| /* |
| * Copyright (C) 2011 Google Inc. All rights reserved. |
| * |
| * Redistribution and use in source and binary forms, with or without |
| * modification, are permitted provided that the following conditions are |
| * met: |
| * |
| * * Redistributions of source code must retain the above copyright |
| * notice, this list of conditions and the following disclaimer. |
| * * Redistributions in binary form must reproduce the above |
| * copyright notice, this list of conditions and the following disclaimer |
| * in the documentation and/or other materials provided with the |
| * distribution. |
| * * Neither the name of Google Inc. nor the names of its |
| * contributors may be used to endorse or promote products derived from |
| * this software without specific prior written permission. |
| * |
| * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
| * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT |
| * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR |
| * A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT |
| * OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, |
| * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT |
| * LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, |
| * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY |
| * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT |
| * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE |
| * OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE. |
| */ |
| |
| #include "platform/testing/URLTestHelpers.h" |
| #include "platform/testing/UnitTestHelpers.h" |
| #include "public/platform/Platform.h" |
| #include "public/platform/WebString.h" |
| #include "public/platform/WebThread.h" |
| #include "public/platform/WebURL.h" |
| #include "public/platform/WebURLLoader.h" |
| #include "public/platform/WebURLLoaderClient.h" |
| #include "public/platform/WebURLLoaderMockFactory.h" |
| #include "public/platform/WebURLRequest.h" |
| #include "public/platform/WebURLResponse.h" |
| #include "public/web/WebCache.h" |
| #include "public/web/WebFrame.h" |
| #include "public/web/WebURLLoaderOptions.h" |
| #include "public/web/WebView.h" |
| #include "testing/gtest/include/gtest/gtest.h" |
| #include "web/tests/FrameTestHelpers.h" |
| #include "wtf/PtrUtil.h" |
| #include "wtf/text/CString.h" |
| #include "wtf/text/WTFString.h" |
| #include <memory> |
| |
| using blink::URLTestHelpers::toKURL; |
| using blink::testing::runPendingTasks; |
| |
| namespace blink { |
| |
| class AssociatedURLLoaderTest : public ::testing::Test, |
| public WebURLLoaderClient { |
| public: |
| AssociatedURLLoaderTest() |
| : m_willFollowRedirect(false), |
| m_didSendData(false), |
| m_didReceiveResponse(false), |
| m_didReceiveData(false), |
| m_didReceiveCachedMetadata(false), |
| m_didFinishLoading(false), |
| m_didFail(false) { |
| // Reuse one of the test files from WebFrameTest. |
| m_baseFilePath = testing::blinkRootDir(); |
| m_baseFilePath.append("/Source/web/tests/data/"); |
| m_frameFilePath = m_baseFilePath; |
| m_frameFilePath.append("iframes_test.html"); |
| } |
| |
| KURL RegisterMockedUrl(const std::string& urlRoot, |
| const WTF::String& filename) { |
| WebURLResponse response; |
| response.setMIMEType("text/html"); |
| WTF::String localPath = m_baseFilePath; |
| localPath.append(filename); |
| KURL url = toKURL(urlRoot + filename.utf8().data()); |
| Platform::current()->getURLLoaderMockFactory()->registerURL(url, response, |
| localPath); |
| return url; |
| } |
| |
| void SetUp() override { |
