content/browser/cross_site_transfer_browsertest.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "base/command_line.h"
   6 #include "base/strings/stringprintf.h"
   7 #include "content/browser/loader/resource_dispatcher_host_impl.h"
   8 #include "content/public/browser/navigation_entry.h"
   9 #include "content/public/browser/resource_dispatcher_host_delegate.h"
  10 #include "content/public/browser/resource_throttle.h"
  11 #include "content/public/browser/web_contents.h"
  12 #include "content/public/common/content_switches.h"
  13 #include "content/public/test/browser_test_utils.h"
  14 #include "content/public/test/content_browser_test.h"
  15 #include "content/public/test/content_browser_test_utils.h"
  16 #include "content/public/test/test_navigation_observer.h"
  17 #include "content/shell/browser/shell.h"
  18 #include "content/shell/browser/shell_content_browser_client.h"
  19 #include "content/shell/browser/shell_resource_dispatcher_host_delegate.h"
  20 #include "net/base/escape.h"
  21 #include "net/dns/mock_host_resolver.h"
  22 #include "net/test/embedded_test_server/embedded_test_server.h"
  23 #include "net/url_request/url_request.h"
  24 #include "net/url_request/url_request_status.h"
  25 #include "url/gurl.h"
  26
  27 namespace content {
  28
  29 // Tracks a single request for a specified URL, and allows waiting until the
  30 // request is destroyed, and then inspecting whether it completed successfully.
  31 class TrackingResourceDispatcherHostDelegate
  32     : public ShellResourceDispatcherHostDelegate {
  33  public:
  34   TrackingResourceDispatcherHostDelegate() : throttle_created_(false) {
  35   }
  36
  37   void RequestBeginning(net::URLRequest* request,
  38                         ResourceContext* resource_context,
  39                         AppCacheService* appcache_service,
  40                         ResourceType resource_type,
  41                         ScopedVector<ResourceThrottle>* throttles) override {
  42     CHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
  43     ShellResourceDispatcherHostDelegate::RequestBeginning(
  44         request, resource_context, appcache_service, resource_type, throttles);
  45     // Expect only a single request for the tracked url.
  46     ASSERT_FALSE(throttle_created_);
  47     // If this is a request for the tracked URL, add a throttle to track it.
  48     if (request->url() == tracked_url_)
  49       throttles->push_back(new TrackingThrottle(request, this));
  50   }
  51
  52   // Starts tracking a URL.  The request for previously tracked URL, if any,
  53   // must have been made and deleted before calling this function.
  54   void SetTrackedURL(const GURL& tracked_url) {
  55     CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
  56     // Should not currently be tracking any URL.
  57     ASSERT_FALSE(run_loop_);
  58
  59     // Create a RunLoop that will be stopped once the request for the tracked
  60     // URL has been destroyed, to allow tracking the URL while also waiting for
  61     // other events.
  62     run_loop_.reset(new base::RunLoop());
  63
  64     BrowserThread::PostTask(
  65         BrowserThread::IO, FROM_HERE,
  66         base::Bind(
  67             &TrackingResourceDispatcherHostDelegate::SetTrackedURLOnIOThread,
  68             base::Unretained(this),
  69             tracked_url));
  70   }
  71
  72   // Waits until the tracked URL has been requests, and the request for it has
  73   // been destroyed.
  74   bool WaitForTrackedURLAndGetCompleted() {
  75     CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
  76     run_loop_->Run();
  77     run_loop_.reset();
  78     return tracked_request_completed_;
  79   }
  80
  81  private:
  82   // ResourceThrottle attached to request for the tracked URL.  On destruction,
  83   // passes the final URLRequestStatus back to the delegate.
  84   class TrackingThrottle : public ResourceThrottle {
  85    public:
  86     TrackingThrottle(net::URLRequest* request,
  87                      TrackingResourceDispatcherHostDelegate* tracker)
  88         : request_(request), tracker_(tracker) {
  89     }
  90
  91     ~TrackingThrottle() override {
  92       // If the request is deleted without being cancelled, its status will
  93       // indicate it succeeded, so have to check if the request is still pending
  94       // as well.
