content/browser/security_exploit_browsertest.cc

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "base/command_line.h"
   6 #include "base/containers/hash_tables.h"
   7 #include "content/browser/dom_storage/dom_storage_context_wrapper.h"
   8 #include "content/browser/dom_storage/session_storage_namespace_impl.h"
   9 #include "content/browser/renderer_host/render_view_host_factory.h"
  10 #include "content/browser/renderer_host/render_view_host_impl.h"
  11 #include "content/browser/web_contents/web_contents_impl.h"
  12 #include "content/common/view_messages.h"
  13 #include "content/public/browser/browser_context.h"
  14 #include "content/public/browser/storage_partition.h"
  15 #include "content/public/common/content_switches.h"
  16 #include "content/public/test/browser_test_utils.h"
  17 #include "content/public/test/test_utils.h"
  18 #include "content/shell/browser/shell.h"
  19 #include "content/test/content_browser_test.h"
  20 #include "content/test/content_browser_test_utils.h"
  21
  22 namespace content {
  23
  24 namespace {
  25
  26 // This is a helper function for the tests which attempt to create a
  27 // duplicate RenderViewHost or RenderWidgetHost. It tries to create two objects
  28 // with the same process and routing ids, which causes a collision.
  29 // It creates a couple of windows in process 1, which causes a few routing ids
  30 // to be allocated. Then a cross-process navigation is initiated, which causes a
  31 // new process 2 to be created and have a pending RenderViewHost for it. The
  32 // routing id of the RenderViewHost which is target for a duplicate is set
  33 // into |target_routing_id| and the pending RenderViewHost which is used for
  34 // the attempt is the return value.
  35 RenderViewHostImpl* PrepareToDuplicateHosts(Shell* shell,
  36                                             int* target_routing_id) {
  37   GURL foo("http://foo.com/files/simple_page.html");
  38
  39   // Start off with initial navigation, so we get the first process allocated.
  40   NavigateToURL(shell, foo);
  41
  42   // Open another window, so we generate some more routing ids.
  43   ShellAddedObserver shell2_observer;
  44   EXPECT_TRUE(ExecuteScript(
  45       shell->web_contents(), "window.open(document.URL + '#2');"));
  46   Shell* shell2 = shell2_observer.GetShell();
  47
  48   // The new window must be in the same process, but have a new routing id.
  49   EXPECT_EQ(shell->web_contents()->GetRenderViewHost()->GetProcess()->GetID(),
  50             shell2->web_contents()->GetRenderViewHost()->GetProcess()->GetID());
  51   *target_routing_id =
  52       shell2->web_contents()->GetRenderViewHost()->GetRoutingID();
  53   EXPECT_NE(*target_routing_id,
  54             shell->web_contents()->GetRenderViewHost()->GetRoutingID());
  55
  56   // Now, simulate a link click coming from the renderer.
  57   GURL extension_url("https://bar.com/files/simple_page.html");
  58   WebContentsImpl* wc = static_cast<WebContentsImpl*>(shell->web_contents());
  59   wc->RequestOpenURL(
  60       shell->web_contents()->GetRenderViewHost(), extension_url,
  61       Referrer(), CURRENT_TAB, wc->GetFrameTree()->root()->frame_id(),
  62       false, true);
  63
  64   // Since the navigation above requires a cross-process swap, there will be a
  65   // pending RenderViewHost. Ensure it exists and is in a different process
  66   // than the initial page.
  67   RenderViewHostImpl* pending_rvh =
  68       wc->GetRenderManagerForTesting()->pending_render_view_host();
  69   EXPECT_TRUE(pending_rvh != NULL);
  70   EXPECT_NE(shell->web_contents()->GetRenderViewHost()->GetProcess()->GetID(),
  71             pending_rvh->GetProcess()->GetID());
  72
  73   return pending_rvh;
  74 }
  75
  76 }  // namespace
  77
  78
  79 // The goal of these tests will be to "simulate" exploited renderer processes,
  80 // which can send arbitrary IPC messages and confuse browser process internal
  81 // state, leading to security bugs. We are trying to verify that the browser
  82 // doesn't perform any dangerous operations in such cases.
