content/browser/renderer_host/render_view_host_unittest.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "base/path_service.h"
   6 #include "base/strings/utf_string_conversions.h"
   7 #include "content/browser/child_process_security_policy_impl.h"
   8 #include "content/browser/frame_host/render_frame_host_impl.h"
   9 #include "content/browser/renderer_host/render_message_filter.h"
  10 #include "content/browser/renderer_host/render_view_host_delegate_view.h"
  11 #include "content/browser/renderer_host/render_widget_helper.h"
  12 #include "content/common/input_messages.h"
  13 #include "content/common/view_messages.h"
  14 #include "content/public/browser/browser_context.h"
  15 #include "content/public/browser/navigation_entry.h"
  16 #include "content/public/common/bindings_policy.h"
  17 #include "content/public/common/drop_data.h"
  18 #include "content/public/common/url_constants.h"
  19 #include "content/public/test/mock_render_process_host.h"
  20 #include "content/test/test_content_browser_client.h"
  21 #include "content/test/test_render_view_host.h"
  22 #include "content/test/test_web_contents.h"
  23 #include "net/base/filename_util.h"
  24 #include "third_party/WebKit/public/web/WebDragOperation.h"
  25 #include "ui/base/page_transition_types.h"
  26
  27 namespace content {
  28
  29 class RenderViewHostTestBrowserClient : public TestContentBrowserClient {
  30  public:
  31   RenderViewHostTestBrowserClient() {}
  32   ~RenderViewHostTestBrowserClient() override {}
  33
  34   bool IsHandledURL(const GURL& url) override {
  35     return url.scheme() == url::kFileScheme;
  36   }
  37
  38  private:
  39   DISALLOW_COPY_AND_ASSIGN(RenderViewHostTestBrowserClient);
  40 };
  41
  42 class RenderViewHostTest : public RenderViewHostImplTestHarness {
  43  public:
  44   RenderViewHostTest() : old_browser_client_(NULL) {}
  45   ~RenderViewHostTest() override {}
  46
  47   void SetUp() override {
  48     RenderViewHostImplTestHarness::SetUp();
  49     old_browser_client_ = SetBrowserClientForTesting(&test_browser_client_);
  50   }
  51
  52   void TearDown() override {
  53     SetBrowserClientForTesting(old_browser_client_);
  54     RenderViewHostImplTestHarness::TearDown();
  55   }
  56
  57  private:
  58   RenderViewHostTestBrowserClient test_browser_client_;
  59   ContentBrowserClient* old_browser_client_;
  60
  61   DISALLOW_COPY_AND_ASSIGN(RenderViewHostTest);
  62 };
  63
  64 // All about URLs reported by the renderer should get rewritten to about:blank.
  65 // See RenderViewHost::OnNavigate for a discussion.
  66 TEST_F(RenderViewHostTest, FilterAbout) {
  67   main_test_rfh()->NavigateAndCommitRendererInitiated(
  68       1, true, GURL("about:cache"));
  69   ASSERT_TRUE(controller().GetVisibleEntry());
  70   EXPECT_EQ(GURL(url::kAboutBlankURL),
  71             controller().GetVisibleEntry()->GetURL());
  72 }
  73
  74 // Create a full screen popup RenderWidgetHost and View.
  75 TEST_F(RenderViewHostTest, CreateFullscreenWidget) {
  76   int routing_id = process()->GetNextRoutingID();
  77   test_rvh()->CreateNewFullscreenWidget(routing_id);
  78 }
  79
  80 // Makes sure that the RenderViewHost is not waiting for an unload ack when
  81 // reloading a page. If this is not the case, when reloading, the contents may
  82 // get closed out even though the user pressed the reload button.
  83 TEST_F(RenderViewHostTest, ResetUnloadOnReload) {
  84   const GURL url1("http://foo1");
  85   const GURL url2("http://foo2");
  86
  87   // This test is for a subtle timing bug. Here's the sequence that triggered
  88   // the bug:
  89   // . go to a page.
  90   // . go to a new page, preferably one that takes a while to resolve, such
  91   //   as one on a site that doesn't exist.
  92   //   . After this step IsWaitingForUnloadACK returns true on the first RVH.
  93   // . click stop before the page has been commited.
  94   // . click reload.
  95   //   . IsWaitingForUnloadACK still returns true, and if the hang monitor fires
  96   //     the contents gets closed.
  97
  98   NavigateAndCommit(url1);
  99   controller().LoadURL(
 100       url2, Referrer(), ui::PAGE_TRANSITION_LINK, std::string());
 101   // Simulate the ClosePage call which is normally sent by the net::URLRequest.
 102   test_rvh()->ClosePage();
 103   // Needed so that navigations are not suspended on the RFH.
 104   main_test_rfh()->SendBeforeUnloadACK(true);
 105   contents()->Stop();
 106   controller().Reload(false);
 107   EXPECT_FALSE(main_test_rfh()->IsWaitingForUnloadACK());
 108 }
 109
 110 // Ensure we do not grant bindings to a process shared with unprivileged views.
