content/browser/cross_site_transfer_browsertest.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "base/command_line.h"
   6 #include "base/strings/stringprintf.h"
   7 #include "content/browser/loader/resource_dispatcher_host_impl.h"
   8 #include "content/public/browser/navigation_entry.h"
   9 #include "content/public/browser/resource_dispatcher_host_delegate.h"
  10 #include "content/public/browser/resource_throttle.h"
  11 #include "content/public/browser/web_contents.h"
  12 #include "content/public/common/content_switches.h"
  13 #include "content/public/test/browser_test_utils.h"
  14 #include "content/public/test/content_browser_test.h"
  15 #include "content/public/test/content_browser_test_utils.h"
  16 #include "content/public/test/test_navigation_observer.h"
  17 #include "content/shell/browser/shell.h"
  18 #include "content/shell/browser/shell_content_browser_client.h"
  19 #include "content/shell/browser/shell_resource_dispatcher_host_delegate.h"
  20 #include "net/base/escape.h"
  21 #include "net/dns/mock_host_resolver.h"
  22 #include "net/url_request/url_request.h"
  23 #include "net/url_request/url_request_status.h"
  24 #include "url/gurl.h"
  25
  26 namespace content {
  27
  28 // Tracks a single request for a specified URL, and allows waiting until the
  29 // request is destroyed, and then inspecting whether it completed successfully.
  30 class TrackingResourceDispatcherHostDelegate
  31     : public ShellResourceDispatcherHostDelegate {
  32  public:
  33   TrackingResourceDispatcherHostDelegate() : throttle_created_(false) {
  34   }
  35
  36   virtual void RequestBeginning(
  37       net::URLRequest* request,
  38       ResourceContext* resource_context,
  39       appcache::AppCacheService* appcache_service,
  40       ResourceType::Type resource_type,
  41       int child_id,
  42       int route_id,
  43       ScopedVector<ResourceThrottle>* throttles) OVERRIDE {
  44     CHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
  45     ShellResourceDispatcherHostDelegate::RequestBeginning(
  46         request, resource_context, appcache_service, resource_type, child_id,
  47         route_id, throttles);
  48     // Expect only a single request for the tracked url.
  49     ASSERT_FALSE(throttle_created_);
  50     // If this is a request for the tracked URL, add a throttle to track it.
  51     if (request->url() == tracked_url_)
  52       throttles->push_back(new TrackingThrottle(request, this));
  53   }
  54
  55   // Starts tracking a URL.  The request for previously tracked URL, if any,
  56   // must have been made and deleted before calling this function.
  57   void SetTrackedURL(const GURL& tracked_url) {
  58     CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
  59     // Should not currently be tracking any URL.
  60     ASSERT_FALSE(run_loop_);
  61
  62     // Create a RunLoop that will be stopped once the request for the tracked
  63     // URL has been destroyed, to allow tracking the URL while also waiting for
  64     // other events.
  65     run_loop_.reset(new base::RunLoop());
  66
  67     BrowserThread::PostTask(
  68         BrowserThread::IO, FROM_HERE,
  69         base::Bind(
  70             &TrackingResourceDispatcherHostDelegate::SetTrackedURLOnIOThread,
  71             base::Unretained(this),
  72             tracked_url));
  73   }
  74
  75   // Waits until the tracked URL has been requests, and the request for it has
  76   // been destroyed.
  77   bool WaitForTrackedURLAndGetCompleted() {
  78     CHECK(BrowserThread::CurrentlyOn(BrowserThread::UI));
  79     run_loop_->Run();
  80     run_loop_.reset();
  81     return tracked_request_completed_;
  82   }
  83
  84  private:
  85   // ResourceThrottle attached to request for the tracked URL.  On destruction,
  86   // passes the final URLRequestStatus back to the delegate.
  87   class TrackingThrottle : public ResourceThrottle {
  88    public:
  89     TrackingThrottle(net::URLRequest* request,
  90                      TrackingResourceDispatcherHostDelegate* tracker)
  91         : request_(request), tracker_(tracker) {
  92     }
  93
  94     virtual ~TrackingThrottle() {
  95       // If the request is deleted without being cancelled, its status will
  96       // indicate it succeeded, so have to check if the request is still pending
  97       // as well.
