diff options
| author | tsepez@chromium.org <tsepez@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2011-08-30 18:31:37 +0000 |
|---|---|---|
| committer | tsepez@chromium.org <tsepez@chromium.org@0039d316-1c4b-4281-b951-d872f2087c98> | 2011-08-30 18:31:37 +0000 |
| commit | 5466c9f369999f03d9067fd01953ce326ac3affd (patch) | |
| tree | 6a2e8e7b1e2522ff615c3c0e7b4f6a57b15290f1 /content | |
| parent | 0d069b50d0c2f10ecddb64f92223ec7cf799698f (diff) | |
| download | chromium_src-5466c9f369999f03d9067fd01953ce326ac3affd.zip chromium_src-5466c9f369999f03d9067fd01953ce326ac3affd.tar.gz chromium_src-5466c9f369999f03d9067fd01953ce326ac3affd.tar.bz2 | |
Protect sensistive chrome: and chrome-extension: schemes as not being able to be manipulated by bookmarklets and javascript: URLs typed into the omnibox.
BUG=93498
Review URL: http://codereview.chromium.org/7748022
git-svn-id: svn://svn.chromium.org/chrome/trunk/src@98849 0039d316-1c4b-4281-b951-d872f2087c98
Diffstat (limited to 'content')
| -rw-r--r-- | content/browser/renderer_host/resource_dispatcher_host_uitest.cc | 24 |
1 files changed, 16 insertions, 8 deletions
diff --git a/content/browser/renderer_host/resource_dispatcher_host_uitest.cc b/content/browser/renderer_host/resource_dispatcher_host_uitest.cc index a518112..19bb298 100644 --- a/content/browser/renderer_host/resource_dispatcher_host_uitest.cc +++ b/content/browser/renderer_host/resource_dispatcher_host_uitest.cc @@ -9,6 +9,7 @@ #include "base/file_path.h" #include "base/path_service.h" #include "base/string_util.h" +#include "base/utf_string_conversions.h" #include "base/test/test_timeouts.h" #include "chrome/test/automation/automation_proxy.h" #include "chrome/test/automation/browser_proxy.h" @@ -356,15 +357,22 @@ TEST_F(ResourceDispatcherTest, CrossSiteNavigationErrorPage) { // the ResourceDispatcherHost would think that such navigations were // cross-site, because we didn't clean up from the previous request. Since // TabContents was in the NORMAL state, it would ignore the attempt to run - // the onunload handler, and the navigation would fail. - // (Test by redirecting to javascript:window.location='someURL'.) + // the onunload handler, and the navigation would fail. We can't test by + // redirecting to javascript:window.location='someURL', since javascript: + // URLs are prohibited by policy from interacting with sensitive chrome + // pages of which the error page is one. Instead, use automation to kick + // off the navigation, and wait to see that the tab loads. + bool success; GURL test_url(test_server.GetURL("files/title2.html")); - std::string redirect_url = "javascript:window.location='" + - test_url.possibly_invalid_spec() + "'"; - ASSERT_EQ(AUTOMATION_MSG_NAVIGATION_SUCCESS, - tab->NavigateToURL(GURL(redirect_url))); - EXPECT_TRUE(tab->GetTabTitle(&tab_title)); - EXPECT_EQ(L"Title Of Awesomeness", tab_title); + std::string redirect_script = "window.location='" + + test_url.possibly_invalid_spec() + "';" + + "window.domAutomationController.send(true);"; + EXPECT_TRUE(tab->ExecuteAndExtractBool( + L"", ASCIIToWide(redirect_script), &success)); + EXPECT_TRUE(WaitUntilJavaScriptCondition( + tab.get(), L"", L"window.domAutomationController.send(" + L"document.title == 'Title Of Awesomeness')", + 20000)); } TEST_F(ResourceDispatcherTest, CrossOriginRedirectBlocked) { |