 111 TEST_F(RenderViewHostTest, DontGrantBindingsToSharedProcess) {
 112   // Create another view in the same process.
 113   scoped_ptr<TestWebContents> new_web_contents(
 114       TestWebContents::Create(browser_context(), rvh()->GetSiteInstance()));
 115
 116   rvh()->AllowBindings(BINDINGS_POLICY_WEB_UI);
 117   EXPECT_FALSE(rvh()->GetEnabledBindings() & BINDINGS_POLICY_WEB_UI);
 118 }
 119
 120 class MockDraggingRenderViewHostDelegateView
 121     : public RenderViewHostDelegateView {
 122  public:
 123   ~MockDraggingRenderViewHostDelegateView() override {}
 124   void StartDragging(const DropData& drop_data,
 125                      blink::WebDragOperationsMask allowed_ops,
 126                      const gfx::ImageSkia& image,
 127                      const gfx::Vector2d& image_offset,
 128                      const DragEventSourceInfo& event_info) override {
 129     drag_url_ = drop_data.url;
 130     html_base_url_ = drop_data.html_base_url;
 131   }
 132   void UpdateDragCursor(blink::WebDragOperation operation) override {}
 133   void GotFocus() override {}
 134   void TakeFocus(bool reverse) override {}
 135   virtual void UpdatePreferredSize(const gfx::Size& pref_size) {}
 136
 137   GURL drag_url() {
 138     return drag_url_;
 139   }
 140
 141   GURL html_base_url() {
 142     return html_base_url_;
 143   }
 144
 145  private:
 146   GURL drag_url_;
 147   GURL html_base_url_;
 148 };
 149
 150 TEST_F(RenderViewHostTest, StartDragging) {
 151   TestWebContents* web_contents = contents();
 152   MockDraggingRenderViewHostDelegateView delegate_view;
 153   web_contents->set_delegate_view(&delegate_view);
 154
 155   DropData drop_data;
 156   GURL file_url = GURL("file:///home/user/secrets.txt");
 157   drop_data.url = file_url;
 158   drop_data.html_base_url = file_url;
 159   test_rvh()->TestOnStartDragging(drop_data);
 160   EXPECT_EQ(GURL(url::kAboutBlankURL), delegate_view.drag_url());
 161   EXPECT_EQ(GURL(url::kAboutBlankURL), delegate_view.html_base_url());
 162
 163   GURL http_url = GURL("http://www.domain.com/index.html");
 164   drop_data.url = http_url;
 165   drop_data.html_base_url = http_url;
 166   test_rvh()->TestOnStartDragging(drop_data);
 167   EXPECT_EQ(http_url, delegate_view.drag_url());
 168   EXPECT_EQ(http_url, delegate_view.html_base_url());
 169
 170   GURL https_url = GURL("https://www.domain.com/index.html");
 171   drop_data.url = https_url;
 172   drop_data.html_base_url = https_url;
 173   test_rvh()->TestOnStartDragging(drop_data);
 174   EXPECT_EQ(https_url, delegate_view.drag_url());
 175   EXPECT_EQ(https_url, delegate_view.html_base_url());
 176
 177   GURL javascript_url = GURL("javascript:alert('I am a bookmarklet')");
 178   drop_data.url = javascript_url;
 179   drop_data.html_base_url = http_url;
 180   test_rvh()->TestOnStartDragging(drop_data);
 181   EXPECT_EQ(javascript_url, delegate_view.drag_url());
 182   EXPECT_EQ(http_url, delegate_view.html_base_url());
 183 }
 184
 185 TEST_F(RenderViewHostTest, DragEnteredFileURLsStillBlocked) {
 186   DropData dropped_data;
 187   gfx::Point client_point;
 188   gfx::Point screen_point;
 189   // We use "//foo/bar" path (rather than "/foo/bar") since dragged paths are
 190   // expected to be absolute on any platforms.