| m_helper.initialize(); |
| |
| std::string urlRoot = "http://www.test.com/"; |
| KURL url = RegisterMockedUrl(urlRoot, "iframes_test.html"); |
| const char* iframeSupportFiles[] = { |
| "invisible_iframe.html", "visible_iframe.html", |
| "zero_sized_iframe.html", |
| }; |
| for (size_t i = 0; i < WTF_ARRAY_LENGTH(iframeSupportFiles); ++i) { |
| RegisterMockedUrl(urlRoot, iframeSupportFiles[i]); |
| } |
| |
| FrameTestHelpers::loadFrame(mainFrame(), url.getString().utf8().data()); |
| |
| Platform::current()->getURLLoaderMockFactory()->unregisterURL(url); |
| } |
| |
| void TearDown() override { |
| Platform::current()->getURLLoaderMockFactory()->unregisterAllURLs(); |
| WebCache::clear(); |
| } |
| |
| void serveRequests() { |
| Platform::current()->getURLLoaderMockFactory()->serveAsynchronousRequests(); |
| } |
| |
| std::unique_ptr<WebURLLoader> createAssociatedURLLoader( |
| const WebURLLoaderOptions options = WebURLLoaderOptions()) { |
| return wrapUnique(mainFrame()->createAssociatedURLLoader(options)); |
| } |
| |
| // WebURLLoaderClient implementation. |
| void willFollowRedirect(WebURLLoader* loader, |
| WebURLRequest& newRequest, |
| const WebURLResponse& redirectResponse, |
| int64_t encodedDataLength) override { |
| m_willFollowRedirect = true; |
| EXPECT_EQ(m_expectedLoader.get(), loader); |
| EXPECT_EQ(m_expectedNewRequest.url(), newRequest.url()); |
| // Check that CORS simple headers are transferred to the new request. |
| EXPECT_EQ(m_expectedNewRequest.httpHeaderField("accept"), |
| newRequest.httpHeaderField("accept")); |
| EXPECT_EQ(m_expectedRedirectResponse.url(), redirectResponse.url()); |
| EXPECT_EQ(m_expectedRedirectResponse.httpStatusCode(), |
| redirectResponse.httpStatusCode()); |
| EXPECT_EQ(m_expectedRedirectResponse.mimeType(), |
| redirectResponse.mimeType()); |
| } |
| |
| void didSendData(WebURLLoader* loader, |
| unsigned long long bytesSent, |
| unsigned long long totalBytesToBeSent) override { |
| m_didSendData = true; |
| EXPECT_EQ(m_expectedLoader.get(), loader); |
| } |
| |
| void didReceiveResponse(WebURLLoader* loader, |
| const WebURLResponse& response) override { |
| m_didReceiveResponse = true; |
| m_actualResponse = WebURLResponse(response); |
| EXPECT_EQ(m_expectedLoader.get(), loader); |
| EXPECT_EQ(m_expectedResponse.url(), response.url()); |
| EXPECT_EQ(m_expectedResponse.httpStatusCode(), response.httpStatusCode()); |
| } |
| |
| void didDownloadData(WebURLLoader* loader, |
| int dataLength, |
| int encodedDataLength) override { |
| m_didDownloadData = true; |
| EXPECT_EQ(m_expectedLoader.get(), loader); |
| } |
| |
| void didReceiveData(WebURLLoader* loader, |
| const char* data, |
| int dataLength, |
| int encodedDataLength, |
| int encodedBodyLength) override { |
| m_didReceiveData = true; |
| EXPECT_EQ(m_expectedLoader.get(), loader); |
| EXPECT_TRUE(data); |
| EXPECT_GT(dataLength, 0); |
| } |
| |
| void didReceiveCachedMetadata(WebURLLoader* loader, |
| const char* data, |
| int dataLength) override { |
| m_didReceiveCachedMetadata = true; |
| EXPECT_EQ(m_expectedLoader.get(), loader); |
| } |
| |
| void didFinishLoading(WebURLLoader* loader, |
| double finishTime, |
| int64_t encodedDataLength) override { |
| m_didFinishLoading = true; |
| EXPECT_EQ(m_expectedLoader.get(), loader); |
| } |
| |
| void didFail(WebURLLoader* loader, const WebURLError& error) override { |
| m_didFail = true; |
| EXPECT_EQ(m_expectedLoader.get(), loader); |
| } |
| |
| void CheckMethodFails(const char* unsafeMethod) { |
