2020-08-14 21:28:23 +02:00
|
|
|
// Copyright (c) 2020 The Chromium Embedded Framework Authors. All rights
|
|
|
|
|
// reserved. Use of this source code is governed by a BSD-style license that
|
|
|
|
|
// can be found in the LICENSE file.
|
|
|
|
|
|
|
|
|
|
#include <algorithm>
|
2020-09-11 18:52:35 +02:00
|
|
|
#include <set>
|
2023-11-17 00:19:27 +01:00
|
|
|
#include <sstream>
|
2020-08-14 21:28:23 +02:00
|
|
|
#include <vector>
|
|
|
|
|
|
2021-06-17 22:08:01 +02:00
|
|
|
#include "include/base/cef_callback.h"
|
2020-08-14 21:28:23 +02:00
|
|
|
#include "include/cef_callback.h"
|
|
|
|
|
#include "include/cef_origin_whitelist.h"
|
|
|
|
|
#include "include/cef_scheme.h"
|
|
|
|
|
#include "include/wrapper/cef_closure_task.h"
|
|
|
|
|
#include "tests/ceftests/routing_test_handler.h"
|
|
|
|
|
#include "tests/ceftests/test_request.h"
|
2022-07-31 01:53:48 +02:00
|
|
|
#include "tests/ceftests/test_server_observer.h"
|
2020-08-14 21:28:23 +02:00
|
|
|
#include "tests/ceftests/test_util.h"
|
2021-04-05 20:49:17 +02:00
|
|
|
#include "tests/shared/browser/client_app_browser.h"
|
2020-08-14 21:28:23 +02:00
|
|
|
|
|
|
|
|
namespace {
|
|
|
|
|
|
2021-04-05 20:49:17 +02:00
|
|
|
// Browser-side app delegate.
|
|
|
|
|
class CorsBrowserTest : public client::ClientAppBrowser::Delegate {
|
|
|
|
|
public:
|
2024-01-20 18:00:09 +01:00
|
|
|
CorsBrowserTest() = default;
|
2021-04-05 20:49:17 +02:00
|
|
|
|
|
|
|
|
void OnContextInitialized(CefRefPtr<client::ClientAppBrowser> app) override {
|
2024-04-30 03:09:17 +02:00
|
|
|
#if !defined(DISABLE_ALLOY_BOOTSTRAP)
|
|
|
|
|
if (IsChromeBootstrap())
|
|
|
|
|
#endif
|
|
|
|
|
{
|
2021-04-05 20:49:17 +02:00
|
|
|
// Disable InsecureFormNavigationThrottle which blocks 307 redirect of
|
|
|
|
|
// POST requests from HTTPS to custom non-standard scheme causing the
|
|
|
|
|
// CorsTest.RedirectPost307HttpSchemeToCustomNonStandardScheme test to
|
|
|
|
|
// fail.
|
|
|
|
|
CefRefPtr<CefValue> value = CefValue::Create();
|
|
|
|
|
value->SetBool(false);
|
|
|
|
|
CefString error;
|
|
|
|
|
bool result = CefRequestContext::GetGlobalContext()->SetPreference(
|
|
|
|
|
"profile.mixed_forms_warnings", value, error);
|
|
|
|
|
CHECK(result) << error.ToString();
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private:
|
|
|
|
|
IMPLEMENT_REFCOUNTING(CorsBrowserTest);
|
|
|
|
|
};
|
|
|
|
|
|
2022-07-31 03:17:40 +02:00
|
|
|
constexpr bool kUseHttpsServerScheme = false;
|
|
|
|
|
|
2020-08-14 21:28:23 +02:00
|
|
|
const char kMimeTypeHtml[] = "text/html";
|
|
|
|
|
const char kMimeTypeText[] = "text/plain";
|
|
|
|
|
|
|
|
|
|
const char kDefaultHtml[] = "<html><body>TEST</body></html>";
|
|
|
|
|
const char kDefaultText[] = "TEST";
|
2020-09-04 21:08:55 +02:00
|
|
|
const char kDefaultCookie[] = "testCookie=testVal";
|
2020-08-14 21:28:23 +02:00
|
|
|
|
|
|
|
|
const char kSuccessMsg[] = "CorsTestHandler.Success";
|
|
|
|
|
const char kFailureMsg[] = "CorsTestHandler.Failure";
|
|
|
|
|
|
|
|
|
|
// Source that will handle the request.
|
|
|
|
|
enum class HandlerType {
|
|
|
|
|
SERVER,
|
|
|
|
|
HTTP_SCHEME,
|
|
|
|
|
CUSTOM_STANDARD_SCHEME,
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME,
|
2021-04-12 19:55:48 +02:00
|
|
|
CUSTOM_UNREGISTERED_SCHEME,
|
2020-08-14 21:28:23 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
std::string GetOrigin(HandlerType handler) {
|
|
|
|
|
switch (handler) {
|
|
|
|
|
case HandlerType::SERVER:
|
2023-11-17 00:19:27 +01:00
|
|
|
// TODO: Only call test_server::GetOrigin() after test server
|
|
|
|
|
// initialization.
|
|
|
|
|
if (!kUseHttpsServerScheme) {
|
|
|
|
|
std::stringstream ss;
|
|
|
|
|
ss << "http://" << test_server::kHttpServerAddress << ":"
|
|
|
|
|
<< test_server::kHttpServerPort;
|
|
|
|
|
return ss.str();
|
|
|
|
|
}
|
2022-07-31 03:17:40 +02:00
|
|
|
return test_server::GetOrigin(kUseHttpsServerScheme);
|
2020-08-14 21:28:23 +02:00
|
|
|
case HandlerType::HTTP_SCHEME:
|
2021-03-04 23:36:57 +01:00
|
|
|
// Use HTTPS because requests from HTTP to the loopback address will be
|
|
|
|
|
// blocked by https://chromestatus.com/feature/5436853517811712.
|
|
|
|
|
return "https://corstest.com";
|
2020-08-14 21:28:23 +02:00
|
|
|
case HandlerType::CUSTOM_STANDARD_SCHEME:
|
2021-04-12 19:55:48 +02:00
|
|
|
// Standard scheme that's registered as CORS and fetch enabled.
|
2020-08-14 21:28:23 +02:00
|
|
|
// Registered in scheme_handler_unittest.cc.
|
|
|
|
|
return "customstdfetch://corstest";
|
|
|
|
|
case HandlerType::CUSTOM_NONSTANDARD_SCHEME:
|
2021-04-12 19:55:48 +02:00
|
|
|
// Non-standard schemes are not CORS or fetch enabled.
|
2020-08-14 21:28:23 +02:00
|
|
|
// Registered in scheme_handler_unittest.cc.
|
|
|
|
|
return "customnonstd:corstest";
|
2021-04-12 19:55:48 +02:00
|
|
|
case HandlerType::CUSTOM_UNREGISTERED_SCHEME:
|
|
|
|
|
// A scheme that isn't registered anywhere is treated as a non-standard
|
|
|
|
|
// scheme.
|
|
|
|
|
return "customstdunregistered://corstest";
|
2020-08-14 21:28:23 +02:00
|
|
|
}
|
|
|
|
|
NOTREACHED();
|
|
|
|
|
return std::string();
|
|
|
|
|
}
|
|
|
|
|
|
2021-06-04 03:34:56 +02:00
|
|
|
std::string GetScheme(HandlerType handler) {
|
|
|
|
|
switch (handler) {
|
|
|
|
|
case HandlerType::SERVER:
|
2022-07-31 03:17:40 +02:00
|
|
|
return test_server::GetScheme(kUseHttpsServerScheme);
|
2021-06-04 03:34:56 +02:00
|
|
|
case HandlerType::HTTP_SCHEME:
|
|
|
|
|
return "https";
|
|
|
|
|
case HandlerType::CUSTOM_STANDARD_SCHEME:
|
|
|
|
|
return "customstdfetch";
|
|
|
|
|
case HandlerType::CUSTOM_NONSTANDARD_SCHEME:
|
|
|
|
|
return "customnonstd";
|
|
|
|
|
case HandlerType::CUSTOM_UNREGISTERED_SCHEME:
|
|
|
|
|
return "customstdunregistered";
|
|
|
|
|
}
|
|
|
|
|
NOTREACHED();
|
|
|
|
|
return std::string();
|
|
|
|
|
}
|
|
|
|
|
|
2021-04-12 19:55:48 +02:00
|
|
|
bool IsNonStandardType(HandlerType handler) {
|
|
|
|
|
return handler == HandlerType::CUSTOM_NONSTANDARD_SCHEME ||
|
|
|
|
|
handler == HandlerType::CUSTOM_UNREGISTERED_SCHEME;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
bool IsStandardType(HandlerType handler) {
|
|
|
|
|
return !IsNonStandardType(handler);
|
|
|
|
|
}
|
|
|
|
|
|
2020-08-14 21:28:23 +02:00
|
|
|
std::string GetPathURL(HandlerType handler, const std::string& path) {
|
|
|
|
|
return GetOrigin(handler) + path;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
struct Resource {
|
|
|
|
|
// Uniquely identifies the resource.
|
|
|
|
|
HandlerType handler = HandlerType::SERVER;
|
|
|
|
|
std::string path;
|
2020-09-11 18:52:35 +02:00
|
|
|
// If non-empty the method value must match.
|
|
|
|
|
std::string method;
|
2020-08-14 21:28:23 +02:00
|
|
|
|
|
|
|
|
// Response information that will be returned.
|
|
|
|
|
CefRefPtr<CefResponse> response;
|
|
|
|
|
std::string response_data;
|
|
|
|
|
|
|
|
|
|
// Expected error code in OnLoadError.
|
|
|
|
|
cef_errorcode_t expected_error_code = ERR_NONE;
|
|
|
|
|
|
|
|
|
|
// Expected number of responses.
|
|
|
|
|
int expected_response_ct = 1;
|
|
|
|
|
|
|
|
|
|
// Expected number of OnQuery calls.
|
|
|
|
|
int expected_success_query_ct = 0;
|
|
|
|
|
int expected_failure_query_ct = 0;
|
|
|
|
|
|
|
|
|
|
// Actual number of responses.
|
|
|
|
|
int response_ct = 0;
|
|
|
|
|
|
|
|
|
|
// Actual number of OnQuery calls.
|
|
|
|
|
int success_query_ct = 0;
|
|
|
|
|
int failure_query_ct = 0;
|
|
|
|
|
|
2024-01-20 18:00:09 +01:00
|
|
|
Resource() = default;
|
2020-08-14 21:28:23 +02:00
|
|
|
Resource(HandlerType request_handler,
|
|
|
|
|
const std::string& request_path,
|
|
|
|
|
const std::string& mime_type = kMimeTypeHtml,
|
|
|
|
|
const std::string& data = kDefaultHtml,
|
|
|
|
|
int status = 200) {
|
|
|
|
|
Init(request_handler, request_path, mime_type, data, status);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Perform basic initialization.
|
|
|
|
|
void Init(HandlerType request_handler,
|
|
|
|
|
const std::string& request_path,
|
|
|
|
|
const std::string& mime_type = kMimeTypeHtml,
|
|
|
|
|
const std::string& data = kDefaultHtml,
|
|
|
|
|
int status = 200) {
|
|
|
|
|
handler = request_handler;
|
|
|
|
|
path = request_path;
|
|
|
|
|
response_data = data;
|
|
|
|
|
response = CefResponse::Create();
|
|
|
|
|
response->SetMimeType(mime_type);
|
|
|
|
|
response->SetStatus(status);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Validate expected initial state.
|
|
|
|
|
void Validate() const {
|
|
|
|
|
DCHECK(!path.empty());
|
|
|
|
|
DCHECK(response);
|
|
|
|
|
DCHECK(!response->GetMimeType().empty());
|
|
|
|
|
DCHECK_EQ(0, response_ct);
|
|
|
|
|
DCHECK_GE(expected_response_ct, 0);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
std::string GetPathURL() const { return ::GetPathURL(handler, path); }
|
|
|
|
|
|
|
|
|
|
// Returns true if all expectations have been met.
|
|
|
|
|
bool IsDone() const {
|
|
|
|
|
return response_ct == expected_response_ct &&
|
|
|
|
|
success_query_ct == expected_success_query_ct &&
|
|
|
|
|
failure_query_ct == expected_failure_query_ct;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void AssertDone() const {
|
|
|
|
|
EXPECT_EQ(expected_response_ct, response_ct) << GetPathURL();
|
|
|
|
|
EXPECT_EQ(expected_success_query_ct, success_query_ct) << GetPathURL();
|
|
|
|
|
EXPECT_EQ(expected_failure_query_ct, failure_query_ct) << GetPathURL();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Optionally override to verify request contents.
|
|
|
|
|
virtual bool VerifyRequest(CefRefPtr<CefRequest> request) const {
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
struct TestSetup {
|
|
|
|
|
// Available resources.
|
|
|
|
|
typedef std::vector<Resource*> ResourceList;
|
|
|
|
|
ResourceList resources;
|
|
|
|
|
|
2023-01-03 19:24:17 +01:00
|
|
|
struct ConsoleMessage {
|
|
|
|
|
std::string message;
|
|
|
|
|
|
|
|
|
|
// Number of times the message was received. All registered messages are
|
|
|
|
|
// expected at least one time.
|
|
|
|
|
size_t count = 0;
|
|
|
|
|
};
|
|
|
|
|
|
2020-08-14 21:28:23 +02:00
|
|
|
// Used for testing received console messages.
|
2023-01-03 19:24:17 +01:00
|
|
|
std::vector<ConsoleMessage> console_messages;
|
2020-08-14 21:28:23 +02:00
|
|
|
|
2020-09-04 21:08:55 +02:00
|
|
|
// If true cookies will be cleared after every test run.
