// Copyright 2017 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "third_party/blink/renderer/bindings/core/v8/binding_security.h"

#include "testing/gtest/include/gtest/gtest.h"
#include "third_party/blink/renderer/core/dom/document.h"
#include "third_party/blink/renderer/core/loader/document_loader.h"
#include "third_party/blink/renderer/core/testing/sim/sim_request.h"
#include "third_party/blink/renderer/core/testing/sim/sim_test.h"
#include "third_party/blink/renderer/platform/instrumentation/use_counter.h"
#include "third_party/blink/renderer/platform/testing/unit_test_helpers.h"

namespace blink {

namespace {
const char kMainFrame[] = "https://example.com/main.html";
const char kSameOriginTarget[] = "https://example.com/target.html";
const char kSameOriginDomainTarget[] = "https://sub.example.com/target.html";
const char kCrossOriginTarget[] = "https://not-example.com/target.html";

const char kTargetHTML[] =
    "<!DOCTYPE html>"
    "<script>"
    "  (window.opener || window.top).postMessage('yay', '*');"
    "</script>";
const char kSameOriginDomainTargetHTML[] =
    "<!DOCTYPE html>"
    "<script>"
    "  document.domain = 'example.com';"
    "  (window.opener || window.top).postMessage('yay', '*');"
    "</script>";
}

class BindingSecurityCounterTest
    : public SimTest,
      public testing::WithParamInterface<const char*> {
 public:
  enum class OriginDisposition { CrossOrigin, SameOrigin, SameOriginDomain };

  BindingSecurityCounterTest() = default;

  void LoadWindowAndAccessProperty(OriginDisposition which_origin,
                                   const String& property) {
    const char* target_url;
    const char* target_html;
    switch (which_origin) {
      case OriginDisposition::CrossOrigin:
        target_url = kCrossOriginTarget;
        target_html = kTargetHTML;
        break;
      case OriginDisposition::SameOrigin:
        target_url = kSameOriginTarget;
        target_html = kTargetHTML;
        break;
      case OriginDisposition::SameOriginDomain:
        target_url = kSameOriginDomainTarget;
        target_html = kSameOriginDomainTargetHTML;
        break;
    }

    SimRequest main(kMainFrame, "text/html");
    SimRequest target(target_url, "text/html");
    const String& document = String::Format(
        "<!DOCTYPE html>"
        "<script>"
        "  %s"
        "  window.addEventListener('message', e => {"
        "    window.other = e.source.%s;"
        "    console.log('yay');"
        "  });"
        "  var w = window.open('%s');"
        "</script>",
        which_origin == OriginDisposition::SameOriginDomain
            ? "document.domain = 'example.com';"
            : "",
        property.Utf8().c_str(), target_url);

    LoadURL(kMainFrame);
    main.Complete(document);
    target.Complete(target_html);
    test::RunPendingTasks();
  }

  void LoadFrameAndAccessProperty(OriginDisposition which_origin,
                                  const String& property) {
    const char* target_url;
    const char* target_html;
    switch (which_origin) {
      case OriginDisposition::CrossOrigin:
        target_url = kCrossOriginTarget;
        target_html = kTargetHTML;
        break;
      case OriginDisposition::SameOrigin:
        target_url = kSameOriginTarget;
        target_html = kTargetHTML;
        break;
      case OriginDisposition::SameOriginDomain:
        target_url = kSameOriginDomainTarget;
        target_html = kSameOriginDomainTargetHTML;
        break;
    }
    SimRequest main(kMainFrame, "text/html");
    SimRequest target(target_url, "text/html");
    const String& document = String::Format(
        "<!DOCTYPE html>"
        "<body>"
        "<script>"
        "  %s"
        "  var i = document.createElement('iframe');"
        "  window.addEventListener('message', e => {"
        "    window.other = e.source.%s;"
        "    console.log('yay');"
        "  });"
        "  i.src = '%s';"
        "  document.body.appendChild(i);"
        "</script>",
        which_origin == OriginDisposition::SameOriginDomain
            ? "document.domain = 'example.com';"
            : "",
        property.Utf8().c_str(), target_url);

    LoadURL(kMainFrame);
    main.Complete(document);
    target.Complete(target_html);
    test::RunPendingTasks();
  }
};

INSTANTIATE_TEST_SUITE_P(WindowProperties,
                         BindingSecurityCounterTest,
                         testing::Values("window",
                                         "self",
                                         "location",
                                         "close",
                                         "closed",
                                         "focus",
                                         "blur",
                                         "frames",
                                         "length",
                                         "top",
                                         "opener",
                                         "parent",
                                         "postMessage"));

TEST_P(BindingSecurityCounterTest, CrossOriginWindow) {
  LoadWindowAndAccessProperty(OriginDisposition::CrossOrigin, GetParam());
  EXPECT_TRUE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kCrossOriginPropertyAccess));
  EXPECT_TRUE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kCrossOriginPropertyAccessFromOpener));
  EXPECT_FALSE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kDocumentDomainEnabledCrossOriginAccess));
}

TEST_P(BindingSecurityCounterTest, SameOriginWindow) {
  LoadWindowAndAccessProperty(OriginDisposition::SameOrigin, GetParam());
  EXPECT_FALSE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kCrossOriginPropertyAccess));
  EXPECT_FALSE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kCrossOriginPropertyAccessFromOpener));
  EXPECT_FALSE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kDocumentDomainEnabledCrossOriginAccess));
}

TEST_P(BindingSecurityCounterTest, SameOriginDomainWindow) {
  LoadWindowAndAccessProperty(OriginDisposition::SameOriginDomain, GetParam());
  EXPECT_FALSE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kCrossOriginPropertyAccess));
  EXPECT_FALSE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kCrossOriginPropertyAccessFromOpener));
  EXPECT_TRUE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kDocumentDomainEnabledCrossOriginAccess));
}

TEST_P(BindingSecurityCounterTest, CrossOriginFrame) {
  LoadFrameAndAccessProperty(OriginDisposition::CrossOrigin, GetParam());
  EXPECT_TRUE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kCrossOriginPropertyAccess));
  EXPECT_FALSE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kCrossOriginPropertyAccessFromOpener));
  EXPECT_FALSE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kDocumentDomainEnabledCrossOriginAccess));
}

TEST_P(BindingSecurityCounterTest, SameOriginFrame) {
  LoadFrameAndAccessProperty(OriginDisposition::SameOrigin, GetParam());
  EXPECT_FALSE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kCrossOriginPropertyAccess));
  EXPECT_FALSE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kCrossOriginPropertyAccessFromOpener));
  EXPECT_FALSE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kDocumentDomainEnabledCrossOriginAccess));
}

TEST_P(BindingSecurityCounterTest, SameOriginDomainFrame) {
  LoadFrameAndAccessProperty(OriginDisposition::SameOriginDomain, GetParam());
  EXPECT_FALSE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kCrossOriginPropertyAccess));
  EXPECT_FALSE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kCrossOriginPropertyAccessFromOpener));
  EXPECT_TRUE(
      GetDocument().Loader()->GetUseCounterHelper().HasRecordedMeasurement(
          WebFeature::kDocumentDomainEnabledCrossOriginAccess));
}

}  // namespace