| WebURLRequest request; |
| request.setURL(toKURL("http://www.test.com/success.html")); |
| request.setHTTPMethod(WebString::fromUTF8(unsafeMethod)); |
| WebURLLoaderOptions options; |
| options.untrustedHTTP = true; |
| CheckFails(request, options); |
| } |
| |
| void CheckHeaderFails(const char* headerField) { |
| CheckHeaderFails(headerField, "foo"); |
| } |
| |
| void CheckHeaderFails(const char* headerField, const char* headerValue) { |
| WebURLRequest request; |
| request.setURL(toKURL("http://www.test.com/success.html")); |
| if (equalIgnoringASCIICase(WebString::fromUTF8(headerField), "referer")) |
| request.setHTTPReferrer(WebString::fromUTF8(headerValue), |
| WebReferrerPolicyDefault); |
| else |
| request.setHTTPHeaderField(WebString::fromUTF8(headerField), |
| WebString::fromUTF8(headerValue)); |
| WebURLLoaderOptions options; |
| options.untrustedHTTP = true; |
| CheckFails(request, options); |
| } |
| |
| void CheckFails(const WebURLRequest& request, |
| WebURLLoaderOptions options = WebURLLoaderOptions()) { |
| m_expectedLoader = createAssociatedURLLoader(options); |
| EXPECT_TRUE(m_expectedLoader); |
| m_didFail = false; |
| m_expectedLoader->loadAsynchronously(request, this); |
| // Failure should not be reported synchronously. |
| EXPECT_FALSE(m_didFail); |
| // Allow the loader to return the error. |
| runPendingTasks(); |
| EXPECT_TRUE(m_didFail); |
| EXPECT_FALSE(m_didReceiveResponse); |
| } |
| |
| bool CheckAccessControlHeaders(const char* headerName, bool exposed) { |
| std::string id("http://www.other.com/CheckAccessControlExposeHeaders_"); |
| id.append(headerName); |
| if (exposed) |
| id.append("-Exposed"); |
| id.append(".html"); |
| |
| KURL url = toKURL(id); |
| WebURLRequest request; |
| request.setURL(url); |
| |
| WebString headerNameString(WebString::fromUTF8(headerName)); |
| m_expectedResponse = WebURLResponse(); |
| m_expectedResponse.setMIMEType("text/html"); |
| m_expectedResponse.setHTTPStatusCode(200); |
| m_expectedResponse.addHTTPHeaderField("Access-Control-Allow-Origin", "*"); |
| if (exposed) |
| m_expectedResponse.addHTTPHeaderField("access-control-expose-headers", |
| headerNameString); |
| m_expectedResponse.addHTTPHeaderField(headerNameString, "foo"); |
| Platform::current()->getURLLoaderMockFactory()->registerURL( |
| url, m_expectedResponse, m_frameFilePath); |
| |
| WebURLLoaderOptions options; |
| options.crossOriginRequestPolicy = |
| WebURLLoaderOptions::CrossOriginRequestPolicyUseAccessControl; |
| m_expectedLoader = createAssociatedURLLoader(options); |
| EXPECT_TRUE(m_expectedLoader); |
| m_expectedLoader->loadAsynchronously(request, this); |
| serveRequests(); |
| EXPECT_TRUE(m_didReceiveResponse); |
| EXPECT_TRUE(m_didReceiveData); |
| EXPECT_TRUE(m_didFinishLoading); |
| |
| return !m_actualResponse.httpHeaderField(headerNameString).isEmpty(); |
| } |
| |
| WebFrame* mainFrame() const { return m_helper.webView()->mainFrame(); } |
| |
| protected: |
| String m_baseFilePath; |
| String m_frameFilePath; |
| FrameTestHelpers::WebViewHelper m_helper; |
| |
| std::unique_ptr<WebURLLoader> m_expectedLoader; |
| WebURLResponse m_actualResponse; |
| WebURLResponse m_expectedResponse; |
| WebURLRequest m_expectedNewRequest; |
| WebURLResponse m_expectedRedirectResponse; |
| bool m_willFollowRedirect; |
| bool m_didSendData; |
| bool m_didReceiveResponse; |
| bool m_didDownloadData; |
| bool m_didReceiveData; |
| bool m_didReceiveCachedMetadata; |
| bool m_didFinishLoading; |
| bool m_didFail; |
| }; |
| |
