| // Copyright 2015 The Chromium Authors. All rights reserved. |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #include "third_party/blink/renderer/core/frame/csp/source_list_directive.h" |
| |
| #include "testing/gtest/include/gtest/gtest.h" |
| #include "third_party/blink/renderer/core/frame/csp/content_security_policy.h" |
| #include "third_party/blink/renderer/core/frame/csp/csp_source.h" |
| #include "third_party/blink/renderer/core/testing/null_execution_context.h" |
| #include "third_party/blink/renderer/platform/heap/heap.h" |
| #include "third_party/blink/renderer/platform/loader/fetch/resource_request.h" |
| #include "third_party/blink/renderer/platform/weborigin/kurl.h" |
| #include "third_party/blink/renderer/platform/weborigin/security_origin.h" |
| |
| namespace blink { |
| |
| class SourceListDirectiveTest : public testing::Test { |
| public: |
| SourceListDirectiveTest() |
| : csp(MakeGarbageCollected<ContentSecurityPolicy>()) {} |
| ~SourceListDirectiveTest() override { context->NotifyContextDestroyed(); } |
| |
| protected: |
| struct Source { |
| String scheme; |
| String host; |
| const int port; |
| String path; |
| bool host_wildcard; |
| bool port_wildcard; |
| }; |
| |
| void SetUp() override { |
| KURL secure_url("https://example.test/image.png"); |
| self_source = network::mojom::blink::CSPSource::New("https", "example.test", |
| 443, "", false, false); |
| context = MakeGarbageCollected<NullExecutionContext>(); |
| context->GetSecurityContext().SetSecurityOrigin( |
| SecurityOrigin::Create(secure_url)); |
| csp->BindToDelegate(context->GetContentSecurityPolicyDelegate()); |
| } |
| |
| Persistent<ContentSecurityPolicy> csp; |
| Persistent<ExecutionContext> context; |
| network::mojom::blink::CSPSourcePtr self_source; |
| }; |
| |
| TEST_F(SourceListDirectiveTest, BasicMatchingNone) { |
| KURL base; |
| String sources = "'none'"; |
| network::mojom::blink::CSPSourceListPtr source_list = |
| CSPSourceListParse("script-src", sources, csp.Get()); |
| ASSERT_TRUE(source_list); |
| |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://example.com/"))); |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://example.test/"))); |
| } |
| |
| TEST_F(SourceListDirectiveTest, BasicMatchingStrictDynamic) { |
| String sources = "'strict-dynamic'"; |
| network::mojom::blink::CSPSourceListPtr source_list = |
| CSPSourceListParse("script-src", sources, csp.Get()); |
| |
| EXPECT_TRUE(source_list->allow_dynamic); |
| } |
| |
| TEST_F(SourceListDirectiveTest, BasicMatchingUnsafeHashes) { |
| String sources = "'unsafe-hashes'"; |
| network::mojom::blink::CSPSourceListPtr source_list = |
| CSPSourceListParse("script-src", sources, csp.Get()); |
| |
| EXPECT_TRUE(source_list->allow_unsafe_hashes); |
| } |
| |
| TEST_F(SourceListDirectiveTest, BasicMatchingStar) { |
| KURL base; |
| String sources = "*"; |
| network::mojom::blink::CSPSourceListPtr source_list = |
| CSPSourceListParse("script-src", sources, csp.Get()); |
| |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://example.com/"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://example.com/"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://example.com/bar"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://foo.example.com/"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://foo.example.com/bar"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "ftp://example.com/"))); |
| |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "data:https://example.test/"))); |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "blob:https://example.test/"))); |
| EXPECT_FALSE( |
| CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "filesystem:https://example.test/"))); |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "file:///etc/hosts"))); |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "applewebdata://example.test/"))); |
| } |
| |
| TEST_F(SourceListDirectiveTest, StarallowsSelf) { |
| KURL base; |
| String sources = "*"; |
| network::mojom::blink::CSPSourceListPtr source_list = |
| CSPSourceListParse("script-src", sources, csp.Get()); |
| |
| auto self_origin = |
| network::mojom::blink::CSPSource::New("file", "", -1, "", false, false); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_origin, |
| KURL(base, "file:///etc/hosts"))); |
| |
| // The other results are the same as above: |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_origin, |
| KURL(base, "http://example.com/"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_origin, |
| KURL(base, "https://example.com/"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_origin, |
| KURL(base, "http://example.com/bar"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_origin, |
| KURL(base, "http://foo.example.com/"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_origin, |
| KURL(base, "http://foo.example.com/bar"))); |
| |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_origin, |
| KURL(base, "data:https://example.test/"))); |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_origin, |
| KURL(base, "blob:https://example.test/"))); |
| EXPECT_FALSE( |
| CSPSourceListAllows(*source_list, *self_origin, |
| KURL(base, "filesystem:https://example.test/"))); |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_origin, |
| KURL(base, "applewebdata://example.test/"))); |
| } |
| |
| TEST_F(SourceListDirectiveTest, BasicMatchingSelf) { |
| KURL base; |
| String sources = "'self'"; |
| network::mojom::blink::CSPSourceListPtr source_list = |
| CSPSourceListParse("script-src", sources, csp.Get()); |
| |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://example.com/"))); |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://not-example.com/"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://example.test/"))); |
| } |
| |
| TEST_F(SourceListDirectiveTest, BlobMatchingBlob) { |
| KURL base; |
| String sources = "blob:"; |
| network::mojom::blink::CSPSourceListPtr source_list = |
| CSPSourceListParse("script-src", sources, csp.Get()); |
| |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://example.test/"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "blob:https://example.test/"))); |
| } |
| |
| TEST_F(SourceListDirectiveTest, BasicMatching) { |
| KURL base; |
| String sources = "http://example1.com:8000/foo/ https://example2.com/"; |
| network::mojom::blink::CSPSourceListPtr source_list = |
| CSPSourceListParse("script-src", sources, csp.Get()); |
| |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://example1.com:8000/foo/"))); |
| EXPECT_TRUE( |
| CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://example1.com:8000/foo/bar"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://example2.com/"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://example2.com/foo/"))); |
| |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://not-example.com/"))); |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://example1.com/"))); |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://example1.com/foo"))); |
| EXPECT_FALSE(CSPSourceListAllows( |
| *source_list, *self_source, KURL(base, "http://example1.com:9000/foo/"))); |
| EXPECT_FALSE(CSPSourceListAllows( |
| *source_list, *self_source, KURL(base, "http://example1.com:8000/FOO/"))); |
| } |
| |
| TEST_F(SourceListDirectiveTest, WildcardMatching) { |
| KURL base; |
| String sources = |
| "http://example1.com:*/foo/ https://*.example2.com/bar/ http://*.test/"; |