  95       tracker_->OnTrackedRequestDestroyed(
  96           !request_->is_pending() && request_->status().is_success());
  97     }
  98
  99     // ResourceThrottle implementation:
 100     const char* GetNameForLogging() const override {
 101       return "TrackingThrottle";
 102     }
 103
 104    private:
 105     net::URLRequest* request_;
 106     TrackingResourceDispatcherHostDelegate* tracker_;
 107
 108     DISALLOW_COPY_AND_ASSIGN(TrackingThrottle);
 109   };
 110
 111   void SetTrackedURLOnIOThread(const GURL& tracked_url) {
 112     CHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 113     throttle_created_ = false;
 114     tracked_url_ = tracked_url;
 115   }
 116
 117   void OnTrackedRequestDestroyed(bool completed) {
 118     CHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 119     tracked_request_completed_ = completed;
 120     tracked_url_ = GURL();
 121
 122     BrowserThread::PostTask(
 123         BrowserThread::UI, FROM_HERE, run_loop_->QuitClosure());
 124   }
 125
 126   // These live on the IO thread.
 127   GURL tracked_url_;
 128   bool throttle_created_;
 129
 130   // This is created and destroyed on the UI thread, but stopped on the IO
 131   // thread.
 132   scoped_ptr<base::RunLoop> run_loop_;
 133
 134   // Set on the IO thread while |run_loop_| is non-NULL, read on the UI thread
 135   // after deleting run_loop_.
 136   bool tracked_request_completed_;
 137
 138   DISALLOW_COPY_AND_ASSIGN(TrackingResourceDispatcherHostDelegate);
 139 };
 140
 141 // WebContentsDelegate that fails to open a URL when there's a request that
 142 // needs to be transferred between renderers.
 143 class NoTransferRequestDelegate : public WebContentsDelegate {
 144  public:
 145   NoTransferRequestDelegate() {}
 146
 147   WebContents* OpenURLFromTab(WebContents* source,
 148                               const OpenURLParams& params) override {
 149     bool is_transfer =
 150         (params.transferred_global_request_id != GlobalRequestID());
 151     if (is_transfer)
 152       return NULL;
 153     NavigationController::LoadURLParams load_url_params(params.url);
 154     load_url_params.referrer = params.referrer;
 155     load_url_params.frame_tree_node_id = params.frame_tree_node_id;
 156     load_url_params.transition_type = params.transition;
 157     load_url_params.extra_headers = params.extra_headers;
 158     load_url_params.should_replace_current_entry =
 159         params.should_replace_current_entry;
 160     load_url_params.is_renderer_initiated = true;
 161     source->GetController().LoadURLWithParams(load_url_params);
 162     return source;
 163   }
 164
 165  private:
 166   DISALLOW_COPY_AND_ASSIGN(NoTransferRequestDelegate);
 167 };
 168
 169 class CrossSiteTransferTest : public ContentBrowserTest {
 170  public:
 171   CrossSiteTransferTest() : old_delegate_(NULL) {
 172   }
 173
 174   // ContentBrowserTest implementation:
 175   void SetUpOnMainThread() override {
 176     BrowserThread::PostTask(
 177         BrowserThread::IO, FROM_HERE,
 178         base::Bind(
 179             &CrossSiteTransferTest::InjectResourceDisptcherHostDelegate,
 180             base::Unretained(this)));
 181     host_resolver()->AddRule("*", "127.0.0.1");
 182     ASSERT_TRUE(embedded_test_server()->InitializeAndWaitUntilReady());
 183     content::SetupCrossSiteRedirector(embedded_test_server());
 184   }
 185
 186   void TearDownOnMainThread() override {
 187     BrowserThread::PostTask(
 188         BrowserThread::IO, FROM_HERE,
 189         base::Bind(
 190             &CrossSiteTransferTest::RestoreResourceDisptcherHostDelegate,
 191             base::Unretained(this)));
 192   }
 193
 194  protected:
 195   void NavigateToURLContentInitiated(Shell* window,
 196                                      const GURL& url,
 197                                      bool should_replace_current_entry,
 198                                      bool should_wait_for_navigation) {
 199     std::string script;
 200     if (should_replace_current_entry)
 201       script = base::StringPrintf("location.replace('%s')", url.spec().c_str());
 202     else
 203       script = base::StringPrintf("location.href = '%s'", url.spec().c_str());
 204     TestNavigationObserver load_observer(shell()->web_contents(), 1);
 205     bool result = ExecuteScript(window->web_contents(), script);
 206     EXPECT_TRUE(result);
 207     if (should_wait_for_navigation)
 208       load_observer.Wait();
 209   }
 210
 211   void SetUpCommandLine(base::CommandLine* command_line) override {
 212     // Use --site-per-process to force process swaps for cross-site transfers.