|
|
|
|
|
bool clear_cookies = false;
|
|
|
|
|
|
2020-08-14 21:28:23 +02:00
|
|
|
void AddResource(Resource* resource) {
|
|
|
|
|
DCHECK(resource);
|
|
|
|
|
resource->Validate();
|
|
|
|
|
resources.push_back(resource);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void AddConsoleMessage(const std::string& message) {
|
|
|
|
|
DCHECK(!message.empty());
|
2023-01-03 19:24:17 +01:00
|
|
|
console_messages.push_back({message, 0U});
|
2020-08-14 21:28:23 +02:00
|
|
|
}
|
|
|
|
|
|
2020-09-11 18:52:35 +02:00
|
|
|
Resource* GetResource(const std::string& url,
|
|
|
|
|
const std::string& method = std::string()) const {
|
2023-01-02 23:59:03 +01:00
|
|
|
if (resources.empty()) {
|
2020-08-14 21:28:23 +02:00
|
|
|
return nullptr;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-08-14 21:28:23 +02:00
|
|
|
|
2020-09-11 18:52:35 +02:00
|
|
|
std::set<std::string> matching_methods;
|
|
|
|
|
if (method.empty()) {
|
|
|
|
|
// Match standard HTTP methods.
|
|
|
|
|
matching_methods.insert("GET");
|
|
|
|
|
matching_methods.insert("POST");
|
|
|
|
|
} else {
|
|
|
|
|
matching_methods.insert(method);
|
|
|
|
|
}
|
|
|
|
|
|
2020-08-14 21:28:23 +02:00
|
|
|
const std::string& path_url = test_request::GetPathURL(url);
|
|
|
|
|
ResourceList::const_iterator it = resources.begin();
|
|
|
|
|
for (; it != resources.end(); ++it) {
|
|
|
|
|
Resource* resource = *it;
|
2020-09-11 18:52:35 +02:00
|
|
|
if (resource->GetPathURL() == path_url &&
|
|
|
|
|
(resource->method.empty() ||
|
|
|
|
|
matching_methods.find(resource->method) != matching_methods.end())) {
|
2020-08-14 21:28:23 +02:00
|
|
|
return resource;
|
2020-09-11 18:52:35 +02:00
|
|
|
}
|
2020-08-14 21:28:23 +02:00
|
|
|
}
|
|
|
|
|
return nullptr;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
Resource* GetResource(CefRefPtr<CefRequest> request) const {
|
2020-09-11 18:52:35 +02:00
|
|
|
return GetResource(request->GetURL(), request->GetMethod());
|
2020-08-14 21:28:23 +02:00
|
|
|
}
|
|
|
|
|
|
2022-11-15 20:45:55 +01:00
|
|
|
// Optional initialization after the test server is started.
|
|
|
|
|
virtual void Initialize() {}
|
|
|
|
|
|
2020-08-14 21:28:23 +02:00
|
|
|
// Validate expected initial state.
|
|
|
|
|
void Validate() const { DCHECK(!resources.empty()); }
|
|
|
|
|
|
|
|
|
|
std::string GetMainURL() const { return resources.front()->GetPathURL(); }
|
|
|
|
|
|
|
|
|
|
// Returns true if the server will be used.
|
2022-11-15 20:45:55 +01:00
|
|
|
virtual bool NeedsServer() const {
|
2020-08-14 21:28:23 +02:00
|
|
|
ResourceList::const_iterator it = resources.begin();
|
|
|
|
|
for (; it != resources.end(); ++it) {
|
|
|
|
|
Resource* resource = *it;
|
2023-01-02 23:59:03 +01:00
|
|
|
if (resource->handler == HandlerType::SERVER) {
|
2020-08-14 21:28:23 +02:00
|
|
|
return true;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-08-14 21:28:23 +02:00
|
|
|
}
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Returns true if all expectations have been met.
|
|
|
|
|
bool IsDone() const {
|
|
|
|
|
ResourceList::const_iterator it = resources.begin();
|
|
|
|
|
for (; it != resources.end(); ++it) {
|
|
|
|
|
Resource* resource = *it;
|
2023-01-02 23:59:03 +01:00
|
|
|
if (!resource->IsDone()) {
|
2020-08-14 21:28:23 +02:00
|
|
|
return false;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-08-14 21:28:23 +02:00
|
|
|
}
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void AssertDone() const {
|
|
|
|
|
ResourceList::const_iterator it = resources.begin();
|
|
|
|
|
for (; it != resources.end(); ++it) {
|
|
|
|
|
(*it)->AssertDone();
|
|
|
|
|
}
|
|
|
|
|
}
|
2020-09-04 21:08:55 +02:00
|
|
|
|
|
|
|
|
// Optionally override to verify cleared cookie contents.
|
|
|
|
|
virtual bool VerifyClearedCookies(
|
|
|
|
|
const test_request::CookieVector& cookies) const {
|
|
|
|
|
return true;
|
|
|
|
|
}
|
2020-08-14 21:28:23 +02:00
|
|
|
};
|
|
|
|
|
|
|
|
|
|
class TestServerObserver : public test_server::ObserverHelper {
|
|
|
|
|
public:
|
|
|
|
|
TestServerObserver(TestSetup* setup,
|
2021-06-19 21:54:45 +02:00
|
|
|
base::OnceClosure ready_callback,
|
|
|
|
|
base::OnceClosure done_callback)
|
2020-08-14 21:28:23 +02:00
|
|
|
: setup_(setup),
|
2021-06-19 21:54:45 +02:00
|
|
|
ready_callback_(std::move(ready_callback)),
|
2022-05-25 15:42:41 +02:00
|
|
|
done_callback_(std::move(done_callback)) {
|
2020-08-14 21:28:23 +02:00
|
|
|
DCHECK(setup);
|
2022-07-31 03:17:40 +02:00
|
|
|
Initialize(kUseHttpsServerScheme);
|
2020-08-14 21:28:23 +02:00
|
|
|
}
|
|
|
|
|
|
2021-06-19 21:54:45 +02:00
|
|
|
~TestServerObserver() override { std::move(done_callback_).Run(); }
|
2020-08-14 21:28:23 +02:00
|
|
|
|
|
|
|
|
void OnInitialized(const std::string& server_origin) override {
|
|
|
|
|
CEF_REQUIRE_UI_THREAD();
|
2021-06-19 21:54:45 +02:00
|
|
|
std::move(ready_callback_).Run();
|
2020-08-14 21:28:23 +02:00
|
|
|
}
|
|
|
|
|
|
2022-08-02 03:14:12 +02:00
|
|
|
bool OnTestServerRequest(CefRefPtr<CefRequest> request,
|
|
|
|
|
const ResponseCallback& response_callback) override {
|
2020-08-14 21:28:23 +02:00
|
|
|
CEF_REQUIRE_UI_THREAD();
|
|
|
|
|
Resource* resource = setup_->GetResource(request);
|
|
|
|
|
if (!resource) {
|
|
|
|
|
// Not a request we handle.
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
resource->response_ct++;
|
|
|
|
|
EXPECT_TRUE(resource->VerifyRequest(request))
|
|
|
|
|
<< request->GetURL().ToString();
|
2022-07-29 22:05:20 +02:00
|
|
|
response_callback.Run(resource->response, resource->response_data);
|
2020-08-14 21:28:23 +02:00
|
|
|
|
|
|
|
|
// Stop propagating the callback.
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void OnShutdown() override {
|
|
|
|
|
CEF_REQUIRE_UI_THREAD();
|
|
|
|
|
delete this;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private:
|
|
|
|
|
TestSetup* const setup_;
|
2021-06-19 21:54:45 +02:00
|
|
|
base::OnceClosure ready_callback_;
|
|
|
|
|
base::OnceClosure done_callback_;
|
2020-08-14 21:28:23 +02:00
|
|
|
|
|
|
|
|
DISALLOW_COPY_AND_ASSIGN(TestServerObserver);
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
class CorsTestHandler : public RoutingTestHandler {
|
|
|
|
|
public:
|
2022-11-15 20:45:55 +01:00
|
|
|
explicit CorsTestHandler(TestSetup* setup) : setup_(setup) {}
|
2020-08-14 21:28:23 +02:00
|
|
|
|
|
|
|
|
void RunTest() override {
|
2021-06-19 21:54:45 +02:00
|
|
|
StartServer(base::BindOnce(&CorsTestHandler::TriggerCreateBrowser, this));
|
2020-08-14 21:28:23 +02:00
|
|
|
|
|
|
|
|
// Time out the test after a reasonable period of time.
|
|
|
|
|
SetTestTimeout();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Necessary to make the method public in order to destroy the test from
|
|
|
|
|
// ClientSchemeHandlerType::ProcessRequest().
|
|
|
|
|
void DestroyTest() override {
|
|
|
|
|
EXPECT_TRUE(shutting_down_);
|
|
|
|
|
|
2020-09-04 21:08:55 +02:00
|
|
|
if (setup_->NeedsServer()) {
|
|
|
|
|
EXPECT_TRUE(got_stopped_server_);
|
|
|
|
|
} else {
|
|
|
|
|
EXPECT_FALSE(got_stopped_server_);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (setup_->clear_cookies) {
|
|
|
|
|
EXPECT_TRUE(got_cleared_cookies_);
|
|
|
|
|
} else {
|
|
|
|
|
EXPECT_FALSE(got_cleared_cookies_);
|
|
|
|
|
}
|
|
|
|
|
|
2020-08-14 21:28:23 +02:00
|
|
|
setup_->AssertDone();
|
2023-01-03 19:24:17 +01:00
|
|
|
for (const auto& cm : setup_->console_messages) {
|
|
|
|
|
EXPECT_GT(cm.count, 0U)
|
|
|
|
|
<< "Did not receive expected console message: " << cm.message;
|
|
|
|
|
}
|
2020-08-14 21:28:23 +02:00
|
|
|
|
|
|
|
|
RoutingTestHandler::DestroyTest();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
CefRefPtr<CefResourceHandler> GetResourceHandler(
|
|
|
|
|
CefRefPtr<CefBrowser> browser,
|
|
|
|
|
CefRefPtr<CefFrame> frame,
|
|
|
|
|
CefRefPtr<CefRequest> request) override {
|
|
|
|
|
CEF_REQUIRE_IO_THREAD();
|
2020-09-11 18:52:35 +02:00
|
|
|
const std::string& url = request->GetURL();
|
|
|
|
|
const std::string& method = request->GetMethod();
|
|
|
|
|
if (method == "OPTIONS") {
|
|
|
|
|
// We should never see the CORS preflight request.
|
|
|
|
|
ADD_FAILURE() << "Unexpected CORS preflight for " << url;
|
|
|
|
|
}
|
|
|
|
|
|
2020-08-14 21:28:23 +02:00
|
|
|
Resource* resource = setup_->GetResource(request);
|
|
|
|
|
if (resource && resource->handler != HandlerType::SERVER) {
|
|
|
|
|
resource->response_ct++;
|
2020-09-11 18:52:35 +02:00
|
|
|
EXPECT_TRUE(resource->VerifyRequest(request)) << url;
|
2020-08-14 21:28:23 +02:00
|
|
|
return test_request::CreateResourceHandler(resource->response,
|
|
|
|
|
resource->response_data);
|
|
|
|
|
}
|
|
|
|
|
return RoutingTestHandler::GetResourceHandler(browser, frame, request);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void OnLoadEnd(CefRefPtr<CefBrowser> browser,
|
|
|
|
|
CefRefPtr<CefFrame> frame,
|
|
|
|
|
int httpStatusCode) override {
|
|
|
|
|
const std::string& url = frame->GetURL();
|
|
|
|
|
Resource* resource = GetResource(url);
|
2023-01-02 23:59:03 +01:00
|
|
|
if (!resource) {
|
2020-08-14 21:28:23 +02:00
|
|
|
return;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-08-14 21:28:23 +02:00
|
|
|
|
|
|
|
|
const int expected_status = resource->response->GetStatus();
|
|
|
|
|
if (url == main_url_ || expected_status != 200) {
|
|
|
|
|
// Test that the status code is correct.
|
|
|
|
|
EXPECT_EQ(expected_status, httpStatusCode) << url;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
TriggerDestroyTestIfDone();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void OnLoadError(CefRefPtr<CefBrowser> browser,
|
|
|
|
|
CefRefPtr<CefFrame> frame,
|
|
|
|
|
ErrorCode errorCode,
|
|
|
|
|
const CefString& errorText,
|
|
|
|
|
const CefString& failedUrl) override {
|
|
|
|
|
Resource* resource = GetResource(failedUrl);
|
2023-01-02 23:59:03 +01:00
|
|
|
if (!resource) {
|
2020-08-14 21:28:23 +02:00
|
|
|
return;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-08-14 21:28:23 +02:00
|
|
|
|
|
|
|
|
const cef_errorcode_t expected_error = resource->response->GetError();
|
|
|
|
|
|
|
|
|
|
// Tests sometimes also fail with ERR_ABORTED.