| network::mojom::blink::CSPSourceListPtr source_list = |
| CSPSourceListParse("script-src", sources, csp.Get()); |
| |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://example1.com/foo/"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://example1.com:8000/foo/"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://example1.com:9000/foo/"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://foo.example2.com/bar/"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://foo.test/"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://foo.bar.test/"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://example1.com/foo/"))); |
| EXPECT_TRUE( |
| CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://example1.com:8000/foo/"))); |
| EXPECT_TRUE( |
| CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://example1.com:9000/foo/"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://foo.test/"))); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://foo.bar.test/"))); |
| |
| EXPECT_FALSE(CSPSourceListAllows( |
| *source_list, *self_source, KURL(base, "https://example1.com:8000/foo"))); |
| EXPECT_FALSE(CSPSourceListAllows( |
| *source_list, *self_source, KURL(base, "https://example2.com:8000/bar"))); |
| EXPECT_FALSE( |
| CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://foo.example2.com:8000/bar"))); |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://example2.foo.com/bar"))); |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://foo.test.bar/"))); |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "https://example2.com/bar/"))); |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://test/"))); |
| } |
| |
| TEST_F(SourceListDirectiveTest, RedirectMatching) { |
| KURL base; |
| String sources = "http://example1.com/foo/ http://example2.com/bar/"; |
| network::mojom::blink::CSPSourceListPtr source_list = |
| CSPSourceListParse("script-src", sources, csp.Get()); |
| |
| EXPECT_TRUE(CSPSourceListAllows( |
| *source_list, *self_source, KURL(base, "http://example1.com/foo/"), |
| ResourceRequest::RedirectStatus::kFollowedRedirect)); |
| EXPECT_TRUE(CSPSourceListAllows( |
| *source_list, *self_source, KURL(base, "http://example1.com/bar/"), |
| ResourceRequest::RedirectStatus::kFollowedRedirect)); |
| EXPECT_TRUE(CSPSourceListAllows( |
| *source_list, *self_source, KURL(base, "http://example2.com/bar/"), |
| ResourceRequest::RedirectStatus::kFollowedRedirect)); |
| EXPECT_TRUE(CSPSourceListAllows( |
| *source_list, *self_source, KURL(base, "http://example2.com/foo/"), |
| ResourceRequest::RedirectStatus::kFollowedRedirect)); |
| EXPECT_TRUE(CSPSourceListAllows( |
| *source_list, *self_source, KURL(base, "https://example1.com/foo/"), |
| ResourceRequest::RedirectStatus::kFollowedRedirect)); |
| EXPECT_TRUE(CSPSourceListAllows( |
| *source_list, *self_source, KURL(base, "https://example1.com/bar/"), |
| ResourceRequest::RedirectStatus::kFollowedRedirect)); |
| |
| EXPECT_FALSE(CSPSourceListAllows( |
| *source_list, *self_source, KURL(base, "http://example3.com/foo/"), |
| ResourceRequest::RedirectStatus::kFollowedRedirect)); |
| } |
| |
| TEST_F(SourceListDirectiveTest, AllowAllInline) { |
| struct TestCase { |
| String sources; |
| bool expected; |
| } cases[] = { |
| // List does not contain 'unsafe-inline'. |
| {"http://example1.com/foo/", false}, |
| {"'sha512-321cba'", false}, |
| {"'nonce-yay'", false}, |
| {"'strict-dynamic'", false}, |
| {"'sha512-321cba' http://example1.com/foo/", false}, |
| {"http://example1.com/foo/ 'sha512-321cba'", false}, |
| {"http://example1.com/foo/ 'nonce-yay'", false}, |
| {"'sha512-321cba' 'nonce-yay'", false}, |
| {"http://example1.com/foo/ 'sha512-321cba' 'nonce-yay'", false}, |