 213     command_line->AppendSwitch(switches::kSitePerProcess);
 214   }
 215
 216   void InjectResourceDisptcherHostDelegate() {
 217     DCHECK_CURRENTLY_ON(BrowserThread::IO);
 218     old_delegate_ = ResourceDispatcherHostImpl::Get()->delegate();
 219     ResourceDispatcherHostImpl::Get()->SetDelegate(&tracking_delegate_);
 220   }
 221
 222   void RestoreResourceDisptcherHostDelegate() {
 223     DCHECK_CURRENTLY_ON(BrowserThread::IO);
 224     ResourceDispatcherHostImpl::Get()->SetDelegate(old_delegate_);
 225     old_delegate_ = NULL;
 226   }
 227
 228   TrackingResourceDispatcherHostDelegate& tracking_delegate() {
 229     return tracking_delegate_;
 230   }
 231
 232  private:
 233   TrackingResourceDispatcherHostDelegate tracking_delegate_;
 234   ResourceDispatcherHostDelegate* old_delegate_;
 235 };
 236
 237 // The following tests crash in the ThreadSanitizer runtime,
 238 // http://crbug.com/356758.
 239 #if defined(THREAD_SANITIZER)
 240 #define MAYBE_ReplaceEntryCrossProcessThenTransfer \
 241     DISABLED_ReplaceEntryCrossProcessThenTransfer
 242 #define MAYBE_ReplaceEntryCrossProcessTwice \
 243     DISABLED_ReplaceEntryCrossProcessTwice
 244 #else
 245 #define MAYBE_ReplaceEntryCrossProcessThenTransfer \
 246     ReplaceEntryCrossProcessThenTransfer
 247 #define MAYBE_ReplaceEntryCrossProcessTwice ReplaceEntryCrossProcessTwice
 248 #endif
 249 // Tests that the |should_replace_current_entry| flag persists correctly across
 250 // request transfers that began with a cross-process navigation.
 251 IN_PROC_BROWSER_TEST_F(CrossSiteTransferTest,
 252                        MAYBE_ReplaceEntryCrossProcessThenTransfer) {
 253   const NavigationController& controller =
 254       shell()->web_contents()->GetController();
 255
 256   // Navigate to a starting URL, so there is a history entry to replace.
 257   GURL url1 = embedded_test_server()->GetURL("/site_isolation/blank.html?1");
 258   NavigateToURL(shell(), url1);
 259
 260   // Force all future navigations to transfer. Note that this includes same-site
 261   // navigiations which may cause double process swaps (via OpenURL and then via
 262   // transfer). This test intentionally exercises that case.
 263   ShellContentBrowserClient::SetSwapProcessesForRedirect(true);
 264
 265   // Navigate to a page on A.com with entry replacement. This navigation is
 266   // cross-site, so the renderer will send it to the browser via OpenURL to give
 267   // to a new process. It will then be transferred into yet another process due
 268   // to the call above.
 269   GURL url2 =
 270       embedded_test_server()->GetURL("A.com", "/site_isolation/blank.html?2");
 271   // Used to make sure the request for url2 succeeds, and there was only one of
 272   // them.
 273   tracking_delegate().SetTrackedURL(url2);
 274   NavigateToURLContentInitiated(shell(), url2, true, true);
 275
 276   // There should be one history entry. url2 should have replaced url1.
 277   EXPECT_TRUE(controller.GetPendingEntry() == NULL);
 278   EXPECT_EQ(1, controller.GetEntryCount());
 279   EXPECT_EQ(0, controller.GetCurrentEntryIndex());
 280   EXPECT_EQ(url2, controller.GetEntryAtIndex(0)->GetURL());
 281   // Make sure the request succeeded.