| // Test a successful same-origin URL load. |
| TEST_F(AssociatedURLLoaderTest, SameOriginSuccess) { |
| KURL url = toKURL("http://www.test.com/SameOriginSuccess.html"); |
| WebURLRequest request; |
| request.setURL(url); |
| |
| m_expectedResponse = WebURLResponse(); |
| m_expectedResponse.setMIMEType("text/html"); |
| m_expectedResponse.setHTTPStatusCode(200); |
| Platform::current()->getURLLoaderMockFactory()->registerURL( |
| url, m_expectedResponse, m_frameFilePath); |
| |
| m_expectedLoader = createAssociatedURLLoader(); |
| EXPECT_TRUE(m_expectedLoader); |
| m_expectedLoader->loadAsynchronously(request, this); |
| serveRequests(); |
| EXPECT_TRUE(m_didReceiveResponse); |
| EXPECT_TRUE(m_didReceiveData); |
| EXPECT_TRUE(m_didFinishLoading); |
| } |
| |
| // Test that the same-origin restriction is the default. |
| TEST_F(AssociatedURLLoaderTest, SameOriginRestriction) { |
| // This is cross-origin since the frame was loaded from www.test.com. |
| KURL url = toKURL("http://www.other.com/SameOriginRestriction.html"); |
| WebURLRequest request; |
| request.setURL(url); |
| CheckFails(request); |
| } |
| |
| // Test a successful cross-origin load. |
| TEST_F(AssociatedURLLoaderTest, CrossOriginSuccess) { |
| // This is cross-origin since the frame was loaded from www.test.com. |
| KURL url = toKURL("http://www.other.com/CrossOriginSuccess"); |
| WebURLRequest request; |
| request.setURL(url); |
| // No-CORS requests (CrossOriginRequestPolicyAllow) aren't allowed for the |
| // default context. So we set the context as Script here. |
| request.setRequestContext(WebURLRequest::RequestContextScript); |
| |
| m_expectedResponse = WebURLResponse(); |
| m_expectedResponse.setMIMEType("text/html"); |
| m_expectedResponse.setHTTPStatusCode(200); |
| Platform::current()->getURLLoaderMockFactory()->registerURL( |
| url, m_expectedResponse, m_frameFilePath); |
| |
| WebURLLoaderOptions options; |
| options.crossOriginRequestPolicy = |
| WebURLLoaderOptions::CrossOriginRequestPolicyAllow; |
| m_expectedLoader = createAssociatedURLLoader(options); |
| EXPECT_TRUE(m_expectedLoader); |
| m_expectedLoader->loadAsynchronously(request, this); |
| serveRequests(); |
| EXPECT_TRUE(m_didReceiveResponse); |
| EXPECT_TRUE(m_didReceiveData); |
| EXPECT_TRUE(m_didFinishLoading); |
| } |
| |
| // Test a successful cross-origin load using CORS. |
| TEST_F(AssociatedURLLoaderTest, CrossOriginWithAccessControlSuccess) { |
| // This is cross-origin since the frame was loaded from www.test.com. |
| KURL url = |
| toKURL("http://www.other.com/CrossOriginWithAccessControlSuccess.html"); |
| WebURLRequest request; |
| request.setURL(url); |
| |
| m_expectedResponse = WebURLResponse(); |
| m_expectedResponse.setMIMEType("text/html"); |
| m_expectedResponse.setHTTPStatusCode(200); |
| m_expectedResponse.addHTTPHeaderField("access-control-allow-origin", "*"); |
| Platform::current()->getURLLoaderMockFactory()->registerURL( |
| url, m_expectedResponse, m_frameFilePath); |
| |
| WebURLLoaderOptions options; |
| options.crossOriginRequestPolicy = |
| WebURLLoaderOptions::CrossOriginRequestPolicyUseAccessControl; |
| m_expectedLoader = createAssociatedURLLoader(options); |
| EXPECT_TRUE(m_expectedLoader); |
| m_expectedLoader->loadAsynchronously(request, this); |
| serveRequests(); |
| EXPECT_TRUE(m_didReceiveResponse); |
| EXPECT_TRUE(m_didReceiveData); |
| EXPECT_TRUE(m_didFinishLoading); |
| } |
| |
| // Test an unsuccessful cross-origin load using CORS. |
| TEST_F(AssociatedURLLoaderTest, CrossOriginWithAccessControlFailure) { |