| {"http://example1.com/foo/ 'sha512-321cba' 'nonce-yay'", false}, |
| {" 'sha512-321cba' 'nonce-yay' 'strict-dynamic'", false}, |
| // List contains 'unsafe-inline'. |
| {"'unsafe-inline'", true}, |
| {"'self' 'unsafe-inline'", true}, |
| {"'unsafe-inline' http://example1.com/foo/", true}, |
| {"'sha512-321cba' 'unsafe-inline'", false}, |
| {"'nonce-yay' 'unsafe-inline'", false}, |
| {"'strict-dynamic' 'unsafe-inline' 'nonce-yay'", false}, |
| {"'sha512-321cba' http://example1.com/foo/ 'unsafe-inline'", false}, |
| {"http://example1.com/foo/ 'sha512-321cba' 'unsafe-inline'", false}, |
| {"http://example1.com/foo/ 'nonce-yay' 'unsafe-inline'", false}, |
| {"'sha512-321cba' 'nonce-yay' 'unsafe-inline'", false}, |
| {"http://example1.com/foo/ 'sha512-321cba' 'unsafe-inline' 'nonce-yay'", |
| false}, |
| {"http://example1.com/foo/ 'sha512-321cba' 'nonce-yay' 'unsafe-inline'", |
| false}, |
| {" 'sha512-321cba' 'unsafe-inline' 'nonce-yay' 'strict-dynamic'", false}, |
| }; |
| |
| // Script-src and style-src differently handle presence of 'strict-dynamic'. |
| network::mojom::blink::CSPSourceListPtr script_src = CSPSourceListParse( |
| "script-src", "'strict-dynamic' 'unsafe-inline'", csp.Get()); |
| EXPECT_FALSE( |
| CSPSourceListAllowAllInline(CSPDirectiveName::ScriptSrc, *script_src)); |
| |
| network::mojom::blink::CSPSourceListPtr style_src = CSPSourceListParse( |
| "style-src", "'strict-dynamic' 'unsafe-inline'", csp.Get()); |
| EXPECT_TRUE( |
| CSPSourceListAllowAllInline(CSPDirectiveName::StyleSrc, *style_src)); |
| |
| for (const auto& test : cases) { |
| network::mojom::blink::CSPSourceListPtr script_src = |
| CSPSourceListParse("script-src", test.sources, csp.Get()); |
| EXPECT_EQ( |
| CSPSourceListAllowAllInline(CSPDirectiveName::ScriptSrc, *script_src), |
| test.expected); |
| |
| network::mojom::blink::CSPSourceListPtr style_src = |
| CSPSourceListParse("style-src", test.sources, csp.Get()); |
| EXPECT_EQ( |
| CSPSourceListAllowAllInline(CSPDirectiveName::StyleSrc, *style_src), |
| test.expected); |
| |
| // If source list doesn't have a valid type, it must not allow all inline. |
| network::mojom::blink::CSPSourceListPtr img_src = |
| CSPSourceListParse("img-src", test.sources, csp.Get()); |
| EXPECT_FALSE( |
| CSPSourceListAllowAllInline(CSPDirectiveName::ImgSrc, *img_src)); |
| } |
| } |
| |
| TEST_F(SourceListDirectiveTest, IsNone) { |
| struct TestCase { |
| String sources; |
| bool expected; |
| } cases[] = { |
| // Source list is 'none'. |
| {"'none'", true}, |
| {"", true}, |
| {" ", true}, |
| // Source list is not 'none'. |
| {"http://example1.com/foo/", false}, |
| {"'sha512-321cba'", false}, |
| {"'nonce-yay'", false}, |
| {"'strict-dynamic'", false}, |
| {"'sha512-321cba' http://example1.com/foo/", false}, |
| {"http://example1.com/foo/ 'sha512-321cba'", false}, |
| {"http://example1.com/foo/ 'nonce-yay'", false}, |
| {"'none' 'sha512-321cba' http://example1.com/foo/", false}, |
| {"'none' http://example1.com/foo/ 'sha512-321cba'", false}, |
| {"'none' http://example1.com/foo/ 'nonce-yay'", false}, |
| {"'sha512-321cba' 'nonce-yay'", false}, |
| {"http://example1.com/foo/ 'sha512-321cba' 'nonce-yay'", false}, |
| {"http://example1.com/foo/ 'sha512-321cba' 'nonce-yay'", false}, |
| {" 'sha512-321cba' 'nonce-yay' 'strict-dynamic'", false}, |
| }; |
| |
| for (const auto& test : cases) { |
| SCOPED_TRACE(test.sources); |
| network::mojom::blink::CSPSourceListPtr script_src = |
| CSPSourceListParse("script-src", test.sources, csp.Get()); |
| EXPECT_EQ(CSPSourceListIsNone(*script_src), test.expected); |
| |
| network::mojom::blink::CSPSourceListPtr form_action = |
| CSPSourceListParse("form-action", test.sources, csp.Get()); |