 282   EXPECT_TRUE(tracking_delegate().WaitForTrackedURLAndGetCompleted());
 283
 284   // Now navigate as before to a page on B.com, but normally (without
 285   // replacement). This will still perform a double process-swap as above, via
 286   // OpenURL and then transfer.
 287   GURL url3 =
 288       embedded_test_server()->GetURL("B.com", "/site_isolation/blank.html?3");
 289   // Used to make sure the request for url3 succeeds, and there was only one of
 290   // them.
 291   tracking_delegate().SetTrackedURL(url3);
 292   NavigateToURLContentInitiated(shell(), url3, false, true);
 293
 294   // There should be two history entries. url2 should have replaced url1. url2
 295   // should not have replaced url3.
 296   EXPECT_TRUE(controller.GetPendingEntry() == NULL);
 297   EXPECT_EQ(2, controller.GetEntryCount());
 298   EXPECT_EQ(1, controller.GetCurrentEntryIndex());
 299   EXPECT_EQ(url2, controller.GetEntryAtIndex(0)->GetURL());
 300   EXPECT_EQ(url3, controller.GetEntryAtIndex(1)->GetURL());
 301
 302   // Make sure the request succeeded.
 303   EXPECT_TRUE(tracking_delegate().WaitForTrackedURLAndGetCompleted());
 304 }
 305
 306 // Tests that the |should_replace_current_entry| flag persists correctly across
 307 // request transfers that began with a content-initiated in-process
 308 // navigation. This test is the same as the test above, except transfering from
 309 // in-process.
 310 IN_PROC_BROWSER_TEST_F(CrossSiteTransferTest,
 311                        ReplaceEntryInProcessThenTranfers) {
 312   const NavigationController& controller =
 313       shell()->web_contents()->GetController();
 314
 315   // Navigate to a starting URL, so there is a history entry to replace.
 316   GURL url = embedded_test_server()->GetURL("/site_isolation/blank.html?1");
 317   NavigateToURL(shell(), url);
 318
 319   // Force all future navigations to transfer. Note that this includes same-site
 320   // navigiations which may cause double process swaps (via OpenURL and then via
 321   // transfer). All navigations in this test are same-site, so it only swaps
 322   // processes via request transfer.
 323   ShellContentBrowserClient::SetSwapProcessesForRedirect(true);
 324
 325   // Navigate in-process with entry replacement. It will then be transferred
 326   // into a new one due to the call above.
 327   GURL url2 = embedded_test_server()->GetURL("/site_isolation/blank.html?2");
 328   NavigateToURLContentInitiated(shell(), url2, true, true);
 329
 330   // There should be one history entry. url2 should have replaced url1.
 331   EXPECT_TRUE(controller.GetPendingEntry() == NULL);
 332   EXPECT_EQ(1, controller.GetEntryCount());
 333   EXPECT_EQ(0, controller.GetCurrentEntryIndex());
 334   EXPECT_EQ(url2, controller.GetEntryAtIndex(0)->GetURL());
 335
 336   // Now navigate as before, but without replacement.
 337   GURL url3 = embedded_test_server()->GetURL("/site_isolation/blank.html?3");
 338   NavigateToURLContentInitiated(shell(), url3, false, true);
 339
 340   // There should be two history entries. url2 should have replaced url1. url2
 341   // should not have replaced url3.
 342   EXPECT_TRUE(controller.GetPendingEntry() == NULL);
 343   EXPECT_EQ(2, controller.GetEntryCount());
 344   EXPECT_EQ(1, controller.GetCurrentEntryIndex());
 345   EXPECT_EQ(url2, controller.GetEntryAtIndex(0)->GetURL());
 346   EXPECT_EQ(url3, controller.GetEntryAtIndex(1)->GetURL());
 347 }
 348
 349 // Tests that the |should_replace_current_entry| flag persists correctly across
 350 // request transfers that cross processes twice from renderer policy.
 351 IN_PROC_BROWSER_TEST_F(CrossSiteTransferTest,
 352                        MAYBE_ReplaceEntryCrossProcessTwice) {
 353   const NavigationController& controller =
 354       shell()->web_contents()->GetController();
 355
 356   // Navigate to a starting URL, so there is a history entry to replace.