  98       tracker_->OnTrackedRequestDestroyed(
  99           !request_->is_pending() && request_->status().is_success());
 100     }
 101
 102     // ResourceThrottle implementation:
 103     virtual const char* GetNameForLogging() const OVERRIDE {
 104       return "TrackingThrottle";
 105     }
 106
 107    private:
 108     net::URLRequest* request_;
 109     TrackingResourceDispatcherHostDelegate* tracker_;
 110
 111     DISALLOW_COPY_AND_ASSIGN(TrackingThrottle);
 112   };
 113
 114   void SetTrackedURLOnIOThread(const GURL& tracked_url) {
 115     CHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 116     throttle_created_ = false;
 117     tracked_url_ = tracked_url;
 118   }
 119
 120   void OnTrackedRequestDestroyed(bool completed) {
 121     CHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 122     tracked_request_completed_ = completed;
 123     tracked_url_ = GURL();
 124
 125     BrowserThread::PostTask(
 126         BrowserThread::UI, FROM_HERE, run_loop_->QuitClosure());
 127   }
 128
 129   // These live on the IO thread.
 130   GURL tracked_url_;
 131   bool throttle_created_;
 132
 133   // This is created and destroyed on the UI thread, but stopped on the IO
 134   // thread.
 135   scoped_ptr<base::RunLoop> run_loop_;
 136
 137   // Set on the IO thread while |run_loop_| is non-NULL, read on the UI thread
 138   // after deleting run_loop_.
 139   bool tracked_request_completed_;
 140
 141   DISALLOW_COPY_AND_ASSIGN(TrackingResourceDispatcherHostDelegate);
 142 };
 143
 144 // WebContentsDelegate that fails to open a URL when there's a request that
 145 // needs to be transferred between renderers.
 146 class NoTransferRequestDelegate : public WebContentsDelegate {
 147  public:
 148   NoTransferRequestDelegate() {}
 149
 150   virtual WebContents* OpenURLFromTab(WebContents* source,
 151                                       const OpenURLParams& params) OVERRIDE {
 152     bool is_transfer =
 153         (params.transferred_global_request_id != GlobalRequestID());
 154     if (is_transfer)
 155       return NULL;
 156     NavigationController::LoadURLParams load_url_params(params.url);
 157     load_url_params.referrer = params.referrer;
 158     load_url_params.frame_tree_node_id = params.frame_tree_node_id;
 159     load_url_params.transition_type = params.transition;
 160     load_url_params.extra_headers = params.extra_headers;
 161     load_url_params.should_replace_current_entry =
 162         params.should_replace_current_entry;
 163     load_url_params.is_renderer_initiated = true;
 164     source->GetController().LoadURLWithParams(load_url_params);
 165     return source;
 166   }
 167
 168  private:
 169   DISALLOW_COPY_AND_ASSIGN(NoTransferRequestDelegate);
 170 };
 171
 172 class CrossSiteTransferTest : public ContentBrowserTest {
 173  public:
 174   CrossSiteTransferTest() : old_delegate_(NULL) {
 175   }
 176
 177   // ContentBrowserTest implementation:
 178   virtual void SetUpOnMainThread() OVERRIDE {
 179     BrowserThread::PostTask(
 180         BrowserThread::IO, FROM_HERE,
 181         base::Bind(
 182             &CrossSiteTransferTest::InjectResourceDisptcherHostDelegate,
 183             base::Unretained(this)));
 184   }
 185
 186   virtual void TearDownOnMainThread() OVERRIDE {
 187     BrowserThread::PostTask(
 188         BrowserThread::IO, FROM_HERE,
 189         base::Bind(
 190             &CrossSiteTransferTest::RestoreResourceDisptcherHostDelegate,
 191             base::Unretained(this)));
 192   }
 193
 194  protected:
 195   void NavigateToURLContentInitiated(Shell* window,
 196                                      const GURL& url,
 197                                      bool should_replace_current_entry,
 198                                      bool should_wait_for_navigation) {
 199     std::string script;
 200     if (should_replace_current_entry)
 201       script = base::StringPrintf("location.replace('%s')", url.spec().c_str());
 202     else
 203       script = base::StringPrintf("location.href = '%s'", url.spec().c_str());
 204     TestNavigationObserver load_observer(shell()->web_contents(), 1);
 205     bool result = ExecuteScript(window->web_contents(), script);
 206     EXPECT_TRUE(result);
 207     if (should_wait_for_navigation)
 208       load_observer.Wait();
 209   }
 210
 211   virtual void SetUpCommandLine(CommandLine* command_line) OVERRIDE {
 212     // Use --site-per-process to force process swaps for cross-site transfers.
