content/browser/security_exploit_browsertest.cc

   1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "base/command_line.h"
   6 #include "base/containers/hash_tables.h"
   7 #include "base/strings/utf_string_conversions.h"
   8 #include "content/browser/dom_storage/dom_storage_context_wrapper.h"
   9 #include "content/browser/dom_storage/session_storage_namespace_impl.h"
  10 #include "content/browser/frame_host/navigator.h"
  11 #include "content/browser/renderer_host/render_view_host_factory.h"
  12 #include "content/browser/renderer_host/render_view_host_impl.h"
  13 #include "content/browser/web_contents/web_contents_impl.h"
  14 #include "content/common/frame_messages.h"
  15 #include "content/common/view_messages.h"
  16 #include "content/public/browser/browser_context.h"
  17 #include "content/public/browser/interstitial_page.h"
  18 #include "content/public/browser/interstitial_page_delegate.h"
  19 #include "content/public/browser/storage_partition.h"
  20 #include "content/public/common/content_switches.h"
  21 #include "content/public/test/browser_test_utils.h"
  22 #include "content/public/test/content_browser_test.h"
  23 #include "content/public/test/content_browser_test_utils.h"
  24 #include "content/public/test/test_utils.h"
  25 #include "content/shell/browser/shell.h"
  26 #include "ipc/ipc_security_test_util.h"
  27 #include "net/dns/mock_host_resolver.h"
  28 #include "net/test/embedded_test_server/embedded_test_server.h"
  29
  30 using IPC::IpcSecurityTestUtil;
  31
  32 namespace content {
  33
  34 namespace {
  35
  36 // This is a helper function for the tests which attempt to create a
  37 // duplicate RenderViewHost or RenderWidgetHost. It tries to create two objects
  38 // with the same process and routing ids, which causes a collision.
  39 // It creates a couple of windows in process 1, which causes a few routing ids
  40 // to be allocated. Then a cross-process navigation is initiated, which causes a
  41 // new process 2 to be created and have a pending RenderViewHost for it. The
  42 // routing id of the RenderViewHost which is target for a duplicate is set
  43 // into |target_routing_id| and the pending RenderViewHost which is used for
  44 // the attempt is the return value.
  45 RenderViewHostImpl* PrepareToDuplicateHosts(Shell* shell,
  46                                             int* target_routing_id) {
  47   GURL foo("http://foo.com/simple_page.html");
  48
  49   // Start off with initial navigation, so we get the first process allocated.
  50   NavigateToURL(shell, foo);
  51   EXPECT_EQ(base::ASCIIToUTF16("OK"), shell->web_contents()->GetTitle());
  52
  53   // Open another window, so we generate some more routing ids.
  54   ShellAddedObserver shell2_observer;
  55   EXPECT_TRUE(ExecuteScript(
  56       shell->web_contents(), "window.open(document.URL + '#2');"));
  57   Shell* shell2 = shell2_observer.GetShell();
  58
  59   // The new window must be in the same process, but have a new routing id.
  60   EXPECT_EQ(shell->web_contents()->GetRenderViewHost()->GetProcess()->GetID(),
  61             shell2->web_contents()->GetRenderViewHost()->GetProcess()->GetID());
  62   *target_routing_id =
  63       shell2->web_contents()->GetRenderViewHost()->GetRoutingID();
  64   EXPECT_NE(*target_routing_id,
  65             shell->web_contents()->GetRenderViewHost()->GetRoutingID());
  66
  67   // Now, simulate a link click coming from the renderer.
  68   GURL extension_url("https://bar.com/simple_page.html");
  69   WebContentsImpl* wc = static_cast<WebContentsImpl*>(shell->web_contents());
  70   wc->GetFrameTree()->root()->navigator()->RequestOpenURL(
  71       wc->GetFrameTree()->root()->current_frame_host(), extension_url, nullptr,
  72       Referrer(), CURRENT_TAB, false, true);
  73
  74   // Since the navigation above requires a cross-process swap, there will be a
  75   // pending RenderViewHost. Ensure it exists and is in a different process
  76   // than the initial page.
  77   RenderViewHostImpl* pending_rvh =
  78       wc->GetRenderManagerForTesting()->pending_render_view_host();
  79   EXPECT_TRUE(pending_rvh != NULL);
  80   EXPECT_NE(shell->web_contents()->GetRenderViewHost()->GetProcess()->GetID(),
  81             pending_rvh->GetProcess()->GetID());
  82
  83   return pending_rvh;
  84 }
  85
  86 }  // namespace
  87
  88
  89 // The goal of these tests will be to "simulate" exploited renderer processes,
  90 // which can send arbitrary IPC messages and confuse browser process internal
  91 // state, leading to security bugs. We are trying to verify that the browser
  92 // doesn't perform any dangerous operations in such cases.
