content/browser/child_process_security_policy_unittest.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include <set>
   6 #include <string>
   7
   8 #include "base/basictypes.h"
   9 #include "base/files/file_path.h"
  10 #include "content/browser/child_process_security_policy_impl.h"
  11 #include "content/public/common/url_constants.h"
  12 #include "content/test/test_content_browser_client.h"
  13 #include "testing/gtest/include/gtest/gtest.h"
  14 #include "url/gurl.h"
  15 #include "webkit/browser/fileapi/file_permission_policy.h"
  16 #include "webkit/browser/fileapi/file_system_url.h"
  17 #include "webkit/browser/fileapi/isolated_context.h"
  18 #include "webkit/common/fileapi/file_system_types.h"
  19
  20 namespace content {
  21 namespace {
  22
  23 const int kRendererID = 42;
  24 const int kWorkerRendererID = kRendererID + 1;
  25
  26 #if defined(FILE_PATH_USES_DRIVE_LETTERS)
  27 #define TEST_PATH(x) FILE_PATH_LITERAL("c:") FILE_PATH_LITERAL(x)
  28 #else
  29 #define TEST_PATH(x) FILE_PATH_LITERAL(x)
  30 #endif
  31
  32 class ChildProcessSecurityPolicyTestBrowserClient
  33     : public TestContentBrowserClient {
  34  public:
  35   ChildProcessSecurityPolicyTestBrowserClient() {}
  36
  37   virtual bool IsHandledURL(const GURL& url) OVERRIDE {
  38     return schemes_.find(url.scheme()) != schemes_.end();
  39   }
  40
  41   void ClearSchemes() {
  42     schemes_.clear();
  43   }
  44
  45   void AddScheme(const std::string& scheme) {
  46     schemes_.insert(scheme);
  47   }
  48
  49  private:
  50   std::set<std::string> schemes_;
  51 };
  52
  53 }  // namespace
  54
  55 class ChildProcessSecurityPolicyTest : public testing::Test {
  56  public:
  57   ChildProcessSecurityPolicyTest() : old_browser_client_(NULL) {
  58   }
  59
  60   virtual void SetUp() {
  61     old_browser_client_ = SetBrowserClientForTesting(&test_browser_client_);
  62
  63     // Claim to always handle chrome:// URLs because the CPSP's notion of
  64     // allowing WebUI bindings is hard-wired to this particular scheme.
  65     test_browser_client_.AddScheme(kChromeUIScheme);
  66
  67     // Claim to always handle file:// URLs like the browser would.
  68     // net::URLRequest::IsHandledURL() no longer claims support for default
  69     // protocols as this is the responsibility of the browser (which is
  70     // responsible for adding the appropriate ProtocolHandler).
  71     test_browser_client_.AddScheme(url::kFileScheme);
  72   }
  73
  74   virtual void TearDown() {
  75     test_browser_client_.ClearSchemes();
  76     SetBrowserClientForTesting(old_browser_client_);
  77   }
  78
  79  protected:
  80   void RegisterTestScheme(const std::string& scheme) {
  81     test_browser_client_.AddScheme(scheme);
  82   }
  83
  84   void GrantPermissionsForFile(ChildProcessSecurityPolicyImpl* p,
  85                                int child_id,
  86                                const base::FilePath& file,
  87                                int permissions) {
  88     p->GrantPermissionsForFile(child_id, file, permissions);
  89   }
  90
  91   void CheckHasNoFileSystemPermission(ChildProcessSecurityPolicyImpl* p,
  92                                       const std::string& child_id) {
  93     EXPECT_FALSE(p->CanReadFileSystem(kRendererID, child_id));
  94     EXPECT_FALSE(p->CanReadWriteFileSystem(kRendererID, child_id));
  95     EXPECT_FALSE(p->CanCopyIntoFileSystem(kRendererID, child_id));
  96     EXPECT_FALSE(p->CanDeleteFromFileSystem(kRendererID, child_id));
  97   }