| // This is cross-origin since the frame was loaded from www.test.com. |
| KURL url = |
| toKURL("http://www.other.com/CrossOriginWithAccessControlFailure.html"); |
| WebURLRequest request; |
| request.setURL(url); |
| |
| m_expectedResponse = WebURLResponse(); |
| m_expectedResponse.setMIMEType("text/html"); |
| m_expectedResponse.setHTTPStatusCode(200); |
| m_expectedResponse.addHTTPHeaderField("access-control-allow-origin", "*"); |
| Platform::current()->getURLLoaderMockFactory()->registerURL( |
| url, m_expectedResponse, m_frameFilePath); |
| |
| WebURLLoaderOptions options; |
| // Send credentials. This will cause the CORS checks to fail, because |
| // credentials can't be sent to a server which returns the header |
| // "access-control-allow-origin" with "*" as its value. |
| options.allowCredentials = true; |
| options.crossOriginRequestPolicy = |
| WebURLLoaderOptions::CrossOriginRequestPolicyUseAccessControl; |
| m_expectedLoader = createAssociatedURLLoader(options); |
| EXPECT_TRUE(m_expectedLoader); |
| m_expectedLoader->loadAsynchronously(request, this); |
| |
| // Failure should not be reported synchronously. |
| EXPECT_FALSE(m_didFail); |
| // The loader needs to receive the response, before doing the CORS check. |
| serveRequests(); |
| EXPECT_TRUE(m_didFail); |
| EXPECT_FALSE(m_didReceiveResponse); |
| } |
| |
| // Test an unsuccessful cross-origin load using CORS. |
| TEST_F(AssociatedURLLoaderTest, |
| CrossOriginWithAccessControlFailureBadStatusCode) { |
| // This is cross-origin since the frame was loaded from www.test.com. |
| KURL url = |
| toKURL("http://www.other.com/CrossOriginWithAccessControlFailure.html"); |
| WebURLRequest request; |
| request.setURL(url); |
| |
| m_expectedResponse = WebURLResponse(); |
| m_expectedResponse.setMIMEType("text/html"); |
| m_expectedResponse.setHTTPStatusCode(0); |
| m_expectedResponse.addHTTPHeaderField("access-control-allow-origin", "*"); |
| Platform::current()->getURLLoaderMockFactory()->registerURL( |
| url, m_expectedResponse, m_frameFilePath); |
| |
| WebURLLoaderOptions options; |
| options.crossOriginRequestPolicy = |
| WebURLLoaderOptions::CrossOriginRequestPolicyUseAccessControl; |
| m_expectedLoader = createAssociatedURLLoader(options); |
| EXPECT_TRUE(m_expectedLoader); |
| m_expectedLoader->loadAsynchronously(request, this); |
| |
| // Failure should not be reported synchronously. |
| EXPECT_FALSE(m_didFail); |
| // The loader needs to receive the response, before doing the CORS check. |
| serveRequests(); |
| EXPECT_TRUE(m_didFail); |
| EXPECT_FALSE(m_didReceiveResponse); |
| } |
| |
| // Test a same-origin URL redirect and load. |
| TEST_F(AssociatedURLLoaderTest, RedirectSuccess) { |
| KURL url = toKURL("http://www.test.com/RedirectSuccess.html"); |
| char redirect[] = "http://www.test.com/RedirectSuccess2.html"; // Same-origin |
| KURL redirectURL = toKURL(redirect); |
| |
| WebURLRequest request; |
| request.setURL(url); |
| |
| m_expectedRedirectResponse = WebURLResponse(); |
| m_expectedRedirectResponse.setMIMEType("text/html"); |
| m_expectedRedirectResponse.setHTTPStatusCode(301); |
| m_expectedRedirectResponse.setHTTPHeaderField("Location", redirect); |
| Platform::current()->getURLLoaderMockFactory()->registerURL( |
| url, m_expectedRedirectResponse, m_frameFilePath); |
| |
| m_expectedNewRequest = WebURLRequest(); |
| m_expectedNewRequest.setURL(redirectURL); |
| |
| m_expectedResponse = WebURLResponse(); |
| m_expectedResponse.setMIMEType("text/html"); |