|
|
|
|
|
if (!(expected_error == ERR_NONE && errorCode == ERR_ABORTED)) {
|
|
|
|
|
EXPECT_EQ(expected_error, errorCode) << failedUrl.ToString();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
TriggerDestroyTestIfDone();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
bool OnQuery(CefRefPtr<CefBrowser> browser,
|
|
|
|
|
CefRefPtr<CefFrame> frame,
|
2023-06-01 16:06:15 +02:00
|
|
|
int64_t query_id,
|
2020-08-14 21:28:23 +02:00
|
|
|
const CefString& request,
|
|
|
|
|
bool persistent,
|
|
|
|
|
CefRefPtr<Callback> callback) override {
|
|
|
|
|
Resource* resource = GetResource(frame->GetURL());
|
2023-01-02 23:59:03 +01:00
|
|
|
if (!resource) {
|
2020-08-14 21:28:23 +02:00
|
|
|
return false;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-08-14 21:28:23 +02:00
|
|
|
|
|
|
|
|
if (request.ToString() == kSuccessMsg ||
|
|
|
|
|
request.ToString() == kFailureMsg) {
|
|
|
|
|
callback->Success("");
|
2023-01-02 23:59:03 +01:00
|
|
|
if (request.ToString() == kSuccessMsg) {
|
2020-08-14 21:28:23 +02:00
|
|
|
resource->success_query_ct++;
|
2023-01-02 23:59:03 +01:00
|
|
|
} else {
|
2020-08-14 21:28:23 +02:00
|
|
|
resource->failure_query_ct++;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-08-14 21:28:23 +02:00
|
|
|
TriggerDestroyTestIfDone();
|
|
|
|
|
return true;
|
|
|
|
|
}
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
bool OnConsoleMessage(CefRefPtr<CefBrowser> browser,
|
|
|
|
|
cef_log_severity_t level,
|
|
|
|
|
const CefString& message,
|
|
|
|
|
const CefString& source,
|
|
|
|
|
int line) override {
|
|
|
|
|
bool expected = false;
|
|
|
|
|
if (!setup_->console_messages.empty()) {
|
2023-01-03 19:24:17 +01:00
|
|
|
const std::string& actual = message.ToString();
|
|
|
|
|
for (auto& cm : setup_->console_messages) {
|
|
|
|
|
if (actual.find(cm.message) == 0U) {
|
2020-08-14 21:28:23 +02:00
|
|
|
expected = true;
|
2023-01-03 19:24:17 +01:00
|
|
|
cm.count++;
|
2020-08-14 21:28:23 +02:00
|
|
|
break;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
EXPECT_TRUE(expected) << "Unexpected console message: "
|
|
|
|
|
<< message.ToString();
|
|
|
|
|
return false;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
protected:
|
|
|
|
|
void TriggerCreateBrowser() {
|
2022-11-15 20:45:55 +01:00
|
|
|
setup_->Initialize();
|
|
|
|
|
setup_->Validate();
|
|
|
|
|
|
2020-08-14 21:28:23 +02:00
|
|
|
main_url_ = setup_->GetMainURL();
|
|
|
|
|
CreateBrowser(main_url_);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void TriggerDestroyTestIfDone() {
|
2021-06-19 21:54:45 +02:00
|
|
|
CefPostTask(TID_UI,
|
|
|
|
|
base::BindOnce(&CorsTestHandler::DestroyTestIfDone, this));
|
2020-08-14 21:28:23 +02:00
|
|
|
}
|
|
|
|
|
|
2020-09-04 21:08:55 +02:00
|
|
|
void DestroyTestIfDone() {
|
|
|
|
|
CEF_REQUIRE_UI_THREAD();
|
2023-01-02 23:59:03 +01:00
|
|
|
if (shutting_down_) {
|
2020-09-04 21:08:55 +02:00
|
|
|
return;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-09-04 21:08:55 +02:00
|
|
|
|
|
|
|
|
if (setup_->IsDone()) {
|
|
|
|
|
shutting_down_ = true;
|
|
|
|
|
StopServer();
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
2021-06-19 21:54:45 +02:00
|
|
|
void StartServer(base::OnceClosure next_step) {
|
2020-08-14 21:28:23 +02:00
|
|
|
if (!CefCurrentlyOn(TID_UI)) {
|
2021-06-19 21:54:45 +02:00
|
|
|
CefPostTask(TID_UI, base::BindOnce(&CorsTestHandler::StartServer, this,
|
|
|
|
|
std::move(next_step)));
|
2020-08-14 21:28:23 +02:00
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
if (!setup_->NeedsServer()) {
|
2021-06-19 21:54:45 +02:00
|
|
|
std::move(next_step).Run();
|
2020-08-14 21:28:23 +02:00
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Will delete itself after the server stops.
|
|
|
|
|
server_ = new TestServerObserver(
|
2021-06-19 21:54:45 +02:00
|
|
|
setup_, std::move(next_step),
|
|
|
|
|
base::BindOnce(&CorsTestHandler::StoppedServer, this));
|
2020-08-14 21:28:23 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void StopServer() {
|
|
|
|
|
CEF_REQUIRE_UI_THREAD();
|
|
|
|
|
if (!server_) {
|
|
|
|
|
DCHECK(!setup_->NeedsServer());
|
2020-09-04 21:08:55 +02:00
|
|
|
AfterStoppedServer();
|
2020-08-14 21:28:23 +02:00
|
|
|
return;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Results in a call to StoppedServer().
|
|
|
|
|
server_->Shutdown();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void StoppedServer() {
|
|
|
|
|
CEF_REQUIRE_UI_THREAD();
|
2020-09-04 21:08:55 +02:00
|
|
|
got_stopped_server_.yes();
|
2020-08-14 21:28:23 +02:00
|
|
|
server_ = nullptr;
|
2020-09-04 21:08:55 +02:00
|
|
|
AfterStoppedServer();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void AfterStoppedServer() {
|
|
|
|
|
CEF_REQUIRE_UI_THREAD();
|
|
|
|
|
if (setup_->clear_cookies) {
|
|
|
|
|
ClearCookies();
|
|
|
|
|
} else {
|
|
|
|
|
DestroyTest();
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void ClearCookies() {
|
|
|
|
|
CEF_REQUIRE_UI_THREAD();
|
|
|
|
|
DCHECK(setup_->clear_cookies);
|
|
|
|
|
test_request::GetAllCookies(
|
2024-01-20 18:00:09 +01:00
|
|
|
CefCookieManager::GetGlobalManager(nullptr), /*deleteCookies=*/true,
|
2021-06-19 21:54:45 +02:00
|
|
|
base::BindOnce(&CorsTestHandler::ClearedCookies, this));
|
2020-09-04 21:08:55 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void ClearedCookies(const test_request::CookieVector& cookies) {
|
|
|
|
|
CEF_REQUIRE_UI_THREAD();
|
|
|
|
|
got_cleared_cookies_.yes();
|
|
|
|
|
EXPECT_TRUE(setup_->VerifyClearedCookies(cookies));
|
2020-08-14 21:28:23 +02:00
|
|
|
DestroyTest();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
Resource* GetResource(const std::string& url) const {
|
|
|
|
|
Resource* resource = setup_->GetResource(url);
|
|
|
|
|
EXPECT_TRUE(resource) << url;
|
|
|
|
|
return resource;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
TestSetup* setup_;
|
|
|
|
|
std::string main_url_;
|
|
|
|
|
TestServerObserver* server_ = nullptr;
|
|
|
|
|
bool shutting_down_ = false;
|
|
|
|
|
|
2020-09-04 21:08:55 +02:00
|
|
|
TrackCallback got_stopped_server_;
|
|
|
|
|
TrackCallback got_cleared_cookies_;
|
|
|
|
|
|
2020-08-14 21:28:23 +02:00
|
|
|
IMPLEMENT_REFCOUNTING(CorsTestHandler);
|
|
|
|
|
DISALLOW_COPY_AND_ASSIGN(CorsTestHandler);
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
// JS that results in a call to CorsTestHandler::OnQuery.
|
|
|
|
|
std::string GetMsgJS(const std::string& msg) {
|
|
|
|
|
return "window.testQuery({request:'" + msg + "'});";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
std::string GetSuccessMsgJS() {
|
|
|
|
|
return GetMsgJS(kSuccessMsg);
|
|
|
|
|
}
|
|
|
|
|
std::string GetFailureMsgJS() {
|
|
|
|
|
return GetMsgJS(kFailureMsg);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
std::string GetDefaultSuccessMsgHtml() {
|
|
|
|
|
return "<html><body>TEST<script>" + GetSuccessMsgJS() +
|
|
|
|
|
"</script></body></html>";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
} // namespace
|
|
|
|
|
|
|
|
|
|
// Verify the test harness for server requests.
|
|
|
|
|
TEST(CorsTest, BasicServer) {
|
|
|
|
|
TestSetup setup;
|
|
|
|
|
Resource resource(HandlerType::SERVER, "/CorsTest.BasicServer");
|
|
|
|
|
setup.AddResource(&resource);
|
|
|
|
|
|
|
|
|
|
CefRefPtr<CorsTestHandler> handler = new CorsTestHandler(&setup);
|
|
|
|
|
handler->ExecuteTest();
|
|
|
|
|
ReleaseAndWaitForDestructor(handler);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Like above, but also send a query JS message.
|
|
|
|
|
TEST(CorsTest, BasicServerWithQuery) {
|
|
|
|
|
TestSetup setup;
|
|
|
|
|
Resource resource(HandlerType::SERVER, "/CorsTest.BasicServerWithQuery",
|
|
|
|
|
kMimeTypeHtml, GetDefaultSuccessMsgHtml());
|
|
|
|
|
resource.expected_success_query_ct = 1;
|
|
|
|
|
setup.AddResource(&resource);
|
|
|
|
|
|
|
|
|
|
CefRefPtr<CorsTestHandler> handler = new CorsTestHandler(&setup);
|
|
|
|
|
handler->ExecuteTest();
|
|
|
|
|
ReleaseAndWaitForDestructor(handler);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Verify the test harness for http scheme requests.
|
|
|
|
|
TEST(CorsTest, BasicHttpScheme) {
|
|
|
|
|
TestSetup setup;
|
|
|
|
|
Resource resource(HandlerType::HTTP_SCHEME, "/CorsTest.BasicHttpScheme");
|
|
|
|
|
setup.AddResource(&resource);
|
|
|
|
|
|
|
|
|
|
CefRefPtr<CorsTestHandler> handler = new CorsTestHandler(&setup);
|
|
|
|
|
handler->ExecuteTest();
|
|
|
|
|
ReleaseAndWaitForDestructor(handler);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Like above, but also send a query JS message.
|
|
|
|
|
TEST(CorsTest, BasicHttpSchemeWithQuery) {
|
|
|
|
|
TestSetup setup;
|
|
|
|
|
Resource resource(HandlerType::HTTP_SCHEME,
|
|
|
|
|
"/CorsTest.BasicHttpSchemeWithQuery", kMimeTypeHtml,
|
|
|
|
|
GetDefaultSuccessMsgHtml());
|
|
|
|
|
resource.expected_success_query_ct = 1;
|
|
|
|
|
setup.AddResource(&resource);
|
|
|
|
|
|
|
|
|
|
CefRefPtr<CorsTestHandler> handler = new CorsTestHandler(&setup);
|
|
|
|
|
handler->ExecuteTest();
|
|
|
|
|
ReleaseAndWaitForDestructor(handler);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Verify the test harness for custom standard scheme requests.
|
|
|
|
|
TEST(CorsTest, BasicCustomStandardScheme) {
|
|
|
|
|
TestSetup setup;
|
|
|
|
|
Resource resource(HandlerType::CUSTOM_STANDARD_SCHEME,
|
|
|
|
|
"/CorsTest.BasicCustomStandardScheme");
|
|
|
|
|
setup.AddResource(&resource);
|
|
|
|
|
|
|
|
|
|
CefRefPtr<CorsTestHandler> handler = new CorsTestHandler(&setup);
|
|
|
|
|
handler->ExecuteTest();
|
|
|
|
|
ReleaseAndWaitForDestructor(handler);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Like above, but also send a query JS message.
|
|
|
|
|
TEST(CorsTest, BasicCustomStandardSchemeWithQuery) {
|
|
|
|
|
TestSetup setup;
|
|
|
|
|
Resource resource(HandlerType::CUSTOM_STANDARD_SCHEME,
|
|
|
|
|
"/CorsTest.BasicCustomStandardSchemeWithQuery",
|
|
|
|
|
kMimeTypeHtml, GetDefaultSuccessMsgHtml());
|
|
|
|
|
resource.expected_success_query_ct = 1;
|
|
|
|
|
setup.AddResource(&resource);
|
|
|
|
|
|
|
|
|
|
CefRefPtr<CorsTestHandler> handler = new CorsTestHandler(&setup);
|
|
|
|
|
handler->ExecuteTest();
|
|
|
|
|
ReleaseAndWaitForDestructor(handler);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
namespace {
|
|
|
|
|
|
2020-09-04 21:08:55 +02:00
|
|
|
struct CookieTestSetup : TestSetup {
|
2024-01-20 18:00:09 +01:00
|
|
|
CookieTestSetup() = default;
|
2020-09-04 21:08:55 +02:00
|
|
|
|
|
|
|
|
bool expect_cookie = false;
|
|
|
|
|
|
|
|
|
|
bool VerifyClearedCookies(
|
|
|
|
|
const test_request::CookieVector& cookies) const override {
|
|
|
|
|
if (!expect_cookie) {
|
|
|
|
|
EXPECT_TRUE(cookies.empty());
|
|
|
|
|
return cookies.empty();
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
EXPECT_EQ(1U, cookies.size());
|
|
|
|
|
const std::string& cookie = CefString(&cookies[0].name).ToString() + "=" +
|
|
|
|
|
CefString(&cookies[0].value).ToString();
|
|
|
|
|
EXPECT_STREQ(kDefaultCookie, cookie.c_str());
|
|
|
|
|
return cookie == kDefaultCookie;
|
|
|
|
|
}
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
struct CookieResource : Resource {
|
2024-01-20 18:00:09 +01:00
|
|
|
CookieResource() = default;
|
2020-09-04 21:08:55 +02:00
|
|
|
|
|
|
|
|
bool expect_cookie = false;
|
|
|
|
|
|
|
|
|
|
void InitSetCookie() {
|
|
|
|
|
response->SetHeaderByName("Set-Cookie", kDefaultCookie,
|
2024-01-20 18:00:09 +01:00
|
|
|
/*overwrite=*/true);
|
2020-09-04 21:08:55 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
bool VerifyRequest(CefRefPtr<CefRequest> request) const override {
|
|
|
|
|
const std::string& cookie = request->GetHeaderByName("Cookie");
|
|
|
|
|
const std::string& expected_cookie =
|
|
|
|
|
expect_cookie ? kDefaultCookie : std::string();
|
|
|
|
|
EXPECT_STREQ(expected_cookie.c_str(), cookie.c_str()) << GetPathURL();
|
|
|
|
|
return expected_cookie == cookie;
|
|
|
|
|
}
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
void SetupCookieExpectations(CookieTestSetup* setup,
|
|
|
|
|
CookieResource* main_resource,
|
|
|
|
|
CookieResource* sub_resource) {
|
|
|
|
|
// All schemes except custom non-standard support cookies.
|
2021-04-12 19:55:48 +02:00
|
|
|
const bool supports_cookies = IsStandardType(main_resource->handler);
|
2020-09-04 21:08:55 +02:00
|
|
|
|
|
|
|
|
// The main resource may set the cookie (if cookies are supported), but should
|
|
|
|
|
// not receive one.
|
|
|
|
|
main_resource->InitSetCookie();
|
|
|
|
|
main_resource->expect_cookie = false;
|
|
|
|
|
|
|
|
|
|
// A cookie will be set only for schemes that support cookies.
|
|
|
|
|
setup->expect_cookie = supports_cookies;
|
|
|
|
|
// Always clear cookies so we can verify that one wasn't set unexpectedly.
|
|
|
|
|
setup->clear_cookies = true;
|
|
|
|
|
|
|
|
|
|
// Expect the sub-resource to receive the cookie for same-origin requests
|
|
|
|
|
// only.