  98
  99   void CheckHasNoFileSystemFilePermission(ChildProcessSecurityPolicyImpl* p,
 100                                           const base::FilePath& file,
 101                                           const fileapi::FileSystemURL& url) {
 102     EXPECT_FALSE(p->CanReadFile(kRendererID, file));
 103     EXPECT_FALSE(p->CanCreateReadWriteFile(kRendererID, file));
 104     EXPECT_FALSE(p->CanReadFileSystemFile(kRendererID, url));
 105     EXPECT_FALSE(p->CanWriteFileSystemFile(kRendererID, url));
 106     EXPECT_FALSE(p->CanCreateFileSystemFile(kRendererID, url));
 107     EXPECT_FALSE(p->CanCreateReadWriteFileSystemFile(kRendererID, url));
 108     EXPECT_FALSE(p->CanCopyIntoFileSystemFile(kRendererID, url));
 109     EXPECT_FALSE(p->CanDeleteFileSystemFile(kRendererID, url));
 110   }
 111
 112  private:
 113   ChildProcessSecurityPolicyTestBrowserClient test_browser_client_;
 114   ContentBrowserClient* old_browser_client_;
 115 };
 116
 117
 118 TEST_F(ChildProcessSecurityPolicyTest, IsWebSafeSchemeTest) {
 119   ChildProcessSecurityPolicyImpl* p =
 120       ChildProcessSecurityPolicyImpl::GetInstance();
 121
 122   EXPECT_TRUE(p->IsWebSafeScheme(url::kHttpScheme));
 123   EXPECT_TRUE(p->IsWebSafeScheme(url::kHttpsScheme));
 124   EXPECT_TRUE(p->IsWebSafeScheme(url::kFtpScheme));
 125   EXPECT_TRUE(p->IsWebSafeScheme(url::kDataScheme));
 126   EXPECT_TRUE(p->IsWebSafeScheme("feed"));
 127   EXPECT_TRUE(p->IsWebSafeScheme(url::kBlobScheme));
 128   EXPECT_TRUE(p->IsWebSafeScheme(url::kFileSystemScheme));
 129
 130   EXPECT_FALSE(p->IsWebSafeScheme("registered-web-safe-scheme"));
 131   p->RegisterWebSafeScheme("registered-web-safe-scheme");
 132   EXPECT_TRUE(p->IsWebSafeScheme("registered-web-safe-scheme"));
 133
 134   EXPECT_FALSE(p->IsWebSafeScheme(kChromeUIScheme));
 135 }
 136
 137 TEST_F(ChildProcessSecurityPolicyTest, IsPseudoSchemeTest) {
 138   ChildProcessSecurityPolicyImpl* p =
 139       ChildProcessSecurityPolicyImpl::GetInstance();
 140
 141   EXPECT_TRUE(p->IsPseudoScheme(url::kAboutScheme));
 142   EXPECT_TRUE(p->IsPseudoScheme(url::kJavaScriptScheme));
 143   EXPECT_TRUE(p->IsPseudoScheme(kViewSourceScheme));
 144
 145   EXPECT_FALSE(p->IsPseudoScheme("registered-pseudo-scheme"));
 146   p->RegisterPseudoScheme("registered-pseudo-scheme");
 147   EXPECT_TRUE(p->IsPseudoScheme("registered-pseudo-scheme"));
 148
 149   EXPECT_FALSE(p->IsPseudoScheme(kChromeUIScheme));
 150 }
 151
 152 TEST_F(ChildProcessSecurityPolicyTest, StandardSchemesTest) {
 153   ChildProcessSecurityPolicyImpl* p =
 154       ChildProcessSecurityPolicyImpl::GetInstance();
 155
 156   p->Add(kRendererID);
 157
 158   // Safe
 159   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("http://www.google.com/")));
 160   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("https://www.paypal.com/")));
 161   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("ftp://ftp.gnu.org/")));
 162   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("data:text/html,<b>Hi</b>")));
 163   EXPECT_TRUE(p->CanRequestURL(kRendererID,
 164                                GURL("view-source:http://www.google.com/")));
 165   EXPECT_TRUE(p->CanRequestURL(
 166       kRendererID, GURL("filesystem:http://localhost/temporary/a.gif")));
 167
 168   // Dangerous
 169   EXPECT_FALSE(p->CanRequestURL(kRendererID,
 170                                 GURL("file:///etc/passwd")));
 171   EXPECT_FALSE(p->CanRequestURL(kRendererID,
 172                                 GURL("chrome://foo/bar")));
 173
 174   p->Remove(kRendererID);