 213     command_line->AppendSwitch(switches::kSitePerProcess);
 214   }
 215
 216   void InjectResourceDisptcherHostDelegate() {
 217     DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 218     old_delegate_ = ResourceDispatcherHostImpl::Get()->delegate();
 219     ResourceDispatcherHostImpl::Get()->SetDelegate(&tracking_delegate_);
 220   }
 221
 222   void RestoreResourceDisptcherHostDelegate() {
 223     DCHECK(BrowserThread::CurrentlyOn(BrowserThread::IO));
 224     ResourceDispatcherHostImpl::Get()->SetDelegate(old_delegate_);
 225     old_delegate_ = NULL;
 226   }
 227
 228   TrackingResourceDispatcherHostDelegate& tracking_delegate() {
 229     return tracking_delegate_;
 230   }
 231
 232  private:
 233   TrackingResourceDispatcherHostDelegate tracking_delegate_;
 234   ResourceDispatcherHostDelegate* old_delegate_;
 235 };
 236
 237 // The following tests crash in the ThreadSanitizer runtime,
 238 // http://crbug.com/356758.
 239 #if defined(THREAD_SANITIZER)
 240 #define MAYBE_ReplaceEntryCrossProcessThenTransfer \
 241     DISABLED_ReplaceEntryCrossProcessThenTransfer
 242 #define MAYBE_ReplaceEntryCrossProcessTwice \
 243     DISABLED_ReplaceEntryCrossProcessTwice
 244 #else
 245 #define MAYBE_ReplaceEntryCrossProcessThenTransfer \
 246     ReplaceEntryCrossProcessThenTransfer
 247 #define MAYBE_ReplaceEntryCrossProcessTwice ReplaceEntryCrossProcessTwice
 248 #endif
 249 // Tests that the |should_replace_current_entry| flag persists correctly across
 250 // request transfers that began with a cross-process navigation.
 251 IN_PROC_BROWSER_TEST_F(CrossSiteTransferTest,
 252                        MAYBE_ReplaceEntryCrossProcessThenTransfer) {
 253   const NavigationController& controller =
 254       shell()->web_contents()->GetController();
 255   host_resolver()->AddRule("*", "127.0.0.1");
 256   ASSERT_TRUE(test_server()->Start());
 257
 258   // These must all stay in scope with replace_host.
 259   GURL::Replacements replace_host;
 260   std::string a_com("A.com");
 261   std::string b_com("B.com");
 262
 263   // Navigate to a starting URL, so there is a history entry to replace.
 264   GURL url1 = test_server()->GetURL("files/site_isolation/blank.html?1");
 265   NavigateToURL(shell(), url1);
 266
 267   // Force all future navigations to transfer. Note that this includes same-site
 268   // navigiations which may cause double process swaps (via OpenURL and then via
 269   // transfer). This test intentionally exercises that case.
 270   ShellContentBrowserClient::SetSwapProcessesForRedirect(true);
 271
 272   // Navigate to a page on A.com with entry replacement. This navigation is
 273   // cross-site, so the renderer will send it to the browser via OpenURL to give
 274   // to a new process. It will then be transferred into yet another process due
 275   // to the call above.
 276   GURL url2 = test_server()->GetURL("files/site_isolation/blank.html?2");
 277   replace_host.SetHostStr(a_com);
 278   url2 = url2.ReplaceComponents(replace_host);
 279   // Used to make sure the request for url2 succeeds, and there was only one of
 280   // them.
 281   tracking_delegate().SetTrackedURL(url2);
 282   NavigateToURLContentInitiated(shell(), url2, true, true);
 283
 284   // There should be one history entry. url2 should have replaced url1.
 285   EXPECT_TRUE(controller.GetPendingEntry() == NULL);
 286   EXPECT_EQ(1, controller.GetEntryCount());
 287   EXPECT_EQ(0, controller.GetCurrentEntryIndex());
 288   EXPECT_EQ(url2, controller.GetEntryAtIndex(0)->GetURL());
 289   // Make sure the request succeeded.
 290   EXPECT_TRUE(tracking_delegate().WaitForTrackedURLAndGetCompleted());
 291
 292   // Now navigate as before to a page on B.com, but normally (without
 293   // replacement). This will still perform a double process-swap as above, via
 294   // OpenURL and then transfer.
 295   GURL url3 = test_server()->GetURL("files/site_isolation/blank.html?3");
 296   replace_host.SetHostStr(b_com);
 297   url3 = url3.ReplaceComponents(replace_host);
 298   // Used to make sure the request for url3 succeeds, and there was only one of
 299   // them.