|
|
|
|
|
sub_resource->expect_cookie =
|
|
|
|
|
supports_cookies && main_resource->handler == sub_resource->handler;
|
|
|
|
|
}
|
|
|
|
|
|
2020-08-14 21:28:23 +02:00
|
|
|
std::string GetIframeMainHtml(const std::string& iframe_url,
|
|
|
|
|
const std::string& sandbox_attribs) {
|
|
|
|
|
return "<html><body>TEST<iframe src=\"" + iframe_url + "\" sandbox=\"" +
|
|
|
|
|
sandbox_attribs + "\"></iframe></body></html>";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
std::string GetIframeSubHtml() {
|
|
|
|
|
// Try to script the parent frame, then send the SuccessMsg.
|
|
|
|
|
return "<html><body>TEST<script>try { parent.document.body; } catch "
|
|
|
|
|
"(exception) { console.log(exception.toString()); }" +
|
|
|
|
|
GetSuccessMsgJS() + "</script></body></html>";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
bool HasSandboxAttrib(const std::string& sandbox_attribs,
|
|
|
|
|
const std::string& attrib) {
|
|
|
|
|
return sandbox_attribs.find(attrib) != std::string::npos;
|
|
|
|
|
}
|
|
|
|
|
|
2020-09-04 21:08:55 +02:00
|
|
|
void SetupIframeRequest(CookieTestSetup* setup,
|
2020-08-14 21:28:23 +02:00
|
|
|
const std::string& test_name,
|
|
|
|
|
HandlerType main_handler,
|
2020-09-04 21:08:55 +02:00
|
|
|
CookieResource* main_resource,
|
2020-08-14 21:28:23 +02:00
|
|
|
HandlerType iframe_handler,
|
2020-09-04 21:08:55 +02:00
|
|
|
CookieResource* iframe_resource,
|
2020-08-14 21:28:23 +02:00
|
|
|
const std::string& sandbox_attribs) {
|
|
|
|
|
const std::string& base_path = "/" + test_name;
|
|
|
|
|
|
|
|
|
|
// Expect a single iframe request.
|
|
|
|
|
iframe_resource->Init(iframe_handler, base_path + ".iframe.html",
|
|
|
|
|
kMimeTypeHtml, GetIframeSubHtml());
|
|
|
|
|
|
|
|
|
|
// Expect a single main frame request.
|
|
|
|
|
const std::string& iframe_url = iframe_resource->GetPathURL();
|
|
|
|
|
main_resource->Init(main_handler, base_path, kMimeTypeHtml,
|
|
|
|
|
GetIframeMainHtml(iframe_url, sandbox_attribs));
|
|
|
|
|
|
2020-09-04 21:08:55 +02:00
|
|
|
SetupCookieExpectations(setup, main_resource, iframe_resource);
|
|
|
|
|
|
2020-08-14 21:28:23 +02:00
|
|
|
if (HasSandboxAttrib(sandbox_attribs, "allow-scripts")) {
|
|
|
|
|
// Expect the iframe to load successfully and send the SuccessMsg.
|
|
|
|
|
iframe_resource->expected_success_query_ct = 1;
|
|
|
|
|
|
|
|
|
|
const bool has_same_origin =
|
|
|
|
|
HasSandboxAttrib(sandbox_attribs, "allow-same-origin");
|
|
|
|
|
if (!has_same_origin ||
|
|
|
|
|
(has_same_origin &&
|
2021-04-12 19:55:48 +02:00
|
|
|
(IsNonStandardType(main_handler) || main_handler != iframe_handler))) {
|
2020-08-14 21:28:23 +02:00
|
|
|
// Expect parent frame scripting to fail if:
|
|
|
|
|
// - "allow-same-origin" is not specified;
|
|
|
|
|
// - the main frame is a non-standard scheme (e.g. CORS disabled);
|
|
|
|
|
// - the main frame and iframe origins don't match.
|
|
|
|
|
// The reported origin will be "null" if "allow-same-origin" is not
|
|
|
|
|
// specified, or if the iframe is hosted on a non-standard scheme.
|
|
|
|
|
const std::string& origin =
|
2021-04-12 19:55:48 +02:00
|
|
|
!has_same_origin || IsNonStandardType(iframe_handler)
|
2020-08-14 21:28:23 +02:00
|
|
|
? "null"
|
|
|
|
|
: GetOrigin(iframe_handler);
|
2023-10-19 20:08:48 +02:00
|
|
|
setup->AddConsoleMessage(
|
|
|
|
|
"SecurityError: Failed to read a named property 'document' from "
|
|
|
|
|
"'Window': Blocked a frame with origin \"" +
|
|
|
|
|
origin + "\" from accessing a cross-origin frame.");
|
2020-08-14 21:28:23 +02:00
|
|
|
}
|
2022-11-15 18:50:53 +01:00
|
|
|
|
|
|
|
|
if (has_same_origin && main_handler == iframe_handler &&
|
|
|
|
|
IsStandardType(main_handler)) {
|
|
|
|
|
setup->AddConsoleMessage(
|
|
|
|
|
"An iframe which has both allow-scripts and allow-same-origin for "
|
2023-04-04 20:00:13 +02:00
|
|
|
"its sandbox attribute can escape its sandboxing.");
|
2022-11-15 18:50:53 +01:00
|
|
|
}
|
2020-08-14 21:28:23 +02:00
|
|
|
} else {
|
|
|
|
|
// Expect JavaScript execution to fail.
|
|
|
|
|
setup->AddConsoleMessage("Blocked script execution in '" + iframe_url +
|
|
|
|
|
"' because the document's frame is sandboxed and "
|
|
|
|
|
"the 'allow-scripts' permission is not set.");
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
setup->AddResource(main_resource);
|
|
|
|
|
setup->AddResource(iframe_resource);
|
|
|
|
|
}
|
|
|
|
|
|
2022-11-15 20:45:55 +01:00
|
|
|
struct IframeTestSetup : CookieTestSetup {
|
|
|
|
|
IframeTestSetup(const std::string& test_name,
|
|
|
|
|
HandlerType main_handler,
|
|
|
|
|
HandlerType iframe_handler,
|
|
|
|
|
const std::string& sandbox_attribs)
|
|
|
|
|
: test_name_(test_name),
|
|
|
|
|
main_handler_(main_handler),
|
|
|
|
|
iframe_handler_(iframe_handler),
|
|
|
|
|
sandbox_attribs_(sandbox_attribs) {}
|
|
|
|
|
|
|
|
|
|
bool NeedsServer() const override {
|
|
|
|
|
return main_handler_ == HandlerType::SERVER ||
|
|
|
|
|
iframe_handler_ == HandlerType::SERVER;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
void Initialize() override {
|
|
|
|
|
SetupIframeRequest(this, test_name_, main_handler_, &resource_main_,
|
|
|
|
|
iframe_handler_, &resource_iframe_, sandbox_attribs_);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
private:
|
|
|
|
|
const std::string test_name_;
|
|
|
|
|
const HandlerType main_handler_;
|
|
|
|
|
const HandlerType iframe_handler_;
|
|
|
|
|
const std::string sandbox_attribs_;
|
|
|
|
|
|
|
|
|
|
CookieResource resource_main_;
|
|
|
|
|
CookieResource resource_iframe_;
|
|
|
|
|
};
|
|
|
|
|
|
2020-08-14 21:28:23 +02:00
|
|
|
} // namespace
|
|
|
|
|
|
|
|
|
|
// Test iframe sandbox attributes with different origin combinations.
|
2022-11-15 20:45:55 +01:00
|
|
|
#define CORS_TEST_IFRAME(test_name, handler_main, handler_iframe, \
|
|
|
|
|
sandbox_attribs) \
|
|
|
|
|
TEST(CorsTest, Iframe##test_name) { \
|
|
|
|
|
IframeTestSetup setup("CorsTest.Iframe" #test_name, \
|
|
|
|
|
HandlerType::handler_main, \
|
|
|
|
|
HandlerType::handler_iframe, sandbox_attribs); \
|
|
|
|
|
CefRefPtr<CorsTestHandler> handler = new CorsTestHandler(&setup); \
|
|
|
|
|
handler->ExecuteTest(); \
|
|
|
|
|
ReleaseAndWaitForDestructor(handler); \
|
2020-08-14 21:28:23 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Test all origin combinations (same and cross-origin).
|
|
|
|
|
#define CORS_TEST_IFRAME_ALL(name, sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##ServerToServer, SERVER, SERVER, sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##ServerToHttpScheme, SERVER, HTTP_SCHEME, \
|
|
|
|
|
sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##ServerToCustomStandardScheme, SERVER, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##ServerToCustomNonStandardScheme, SERVER, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, sandbox_attribs) \
|
2021-04-12 19:55:48 +02:00
|
|
|
CORS_TEST_IFRAME(name##ServerToCustomUnregisteredScheme, SERVER, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, sandbox_attribs) \
|
2020-08-14 21:28:23 +02:00
|
|
|
CORS_TEST_IFRAME(name##HttpSchemeToServer, HTTP_SCHEME, SERVER, \
|
|
|
|
|
sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##HttpSchemeToHttpScheme, HTTP_SCHEME, HTTP_SCHEME, \
|
|
|
|
|
sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##HttpSchemeToCustomStandardScheme, HTTP_SCHEME, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##HttpSchemeToCustomNonStandardScheme, HTTP_SCHEME, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, sandbox_attribs) \
|
2021-04-12 19:55:48 +02:00
|
|
|
CORS_TEST_IFRAME(name##HttpSchemeToCustomUnregisteredScheme, HTTP_SCHEME, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, sandbox_attribs) \
|
2020-08-14 21:28:23 +02:00
|
|
|
CORS_TEST_IFRAME(name##CustomStandardSchemeToServer, CUSTOM_STANDARD_SCHEME, \
|
|
|
|
|
SERVER, sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##CustomStandardSchemeToHttpScheme, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, HTTP_SCHEME, sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##CustomStandardSchemeToCustomStandardScheme, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, CUSTOM_STANDARD_SCHEME, \
|
|
|
|
|
sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##CustomStandardSchemeToCustomNonStandardScheme, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, CUSTOM_NONSTANDARD_SCHEME, \
|
|
|
|
|
sandbox_attribs) \
|
2021-04-12 19:55:48 +02:00
|
|
|
CORS_TEST_IFRAME(name##CustomStandardSchemeToCustomUnregisteredScheme, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, CUSTOM_UNREGISTERED_SCHEME, \
|
|
|
|
|
sandbox_attribs) \
|
2020-08-14 21:28:23 +02:00
|
|
|
CORS_TEST_IFRAME(name##CustomNonStandardSchemeToServer, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, SERVER, sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##CustomNonStandardSchemeToHttpScheme, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, HTTP_SCHEME, sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##CustomNonStandardSchemeToCustomStandardScheme, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, CUSTOM_STANDARD_SCHEME, \
|
|
|
|
|
sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##CustomNonStandardSchemeToCustomNonStandardScheme, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, CUSTOM_NONSTANDARD_SCHEME, \
|
2021-04-12 19:55:48 +02:00
|
|
|
sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##CustomNonStandardSchemeToCustomUnregisteredScheme, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, CUSTOM_UNREGISTERED_SCHEME, \
|
|
|
|
|
sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##CustomUnregisteredSchemeToServer, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, SERVER, sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##CustomUnregisteredSchemeToHttpScheme, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, HTTP_SCHEME, sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##CustomUnregisteredSchemeToCustomStandardScheme, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, CUSTOM_STANDARD_SCHEME, \
|
|
|
|
|
sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##CustomUnregisteredSchemeToCustomNonStandardScheme, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, CUSTOM_NONSTANDARD_SCHEME, \
|
|
|
|
|
sandbox_attribs) \
|
|
|
|
|
CORS_TEST_IFRAME(name##CustomUnregisteredSchemeToCustomUnregisteredScheme, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, CUSTOM_UNREGISTERED_SCHEME, \
|
2020-08-14 21:28:23 +02:00
|
|
|
sandbox_attribs)
|
|
|
|
|
|
|
|
|
|
// Everything is blocked.
|
|
|
|
|
CORS_TEST_IFRAME_ALL(None, "")
|
|
|
|
|
|
|
|
|
|
// JavaScript execution is allowed.
|
|
|
|
|
CORS_TEST_IFRAME_ALL(AllowScripts, "allow-scripts")
|
|
|
|
|
|
|
|
|
|
// JavaScript execution is allowed and scripting the parent is allowed for
|
|
|
|
|
// same-origin only.
|
|
|
|
|
CORS_TEST_IFRAME_ALL(AllowScriptsAndSameOrigin,
|
|
|
|
|
"allow-scripts allow-same-origin")
|
|
|
|
|
|
|
|
|
|
namespace {
|
|
|
|
|
|
2020-09-11 18:52:35 +02:00
|
|
|
const char kSubRequestMethod[] = "GET";
|
|
|
|
|
const char kSubUnsafeHeaderName[] = "x-unsafe-header";
|
|
|
|
|
const char kSubUnsafeHeaderValue[] = "not-safe";
|
|
|
|
|
|
2020-09-04 21:08:55 +02:00
|
|
|
struct SubResource : CookieResource {
|
2024-01-20 18:00:09 +01:00
|
|
|
SubResource() = default;
|
2020-08-14 21:28:23 +02:00
|
|
|
|
|
|
|
|
std::string main_origin;
|
|
|
|
|
bool supports_cors = false;
|
|
|
|
|
bool is_cross_origin = false;
|
|
|
|
|
|
|
|
|
|
void InitCors(HandlerType main_handler, bool add_header) {
|
2020-09-11 18:52:35 +02:00
|
|
|
// Must specify the method to differentiate from the preflight request.
|
|
|
|
|
method = kSubRequestMethod;
|
|
|
|
|
|
2020-08-14 21:28:23 +02:00
|
|
|
// Origin is always "null" for non-standard schemes.
|
2021-04-12 19:55:48 +02:00
|
|
|
main_origin =
|
|
|
|
|
IsNonStandardType(main_handler) ? "null" : GetOrigin(main_handler);
|
2020-08-14 21:28:23 +02:00
|
|
|
|
|
|
|
|
// True if cross-origin requests are allowed. XHR requests to non-standard
|
|
|
|
|
// schemes are not allowed (due to the "null" origin).