| m_expectedResponse.setHTTPStatusCode(200); |
| Platform::current()->getURLLoaderMockFactory()->registerURL( |
| redirectURL, m_expectedResponse, m_frameFilePath); |
| |
| m_expectedLoader = createAssociatedURLLoader(); |
| EXPECT_TRUE(m_expectedLoader); |
| m_expectedLoader->loadAsynchronously(request, this); |
| serveRequests(); |
| EXPECT_TRUE(m_willFollowRedirect); |
| EXPECT_TRUE(m_didReceiveResponse); |
| EXPECT_TRUE(m_didReceiveData); |
| EXPECT_TRUE(m_didFinishLoading); |
| } |
| |
| // Test a cross-origin URL redirect without Access Control set. |
| TEST_F(AssociatedURLLoaderTest, RedirectCrossOriginFailure) { |
| KURL url = toKURL("http://www.test.com/RedirectCrossOriginFailure.html"); |
| char redirect[] = |
| "http://www.other.com/RedirectCrossOriginFailure.html"; // Cross-origin |
| KURL redirectURL = toKURL(redirect); |
| |
| WebURLRequest request; |
| request.setURL(url); |
| |
| m_expectedRedirectResponse = WebURLResponse(); |
| m_expectedRedirectResponse.setMIMEType("text/html"); |
| m_expectedRedirectResponse.setHTTPStatusCode(301); |
| m_expectedRedirectResponse.setHTTPHeaderField("Location", redirect); |
| Platform::current()->getURLLoaderMockFactory()->registerURL( |
| url, m_expectedRedirectResponse, m_frameFilePath); |
| |
| m_expectedNewRequest = WebURLRequest(); |
| m_expectedNewRequest.setURL(redirectURL); |
| |
| m_expectedResponse = WebURLResponse(); |
| m_expectedResponse.setMIMEType("text/html"); |
| m_expectedResponse.setHTTPStatusCode(200); |
| Platform::current()->getURLLoaderMockFactory()->registerURL( |
| redirectURL, m_expectedResponse, m_frameFilePath); |
| |
| m_expectedLoader = createAssociatedURLLoader(); |
| EXPECT_TRUE(m_expectedLoader); |
| m_expectedLoader->loadAsynchronously(request, this); |
| |
| serveRequests(); |
| EXPECT_FALSE(m_willFollowRedirect); |
| EXPECT_FALSE(m_didReceiveResponse); |
| EXPECT_FALSE(m_didReceiveData); |
| EXPECT_FALSE(m_didFinishLoading); |
| } |
| |
| // Test that a cross origin redirect response without CORS headers fails. |
| TEST_F(AssociatedURLLoaderTest, RedirectCrossOriginWithAccessControlFailure) { |
| KURL url = toKURL( |
| "http://www.test.com/RedirectCrossOriginWithAccessControlFailure.html"); |
| char redirect[] = |
| "http://www.other.com/" |
| "RedirectCrossOriginWithAccessControlFailure.html"; // Cross-origin |
| KURL redirectURL = toKURL(redirect); |
| |
| WebURLRequest request; |
| request.setURL(url); |
| |
| m_expectedRedirectResponse = WebURLResponse(); |
| m_expectedRedirectResponse.setMIMEType("text/html"); |
| m_expectedRedirectResponse.setHTTPStatusCode(301); |
| m_expectedRedirectResponse.setHTTPHeaderField("Location", redirect); |
| Platform::current()->getURLLoaderMockFactory()->registerURL( |
| url, m_expectedRedirectResponse, m_frameFilePath); |
| |
| m_expectedNewRequest = WebURLRequest(); |
| m_expectedNewRequest.setURL(redirectURL); |
| |
| m_expectedResponse = WebURLResponse(); |
| m_expectedResponse.setMIMEType("text/html"); |
| m_expectedResponse.setHTTPStatusCode(200); |
| Platform::current()->getURLLoaderMockFactory()->registerURL( |
| redirectURL, m_expectedResponse, m_frameFilePath); |
| |
| WebURLLoaderOptions options; |
| options.crossOriginRequestPolicy = |
| WebURLLoaderOptions::CrossOriginRequestPolicyUseAccessControl; |
| m_expectedLoader = createAssociatedURLLoader(options); |
| EXPECT_TRUE(m_expectedLoader); |
| m_expectedLoader->loadAsynchronously(request, this); |
| |
| serveRequests(); |
| // We should get a notification about access control check failure. |