| EXPECT_EQ(CSPSourceListIsNone(*form_action), test.expected); |
| |
| network::mojom::blink::CSPSourceListPtr frame_src = |
| CSPSourceListParse("frame-src", test.sources, csp.Get()); |
| EXPECT_EQ(CSPSourceListIsNone(*frame_src), test.expected); |
| } |
| } |
| |
| TEST_F(SourceListDirectiveTest, IsSelf) { |
| struct TestCase { |
| String sources; |
| bool expected; |
| } cases[] = { |
| // Source list is 'self'. |
| {"'self'", true}, |
| {"'self' 'none'", true}, |
| |
| // Source list is not 'self'. |
| {"'none'", false}, |
| {"http://example1.com/foo/", false}, |
| {"'sha512-321cba'", false}, |
| {"'nonce-yay'", false}, |
| {"'strict-dynamic'", false}, |
| {"'sha512-321cba' http://example1.com/foo/", false}, |
| {"http://example1.com/foo/ 'sha512-321cba'", false}, |
| {"http://example1.com/foo/ 'nonce-yay'", false}, |
| {"'self' 'sha512-321cba' http://example1.com/foo/", false}, |
| {"'self' http://example1.com/foo/ 'sha512-321cba'", false}, |
| {"'self' http://example1.com/foo/ 'nonce-yay'", false}, |
| {"'sha512-321cba' 'nonce-yay'", false}, |
| {"http://example1.com/foo/ 'sha512-321cba' 'nonce-yay'", false}, |
| {"http://example1.com/foo/ 'sha512-321cba' 'nonce-yay'", false}, |
| {" 'sha512-321cba' 'nonce-yay' 'strict-dynamic'", false}, |
| }; |
| |
| for (const auto& test : cases) { |
| SCOPED_TRACE(test.sources); |
| network::mojom::blink::CSPSourceListPtr script_src = |
| CSPSourceListParse("script-src", test.sources, csp.Get()); |
| EXPECT_EQ(CSPSourceListIsSelf(*script_src), test.expected); |
| |
| network::mojom::blink::CSPSourceListPtr form_action = |
| CSPSourceListParse("form-action", test.sources, csp.Get()); |
| EXPECT_EQ(CSPSourceListIsSelf(*form_action), test.expected); |
| |
| network::mojom::blink::CSPSourceListPtr frame_src = |
| CSPSourceListParse("frame-src", test.sources, csp.Get()); |
| EXPECT_EQ(CSPSourceListIsSelf(*frame_src), test.expected); |
| } |
| } |
| |
| TEST_F(SourceListDirectiveTest, AllowsURLBasedMatching) { |
| struct TestCase { |
| String sources; |
| bool expected; |
| } cases[] = { |
| // No URL-based matching. |
| {"'none'", false}, |
| {"'sha256-abcdefg'", false}, |
| {"'nonce-abc'", false}, |
| {"'nonce-abce' 'sha256-abcdefg'", false}, |
| |
| // Strict-dynamic. |
| {"'sha256-abcdefg' 'strict-dynamic'", false}, |
| {"'nonce-abce' 'strict-dynamic'", false}, |
| {"'nonce-abce' 'sha256-abcdefg' 'strict-dynamic'", false}, |
| {"'sha256-abcdefg' 'strict-dynamic' https:", false}, |
| {"'nonce-abce' 'strict-dynamic' http://example.test", false}, |
| {"'nonce-abce' 'sha256-abcdefg' 'strict-dynamic' *://example.test", |
| false}, |
| |
| // URL-based. |
| {"*", true}, |
| {"'self'", true}, |
| {"http:", true}, |
| {"http: https:", true}, |
| {"http: 'none'", true}, |
| {"http: https: 'none'", true}, |
| {"'sha256-abcdefg' https://example.test", true}, |
| {"'nonce-abc' https://example.test", true}, |
| {"'nonce-abce' 'sha256-abcdefg' https://example.test", true}, |
| {"'sha256-abcdefg' https://example.test 'none'", true}, |
| {"'nonce-abc' https://example.test 'none'", true}, |
| {"'nonce-abce' 'sha256-abcdefg' https://example.test 'none'", true}, |
| |
| }; |
| |
| for (const auto& test : cases) { |
| SCOPED_TRACE(test.sources); |
| network::mojom::blink::CSPSourceListPtr script_src = |
| CSPSourceListParse("script-src", test.sources, csp.Get()); |
| EXPECT_EQ(CSPSourceListAllowsURLBasedMatching(*script_src), test.expected); |
| |
| network::mojom::blink::CSPSourceListPtr form_action = |
| CSPSourceListParse("form-action", test.sources, csp.Get()); |
| EXPECT_EQ(CSPSourceListAllowsURLBasedMatching(*form_action), test.expected); |
| |
| network::mojom::blink::CSPSourceListPtr frame_src = |
| CSPSourceListParse("frame-src", test.sources, csp.Get()); |