 300   tracking_delegate().SetTrackedURL(url3);
 301   NavigateToURLContentInitiated(shell(), url3, false, true);
 302
 303   // There should be two history entries. url2 should have replaced url1. url2
 304   // should not have replaced url3.
 305   EXPECT_TRUE(controller.GetPendingEntry() == NULL);
 306   EXPECT_EQ(2, controller.GetEntryCount());
 307   EXPECT_EQ(1, controller.GetCurrentEntryIndex());
 308   EXPECT_EQ(url2, controller.GetEntryAtIndex(0)->GetURL());
 309   EXPECT_EQ(url3, controller.GetEntryAtIndex(1)->GetURL());
 310
 311   // Make sure the request succeeded.
 312   EXPECT_TRUE(tracking_delegate().WaitForTrackedURLAndGetCompleted());
 313 }
 314
 315 // Tests that the |should_replace_current_entry| flag persists correctly across
 316 // request transfers that began with a content-initiated in-process
 317 // navigation. This test is the same as the test above, except transfering from
 318 // in-process.
 319 IN_PROC_BROWSER_TEST_F(CrossSiteTransferTest,
 320                        ReplaceEntryInProcessThenTranfers) {
 321   const NavigationController& controller =
 322       shell()->web_contents()->GetController();
 323   ASSERT_TRUE(test_server()->Start());
 324
 325   // Navigate to a starting URL, so there is a history entry to replace.
 326   GURL url = test_server()->GetURL("files/site_isolation/blank.html?1");
 327   NavigateToURL(shell(), url);
 328
 329   // Force all future navigations to transfer. Note that this includes same-site
 330   // navigiations which may cause double process swaps (via OpenURL and then via
 331   // transfer). All navigations in this test are same-site, so it only swaps
 332   // processes via request transfer.
 333   ShellContentBrowserClient::SetSwapProcessesForRedirect(true);
 334
 335   // Navigate in-process with entry replacement. It will then be transferred
 336   // into a new one due to the call above.
 337   GURL url2 = test_server()->GetURL("files/site_isolation/blank.html?2");
 338   NavigateToURLContentInitiated(shell(), url2, true, true);
 339
 340   // There should be one history entry. url2 should have replaced url1.
 341   EXPECT_TRUE(controller.GetPendingEntry() == NULL);
 342   EXPECT_EQ(1, controller.GetEntryCount());
 343   EXPECT_EQ(0, controller.GetCurrentEntryIndex());
 344   EXPECT_EQ(url2, controller.GetEntryAtIndex(0)->GetURL());
 345
 346   // Now navigate as before, but without replacement.
 347   GURL url3 = test_server()->GetURL("files/site_isolation/blank.html?3");
 348   NavigateToURLContentInitiated(shell(), url3, false, true);
 349
 350   // There should be two history entries. url2 should have replaced url1. url2
 351   // should not have replaced url3.
 352   EXPECT_TRUE(controller.GetPendingEntry() == NULL);
 353   EXPECT_EQ(2, controller.GetEntryCount());
 354   EXPECT_EQ(1, controller.GetCurrentEntryIndex());
 355   EXPECT_EQ(url2, controller.GetEntryAtIndex(0)->GetURL());
 356   EXPECT_EQ(url3, controller.GetEntryAtIndex(1)->GetURL());
 357 }
 358
 359 // Tests that the |should_replace_current_entry| flag persists correctly across
 360 // request transfers that cross processes twice from renderer policy.
 361 IN_PROC_BROWSER_TEST_F(CrossSiteTransferTest,
 362                        MAYBE_ReplaceEntryCrossProcessTwice) {
 363   const NavigationController& controller =
 364       shell()->web_contents()->GetController();
 365   host_resolver()->AddRule("*", "127.0.0.1");
 366   ASSERT_TRUE(test_server()->Start());
 367
 368   // These must all stay in scope with replace_host.
 369   GURL::Replacements replace_host;
 370   std::string a_com("A.com");
 371   std::string b_com("B.com");
 372
 373   // Navigate to a starting URL, so there is a history entry to replace.
 374   GURL url1 = test_server()->GetURL("files/site_isolation/blank.html?1");
 375   NavigateToURL(shell(), url1);
 376
 377   // Navigate to a page on A.com which redirects to B.com with entry
 378   // replacement. This will switch processes via OpenURL twice. First to A.com,
 379   // and second in response to the server redirect to B.com. The second swap is
 380   // also renderer-initiated via OpenURL because decidePolicyForNavigation is
 381   // currently applied on redirects.