|
2021-04-12 19:55:48 +02:00
|
|
|
supports_cors = IsStandardType(handler);
|
2020-08-14 21:28:23 +02:00
|
|
|
if (!supports_cors) {
|
|
|
|
|
// Don't expect the xhr request.
|
|
|
|
|
expected_response_ct = 0;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// True if the request is considered cross-origin. Any requests between
|
|
|
|
|
// non-standard schemes are considered cross-origin (due to the "null"
|
|
|
|
|
// origin).
|
2021-04-12 19:55:48 +02:00
|
|
|
is_cross_origin =
|
|
|
|
|
main_handler != handler ||
|
|
|
|
|
(IsNonStandardType(main_handler) && handler == main_handler);
|
2020-08-14 21:28:23 +02:00
|
|
|
|
|
|
|
|
if (is_cross_origin && add_header) {
|
|
|
|
|
response->SetHeaderByName("Access-Control-Allow-Origin", main_origin,
|
|
|
|
|
false);
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
bool VerifyRequest(CefRefPtr<CefRequest> request) const override {
|
2023-01-02 23:59:03 +01:00
|
|
|
if (!CookieResource::VerifyRequest(request)) {
|
2020-09-04 21:08:55 +02:00
|
|
|
return false;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-09-04 21:08:55 +02:00
|
|
|
|
2020-09-11 18:52:35 +02:00
|
|
|
const std::string& request_method = request->GetMethod();
|
|
|
|
|
EXPECT_STREQ(method.c_str(), request_method.c_str()) << GetPathURL();
|
2023-01-02 23:59:03 +01:00
|
|
|
if (request_method != method) {
|
2020-09-11 18:52:35 +02:00
|
|
|
return false;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-09-11 18:52:35 +02:00
|
|
|
|
2020-08-14 21:28:23 +02:00
|
|
|
// Verify that the "Origin" header contains the expected value.
|
|
|
|
|
const std::string& origin = request->GetHeaderByName("Origin");
|
2020-09-04 21:08:55 +02:00
|
|
|
const std::string& expected_origin =
|
|
|
|
|
is_cross_origin ? main_origin : std::string();
|
|
|
|
|
EXPECT_STREQ(expected_origin.c_str(), origin.c_str()) << GetPathURL();
|
2023-01-02 23:59:03 +01:00
|
|
|
if (expected_origin != origin) {
|
2020-09-11 18:52:35 +02:00
|
|
|
return false;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-09-11 18:52:35 +02:00
|
|
|
|
|
|
|
|
// Verify that the "X-Unsafe-Header" header contains the expected value.
|
|
|
|
|
const std::string& unsafe_header =
|
|
|
|
|
request->GetHeaderByName(kSubUnsafeHeaderName);
|
|
|
|
|
EXPECT_STREQ(kSubUnsafeHeaderValue, unsafe_header.c_str()) << GetPathURL();
|
|
|
|
|
return unsafe_header == kSubUnsafeHeaderValue;
|
|
|
|
|
}
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
// See https://developer.mozilla.org/en-US/docs/Glossary/Preflight_request
|
|
|
|
|
// for details of CORS preflight behavior.
|
|
|
|
|
struct PreflightResource : Resource {
|
|
|
|
|
std::string main_origin;
|
|
|
|
|
|
|
|
|
|
void InitPreflight(HandlerType main_handler) {
|
|
|
|
|
// CORS preflight requests originate from PreflightController in the network
|
|
|
|
|
// process, so we only expect them for server requests.
|
|
|
|
|
EXPECT_EQ(HandlerType::SERVER, handler);
|
|
|
|
|
|
|
|
|
|
// Origin is always "null" for non-standard schemes.
|
2021-04-12 19:55:48 +02:00
|
|
|
main_origin =
|
|
|
|
|
IsNonStandardType(main_handler) ? "null" : GetOrigin(main_handler);
|
2020-09-11 18:52:35 +02:00
|
|
|
|
|
|
|
|
method = "OPTIONS";
|
|
|
|
|
response->SetHeaderByName("Access-Control-Allow-Methods",
|
|
|
|
|
"GET,HEAD,OPTIONS,POST", false);
|
|
|
|
|
response->SetHeaderByName("Access-Control-Allow-Headers",
|
|
|
|
|
kSubUnsafeHeaderName, false);
|
|
|
|
|
response->SetHeaderByName("Access-Control-Allow-Origin", main_origin,
|
|
|
|
|
false);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
bool VerifyRequest(CefRefPtr<CefRequest> request) const override {
|
|
|
|
|
const std::string& request_method = request->GetMethod();
|
|
|
|
|
EXPECT_STREQ(method.c_str(), request_method.c_str()) << GetPathURL();
|
2023-01-02 23:59:03 +01:00
|
|
|
if (request_method != method) {
|
2020-09-11 18:52:35 +02:00
|
|
|
return false;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-09-11 18:52:35 +02:00
|
|
|
|
|
|
|
|
const std::string& origin = request->GetHeaderByName("Origin");
|
|
|
|
|
EXPECT_STREQ(main_origin.c_str(), origin.c_str()) << GetPathURL();
|
2023-01-02 23:59:03 +01:00
|
|
|
if (main_origin != origin) {
|
2020-09-11 18:52:35 +02:00
|
|
|
return false;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-09-11 18:52:35 +02:00
|
|
|
|
|
|
|
|
const std::string& ac_request_method =
|
|
|
|
|
request->GetHeaderByName("Access-Control-Request-Method");
|
|
|
|
|
EXPECT_STREQ(kSubRequestMethod, ac_request_method.c_str()) << GetPathURL();
|
2023-01-02 23:59:03 +01:00
|
|
|
if (ac_request_method != kSubRequestMethod) {
|
2020-09-11 18:52:35 +02:00
|
|
|
return false;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-09-11 18:52:35 +02:00
|
|
|
|
|
|
|
|
const std::string& ac_request_headers =
|
|
|
|
|
request->GetHeaderByName("Access-Control-Request-Headers");
|
|
|
|
|
EXPECT_STREQ(kSubUnsafeHeaderName, ac_request_headers.c_str())
|
|
|
|
|
<< GetPathURL();
|
2023-01-02 23:59:03 +01:00
|
|
|
if (ac_request_headers != kSubUnsafeHeaderName) {
|
2020-09-11 18:52:35 +02:00
|
|
|
return false;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-09-11 18:52:35 +02:00
|
|
|
|
|
|
|
|
return true;
|
2020-08-14 21:28:23 +02:00
|
|
|
}
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
enum class ExecMode {
|
|
|
|
|
XHR,
|
|
|
|
|
FETCH,
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
std::string GetXhrExecJS(const std::string& sub_url) {
|
2020-09-11 18:52:35 +02:00
|
|
|
// Inclusion of an unsafe header triggers CORS preflight for cross-origin
|
|
|
|
|
// requests to the server.
|
2020-08-14 21:28:23 +02:00
|
|
|
return "xhr = new XMLHttpRequest();\n"
|
|
|
|
|
"xhr.open(\"GET\", \"" +
|
|
|
|
|
sub_url +
|
|
|
|
|
"\", true)\n;"
|
2020-09-11 18:52:35 +02:00
|
|
|
"xhr.setRequestHeader('" +
|
|
|
|
|
kSubUnsafeHeaderName + "', '" + kSubUnsafeHeaderValue +
|
|
|
|
|
"');\n"
|
2020-08-14 21:28:23 +02:00
|
|
|
"xhr.onload = function(e) {\n"
|
|
|
|
|
" if (xhr.readyState === 4) {\n"
|
|
|
|
|
" if (xhr.status === 200) {\n"
|
|
|
|
|
" onResult(xhr.responseText);\n"
|
|
|
|
|
" } else {\n"
|
|
|
|
|
" console.log('XMLHttpRequest failed with status ' + "
|
|
|
|
|
"xhr.status);\n"
|
|
|
|
|
" onResult('FAILURE');\n"
|
|
|
|
|
" }\n"
|
|
|
|
|
" }\n"
|
|
|
|
|
"};\n"
|
|
|
|
|
"xhr.onerror = function(e) {\n"
|
|
|
|
|
" onResult('FAILURE');\n"
|
|
|
|
|
"};\n"
|
|
|
|
|
"xhr.send();\n";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
std::string GetFetchExecJS(const std::string& sub_url) {
|
2020-09-11 18:52:35 +02:00
|
|
|
// Inclusion of an unsafe header triggers CORS preflight for cross-origin
|
|
|
|
|
// requests to the server.
|
|
|
|
|
return std::string() +
|
|
|
|
|
"let h = new Headers();\n"
|
|
|
|
|
"h.append('" +
|
|
|
|
|
kSubUnsafeHeaderName + "', '" + kSubUnsafeHeaderValue +
|
|
|
|
|
"');\n"
|
|
|
|
|
"fetch('" +
|
|
|
|
|
sub_url +
|
|
|
|
|
"', {headers: h})\n"
|
2020-08-14 21:28:23 +02:00
|
|
|
".then(function(response) {\n"
|
|
|
|
|
" if (response.status === 200) {\n"
|
|
|
|
|
" response.text().then(function(text) {\n"
|
|
|
|
|
" onResult(text);\n"
|
|
|
|
|
" }).catch(function(e) {\n"
|
|
|
|
|
" onResult('FAILURE')\n; "
|
|
|
|
|
" })\n;"
|
|
|
|
|
" } else {\n"
|
|
|
|
|
" onResult('FAILURE');\n"
|
|
|
|
|
" }\n"
|
|
|
|
|
"}).catch(function(e) {\n"
|
|
|
|
|
" onResult('FAILURE');\n"
|
|
|
|
|
"});\n";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
std::string GetExecMainHtml(ExecMode mode, const std::string& sub_url) {
|
|
|
|
|
return std::string() +
|
|
|
|
|
"<html><head>\n"
|
|
|
|
|
"<script language=\"JavaScript\">\n" +
|
|
|
|
|
"function onResult(val) {\n"
|
|
|
|
|
" if (val === '" +
|
|
|
|
|
kDefaultText + "') {" + GetSuccessMsgJS() + "} else {" +
|
|
|
|
|
GetFailureMsgJS() +
|
|
|
|
|
"}\n}\n"
|
|
|
|
|
"function execRequest() {\n" +
|
|
|
|
|
(mode == ExecMode::XHR ? GetXhrExecJS(sub_url)
|
|
|
|
|
: GetFetchExecJS(sub_url)) +
|
|
|
|
|
"}\n</script>\n"
|
|
|
|
|
"</head><body onload=\"execRequest();\">"
|
|
|
|
|
"Running execRequest..."
|
|
|
|
|
"</body></html>";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// XHR and fetch requests behave the same, except for console message contents.
|
2020-09-11 18:52:35 +02:00
|
|
|
// In addition to basic CORS header behaviors and request blocking, this test
|
|
|
|
|
// verifies that CORS preflight requests are sent and received when expected.
|
|
|
|
|
// Since preflight behavior is implemented in the network process we expect it
|
|
|
|
|
// to already have substantial test coverage in Chromium.
|
2020-08-14 21:28:23 +02:00
|
|
|
void SetupExecRequest(ExecMode mode,
|
2020-09-04 21:08:55 +02:00
|
|
|
CookieTestSetup* setup,
|
2020-08-14 21:28:23 +02:00
|
|
|
const std::string& test_name,
|
|
|
|
|
HandlerType main_handler,
|
2020-09-04 21:08:55 +02:00
|
|
|
CookieResource* main_resource,
|
2020-08-14 21:28:23 +02:00
|
|
|
HandlerType sub_handler,
|
|
|
|
|
SubResource* sub_resource,
|
2020-09-11 18:52:35 +02:00
|
|
|
PreflightResource* preflight_resource,
|
2020-08-14 21:28:23 +02:00
|
|
|
bool add_header) {
|
|
|
|
|
const std::string& base_path = "/" + test_name;
|
|
|
|
|
|
|
|
|
|
// Expect a single xhr request.
|
2020-09-11 18:52:35 +02:00
|
|
|
const std::string& sub_path = base_path + ".sub.txt";
|
|
|
|
|
sub_resource->Init(sub_handler, sub_path, kMimeTypeText, kDefaultText);
|
2020-08-14 21:28:23 +02:00
|
|
|
sub_resource->InitCors(main_handler, add_header);
|
|
|
|
|
|
|
|
|
|
// Expect a single main frame request.
|
|
|
|
|
const std::string& sub_url = sub_resource->GetPathURL();
|
|
|
|
|
main_resource->Init(main_handler, base_path, kMimeTypeHtml,
|
|
|
|
|
GetExecMainHtml(mode, sub_url));
|
|
|
|
|
|
2020-09-04 21:08:55 +02:00
|
|
|
SetupCookieExpectations(setup, main_resource, sub_resource);
|
|
|
|
|
|
2020-09-11 18:52:35 +02:00
|
|
|
// Cross-origin requests to a server sub-resource will receive a CORS
|
|
|
|
|
// preflight request because we add an unsafe header.
|
|
|
|
|
const bool expect_cors_preflight =
|
|
|
|
|
sub_resource->is_cross_origin && sub_handler == HandlerType::SERVER;
|
|
|
|
|
|
2020-08-14 21:28:23 +02:00
|
|
|
if (sub_resource->is_cross_origin &&
|
|
|
|
|
(!sub_resource->supports_cors || !add_header)) {
|
|
|
|
|
// Expect the cross-origin XHR to be blocked.
|
|
|
|
|
main_resource->expected_failure_query_ct = 1;
|
|
|
|
|
|
|
|
|
|
if (sub_resource->supports_cors && !add_header) {
|
2020-09-11 18:52:35 +02:00
|
|
|
// The request supports CORS, but we didn't add the
|
|
|
|
|
// "Access-Control-Allow-Origin" header.
|
|
|
|
|
if (!expect_cors_preflight || preflight_resource != nullptr) {
|
|
|
|
|
// This is the error message when not expecting a CORS preflight
|
|
|
|
|
// request, or when the preflight request is handled by the server.
|
|
|
|
|
// Unhandled preflight requests will output a different error message
|
|
|
|
|
// (see below).