 357   GURL url1 = embedded_test_server()->GetURL("/site_isolation/blank.html?1");
 358   NavigateToURL(shell(), url1);
 359
 360   // Navigate to a page on A.com which redirects to B.com with entry
 361   // replacement. This will switch processes via OpenURL twice. First to A.com,
 362   // and second in response to the server redirect to B.com. The second swap is
 363   // also renderer-initiated via OpenURL because decidePolicyForNavigation is
 364   // currently applied on redirects.
 365   GURL::Replacements replace_host;
 366   GURL url2b =
 367       embedded_test_server()->GetURL("B.com", "/site_isolation/blank.html?2");
 368   GURL url2a = embedded_test_server()->GetURL(
 369       "A.com", "/cross-site/" + url2b.host() + url2b.PathForRequest());
 370   NavigateToURLContentInitiated(shell(), url2a, true, true);
 371
 372   // There should be one history entry. url2b should have replaced url1.
 373   EXPECT_TRUE(controller.GetPendingEntry() == NULL);
 374   EXPECT_EQ(1, controller.GetEntryCount());
 375   EXPECT_EQ(0, controller.GetCurrentEntryIndex());
 376   EXPECT_EQ(url2b, controller.GetEntryAtIndex(0)->GetURL());
 377
 378   // Now repeat without replacement.
 379   GURL url3b =
 380       embedded_test_server()->GetURL("B.com", "/site_isolation/blank.html?3");
 381   GURL url3a = embedded_test_server()->GetURL(
 382       "A.com", "/cross-site/" + url3b.host() + url3b.PathForRequest());
 383   NavigateToURLContentInitiated(shell(), url3a, false, true);
 384
 385   // There should be two history entries. url2b should have replaced url1. url2b
 386   // should not have replaced url3b.
 387   EXPECT_TRUE(controller.GetPendingEntry() == NULL);
 388   EXPECT_EQ(2, controller.GetEntryCount());
 389   EXPECT_EQ(1, controller.GetCurrentEntryIndex());
 390   EXPECT_EQ(url2b, controller.GetEntryAtIndex(0)->GetURL());
 391   EXPECT_EQ(url3b, controller.GetEntryAtIndex(1)->GetURL());
 392 }
 393
 394 // Tests that the request is destroyed when a cross process navigation is
 395 // cancelled.
 396 IN_PROC_BROWSER_TEST_F(CrossSiteTransferTest, NoLeakOnCrossSiteCancel) {
 397   const NavigationController& controller =
 398       shell()->web_contents()->GetController();
 399
 400   // Navigate to a starting URL, so there is a history entry to replace.
 401   GURL url1 = embedded_test_server()->GetURL("/site_isolation/blank.html?1");
 402   NavigateToURL(shell(), url1);
 403
 404   // Force all future navigations to transfer.
 405   ShellContentBrowserClient::SetSwapProcessesForRedirect(true);
 406
 407   NoTransferRequestDelegate no_transfer_request_delegate;
 408   WebContentsDelegate* old_delegate = shell()->web_contents()->GetDelegate();
 409   shell()->web_contents()->SetDelegate(&no_transfer_request_delegate);
 410
 411   // Navigate to a page on A.com with entry replacement. This navigation is
 412   // cross-site, so the renderer will send it to the browser via OpenURL to give
 413   // to a new process. It will then be transferred into yet another process due
 414   // to the call above.
 415   GURL url2 =
 416       embedded_test_server()->GetURL("A.com", "/site_isolation/blank.html?2");
 417   // Used to make sure the second request is cancelled, and there is only one
 418   // request for url2.
 419   tracking_delegate().SetTrackedURL(url2);
 420
 421   // Don't wait for the navigation to complete, since that never happens in
 422   // this case.
 423   NavigateToURLContentInitiated(shell(), url2, false, false);
 424
 425   // There should be one history entry, with url1.
 426   EXPECT_EQ(1, controller.GetEntryCount());
 427   EXPECT_EQ(0, controller.GetCurrentEntryIndex());
 428   EXPECT_EQ(url1, controller.GetEntryAtIndex(0)->GetURL());
 429
 430   // Make sure the request for url2 did not complete.
 431   EXPECT_FALSE(tracking_delegate().WaitForTrackedURLAndGetCompleted());
 432
 433   shell()->web_contents()->SetDelegate(old_delegate);
 434 }
 435
 436 }  // namespace content