 382   GURL url2b = test_server()->GetURL("files/site_isolation/blank.html?2");
 383   replace_host.SetHostStr(b_com);
 384   url2b = url2b.ReplaceComponents(replace_host);
 385   GURL url2a = test_server()->GetURL(
 386       "server-redirect?" + net::EscapeQueryParamValue(url2b.spec(), false));
 387   replace_host.SetHostStr(a_com);
 388   url2a = url2a.ReplaceComponents(replace_host);
 389   NavigateToURLContentInitiated(shell(), url2a, true, true);
 390
 391   // There should be one history entry. url2b should have replaced url1.
 392   EXPECT_TRUE(controller.GetPendingEntry() == NULL);
 393   EXPECT_EQ(1, controller.GetEntryCount());
 394   EXPECT_EQ(0, controller.GetCurrentEntryIndex());
 395   EXPECT_EQ(url2b, controller.GetEntryAtIndex(0)->GetURL());
 396
 397   // Now repeat without replacement.
 398   GURL url3b = test_server()->GetURL("files/site_isolation/blank.html?3");
 399   replace_host.SetHostStr(b_com);
 400   url3b = url3b.ReplaceComponents(replace_host);
 401   GURL url3a = test_server()->GetURL(
 402       "server-redirect?" + net::EscapeQueryParamValue(url3b.spec(), false));
 403   replace_host.SetHostStr(a_com);
 404   url3a = url3a.ReplaceComponents(replace_host);
 405   NavigateToURLContentInitiated(shell(), url3a, false, true);
 406
 407   // There should be two history entries. url2b should have replaced url1. url2b
 408   // should not have replaced url3b.
 409   EXPECT_TRUE(controller.GetPendingEntry() == NULL);
 410   EXPECT_EQ(2, controller.GetEntryCount());
 411   EXPECT_EQ(1, controller.GetCurrentEntryIndex());
 412   EXPECT_EQ(url2b, controller.GetEntryAtIndex(0)->GetURL());
 413   EXPECT_EQ(url3b, controller.GetEntryAtIndex(1)->GetURL());
 414 }
 415
 416 // Tests that the request is destroyed when a cross process navigation is
 417 // cancelled.
 418 IN_PROC_BROWSER_TEST_F(CrossSiteTransferTest, NoLeakOnCrossSiteCancel) {
 419   const NavigationController& controller =
 420       shell()->web_contents()->GetController();
 421   host_resolver()->AddRule("*", "127.0.0.1");
 422   ASSERT_TRUE(test_server()->Start());
 423
 424   // These must all stay in scope with replace_host.
 425   GURL::Replacements replace_host;
 426   std::string a_com("A.com");
 427   std::string b_com("B.com");
 428
 429   // Navigate to a starting URL, so there is a history entry to replace.
 430   GURL url1 = test_server()->GetURL("files/site_isolation/blank.html?1");
 431   NavigateToURL(shell(), url1);
 432
 433   // Force all future navigations to transfer.
 434   ShellContentBrowserClient::SetSwapProcessesForRedirect(true);
 435
 436   NoTransferRequestDelegate no_transfer_request_delegate;
 437   WebContentsDelegate* old_delegate = shell()->web_contents()->GetDelegate();
 438   shell()->web_contents()->SetDelegate(&no_transfer_request_delegate);
 439
 440   // Navigate to a page on A.com with entry replacement. This navigation is
 441   // cross-site, so the renderer will send it to the browser via OpenURL to give
 442   // to a new process. It will then be transferred into yet another process due
 443   // to the call above.
 444   GURL url2 = test_server()->GetURL("files/site_isolation/blank.html?2");
 445   replace_host.SetHostStr(a_com);
 446   url2 = url2.ReplaceComponents(replace_host);
 447   // Used to make sure the second request is cancelled, and there is only one
 448   // request for url2.
 449   tracking_delegate().SetTrackedURL(url2);
 450
 451   // Don't wait for the navigation to complete, since that never happens in
 452   // this case.
 453   NavigateToURLContentInitiated(shell(), url2, false, false);
 454
 455   // There should be one history entry, with url1.
 456   EXPECT_EQ(1, controller.GetEntryCount());
 457   EXPECT_EQ(0, controller.GetCurrentEntryIndex());
 458   EXPECT_EQ(url1, controller.GetEntryAtIndex(0)->GetURL());
 459
 460   // Make sure the request for url2 did not complete.
 461   EXPECT_FALSE(tracking_delegate().WaitForTrackedURLAndGetCompleted());
 462
 463   shell()->web_contents()->SetDelegate(old_delegate);
 464 }
 465
 466 }  // namespace content