|
|
|
|
|
if (mode == ExecMode::XHR) {
|
|
|
|
|
setup->AddConsoleMessage(
|
|
|
|
|
"Access to XMLHttpRequest at '" + sub_url + "' from origin '" +
|
|
|
|
|
sub_resource->main_origin +
|
|
|
|
|
"' has been blocked by CORS policy: No "
|
|
|
|
|
"'Access-Control-Allow-Origin' "
|
|
|
|
|
"header is present on the requested resource.");
|
|
|
|
|
} else {
|
|
|
|
|
setup->AddConsoleMessage(
|
|
|
|
|
"Access to fetch at '" + sub_url + "' from origin '" +
|
|
|
|
|
sub_resource->main_origin +
|
|
|
|
|
"' has been blocked by CORS policy: No "
|
|
|
|
|
"'Access-Control-Allow-Origin' header is present on the "
|
|
|
|
|
"requested "
|
|
|
|
|
"resource. If an opaque response serves your needs, set the "
|
|
|
|
|
"request's mode to 'no-cors' to fetch the resource with CORS "
|
|
|
|
|
"disabled.");
|
|
|
|
|
}
|
2020-08-14 21:28:23 +02:00
|
|
|
}
|
|
|
|
|
} else if (mode == ExecMode::XHR) {
|
|
|
|
|
setup->AddConsoleMessage(
|
|
|
|
|
"Access to XMLHttpRequest at '" + sub_url + "' from origin '" +
|
|
|
|
|
sub_resource->main_origin +
|
|
|
|
|
"' has been blocked by CORS policy: Cross origin requests are only "
|
|
|
|
|
"supported for protocol schemes:");
|
|
|
|
|
} else {
|
2021-06-04 03:34:56 +02:00
|
|
|
setup->AddConsoleMessage("Fetch API cannot load " + sub_url +
|
|
|
|
|
". URL scheme \"" + GetScheme(sub_handler) +
|
|
|
|
|
"\" is not supported.");
|
2020-08-14 21:28:23 +02:00
|
|
|
}
|
|
|
|
|
} else {
|
|
|
|
|
// Expect the (possibly cross-origin) XHR to be allowed.
|
|
|
|
|
main_resource->expected_success_query_ct = 1;
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
setup->AddResource(main_resource);
|
|
|
|
|
setup->AddResource(sub_resource);
|
2020-09-11 18:52:35 +02:00
|
|
|
|
|
|
|
|
if (expect_cors_preflight) {
|
|
|
|
|
// Expect a CORS preflight request.
|
|
|
|
|
if (preflight_resource) {
|
|
|
|
|
// The server will handle the preflight request. The cross-origin XHR may
|
|
|
|
|
// still be blocked if the "Access-Control-Allow-Origin" header is missing
|
|
|
|
|
// (see above).
|
|
|
|
|
preflight_resource->Init(sub_handler, sub_path, kMimeTypeText,
|
|
|
|
|
std::string());
|
|
|
|
|
preflight_resource->InitPreflight(main_handler);
|
|
|
|
|
setup->AddResource(preflight_resource);
|
|
|
|
|
} else {
|
|
|
|
|
// The server will not handle the preflight request. Expect the
|
|
|
|
|
// cross-origin XHR to be blocked.
|
|
|
|
|
main_resource->expected_failure_query_ct = 1;
|
|
|
|
|
main_resource->expected_success_query_ct = 0;
|
|
|
|
|
sub_resource->expected_response_ct = 0;
|
|
|
|
|
|
|
|
|
|
if (mode == ExecMode::XHR) {
|
|
|
|
|
setup->AddConsoleMessage(
|
|
|
|
|
"Access to XMLHttpRequest at '" + sub_url + "' from origin '" +
|
|
|
|
|
sub_resource->main_origin +
|
|
|
|
|
"' has been blocked by CORS policy: Response to preflight request "
|
|
|
|
|
"doesn't pass access control check: No "
|
|
|
|
|
"'Access-Control-Allow-Origin' header is present on the requested "
|
|
|
|
|
"resource.");
|
|
|
|
|
} else {
|
|
|
|
|
setup->AddConsoleMessage(
|
|
|
|
|
"Access to fetch at '" + sub_url + "' from origin '" +
|
|
|
|
|
sub_resource->main_origin +
|
|
|
|
|
"' has been blocked by CORS policy: Response to preflight request "
|
|
|
|
|
"doesn't pass access control check: No "
|
|
|
|
|
"'Access-Control-Allow-Origin' header is present on the requested "
|
|
|
|
|
"resource. If an opaque response serves your needs, set the "
|
|
|
|
|
"request's mode to 'no-cors' to fetch the resource with CORS "
|
|
|
|
|
"disabled.");
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
}
|
2020-08-14 21:28:23 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
} // namespace
|
|
|
|
|
|
|
|
|
|
// Test XHR requests with different origin combinations.
|
2020-09-11 18:52:35 +02:00
|
|
|
#define CORS_TEST_XHR(test_name, handler_main, handler_sub, add_header) \
|
|
|
|
|
TEST(CorsTest, Xhr##test_name) { \
|
|
|
|
|
CookieTestSetup setup; \
|
|
|
|
|
CookieResource resource_main; \
|
|
|
|
|
SubResource resource_sub; \
|
|
|
|
|
PreflightResource resource_preflight; \
|
|
|
|
|
SetupExecRequest(ExecMode::XHR, &setup, "CorsTest.Xhr" #test_name, \
|
|
|
|
|
HandlerType::handler_main, &resource_main, \
|
|
|
|
|
HandlerType::handler_sub, &resource_sub, \
|
|
|
|
|
&resource_preflight, add_header); \
|
|
|
|
|
CefRefPtr<CorsTestHandler> handler = new CorsTestHandler(&setup); \
|
|
|
|
|
handler->ExecuteTest(); \
|
|
|
|
|
ReleaseAndWaitForDestructor(handler); \
|
2020-08-14 21:28:23 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Test all origin combinations (same and cross-origin).
|
|
|
|
|
#define CORS_TEST_XHR_ALL(name, add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##ServerToServer, SERVER, SERVER, add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##ServerToHttpScheme, SERVER, HTTP_SCHEME, add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##ServerToCustomStandardScheme, SERVER, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##ServerToCustomNonStandardScheme, SERVER, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, add_header) \
|
2021-04-12 19:55:48 +02:00
|
|
|
CORS_TEST_XHR(name##ServerToCustomUnregisteredScheme, SERVER, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, add_header) \
|
2020-08-14 21:28:23 +02:00
|
|
|
CORS_TEST_XHR(name##HttpSchemeToServer, HTTP_SCHEME, SERVER, add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##HttpSchemeToHttpScheme, HTTP_SCHEME, HTTP_SCHEME, \
|
|
|
|
|
add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##HttpSchemeToCustomStandardScheme, HTTP_SCHEME, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##HttpSchemeToCustomNonStandardScheme, HTTP_SCHEME, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, add_header) \
|
2021-04-12 19:55:48 +02:00
|
|
|
CORS_TEST_XHR(name##HttpSchemeToCustomUnregisteredScheme, HTTP_SCHEME, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, add_header) \
|
2020-08-14 21:28:23 +02:00
|
|
|
CORS_TEST_XHR(name##CustomStandardSchemeToServer, CUSTOM_STANDARD_SCHEME, \
|
|
|
|
|
SERVER, add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##CustomStandardSchemeToHttpScheme, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, HTTP_SCHEME, add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##CustomStandardSchemeToCustomStandardScheme, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, CUSTOM_STANDARD_SCHEME, add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##CustomStandardSchemeToCustomNonStandardScheme, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, CUSTOM_NONSTANDARD_SCHEME, add_header) \
|
2021-04-12 19:55:48 +02:00
|
|
|
CORS_TEST_XHR(name##CustomStandardSchemeToCustomUnregisteredScheme, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, CUSTOM_UNREGISTERED_SCHEME, \
|
|
|
|
|
add_header) \
|
2020-08-14 21:28:23 +02:00
|
|
|
CORS_TEST_XHR(name##CustomNonStandardSchemeToServer, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, SERVER, add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##CustomNonStandardSchemeToHttpScheme, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, HTTP_SCHEME, add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##CustomNonStandardSchemeToCustomStandardScheme, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, CUSTOM_STANDARD_SCHEME, add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##CustomNonStandardSchemeToCustomNonStandardScheme, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, CUSTOM_NONSTANDARD_SCHEME, \
|
2021-04-12 19:55:48 +02:00
|
|
|
add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##CustomNonStandardSchemeToCustomUnregisteredScheme, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, CUSTOM_UNREGISTERED_SCHEME, \
|
|
|
|
|
add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##CustomUnregisteredSchemeToServer, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, SERVER, add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##CustomUnregisteredSchemeToHttpScheme, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, HTTP_SCHEME, add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##CustomUnregisteredSchemeToCustomStandardScheme, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, CUSTOM_STANDARD_SCHEME, \
|
|
|
|
|
add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##CustomUnregisteredSchemeToCustomNonStandardScheme, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, CUSTOM_NONSTANDARD_SCHEME, \
|
|
|
|
|
add_header) \
|
|
|
|
|
CORS_TEST_XHR(name##CustomUnregisteredSchemeToCustomUnregisteredScheme, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, CUSTOM_UNREGISTERED_SCHEME, \
|
2020-08-14 21:28:23 +02:00
|
|
|
add_header)
|
|
|
|
|
|
|
|
|
|
// XHR requests without the "Access-Control-Allow-Origin" header.
|
|
|
|
|
CORS_TEST_XHR_ALL(NoHeader, false)
|
|
|
|
|
|
|
|
|
|
// XHR requests with the "Access-Control-Allow-Origin" header.
|
|
|
|
|
CORS_TEST_XHR_ALL(WithHeader, true)
|
|
|
|
|
|
2020-09-11 18:52:35 +02:00
|
|
|
// Like above, but without handling CORS preflight requests.
|
|
|
|
|
#define CORS_TEST_XHR_NO_PREFLIGHT(test_name, handler_main, handler_sub, \
|
|
|
|
|
add_header) \
|
|
|
|
|
TEST(CorsTest, Xhr##test_name) { \
|
|
|
|
|
CookieTestSetup setup; \
|
|
|
|
|
CookieResource resource_main; \
|
|
|
|
|
SubResource resource_sub; \
|
|
|
|
|
SetupExecRequest(ExecMode::XHR, &setup, "CorsTest.Xhr" #test_name, \
|
|
|
|
|
HandlerType::handler_main, &resource_main, \
|
|
|
|
|
HandlerType::handler_sub, &resource_sub, nullptr, \
|
|
|
|
|
add_header); \
|
|
|
|
|
CefRefPtr<CorsTestHandler> handler = new CorsTestHandler(&setup); \
|
|
|
|
|
handler->ExecuteTest(); \
|
|
|
|
|
ReleaseAndWaitForDestructor(handler); \
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#define CORS_TEST_XHR_NO_PREFLIGHT_SERVER(name, add_header) \
|
|
|
|
|
CORS_TEST_XHR_NO_PREFLIGHT(name##ServerToServer, SERVER, SERVER, add_header) \
|
|
|
|
|
CORS_TEST_XHR_NO_PREFLIGHT(name##HttpSchemeToServer, HTTP_SCHEME, SERVER, \
|
|
|
|
|
add_header) \
|
|
|
|
|
CORS_TEST_XHR_NO_PREFLIGHT(name##CustomStandardSchemeToServer, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, SERVER, add_header) \
|
|
|
|
|
CORS_TEST_XHR_NO_PREFLIGHT(name##CustomNonStandardSchemeToServer, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, SERVER, add_header)
|
|
|
|
|
|
|
|
|
|
// XHR requests without the "Access-Control-Allow-Origin" header.
|
|
|
|
|
CORS_TEST_XHR_NO_PREFLIGHT_SERVER(NoHeaderNoPreflight, false)
|
|
|
|
|
|
|
|
|
|
// XHR requests with the "Access-Control-Allow-Origin" header.
|
|
|
|
|
CORS_TEST_XHR_NO_PREFLIGHT_SERVER(WithHeaderNoPreflight, true)
|
|
|
|
|
|
2020-08-14 21:28:23 +02:00
|
|
|
// Test fetch requests with different origin combinations.
|
|
|
|
|
#define CORS_TEST_FETCH(test_name, handler_main, handler_sub, add_header) \
|
|
|
|
|
TEST(CorsTest, Fetch##test_name) { \
|
2020-09-04 21:08:55 +02:00
|
|
|
CookieTestSetup setup; \
|
|
|
|
|
CookieResource resource_main; \
|
2020-08-14 21:28:23 +02:00
|
|
|
SubResource resource_sub; \
|
2020-09-11 18:52:35 +02:00
|
|
|
PreflightResource resource_preflight; \
|
2020-08-14 21:28:23 +02:00
|
|
|
SetupExecRequest(ExecMode::FETCH, &setup, "CorsTest.Fetch" #test_name, \
|
|
|
|
|
HandlerType::handler_main, &resource_main, \
|
2020-09-11 18:52:35 +02:00
|
|
|
HandlerType::handler_sub, &resource_sub, \
|
|
|
|
|
&resource_preflight, add_header); \
|
2020-08-14 21:28:23 +02:00
|
|
|
CefRefPtr<CorsTestHandler> handler = new CorsTestHandler(&setup); \
|
|
|
|
|
handler->ExecuteTest(); \
|
|
|
|
|
ReleaseAndWaitForDestructor(handler); \
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Test all origin combinations (same and cross-origin).
