content/common/cross_site_document_classifier_unittest.cc

   1 // Copyright 2015 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "base/strings/string_piece.h"
   6 #include "content/common/cross_site_document_classifier.h"
   7 #include "testing/gtest/include/gtest/gtest.h"
   8
   9 using base::StringPiece;
  10
  11 namespace content {
  12
  13 TEST(CrossSiteDocumentClassifierTest, IsBlockableScheme) {
  14   GURL data_url("data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA==");
  15   GURL ftp_url("ftp://google.com");
  16   GURL mailto_url("mailto:google@google.com");
  17   GURL about_url("about:chrome");
  18   GURL http_url("http://google.com");
  19   GURL https_url("https://google.com");
  20
  21   EXPECT_FALSE(CrossSiteDocumentClassifier::IsBlockableScheme(data_url));
  22   EXPECT_FALSE(CrossSiteDocumentClassifier::IsBlockableScheme(ftp_url));
  23   EXPECT_FALSE(CrossSiteDocumentClassifier::IsBlockableScheme(mailto_url));
  24   EXPECT_FALSE(CrossSiteDocumentClassifier::IsBlockableScheme(about_url));
  25   EXPECT_TRUE(CrossSiteDocumentClassifier::IsBlockableScheme(http_url));
  26   EXPECT_TRUE(CrossSiteDocumentClassifier::IsBlockableScheme(https_url));
  27 }
  28
  29 TEST(CrossSiteDocumentClassifierTest, IsSameSite) {
  30   GURL a_com_url0("https://mock1.a.com:8080/page1.html");
  31   GURL a_com_url1("https://mock2.a.com:9090/page2.html");
  32   GURL a_com_url2("https://a.com/page3.html");
  33   EXPECT_TRUE(CrossSiteDocumentClassifier::IsSameSite(a_com_url0, a_com_url1));
  34   EXPECT_TRUE(CrossSiteDocumentClassifier::IsSameSite(a_com_url1, a_com_url2));
  35   EXPECT_TRUE(CrossSiteDocumentClassifier::IsSameSite(a_com_url2, a_com_url0));
  36
  37   GURL b_com_url0("https://mock1.b.com/index.html");
  38   EXPECT_FALSE(CrossSiteDocumentClassifier::IsSameSite(a_com_url0, b_com_url0));
  39
  40   GURL about_blank_url("about:blank");
  41   EXPECT_FALSE(
  42       CrossSiteDocumentClassifier::IsSameSite(a_com_url0, about_blank_url));
  43
  44   GURL chrome_url("chrome://extension");
  45   EXPECT_FALSE(CrossSiteDocumentClassifier::IsSameSite(a_com_url0, chrome_url));
  46
  47   GURL empty_url("");
  48   EXPECT_FALSE(CrossSiteDocumentClassifier::IsSameSite(a_com_url0, empty_url));
  49 }
  50
  51 TEST(CrossSiteDocumentClassifierTest, IsValidCorsHeaderSet) {
  52   GURL frame_origin("http://www.google.com");
  53   GURL site_origin("http://www.yahoo.com");
  54
  55   EXPECT_TRUE(CrossSiteDocumentClassifier::IsValidCorsHeaderSet(
  56       frame_origin, site_origin, "*"));
  57   EXPECT_FALSE(CrossSiteDocumentClassifier::IsValidCorsHeaderSet(
  58       frame_origin, site_origin, "\"*\""));
  59   EXPECT_TRUE(CrossSiteDocumentClassifier::IsValidCorsHeaderSet(
  60       frame_origin, site_origin, "http://mail.google.com"));
  61   EXPECT_FALSE(CrossSiteDocumentClassifier::IsValidCorsHeaderSet(
  62       frame_origin, site_origin, "https://mail.google.com"));
  63   EXPECT_FALSE(CrossSiteDocumentClassifier::IsValidCorsHeaderSet(
  64       frame_origin, site_origin, "http://yahoo.com"));
  65   EXPECT_FALSE(CrossSiteDocumentClassifier::IsValidCorsHeaderSet(
  66       frame_origin, site_origin, "www.google.com"));
  67 }
  68
  69 TEST(CrossSiteDocumentClassifierTest, SniffForHTML) {
  70   StringPiece html_data("  \t\r\n    <HtMladfokadfkado");
  71   StringPiece comment_html_data(" <!-- this is comment --> <html><body>");
  72   StringPiece two_comments_html_data(
  73       "<!-- this is comment -->\n<!-- this is comment --><html><body>");
  74   StringPiece mixed_comments_html_data(
  75       "<!-- this is comment <!-- --> <script></script>");
  76   StringPiece non_html_data("        var name=window.location;\nadfadf");
  77   StringPiece comment_js_data(" <!-- this is comment -> document.write(1); ");
  78   StringPiece empty_data("");
  79
  80   EXPECT_TRUE(CrossSiteDocumentClassifier::SniffForHTML(html_data));
  81   EXPECT_TRUE(CrossSiteDocumentClassifier::SniffForHTML(comment_html_data));
  82   EXPECT_TRUE(
  83       CrossSiteDocumentClassifier::SniffForHTML(two_comments_html_data));
  84   EXPECT_TRUE(
  85       CrossSiteDocumentClassifier::SniffForHTML(mixed_comments_html_data));
  86   EXPECT_FALSE(CrossSiteDocumentClassifier::SniffForHTML(non_html_data));
  87   EXPECT_FALSE(CrossSiteDocumentClassifier::SniffForHTML(comment_js_data));
  88
  89   // Basic bounds check.
  90   EXPECT_FALSE(CrossSiteDocumentClassifier::SniffForHTML(empty_data));
  91 }
  92
  93 TEST(CrossSiteDocumentClassifierTest, SniffForXML) {
  94   StringPiece xml_data("   \t \r \n     <?xml version=\"1.0\"?>\n <catalog");
  95   StringPiece non_xml_data("        var name=window.location;\nadfadf");
  96   StringPiece empty_data("");
  97
  98   EXPECT_TRUE(CrossSiteDocumentClassifier::SniffForXML(xml_data));
  99   EXPECT_FALSE(CrossSiteDocumentClassifier::SniffForXML(non_xml_data));
 100
 101   // Basic bounds check.
 102   EXPECT_FALSE(CrossSiteDocumentClassifier::SniffForXML(empty_data));
 103 }
 104
 105 TEST(CrossSiteDocumentClassifierTest, SniffForJSON) {
 106   StringPiece json_data("\t\t\r\n   { \"name\" : \"chrome\", ");
 107   StringPiece non_json_data0("\t\t\r\n   { name : \"chrome\", ");
 108   StringPiece non_json_data1("\t\t\r\n   foo({ \"name\" : \"chrome\", ");
 109   StringPiece empty_data("");
 110
 111   EXPECT_TRUE(CrossSiteDocumentClassifier::SniffForJSON(json_data));
 112   EXPECT_FALSE(CrossSiteDocumentClassifier::SniffForJSON(non_json_data0));
 113   EXPECT_FALSE(CrossSiteDocumentClassifier::SniffForJSON(non_json_data1));
 114
 115   // Basic bounds check.
 116   EXPECT_FALSE(CrossSiteDocumentClassifier::SniffForJSON(empty_data));
 117 }
 118
 119 }  // namespace content