanConnectAndSendMessages(incognito_browser, id));
 
   // Then yes.
   ExtensionPrefs::Get(profile())->SetIsIncognitoEnabled(id, true);
   EXPECT_EQ(OK, CanConnectAndSendMessages(incognito_browser, id));
 }
 
+// Tests a connection from an iframe within a tab which doesn't have
+// permission. Iframe should work.
+IN_PROC_BROWSER_TEST_F(ExternallyConnectableMessagingTest,
+                       FromIframeWithPermission) {
+  InitializeTestServer();
+
+  const Extension* extension = LoadChromiumConnectableExtension();
+
+  ui_test_utils::NavigateToURL(browser(), google_com_url());
+  EXPECT_EQ(NAMESPACE_NOT_DEFINED, CanConnectAndSendMessages(extension->id()));
+  EXPECT_FALSE(AreAnyNonWebApisDefined());
+
+  ASSERT_TRUE(AppendIframe(chromium_org_url()));
+
+  const char* frame_xpath = "//iframe[1]";
+  EXPECT_EQ(OK, CanConnectAndSendMessages(extension->id(), frame_xpath));
+  EXPECT_FALSE(AreAnyNonWebApisDefined(frame_xpath));
+}
+
+// Tests connection from an iframe without permission within a tab that does.
+// Iframe shouldn't work.
+IN_PROC_BROWSER_TEST_F(ExternallyConnectableMessagingTest,
+                       FromIframeWithoutPermission) {
+  InitializeTestServer();
+
+  const Extension* extension = LoadChromiumConnectableExtension();
+
+  ui_test_utils::NavigateToURL(browser(), chromium_org_url());
+  EXPECT_EQ(OK, CanConnectAndSendMessages(extension->id()));
+  EXPECT_FALSE(AreAnyNonWebApisDefined());
+
+  ASSERT_TRUE(AppendIframe(google_com_url()));
+
+  const char* frame_xpath = "//iframe[1]";
+  EXPECT_EQ(NAMESPACE_NOT_DEFINED,
+            CanConnectAndSendMessages(extension->id(), frame_xpath));
+  EXPECT_FALSE(AreAnyNonWebApisDefined(frame_xpath));
+}
+
 }  // namespace
-}  // namespace extensions
+};  // namespace extensions