|
|
|
|
|
#define CORS_TEST_FETCH_ALL(name, add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##ServerToServer, SERVER, SERVER, add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##ServerToHttpScheme, SERVER, HTTP_SCHEME, add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##ServerToCustomStandardScheme, SERVER, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##ServerToCustomNonStandardScheme, SERVER, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, add_header) \
|
2021-04-12 19:55:48 +02:00
|
|
|
CORS_TEST_FETCH(name##ServerToCustomUnregisteredScheme, SERVER, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, add_header) \
|
2020-08-14 21:28:23 +02:00
|
|
|
CORS_TEST_FETCH(name##HttpSchemeToServer, HTTP_SCHEME, SERVER, add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##HttpSchemeToHttpScheme, HTTP_SCHEME, HTTP_SCHEME, \
|
|
|
|
|
add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##HttpSchemeToCustomStandardScheme, HTTP_SCHEME, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##HttpSchemeToCustomNonStandardScheme, HTTP_SCHEME, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, add_header) \
|
2021-04-12 19:55:48 +02:00
|
|
|
CORS_TEST_FETCH(name##HttpSchemeToCustomUnregisteredScheme, HTTP_SCHEME, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, add_header) \
|
2020-08-14 21:28:23 +02:00
|
|
|
CORS_TEST_FETCH(name##CustomStandardSchemeToServer, CUSTOM_STANDARD_SCHEME, \
|
|
|
|
|
SERVER, add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##CustomStandardSchemeToHttpScheme, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, HTTP_SCHEME, add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##CustomStandardSchemeToCustomStandardScheme, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, CUSTOM_STANDARD_SCHEME, add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##CustomStandardSchemeToCustomNonStandardScheme, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, CUSTOM_NONSTANDARD_SCHEME, \
|
|
|
|
|
add_header) \
|
2021-04-12 19:55:48 +02:00
|
|
|
CORS_TEST_FETCH(name##CustomStandardSchemeToCustomUnregisteredScheme, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, CUSTOM_UNREGISTERED_SCHEME, \
|
|
|
|
|
add_header) \
|
2020-08-14 21:28:23 +02:00
|
|
|
CORS_TEST_FETCH(name##CustomNonStandardSchemeToServer, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, SERVER, add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##CustomNonStandardSchemeToHttpScheme, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, HTTP_SCHEME, add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##CustomNonStandardSchemeToCustomStandardScheme, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, CUSTOM_STANDARD_SCHEME, \
|
|
|
|
|
add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##CustomNonStandardSchemeToCustomNonStandardScheme, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, CUSTOM_NONSTANDARD_SCHEME, \
|
2021-04-12 19:55:48 +02:00
|
|
|
add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##CustomNonStandardSchemeToCustomUnregisteredScheme, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, CUSTOM_UNREGISTERED_SCHEME, \
|
|
|
|
|
add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##CustomUnregisteredSchemeToServer, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, SERVER, add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##CustomUnregisteredSchemeToHttpScheme, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, HTTP_SCHEME, add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##CustomUnregisteredSchemeToCustomStandardScheme, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, CUSTOM_STANDARD_SCHEME, \
|
|
|
|
|
add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##CustomUnregisteredSchemeToCustomNonStandardScheme, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, CUSTOM_NONSTANDARD_SCHEME, \
|
|
|
|
|
add_header) \
|
|
|
|
|
CORS_TEST_FETCH(name##CustomUnregisteredSchemeToCustomUnregisteredScheme, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, CUSTOM_UNREGISTERED_SCHEME, \
|
2020-08-14 21:28:23 +02:00
|
|
|
add_header)
|
|
|
|
|
|
|
|
|
|
// Fetch requests without the "Access-Control-Allow-Origin" header.
|
|
|
|
|
CORS_TEST_FETCH_ALL(NoHeader, false)
|
|
|
|
|
|
|
|
|
|
// Fetch requests with the "Access-Control-Allow-Origin" header.
|
|
|
|
|
CORS_TEST_FETCH_ALL(WithHeader, true)
|
2020-09-09 19:57:46 +02:00
|
|
|
|
2020-09-11 18:52:35 +02:00
|
|
|
// Like above, but without handling CORS preflight requests.
|
|
|
|
|
#define CORS_TEST_FETCH_NO_PREFLIGHT(test_name, handler_main, handler_sub, \
|
|
|
|
|
add_header) \
|
|
|
|
|
TEST(CorsTest, Fetch##test_name) { \
|
|
|
|
|
CookieTestSetup setup; \
|
|
|
|
|
CookieResource resource_main; \
|
|
|
|
|
SubResource resource_sub; \
|
|
|
|
|
SetupExecRequest(ExecMode::FETCH, &setup, "CorsTest.Fetch" #test_name, \
|
|
|
|
|
HandlerType::handler_main, &resource_main, \
|
|
|
|
|
HandlerType::handler_sub, &resource_sub, nullptr, \
|
|
|
|
|
add_header); \
|
|
|
|
|
CefRefPtr<CorsTestHandler> handler = new CorsTestHandler(&setup); \
|
|
|
|
|
handler->ExecuteTest(); \
|
|
|
|
|
ReleaseAndWaitForDestructor(handler); \
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
#define CORS_TEST_FETCH_NO_PREFLIGHT_SERVER(name, add_header) \
|
|
|
|
|
CORS_TEST_FETCH_NO_PREFLIGHT(name##ServerToServer, SERVER, SERVER, \
|
|
|
|
|
add_header) \
|
|
|
|
|
CORS_TEST_FETCH_NO_PREFLIGHT(name##HttpSchemeToServer, HTTP_SCHEME, SERVER, \
|
|
|
|
|
add_header) \
|
|
|
|
|
CORS_TEST_FETCH_NO_PREFLIGHT(name##CustomStandardSchemeToServer, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, SERVER, add_header) \
|
|
|
|
|
CORS_TEST_FETCH_NO_PREFLIGHT(name##CustomNonStandardSchemeToServer, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, SERVER, add_header)
|
|
|
|
|
|
|
|
|
|
// Fetch requests without the "Access-Control-Allow-Origin" header.
|
|
|
|
|
CORS_TEST_FETCH_NO_PREFLIGHT_SERVER(NoHeaderNoPreflight, false)
|
|
|
|
|
|
|
|
|
|
// Fetch requests with the "Access-Control-Allow-Origin" header.
|
|
|
|
|
CORS_TEST_FETCH_NO_PREFLIGHT_SERVER(WithHeaderNoPreflight, true)
|
|
|
|
|
|
2020-09-09 19:57:46 +02:00
|
|
|
namespace {
|
|
|
|
|
|
2020-09-09 21:59:33 +02:00
|
|
|
enum class RedirectMode {
|
2020-09-09 19:57:46 +02:00
|
|
|
MODE_302,
|
|
|
|
|
MODE_307,
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
struct RedirectGetResource : CookieResource {
|
2024-01-20 18:00:09 +01:00
|
|
|
RedirectGetResource() = default;
|
2020-09-09 19:57:46 +02:00
|
|
|
|
|
|
|
|
bool VerifyRequest(CefRefPtr<CefRequest> request) const override {
|
2023-01-02 23:59:03 +01:00
|
|
|
if (!CookieResource::VerifyRequest(request)) {
|
2020-09-09 19:57:46 +02:00
|
|
|
return false;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-09-09 19:57:46 +02:00
|
|
|
|
|
|
|
|
// The "Origin" header should never be present for a redirect.
|
|
|
|
|
const std::string& origin = request->GetHeaderByName("Origin");
|
|
|
|
|
EXPECT_TRUE(origin.empty()) << GetPathURL();
|
|
|
|
|
return origin.empty();
|
|
|
|
|
}
|
|
|
|
|
};
|
|
|
|
|
|
2020-09-09 21:59:33 +02:00
|
|
|
void SetupRedirectResponse(RedirectMode mode,
|
|
|
|
|
const std::string& redirect_url,
|
|
|
|
|
CefRefPtr<CefResponse> response) {
|
2023-01-02 23:59:03 +01:00
|
|
|
if (mode == RedirectMode::MODE_302) {
|
2020-09-09 19:57:46 +02:00
|
|
|
response->SetStatus(302);
|
2023-01-02 23:59:03 +01:00
|
|
|
} else if (mode == RedirectMode::MODE_307) {
|
2020-09-09 19:57:46 +02:00
|
|
|
response->SetStatus(307);
|
2023-01-02 23:59:03 +01:00
|
|
|
} else {
|
2020-09-09 19:57:46 +02:00
|
|
|
NOTREACHED();
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-09-09 19:57:46 +02:00
|
|
|
|
|
|
|
|
response->SetHeaderByName("Location", redirect_url,
|
2024-01-20 18:00:09 +01:00
|
|
|
/*overwrite=*/false);
|
2020-09-09 19:57:46 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Test redirect requests.
|
2020-09-09 21:59:33 +02:00
|
|
|
void SetupRedirectGetRequest(RedirectMode mode,
|
2020-09-09 19:57:46 +02:00
|
|
|
CookieTestSetup* setup,
|
|
|
|
|
const std::string& test_name,
|
|
|
|
|
HandlerType main_handler,
|
|
|
|
|
CookieResource* main_resource,
|
|
|
|
|
HandlerType redirect_handler,
|
|
|
|
|
RedirectGetResource* redirect_resource) {
|
|
|
|
|
const std::string& base_path = "/" + test_name;
|
|
|
|
|
|
|
|
|
|
// Expect a single redirect request that sends SuccessMsg.
|
|
|
|
|
redirect_resource->Init(redirect_handler, base_path + ".redirect.html",
|
|
|
|
|
kMimeTypeHtml, GetDefaultSuccessMsgHtml());
|
|
|
|
|
redirect_resource->expected_success_query_ct = 1;
|
|
|
|
|
|
|
|
|
|
// Expect a single main request that results in a redirect.
|
|
|
|
|
const std::string& redirect_url = redirect_resource->GetPathURL();
|
|
|
|
|
main_resource->Init(main_handler, base_path, kMimeTypeHtml, std::string());
|
2020-09-09 21:59:33 +02:00
|
|
|
SetupRedirectResponse(mode, redirect_url, main_resource->response);
|
2020-09-09 19:57:46 +02:00
|
|
|
|
|
|
|
|
SetupCookieExpectations(setup, main_resource, redirect_resource);
|
|
|
|
|
|
|
|
|
|
setup->AddResource(main_resource);
|
|
|
|
|
setup->AddResource(redirect_resource);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
} // namespace
|
|
|
|
|
|
|
|
|
|
// Test redirect GET requests with different origin combinations.
|
2020-09-09 21:59:33 +02:00
|
|
|
#define CORS_TEST_REDIRECT_GET(test_name, mode, handler_main, \
|
|
|
|
|
handler_redirect) \
|
|
|
|
|
TEST(CorsTest, RedirectGet##test_name) { \
|
|
|
|
|
CookieTestSetup setup; \
|
|
|
|
|
CookieResource resource_main; \
|
|
|
|
|
RedirectGetResource resource_redirect; \
|
|
|
|
|
SetupRedirectGetRequest( \
|
|
|
|
|
RedirectMode::mode, &setup, "CorsTest.RedirectGet" #test_name, \
|
|
|
|
|
HandlerType::handler_main, &resource_main, \
|
|
|
|
|
HandlerType::handler_redirect, &resource_redirect); \
|
|
|
|
|
CefRefPtr<CorsTestHandler> handler = new CorsTestHandler(&setup); \
|
|
|
|
|
handler->ExecuteTest(); \
|
|
|
|
|
ReleaseAndWaitForDestructor(handler); \
|
2020-09-09 19:57:46 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Test all redirect GET combinations (same and cross-origin).
|
|
|
|
|
#define CORS_TEST_REDIRECT_GET_ALL(name, mode) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET(name##ServerToServer, mode, SERVER, SERVER) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET(name##ServerToHttpScheme, mode, SERVER, HTTP_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET(name##ServerToCustomStandardScheme, mode, SERVER, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET(name##ServerToCustomNonStandardScheme, mode, SERVER, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME) \
|
2021-04-12 19:55:48 +02:00
|
|
|
CORS_TEST_REDIRECT_GET(name##ServerToCustomUnregisteredScheme, mode, SERVER, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME) \
|
2020-09-09 19:57:46 +02:00
|
|
|
CORS_TEST_REDIRECT_GET(name##HttpSchemeToServer, mode, HTTP_SCHEME, SERVER) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET(name##HttpSchemeToHttpScheme, mode, HTTP_SCHEME, \
|
|
|
|
|
HTTP_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET(name##HttpSchemeToCustomStandardScheme, mode, \
|
|
|
|
|
HTTP_SCHEME, CUSTOM_STANDARD_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET(name##HttpSchemeToCustomNonStandardScheme, mode, \
|
|
|
|
|
HTTP_SCHEME, CUSTOM_NONSTANDARD_SCHEME) \
|
2021-04-12 19:55:48 +02:00
|
|
|
CORS_TEST_REDIRECT_GET(name##HttpSchemeToCustomUnregisteredScheme, mode, \
|
|
|
|
|
HTTP_SCHEME, CUSTOM_UNREGISTERED_SCHEME) \
|
2020-09-09 19:57:46 +02:00
|
|
|
CORS_TEST_REDIRECT_GET(name##CustomStandardSchemeToServer, mode, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, SERVER) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET(name##CustomStandardSchemeToHttpScheme, mode, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, HTTP_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET(name##CustomStandardSchemeToCustomStandardScheme, \
|
|
|
|
|
mode, CUSTOM_STANDARD_SCHEME, CUSTOM_STANDARD_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET(name##CustomStandardSchemeToCustomNonStandardScheme, \
|
|
|
|
|
mode, CUSTOM_STANDARD_SCHEME, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME) \
|
2021-04-12 19:55:48 +02:00
|
|
|
CORS_TEST_REDIRECT_GET(name##CustomStandardSchemeToCustomUnregisteredScheme, \
|
|
|
|
|
mode, CUSTOM_STANDARD_SCHEME, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME) \
|
2020-09-09 19:57:46 +02:00
|
|
|
CORS_TEST_REDIRECT_GET(name##CustomNonStandardSchemeToServer, mode, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, SERVER) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET(name##CustomNonStandardSchemeToHttpScheme, mode, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, HTTP_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET(name##CustomNonStandardSchemeToCustomStandardScheme, \
|
|
|
|
|
mode, CUSTOM_NONSTANDARD_SCHEME, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET( \
|
|
|
|
|
name##CustomNonStandardSchemeToCustomNonStandardScheme, mode, \
|
2021-04-12 19:55:48 +02:00
|
|
|
CUSTOM_NONSTANDARD_SCHEME, CUSTOM_NONSTANDARD_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET( \
|
|
|
|
|
name##CustomNonStandardSchemeToCustomUnregisteredScheme, mode, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, CUSTOM_UNREGISTERED_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET(name##CustomUnregisteredSchemeToServer, mode, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, SERVER) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET(name##CustomUnregisteredSchemeToHttpScheme, mode, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, HTTP_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET(name##CustomUnregisteredSchemeToCustomStandardScheme, \
|
|
|
|
|
mode, CUSTOM_UNREGISTERED_SCHEME, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET( \
|
|
|
|
|
name##CustomUnregisteredSchemeToCustomNonStandardScheme, mode, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, CUSTOM_NONSTANDARD_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_GET( \
|
|
|
|
|
name##CustomUnregisteredSchemeToCustomUnregisteredScheme, mode, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, CUSTOM_UNREGISTERED_SCHEME)
|
2020-09-09 19:57:46 +02:00
|
|
|
|
|
|
|
|
// Redirect GET requests.