| EXPECT_EQ(CSPSourceListAllowsURLBasedMatching(*frame_src), test.expected); |
| } |
| } |
| |
| TEST_F(SourceListDirectiveTest, ParseHost) { |
| struct TestCase { |
| String sources; |
| bool expected; |
| } cases[] = { |
| // Wildcard. |
| {"*", true}, |
| {"*.", false}, |
| {"*.a", true}, |
| {"a.*.a", false}, |
| {"a.*", false}, |
| |
| // Dots. |
| {"a.b.c", true}, |
| {"a.b.", false}, |
| {".b.c", false}, |
| {"a..c", false}, |
| |
| // Valid/Invalid characters. |
| {"az09-", true}, |
| {"+", false}, |
| }; |
| |
| for (const auto& test : cases) { |
| network::mojom::blink::CSPSourceListPtr parsed = |
| CSPSourceListParse("default-src", test.sources, csp.Get()); |
| EXPECT_EQ(CSPSourceListIsNone(*parsed), !test.expected) |
| << "CSPSourceListParse failed to parse: " << test.sources; |
| } |
| } |
| |
| TEST_F(SourceListDirectiveTest, AllowHostWildcard) { |
| KURL base; |
| // When the host-part is "*", the port must still be checked. |
| // See crbug.com/682673. |
| { |
| String sources = "http://*:111"; |
| network::mojom::blink::CSPSourceListPtr source_list = |
| CSPSourceListParse("default-src", sources, csp.Get()); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://a.com:111"))); |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://a.com:222"))); |
| } |
| // When the host-part is "*", the path must still be checked. |
| // See crbug.com/682673. |
| { |
| String sources = "http://*/welcome.html"; |
| network::mojom::blink::CSPSourceListPtr source_list = |
| CSPSourceListParse("default-src", sources, csp.Get()); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://a.com/welcome.html"))); |
| EXPECT_FALSE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://a.com/passwords.txt"))); |
| } |
| // When the host-part is "*" and the expression-source is not "*", then every |
| // host are allowed. See crbug.com/682673. |
| { |
| String sources = "http://*"; |
| network::mojom::blink::CSPSourceListPtr source_list = |
| CSPSourceListParse("default-src", sources, csp.Get()); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://a.com"))); |
| } |
| } |
| |
| TEST_F(SourceListDirectiveTest, AllowHostMixedCase) { |
| KURL base; |
| // Non-wildcard sources should match hosts case-insensitively. |
| { |
| String sources = "http://ExAmPle.com"; |
| network::mojom::blink::CSPSourceListPtr source_list = |
| CSPSourceListParse("default-src", sources, csp.Get()); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://example.com"))); |
| } |
| // Wildcard sources should match hosts case-insensitively. |
| { |
| String sources = "http://*.ExAmPle.com"; |
| network::mojom::blink::CSPSourceListPtr source_list = |
| CSPSourceListParse("default-src", sources, csp.Get()); |
| EXPECT_TRUE(CSPSourceListAllows(*source_list, *self_source, |
| KURL(base, "http://www.example.com"))); |
| } |
| } |
| |
| TEST_F(SourceListDirectiveTest, AllowNonce) { |
| struct TestCase { |
| const char* directive_value; |
| const char* nonce; |
| bool expected; |
| } cases[] = { |
| {"'self'", "yay", false}, |
| {"'self'", "boo", false}, |
| {"'nonce-yay'", "yay", true}, |
| {"'nonce-yay'", "boo", false}, |
| {"'nonce-yay' 'nonce-boo'", "yay", true}, |
| {"'nonce-yay' 'nonce-boo'", "boo", true}, |
| }; |
| |
| for (const auto& test : cases) { |
| network::mojom::blink::CSPSourceListPtr source_list = |
| CSPSourceListParse("script-src", test.directive_value, csp.Get()); |
| EXPECT_EQ(test.expected, CSPSourceListAllowNonce(*source_list, test.nonce)); |
| // Empty/null strings are always not present. |
| EXPECT_FALSE(CSPSourceListAllowNonce(*source_list, "")); |
| EXPECT_FALSE(CSPSourceListAllowNonce(*source_list, String())); |
| } |
| } |
| |
| } // namespace blink |