  93 class SecurityExploitBrowserTest : public ContentBrowserTest {
  94  public:
  95   SecurityExploitBrowserTest() {}
  96
  97   void SetUpCommandLine(base::CommandLine* command_line) override {
  98     ASSERT_TRUE(embedded_test_server()->InitializeAndWaitUntilReady());
  99
 100     // Add a host resolver rule to map all outgoing requests to the test server.
 101     // This allows us to use "real" hostnames in URLs, which we can use to
 102     // create arbitrary SiteInstances.
 103     command_line->AppendSwitchASCII(
 104         switches::kHostResolverRules,
 105         "MAP * " +
 106             net::HostPortPair::FromURL(embedded_test_server()->base_url())
 107                 .ToString() +
 108             ",EXCLUDE localhost");
 109   }
 110 };
 111
 112 // Ensure that we kill the renderer process if we try to give it WebUI
 113 // properties and it doesn't have enabled WebUI bindings.
 114 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, SetWebUIProperty) {
 115   GURL foo("http://foo.com/simple_page.html");
 116
 117   NavigateToURL(shell(), foo);
 118   EXPECT_EQ(base::ASCIIToUTF16("OK"), shell()->web_contents()->GetTitle());
 119   EXPECT_EQ(0,
 120       shell()->web_contents()->GetRenderViewHost()->GetEnabledBindings());
 121
 122   content::RenderProcessHostWatcher terminated(
 123       shell()->web_contents(),
 124       content::RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT);
 125   shell()->web_contents()->GetRenderViewHost()->SetWebUIProperty(
 126       "toolkit", "views");
 127   terminated.Wait();
 128 }
 129
 130 // This is a test for crbug.com/312016 attempting to create duplicate
 131 // RenderViewHosts. SetupForDuplicateHosts sets up this test case and leaves
 132 // it in a state with pending RenderViewHost. Before the commit of the new
 133 // pending RenderViewHost, this test case creates a new window through the new
 134 // process.
 135 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
 136                        AttemptDuplicateRenderViewHost) {
 137   int duplicate_routing_id = MSG_ROUTING_NONE;
 138   RenderViewHostImpl* pending_rvh =
 139       PrepareToDuplicateHosts(shell(), &duplicate_routing_id);
 140   EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id);
 141
 142   // Since this test executes on the UI thread and hopping threads might cause
 143   // different timing in the test, let's simulate a CreateNewWindow call coming
 144   // from the IO thread.
 145   ViewHostMsg_CreateWindow_Params params;
 146   DOMStorageContextWrapper* dom_storage_context =
 147       static_cast<DOMStorageContextWrapper*>(
 148           BrowserContext::GetStoragePartition(
 149               shell()->web_contents()->GetBrowserContext(),
 150               pending_rvh->GetSiteInstance())->GetDOMStorageContext());
 151   scoped_refptr<SessionStorageNamespaceImpl> session_storage(
 152       new SessionStorageNamespaceImpl(dom_storage_context));
 153   // Cause a deliberate collision in routing ids.
 154   int main_frame_routing_id = duplicate_routing_id + 1;
 155   pending_rvh->CreateNewWindow(duplicate_routing_id,
 156                                main_frame_routing_id,
 157                                params,
 158                                session_storage.get());
 159
 160   // If the above operation doesn't cause a crash, the test has succeeded!
 161 }
 162
 163 // This is a test for crbug.com/312016. It tries to create two RenderWidgetHosts
 164 // with the same process and routing ids, which causes a collision. It is almost
 165 // identical to the AttemptDuplicateRenderViewHost test case.
 166 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
 167                        AttemptDuplicateRenderWidgetHost) {
 168   int duplicate_routing_id = MSG_ROUTING_NONE;
 169   RenderViewHostImpl* pending_rvh =
 170       PrepareToDuplicateHosts(shell(), &duplicate_routing_id);
 171   EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id);
 172
 173   // Since this test executes on the UI thread and hopping threads might cause
 174   // different timing in the test, let's simulate a CreateNewWidget call coming
 175   // from the IO thread.  Use the existing window routing id to cause a
 176   // deliberate collision.
 177   pending_rvh->CreateNewWidget(duplicate_routing_id, blink::WebPopupTypeSelect);
 178
 179   // If the above operation doesn't crash, the test has succeeded!