| EXPECT_FALSE(m_willFollowRedirect); |
| EXPECT_FALSE(m_didReceiveResponse); |
| EXPECT_FALSE(m_didReceiveData); |
| EXPECT_TRUE(m_didFail); |
| } |
| |
| // Test that a cross origin redirect response with CORS headers that allow the |
| // requesting origin succeeds. |
| TEST_F(AssociatedURLLoaderTest, RedirectCrossOriginWithAccessControlSuccess) { |
| KURL url = toKURL( |
| "http://www.test.com/RedirectCrossOriginWithAccessControlSuccess.html"); |
| char redirect[] = |
| "http://www.other.com/" |
| "RedirectCrossOriginWithAccessControlSuccess.html"; // Cross-origin |
| KURL redirectURL = toKURL(redirect); |
| |
| WebURLRequest request; |
| request.setURL(url); |
| // Add a CORS simple header. |
| request.setHTTPHeaderField("accept", "application/json"); |
| |
| // Create a redirect response that allows the redirect to pass the access |
| // control checks. |
| m_expectedRedirectResponse = WebURLResponse(); |
| m_expectedRedirectResponse.setMIMEType("text/html"); |
| m_expectedRedirectResponse.setHTTPStatusCode(301); |
| m_expectedRedirectResponse.setHTTPHeaderField("Location", redirect); |
| m_expectedRedirectResponse.addHTTPHeaderField("access-control-allow-origin", |
| "*"); |
| Platform::current()->getURLLoaderMockFactory()->registerURL( |
| url, m_expectedRedirectResponse, m_frameFilePath); |
| |
| m_expectedNewRequest = WebURLRequest(); |
| m_expectedNewRequest.setURL(redirectURL); |
| m_expectedNewRequest.setHTTPHeaderField("accept", "application/json"); |
| |
| m_expectedResponse = WebURLResponse(); |
| m_expectedResponse.setMIMEType("text/html"); |
| m_expectedResponse.setHTTPStatusCode(200); |
| m_expectedResponse.addHTTPHeaderField("access-control-allow-origin", "*"); |
| Platform::current()->getURLLoaderMockFactory()->registerURL( |
| redirectURL, m_expectedResponse, m_frameFilePath); |
| |
| WebURLLoaderOptions options; |
| options.crossOriginRequestPolicy = |
| WebURLLoaderOptions::CrossOriginRequestPolicyUseAccessControl; |
| m_expectedLoader = createAssociatedURLLoader(options); |
| EXPECT_TRUE(m_expectedLoader); |
| m_expectedLoader->loadAsynchronously(request, this); |
| serveRequests(); |
| // We should not receive a notification for the redirect. |
| EXPECT_FALSE(m_willFollowRedirect); |
| EXPECT_TRUE(m_didReceiveResponse); |
| EXPECT_TRUE(m_didReceiveData); |
| EXPECT_TRUE(m_didFinishLoading); |
| } |
| |
| // Test that untrusted loads can't use a forbidden method. |
| TEST_F(AssociatedURLLoaderTest, UntrustedCheckMethods) { |
| // Check non-token method fails. |
| CheckMethodFails("GET()"); |
| CheckMethodFails("POST\x0d\x0ax-csrf-token:\x20test1234"); |
| |
| // Forbidden methods should fail regardless of casing. |
| CheckMethodFails("CoNneCt"); |
| CheckMethodFails("TrAcK"); |
| CheckMethodFails("TrAcE"); |
| } |
| |
| // This test is flaky on Windows and Android. See <http://crbug.com/471645>. |
| #if OS(WIN) || OS(ANDROID) |
| #define MAYBE_UntrustedCheckHeaders DISABLED_UntrustedCheckHeaders |
| #else |
| #define MAYBE_UntrustedCheckHeaders UntrustedCheckHeaders |
| #endif |
| |
| // Test that untrusted loads can't use a forbidden header field. |
| TEST_F(AssociatedURLLoaderTest, MAYBE_UntrustedCheckHeaders) { |
| // Check non-token header fails. |
| CheckHeaderFails("foo()"); |
| |
| // Check forbidden headers fail. |
| CheckHeaderFails("accept-charset"); |
| CheckHeaderFails("accept-encoding"); |
| CheckHeaderFails("connection"); |
| CheckHeaderFails("content-length"); |
| CheckHeaderFails("cookie"); |