|
|
|
|
|
CORS_TEST_REDIRECT_GET_ALL(302, MODE_302)
|
|
|
|
|
CORS_TEST_REDIRECT_GET_ALL(307, MODE_307)
|
2020-09-09 21:59:33 +02:00
|
|
|
|
|
|
|
|
namespace {
|
|
|
|
|
|
|
|
|
|
struct PostResource : CookieResource {
|
2024-01-20 18:00:09 +01:00
|
|
|
PostResource() = default;
|
2020-09-09 21:59:33 +02:00
|
|
|
|
|
|
|
|
bool expect_downgrade_to_get = false;
|
|
|
|
|
bool was_redirected = false;
|
|
|
|
|
|
|
|
|
|
std::string main_origin;
|
|
|
|
|
bool is_cross_origin;
|
|
|
|
|
|
|
|
|
|
void InitOrigin(HandlerType main_handler) {
|
|
|
|
|
// Origin is always "null" for non-HTTP(S) schemes.
|
|
|
|
|
// This should only be "null" for non-standard schemes, but Blink is likely
|
|
|
|
|
// using SchemeIsHTTPOrHTTPS() when submitting the form request.
|
2021-04-12 19:55:48 +02:00
|
|
|
main_origin = IsNonStandardType(main_handler) ||
|
2020-09-11 18:52:35 +02:00
|
|
|
main_handler == HandlerType::CUSTOM_STANDARD_SCHEME
|
2020-09-09 21:59:33 +02:00
|
|
|
? "null"
|
|
|
|
|
: GetOrigin(main_handler);
|
|
|
|
|
|
|
|
|
|
// True if the request is considered cross-origin. Any requests between
|
|
|
|
|
// non-standard schemes are considered cross-origin (due to the "null"
|
|
|
|
|
// origin).
|
2021-04-12 19:55:48 +02:00
|
|
|
is_cross_origin =
|
|
|
|
|
main_handler != handler ||
|
|
|
|
|
(IsNonStandardType(main_handler) && handler == main_handler);
|
2020-09-09 21:59:33 +02:00
|
|
|
}
|
|
|
|
|
|
|
|
|
|
bool VerifyRequest(CefRefPtr<CefRequest> request) const override {
|
2023-01-02 23:59:03 +01:00
|
|
|
if (!CookieResource::VerifyRequest(request)) {
|
2020-09-09 21:59:33 +02:00
|
|
|
return false;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-09-09 21:59:33 +02:00
|
|
|
|
|
|
|
|
// The "Origin" header should be present if the request is POST, and was not
|
|
|
|
|
// redirected cross-origin.
|
|
|
|
|
std::string expected_origin;
|
|
|
|
|
if (!expect_downgrade_to_get) {
|
|
|
|
|
if (was_redirected && is_cross_origin) {
|
|
|
|
|
// Always "null" for cross-origin redirects.
|
|
|
|
|
expected_origin = "null";
|
|
|
|
|
} else {
|
|
|
|
|
expected_origin = main_origin;
|
|
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
const std::string& origin = request->GetHeaderByName("Origin");
|
|
|
|
|
EXPECT_STREQ(expected_origin.c_str(), origin.c_str()) << GetPathURL();
|
2023-01-02 23:59:03 +01:00
|
|
|
if (expected_origin != origin) {
|
2020-09-09 21:59:33 +02:00
|
|
|
return false;
|
2023-01-02 23:59:03 +01:00
|
|
|
}
|
2020-09-09 21:59:33 +02:00
|
|
|
|
2020-10-15 18:39:41 +02:00
|
|
|
const std::string& req_method = request->GetMethod();
|
2020-09-09 21:59:33 +02:00
|
|
|
const bool has_post_data = request->GetPostData() != nullptr;
|
|
|
|
|
if (expect_downgrade_to_get) {
|
|
|
|
|
EXPECT_FALSE(has_post_data) << GetPathURL();
|
2020-10-15 18:39:41 +02:00
|
|
|
EXPECT_STREQ("GET", req_method.c_str()) << GetPathURL();
|
|
|
|
|
return !has_post_data && req_method == "GET";
|
2020-09-09 21:59:33 +02:00
|
|
|
} else {
|
|
|
|
|
EXPECT_TRUE(has_post_data) << GetPathURL();
|
2020-10-15 18:39:41 +02:00
|
|
|
EXPECT_STREQ("POST", req_method.c_str()) << GetPathURL();
|
|
|
|
|
return has_post_data && req_method == "POST";
|
2020-09-09 21:59:33 +02:00
|
|
|
}
|
|
|
|
|
}
|
|
|
|
|
};
|
|
|
|
|
|
|
|
|
|
std::string GetPostFormHtml(const std::string& submit_url) {
|
|
|
|
|
return "<html><body>"
|
|
|
|
|
"<form id=\"f\" action=\"" +
|
|
|
|
|
submit_url +
|
|
|
|
|
"\" method=\"post\">"
|
|
|
|
|
"<input type=\"hidden\" name=\"n\" value=\"v\"></form>"
|
|
|
|
|
"<script>document.getElementById('f').submit();</script>"
|
|
|
|
|
"</body></html>";
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Test redirect requests.
|
|
|
|
|
void SetupRedirectPostRequest(RedirectMode mode,
|
|
|
|
|
CookieTestSetup* setup,
|
|
|
|
|
const std::string& test_name,
|
|
|
|
|
HandlerType main_handler,
|
|
|
|
|
CookieResource* main_resource,
|
|
|
|
|
PostResource* submit_resource,
|
|
|
|
|
HandlerType redirect_handler,
|
|
|
|
|
PostResource* redirect_resource) {
|
|
|
|
|
const std::string& base_path = "/" + test_name;
|
|
|
|
|
|
|
|
|
|
// Expect a single redirect request that sends SuccessMsg.
|
|
|
|
|
redirect_resource->Init(redirect_handler, base_path + ".redirect.html",
|
|
|
|
|
kMimeTypeHtml, GetDefaultSuccessMsgHtml());
|
|
|
|
|
redirect_resource->InitOrigin(main_handler);
|
|
|
|
|
redirect_resource->expected_success_query_ct = 1;
|
|
|
|
|
|
|
|
|
|
// 302 redirects will downgrade POST requests to GET.
|
|
|
|
|
redirect_resource->expect_downgrade_to_get = mode == RedirectMode::MODE_302;
|
|
|
|
|
redirect_resource->was_redirected = true;
|
|
|
|
|
|
|
|
|
|
// Expect a single submit request that redirects the response.
|
|
|
|
|
const std::string& redirect_url = redirect_resource->GetPathURL();
|
|
|
|
|
submit_resource->Init(main_handler, base_path + ".submit.html", kMimeTypeHtml,
|
|
|
|
|
std::string());
|
|
|
|
|
submit_resource->InitOrigin(main_handler);
|
|
|
|
|
SetupRedirectResponse(mode, redirect_url, submit_resource->response);
|
|
|
|
|
|
|
|
|
|
// Expect a single main request that submits the form.
|
|
|
|
|
const std::string& submit_url = submit_resource->GetPathURL();
|
|
|
|
|
main_resource->Init(main_handler, base_path, kMimeTypeHtml,
|
|
|
|
|
GetPostFormHtml(submit_url));
|
|
|
|
|
|
|
|
|
|
SetupCookieExpectations(setup, main_resource, submit_resource);
|
|
|
|
|
SetupCookieExpectations(setup, main_resource, redirect_resource);
|
|
|
|
|
|
|
|
|
|
setup->AddResource(main_resource);
|
|
|
|
|
setup->AddResource(submit_resource);
|
|
|
|
|
setup->AddResource(redirect_resource);
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
} // namespace
|
|
|
|
|
|
|
|
|
|
// Test redirect GET requests with different origin combinations.
|
|
|
|
|
#define CORS_TEST_REDIRECT_POST(test_name, mode, handler_main, \
|
|
|
|
|
handler_redirect) \
|
|
|
|
|
TEST(CorsTest, RedirectPost##test_name) { \
|
|
|
|
|
CookieTestSetup setup; \
|
|
|
|
|
CookieResource resource_main; \
|
|
|
|
|
PostResource resource_submit, resource_redirect; \
|
|
|
|
|
SetupRedirectPostRequest( \
|
|
|
|
|
RedirectMode::mode, &setup, "CorsTest.RedirectPost" #test_name, \
|
|
|
|
|
HandlerType::handler_main, &resource_main, &resource_submit, \
|
|
|
|
|
HandlerType::handler_redirect, &resource_redirect); \
|
|
|
|
|
CefRefPtr<CorsTestHandler> handler = new CorsTestHandler(&setup); \
|
|
|
|
|
handler->ExecuteTest(); \
|
|
|
|
|
ReleaseAndWaitForDestructor(handler); \
|
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
// Test all redirect GET combinations (same and cross-origin).
|
|
|
|
|
#define CORS_TEST_REDIRECT_POST_ALL(name, mode) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST(name##ServerToServer, mode, SERVER, SERVER) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST(name##ServerToHttpScheme, mode, SERVER, HTTP_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST(name##ServerToCustomStandardScheme, mode, SERVER, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST(name##ServerToCustomNonStandardScheme, mode, SERVER, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME) \
|
2021-04-12 19:55:48 +02:00
|
|
|
CORS_TEST_REDIRECT_POST(name##ServerToCustomUnregisteredScheme, mode, \
|
|
|
|
|
SERVER, CUSTOM_UNREGISTERED_SCHEME) \
|
2020-09-09 21:59:33 +02:00
|
|
|
CORS_TEST_REDIRECT_POST(name##HttpSchemeToServer, mode, HTTP_SCHEME, SERVER) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST(name##HttpSchemeToHttpScheme, mode, HTTP_SCHEME, \
|
|
|
|
|
HTTP_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST(name##HttpSchemeToCustomStandardScheme, mode, \
|
|
|
|
|
HTTP_SCHEME, CUSTOM_STANDARD_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST(name##HttpSchemeToCustomNonStandardScheme, mode, \
|
|
|
|
|
HTTP_SCHEME, CUSTOM_NONSTANDARD_SCHEME) \
|
2021-04-12 19:55:48 +02:00
|
|
|
CORS_TEST_REDIRECT_POST(name##HttpSchemeToCustomUnregisteredScheme, mode, \
|
|
|
|
|
HTTP_SCHEME, CUSTOM_UNREGISTERED_SCHEME) \
|
2020-09-09 21:59:33 +02:00
|
|
|
CORS_TEST_REDIRECT_POST(name##CustomStandardSchemeToServer, mode, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, SERVER) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST(name##CustomStandardSchemeToHttpScheme, mode, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, HTTP_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST(name##CustomStandardSchemeToCustomStandardScheme, \
|
|
|
|
|
mode, CUSTOM_STANDARD_SCHEME, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST(name##CustomStandardSchemeToCustomNonStandardScheme, \
|
|
|
|
|
mode, CUSTOM_STANDARD_SCHEME, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME) \
|
2021-04-12 19:55:48 +02:00
|
|
|
CORS_TEST_REDIRECT_POST( \
|
|
|
|
|
name##CustomStandardSchemeToCustomUnregisteredScheme, mode, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME, CUSTOM_UNREGISTERED_SCHEME) \
|
2020-09-09 21:59:33 +02:00
|
|
|
CORS_TEST_REDIRECT_POST(name##CustomNonStandardSchemeToServer, mode, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, SERVER) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST(name##CustomNonStandardSchemeToHttpScheme, mode, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, HTTP_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST(name##CustomNonStandardSchemeToCustomStandardScheme, \
|
|
|
|
|
mode, CUSTOM_NONSTANDARD_SCHEME, \
|
|
|
|
|
CUSTOM_STANDARD_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST( \
|
|
|
|
|
name##CustomNonStandardSchemeToCustomNonStandardScheme, mode, \
|
2021-04-12 19:55:48 +02:00
|
|
|
CUSTOM_NONSTANDARD_SCHEME, CUSTOM_NONSTANDARD_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST( \
|
|
|
|
|
name##CustomNonStandardSchemeToCustomUnregisteredScheme, mode, \
|
|
|
|
|
CUSTOM_NONSTANDARD_SCHEME, CUSTOM_UNREGISTERED_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST(name##CustomUnregisteredSchemeToServer, mode, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, SERVER) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST(name##CustomUnregisteredSchemeToHttpScheme, mode, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, HTTP_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST( \
|
|
|
|
|
name##CustomUnregisteredSchemeToCustomStandardScheme, mode, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, CUSTOM_STANDARD_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST( \
|
|
|
|
|
name##CustomUnregisteredSchemeToCustomNonStandardScheme, mode, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, CUSTOM_NONSTANDARD_SCHEME) \
|
|
|
|
|
CORS_TEST_REDIRECT_POST( \
|
|
|
|
|
name##CustomUnregisteredSchemeToCustomUnregisteredScheme, mode, \
|
|
|
|
|
CUSTOM_UNREGISTERED_SCHEME, CUSTOM_UNREGISTERED_SCHEME)
|
2020-09-09 21:59:33 +02:00
|
|
|
|
|
|
|
|
// Redirect GET requests.
|
|
|
|
|
CORS_TEST_REDIRECT_POST_ALL(302, MODE_302)
|
|
|
|
|
CORS_TEST_REDIRECT_POST_ALL(307, MODE_307)
|
2021-04-05 20:49:17 +02:00
|
|
|
|
2022-02-18 21:43:30 +01:00
|
|
|
// Entry point for creating CORS browser test objects.
|
2021-04-05 20:49:17 +02:00
|
|
|
// Called from client_app_delegates.cc.
|
|
|
|
|
void CreateCorsBrowserTests(client::ClientAppBrowser::DelegateSet& delegates) {
|
|
|
|
|
delegates.insert(new CorsBrowserTest);
|
2021-04-24 03:00:43 +02:00
|
|
|
}
|