 180 }
 181
 182 class SecurityExploitTestInterstitialPage : public InterstitialPageDelegate {
 183  public:
 184   explicit SecurityExploitTestInterstitialPage(WebContents* contents) {
 185     InterstitialPage* interstitial = InterstitialPage::Create(
 186         contents, true, contents->GetLastCommittedURL(), this);
 187     interstitial->Show();
 188   }
 189
 190   // InterstitialPageDelegate implementation.
 191   void CommandReceived(const std::string& command) override {
 192     last_command_ = command;
 193   }
 194
 195   std::string GetHTMLContents() override {
 196     return "<html><head><script>"
 197            "window.domAutomationController.setAutomationId(1);"
 198            "window.domAutomationController.send(\"okay\");"
 199            "</script></head>"
 200            "<body>this page is an interstitial</body></html>";
 201   }
 202
 203   std::string last_command() { return last_command_; }
 204
 205  private:
 206   std::string last_command_;
 207   DISALLOW_COPY_AND_ASSIGN(SecurityExploitTestInterstitialPage);
 208 };
 209
 210 // Fails due to InterstitialPage's reliance on PostNonNestableTask
 211 // http://crbug.com/432737
 212 #if defined(OS_ANDROID)
 213 #define MAYBE_InterstitialCommandFromUnderlyingContent \
 214   DISABLED_InterstitialCommandFromUnderlyingContent
 215 #else
 216 #define MAYBE_InterstitialCommandFromUnderlyingContent \
 217   InterstitialCommandFromUnderlyingContent
 218 #endif
 219
 220 // The interstitial should not be controllable by the underlying content.
 221 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
 222                        MAYBE_InterstitialCommandFromUnderlyingContent) {
 223   // Start off with initial navigation, to allocate the process.
 224   GURL foo("http://foo.com/simple_page.html");
 225   NavigateToURL(shell(), foo);
 226   EXPECT_EQ(base::ASCIIToUTF16("OK"), shell()->web_contents()->GetTitle());
 227
 228   DOMMessageQueue message_queue;
 229
 230   // Install and show an interstitial page.
 231   SecurityExploitTestInterstitialPage* interstitial =
 232       new SecurityExploitTestInterstitialPage(shell()->web_contents());
 233
 234   ASSERT_EQ("", interstitial->last_command());
 235   content::WaitForInterstitialAttach(shell()->web_contents());
 236
 237   InterstitialPage* interstitial_page =
 238       shell()->web_contents()->GetInterstitialPage();
 239   ASSERT_TRUE(interstitial_page != NULL);
 240   ASSERT_TRUE(shell()->web_contents()->ShowingInterstitialPage());
 241   ASSERT_TRUE(interstitial_page->GetDelegateForTesting() == interstitial);
 242
 243   // The interstitial page ought to be able to send a message.
 244   std::string message;
 245   ASSERT_TRUE(message_queue.WaitForMessage(&message));
 246   ASSERT_EQ("\"okay\"", message);
 247   ASSERT_EQ("\"okay\"", interstitial->last_command());
 248
 249   // Send an automation message from the underlying content and wait for it to
 250   // be dispatched on this thread. This message should not be received by the
 251   // interstitial.
 252   content::RenderFrameHost* compromised_renderer =
 253       shell()->web_contents()->GetMainFrame();
 254   FrameHostMsg_DomOperationResponse evil(compromised_renderer->GetRoutingID(),
 255                                          "evil", MSG_ROUTING_NONE);
 256   IpcSecurityTestUtil::PwnMessageReceived(
 257       compromised_renderer->GetProcess()->GetChannel(), evil);
 258
 259   ASSERT_TRUE(message_queue.WaitForMessage(&message));
 260   ASSERT_EQ("evil", message)
 261       << "Automation message should be received by WebContents.";
 262   ASSERT_EQ("\"okay\"", interstitial->last_command())
 263       << "Interstitial should not be affected.";
 264
 265   // Send a second message from the interstitial page, and make sure that the
 266   // "evil" message doesn't arrive in the intervening period.
 267   ASSERT_TRUE(content::ExecuteScript(
 268       interstitial_page->GetMainFrame(),
 269       "window.domAutomationController.send(\"okay2\");"));
 270   ASSERT_TRUE(message_queue.WaitForMessage(&message));
 271   ASSERT_EQ("\"okay2\"", message);
 272   ASSERT_EQ("\"okay2\"", interstitial->last_command());
 273 }
 274
 275 }  // namespace content