| CheckHeaderFails("cookie2"); |
| CheckHeaderFails("date"); |
| CheckHeaderFails("dnt"); |
| CheckHeaderFails("expect"); |
| CheckHeaderFails("host"); |
| CheckHeaderFails("keep-alive"); |
| CheckHeaderFails("origin"); |
| CheckHeaderFails("referer", "http://example.com/"); |
| CheckHeaderFails("te"); |
| CheckHeaderFails("trailer"); |
| CheckHeaderFails("transfer-encoding"); |
| CheckHeaderFails("upgrade"); |
| CheckHeaderFails("user-agent"); |
| CheckHeaderFails("via"); |
| |
| CheckHeaderFails("proxy-"); |
| CheckHeaderFails("proxy-foo"); |
| CheckHeaderFails("sec-"); |
| CheckHeaderFails("sec-foo"); |
| |
| // Check that validation is case-insensitive. |
| CheckHeaderFails("AcCePt-ChArSeT"); |
| CheckHeaderFails("ProXy-FoO"); |
| |
| // Check invalid header values. |
| CheckHeaderFails("foo", "bar\x0d\x0ax-csrf-token:\x20test1234"); |
| } |
| |
| // Test that the loader filters response headers according to the CORS standard. |
| TEST_F(AssociatedURLLoaderTest, CrossOriginHeaderWhitelisting) { |
| // Test that whitelisted headers are returned without exposing them. |
| EXPECT_TRUE(CheckAccessControlHeaders("cache-control", false)); |
| EXPECT_TRUE(CheckAccessControlHeaders("content-language", false)); |
| EXPECT_TRUE(CheckAccessControlHeaders("content-type", false)); |
| EXPECT_TRUE(CheckAccessControlHeaders("expires", false)); |
| EXPECT_TRUE(CheckAccessControlHeaders("last-modified", false)); |
| EXPECT_TRUE(CheckAccessControlHeaders("pragma", false)); |
| |
| // Test that non-whitelisted headers aren't returned. |
| EXPECT_FALSE(CheckAccessControlHeaders("non-whitelisted", false)); |
| |
| // Test that Set-Cookie headers aren't returned. |
| EXPECT_FALSE(CheckAccessControlHeaders("Set-Cookie", false)); |
| EXPECT_FALSE(CheckAccessControlHeaders("Set-Cookie2", false)); |
| |
| // Test that exposed headers that aren't whitelisted are returned. |
| EXPECT_TRUE(CheckAccessControlHeaders("non-whitelisted", true)); |
| |
| // Test that Set-Cookie headers aren't returned, even if exposed. |
| EXPECT_FALSE(CheckAccessControlHeaders("Set-Cookie", true)); |
| } |
| |
| // Test that the loader can allow non-whitelisted response headers for trusted |
| // CORS loads. |
| TEST_F(AssociatedURLLoaderTest, CrossOriginHeaderAllowResponseHeaders) { |
| WebURLRequest request; |
| KURL url = |
| toKURL("http://www.other.com/CrossOriginHeaderAllowResponseHeaders.html"); |
| request.setURL(url); |
| |
| WebString headerNameString(WebString::fromUTF8("non-whitelisted")); |
| m_expectedResponse = WebURLResponse(); |
| m_expectedResponse.setMIMEType("text/html"); |
| m_expectedResponse.setHTTPStatusCode(200); |
| m_expectedResponse.addHTTPHeaderField("Access-Control-Allow-Origin", "*"); |
| m_expectedResponse.addHTTPHeaderField(headerNameString, "foo"); |
| Platform::current()->getURLLoaderMockFactory()->registerURL( |
| url, m_expectedResponse, m_frameFilePath); |
| |
| WebURLLoaderOptions options; |
| options.exposeAllResponseHeaders = |
| true; // This turns off response whitelisting. |
| options.crossOriginRequestPolicy = |
| WebURLLoaderOptions::CrossOriginRequestPolicyUseAccessControl; |
| m_expectedLoader = createAssociatedURLLoader(options); |
| EXPECT_TRUE(m_expectedLoader); |
| m_expectedLoader->loadAsynchronously(request, this); |
| serveRequests(); |
| EXPECT_TRUE(m_didReceiveResponse); |
| EXPECT_TRUE(m_didReceiveData); |
| EXPECT_TRUE(m_didFinishLoading); |
| |
| EXPECT_FALSE(m_actualResponse.httpHeaderField(headerNameString).isEmpty()); |
| } |
| |
| } // namespace blink |