  83 class SecurityExploitBrowserTest : public ContentBrowserTest {
  84  public:
  85   SecurityExploitBrowserTest() {}
  86   virtual void SetUpCommandLine(CommandLine* command_line) OVERRIDE {
  87     ASSERT_TRUE(test_server()->Start());
  88
  89     // Add a host resolver rule to map all outgoing requests to the test server.
  90     // This allows us to use "real" hostnames in URLs, which we can use to
  91     // create arbitrary SiteInstances.
  92     command_line->AppendSwitchASCII(
  93         switches::kHostResolverRules,
  94         "MAP * " + test_server()->host_port_pair().ToString() +
  95             ",EXCLUDE localhost");
  96   }
  97 };
  98
  99 // Ensure that we kill the renderer process if we try to give it WebUI
 100 // properties and it doesn't have enabled WebUI bindings.
 101 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, SetWebUIProperty) {
 102   GURL foo("http://foo.com/files/simple_page.html");
 103
 104   NavigateToURL(shell(), foo);
 105   EXPECT_EQ(0,
 106       shell()->web_contents()->GetRenderViewHost()->GetEnabledBindings());
 107
 108   content::RenderProcessHostWatcher terminated(
 109       shell()->web_contents(),
 110       content::RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
 111   shell()->web_contents()->GetRenderViewHost()->SetWebUIProperty(
 112       "toolkit", "views");
 113   terminated.Wait();
 114 }
 115
 116 // This is a test for crbug.com/312016 attempting to create duplicate
 117 // RenderViewHosts. SetupForDuplicateHosts sets up this test case and leaves
 118 // it in a state with pending RenderViewHost. Before the commit of the new
 119 // pending RenderViewHost, this test case creates a new window through the new
 120 // process.
 121 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
 122                        AttemptDuplicateRenderViewHost) {
 123   int duplicate_routing_id = MSG_ROUTING_NONE;
 124   RenderViewHostImpl* pending_rvh =
 125       PrepareToDuplicateHosts(shell(), &duplicate_routing_id);
 126   EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id);
 127
 128   // Since this test executes on the UI thread and hopping threads might cause
 129   // different timing in the test, let's simulate a CreateNewWindow call coming
 130   // from the IO thread.
 131   ViewHostMsg_CreateWindow_Params params;
 132   DOMStorageContextWrapper* dom_storage_context =
 133       static_cast<DOMStorageContextWrapper*>(
 134           BrowserContext::GetStoragePartition(
 135               shell()->web_contents()->GetBrowserContext(),
 136               pending_rvh->GetSiteInstance())->GetDOMStorageContext());
 137   scoped_refptr<SessionStorageNamespaceImpl> session_storage(
 138       new SessionStorageNamespaceImpl(dom_storage_context));
 139   // Cause a deliberate collision in routing ids.
 140   int main_frame_routing_id = duplicate_routing_id + 1;
 141   pending_rvh->CreateNewWindow(
 142       duplicate_routing_id, main_frame_routing_id, params, session_storage);
 143
 144   // If the above operation doesn't cause a crash, the test has succeeded!
 145 }
 146
 147 // This is a test for crbug.com/312016. It tries to create two RenderWidgetHosts
 148 // with the same process and routing ids, which causes a collision. It is almost
 149 // identical to the AttemptDuplicateRenderViewHost test case.
 150 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
 151                        AttemptDuplicateRenderWidgetHost) {
 152   int duplicate_routing_id = MSG_ROUTING_NONE;
 153   RenderViewHostImpl* pending_rvh =
 154       PrepareToDuplicateHosts(shell(), &duplicate_routing_id);
 155   EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id);
 156
 157   // Since this test executes on the UI thread and hopping threads might cause
 158   // different timing in the test, let's simulate a CreateNewWidget call coming
 159   // from the IO thread.  Use the existing window routing id to cause a
 160   // deliberate collision.
 161   pending_rvh->CreateNewWidget(duplicate_routing_id, blink::WebPopupTypeSelect);
 162
 163   // If the above operation doesn't crash, the test has succeeded!
 164 }
 165
 166 }  // namespace content