 191   base::FilePath highlighted_file_path(FILE_PATH_LITERAL("//tmp/foo.html"));
 192   base::FilePath dragged_file_path(FILE_PATH_LITERAL("//tmp/image.jpg"));
 193   base::FilePath sensitive_file_path(FILE_PATH_LITERAL("//etc/passwd"));
 194   GURL highlighted_file_url = net::FilePathToFileURL(highlighted_file_path);
 195   GURL dragged_file_url = net::FilePathToFileURL(dragged_file_path);
 196   GURL sensitive_file_url = net::FilePathToFileURL(sensitive_file_path);
 197   dropped_data.url = highlighted_file_url;
 198   dropped_data.filenames.push_back(
 199       ui::FileInfo(dragged_file_path, base::FilePath()));
 200
 201   rvh()->DragTargetDragEnter(dropped_data, client_point, screen_point,
 202                               blink::WebDragOperationNone, 0);
 203
 204   int id = process()->GetID();
 205   ChildProcessSecurityPolicyImpl* policy =
 206       ChildProcessSecurityPolicyImpl::GetInstance();
 207
 208   EXPECT_FALSE(policy->CanRequestURL(id, highlighted_file_url));
 209   EXPECT_FALSE(policy->CanReadFile(id, highlighted_file_path));
 210   EXPECT_TRUE(policy->CanRequestURL(id, dragged_file_url));
 211   EXPECT_TRUE(policy->CanReadFile(id, dragged_file_path));
 212   EXPECT_FALSE(policy->CanRequestURL(id, sensitive_file_url));
 213   EXPECT_FALSE(policy->CanReadFile(id, sensitive_file_path));
 214 }
 215
 216 TEST_F(RenderViewHostTest, MessageWithBadHistoryItemFiles) {
 217   base::FilePath file_path;
 218   EXPECT_TRUE(PathService::Get(base::DIR_TEMP, &file_path));
 219   file_path = file_path.AppendASCII("foo");
 220   EXPECT_EQ(0, process()->bad_msg_count());
 221   test_rvh()->TestOnUpdateStateWithFile(-1, file_path);
 222   EXPECT_EQ(1, process()->bad_msg_count());
 223
 224   ChildProcessSecurityPolicyImpl::GetInstance()->GrantReadFile(
 225       process()->GetID(), file_path);
 226   test_rvh()->TestOnUpdateStateWithFile(-1, file_path);
 227   EXPECT_EQ(1, process()->bad_msg_count());
 228 }
 229
 230 TEST_F(RenderViewHostTest, NavigationWithBadHistoryItemFiles) {
 231   GURL url("http://www.google.com");
 232   base::FilePath file_path;
 233   EXPECT_TRUE(PathService::Get(base::DIR_TEMP, &file_path));
 234   file_path = file_path.AppendASCII("bar");
 235   EXPECT_EQ(0, process()->bad_msg_count());
 236   main_test_rfh()->SendRendererInitiatedNavigationRequest(url, false);
 237   main_test_rfh()->PrepareForCommit();
 238   contents()->GetMainFrame()->SendNavigateWithFile(1, 1, true, url, file_path);
 239   EXPECT_EQ(1, process()->bad_msg_count());
 240
 241   ChildProcessSecurityPolicyImpl::GetInstance()->GrantReadFile(
 242       process()->GetID(), file_path);
 243   main_test_rfh()->SendRendererInitiatedNavigationRequest(url, false);
 244   main_test_rfh()->PrepareForCommit();
 245   contents()->GetMainFrame()->SendNavigateWithFile(2, 2, true, url, file_path);
 246   EXPECT_EQ(1, process()->bad_msg_count());
 247 }
 248
 249 TEST_F(RenderViewHostTest, RoutingIdSane) {
 250   RenderFrameHostImpl* root_rfh =
 251       contents()->GetFrameTree()->root()->current_frame_host();
 252   EXPECT_EQ(contents()->GetMainFrame(), root_rfh);
 253   EXPECT_EQ(test_rvh()->GetProcess(), root_rfh->GetProcess());
 254   EXPECT_NE(test_rvh()->GetRoutingID(), root_rfh->routing_id());
 255 }
 256
 257 class TestSaveImageFromDataURL : public RenderMessageFilter {
 258  public:
 259   TestSaveImageFromDataURL(
 260       BrowserContext* context)
 261       : RenderMessageFilter(
 262             0,
 263             nullptr,
 264             context,
 265             context->GetRequestContext(),
 266             nullptr,
 267             nullptr,
 268             nullptr,
 269             nullptr) {
 270     Reset();
 271   }
 272
 273   void Reset() {
 274     url_string_ = std::string();
 275     is_downloaded_ = false;
 276   }
 277
 278   std::string& UrlString() const {
 279     return url_string_;
 280   }
 281
 282   bool IsDownloaded() const {
 283     return is_downloaded_;
 284   }
 285
 286   void Test(const std::string& url) {
 287     OnMessageReceived(ViewHostMsg_SaveImageFromDataURL(0, url));
 288   }
 289
 290  protected:
 291   ~TestSaveImageFromDataURL() override {}
 292   void DownloadUrl(int render_view_id,
 293                    const GURL& url,
 294                    const Referrer& referrer,
 295                    const base::string16& suggested_name,
 296                    const bool use_prompt) const override {
 297     url_string_ = url.spec();
 298     is_downloaded_ = true;
 299   }
 300
 301  private:
 302   mutable std::string url_string_;
 303   mutable bool is_downloaded_;
 304 };
 305
 306 TEST_F(RenderViewHostTest, SaveImageFromDataURL) {
 307   scoped_refptr<TestSaveImageFromDataURL> tester(
 308       new TestSaveImageFromDataURL(browser_context()));
 309
 310   tester->Reset();
 311   tester->Test("http://non-data-url.com");
 312   EXPECT_EQ(tester->UrlString(), "");
 313   EXPECT_FALSE(tester->IsDownloaded());
 314
 315   const std::string data_url = "data:image/gif;base64,"
 316       "R0lGODlhAQABAIAAAAUEBAAAACwAAAAAAQABAAACAkQBADs=";
 317
 318   tester->Reset();
 319   tester->Test(data_url);
 320   EXPECT_EQ(tester->UrlString(), data_url);
 321   EXPECT_TRUE(tester->IsDownloaded());
 322 }
 323
 324 }  // namespace content