コード例 #1
0
TEST_F(SecurityOriginTest, Suborigins)
{
    RuntimeEnabledFeatures::setSuboriginsEnabled(true);

    RefPtr<SecurityOrigin> origin = SecurityOrigin::createFromString("https://test.com");
    Suborigin suborigin;
    suborigin.setName("foobar");
    EXPECT_FALSE(origin->hasSuborigin());
    origin->addSuborigin(suborigin);
    EXPECT_TRUE(origin->hasSuborigin());
    EXPECT_EQ("foobar", origin->suborigin()->name());

    origin = SecurityOrigin::createFromString("https://foobar_test.com");
    EXPECT_EQ("https", origin->protocol());
    EXPECT_EQ("test.com", origin->host());
    EXPECT_EQ("foobar", origin->suborigin()->name());

    origin = SecurityOrigin::createFromString("https://foobar_test.com");
    EXPECT_TRUE(origin->hasSuborigin());
    EXPECT_EQ("foobar", origin->suborigin()->name());

    origin = SecurityOrigin::createFromString("https://foobar+test.com");
    EXPECT_FALSE(origin->hasSuborigin());

    origin = SecurityOrigin::createFromString("https://_test.com");
    EXPECT_FALSE(origin->hasSuborigin());

    origin = adoptRef<SecurityOrigin>(new SecurityOrigin);
    EXPECT_FALSE(origin->hasSuborigin());

    origin = SecurityOrigin::createFromString("https://foobar_test.com");
    Suborigin emptySuborigin;
    EXPECT_DEATH(origin->addSuborigin(emptySuborigin), "");
}
コード例 #2
0
void expectParsePolicyFail(const char* message, String header)
{
    SCOPED_TRACE(message);

    Vector<String> messages;
    Suborigin suborigin;
    EXPECT_FALSE(parseSuboriginHeader(header, &suborigin, messages));
    EXPECT_EQ(String(), suborigin.name());
}
コード例 #3
0
void expectParseNamePass(const char* message, String header, String expectedName)
{
    SCOPED_TRACE(message);

    Vector<String> messages;
    Suborigin suborigin;
    EXPECT_TRUE(parseSuboriginHeader(header, &suborigin, messages));
    EXPECT_EQ(expectedName, suborigin.name());
}
コード例 #4
0
void expectParsePolicyPass(const char* message, String header, const Suborigin::SuboriginPolicyOptions expectedPolicy[], size_t numPolicies)
{
    SCOPED_TRACE(message);

    Vector<String> messages;
    Suborigin suborigin;
    EXPECT_TRUE(parseSuboriginHeader(header, &suborigin, messages));
    unsigned policiesMask = 0;
    for (size_t i = 0; i < numPolicies; i++)
        policiesMask |= static_cast<unsigned>(expectedPolicy[i]);
    EXPECT_EQ(policiesMask, suborigin.optionsMask());
}
コード例 #5
0
ファイル: SecurityContext.cpp プロジェクト: mirror/chromium
// Enforces the given suborigin as part of the security origin for this
// security context. |name| must not be empty, although it may be null. A null
// name represents a lack of a suborigin.
// See: https://w3c.github.io/webappsec-suborigins/index.html
void SecurityContext::enforceSuborigin(const Suborigin& suborigin) {
  if (!RuntimeEnabledFeatures::suboriginsEnabled())
    return;

  DCHECK(!suborigin.name().isEmpty());
  DCHECK(RuntimeEnabledFeatures::suboriginsEnabled());
  DCHECK(m_securityOrigin.get());
  DCHECK(!m_securityOrigin->hasSuborigin() ||
         m_securityOrigin->suborigin()->name() == suborigin.name());
  m_securityOrigin->addSuborigin(suborigin);
  didUpdateSecurityOrigin();
}
コード例 #6
0
void SecurityOrigin::addSuborigin(const Suborigin& suborigin)
{
    ASSERT(RuntimeEnabledFeatures::suboriginsEnabled());
    // Changing suborigins midstream is bad. Very bad. It should not happen.
    // This is, in fact,  one of the very basic invariants that makes
    // suborigins an effective security tool.
    RELEASE_ASSERT(m_suborigin.name().isNull() || (m_suborigin.name() == suborigin.name()));
    m_suborigin.setTo(suborigin);
}
コード例 #7
0
TEST_F(SecurityOriginTest, SuboriginsParsing) {
  RuntimeEnabledFeatures::setSuboriginsEnabled(true);
  String protocol, realProtocol, host, realHost, suborigin;
  protocol = "https";
  host = "test.com";
  EXPECT_FALSE(SecurityOrigin::deserializeSuboriginAndProtocolAndHost(
      protocol, host, suborigin, realProtocol, realHost));

  protocol = "https-so";
  host = "foobar.test.com";
  EXPECT_TRUE(SecurityOrigin::deserializeSuboriginAndProtocolAndHost(
      protocol, host, suborigin, realProtocol, realHost));
  EXPECT_EQ("https", realProtocol);
  EXPECT_EQ("test.com", realHost);
  EXPECT_EQ("foobar", suborigin);

  RefPtr<SecurityOrigin> origin;
  StringBuilder builder;

  origin = SecurityOrigin::createFromString("https-so://foobar.test.com");
  origin->buildRawString(builder, true);
  EXPECT_EQ("https-so://foobar.test.com", builder.toString());
  EXPECT_EQ("https-so://foobar.test.com", origin->toString());
  builder.clear();
  origin->buildRawString(builder, false);
  EXPECT_EQ("https://test.com", builder.toString());
  EXPECT_EQ("https://test.com", origin->toPhysicalOriginString());

  Suborigin suboriginObj;
  suboriginObj.setName("foobar");
  builder.clear();
  origin = SecurityOrigin::createFromString("https://test.com");
  origin->addSuborigin(suboriginObj);
  origin->buildRawString(builder, true);
  EXPECT_EQ("https-so://foobar.test.com", builder.toString());
  EXPECT_EQ("https-so://foobar.test.com", origin->toString());
  builder.clear();
  origin->buildRawString(builder, false);
  EXPECT_EQ("https://test.com", builder.toString());
  EXPECT_EQ("https://test.com", origin->toPhysicalOriginString());
}