 175 }
 176
 177 TEST_F(ChildProcessSecurityPolicyTest, AboutTest) {
 178   ChildProcessSecurityPolicyImpl* p =
 179       ChildProcessSecurityPolicyImpl::GetInstance();
 180
 181   p->Add(kRendererID);
 182
 183   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("about:blank")));
 184   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("about:BlAnK")));
 185   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("aBouT:BlAnK")));
 186   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("aBouT:blank")));
 187
 188   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:memory")));
 189   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:crash")));
 190   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:cache")));
 191   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:hang")));
 192
 193   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("aBoUt:memory")));
 194   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:CrASh")));
 195   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("abOuT:cAChe")));
 196
 197   // Requests for about: pages should be denied.
 198   p->GrantRequestURL(kRendererID, GURL("about:crash"));
 199   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("about:crash")));
 200
 201   // These requests for chrome:// pages should be granted.
 202   GURL chrome_url("chrome://foo");
 203   p->GrantRequestURL(kRendererID, chrome_url);
 204   EXPECT_TRUE(p->CanRequestURL(kRendererID, chrome_url));
 205
 206   p->Remove(kRendererID);
 207 }
 208
 209 TEST_F(ChildProcessSecurityPolicyTest, JavaScriptTest) {
 210   ChildProcessSecurityPolicyImpl* p =
 211       ChildProcessSecurityPolicyImpl::GetInstance();
 212
 213   p->Add(kRendererID);
 214
 215   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("javascript:alert('xss')")));
 216   p->GrantRequestURL(kRendererID, GURL("javascript:alert('xss')"));
 217   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("javascript:alert('xss')")));
 218
 219   p->Remove(kRendererID);
 220 }
 221
 222 TEST_F(ChildProcessSecurityPolicyTest, RegisterWebSafeSchemeTest) {
 223   ChildProcessSecurityPolicyImpl* p =
 224       ChildProcessSecurityPolicyImpl::GetInstance();
 225
 226   p->Add(kRendererID);
 227
 228   // Currently, "asdf" is destined for ShellExecute, so it is allowed.
 229   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("asdf:rockers")));
 230
 231   // Once we register "asdf", we default to deny.
 232   RegisterTestScheme("asdf");
 233   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("asdf:rockers")));
 234
 235   // We can allow new schemes by adding them to the whitelist.
 236   p->RegisterWebSafeScheme("asdf");
 237   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("asdf:rockers")));
 238
 239   // Cleanup.
 240   p->Remove(kRendererID);
 241 }
 242
 243 TEST_F(ChildProcessSecurityPolicyTest, CanServiceCommandsTest) {
 244   ChildProcessSecurityPolicyImpl* p =
 245       ChildProcessSecurityPolicyImpl::GetInstance();
 246
 247   p->Add(kRendererID);
 248
 249   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("file:///etc/passwd")));
 250   p->GrantRequestURL(kRendererID, GURL("file:///etc/passwd"));
 251   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("file:///etc/passwd")));
 252
 253   // We should forget our state if we repeat a renderer id.
 254   p->Remove(kRendererID);
 255   p->Add(kRendererID);
 256   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("file:///etc/passwd")));
 257   p->Remove(kRendererID);
 258 }
 259
 260 TEST_F(ChildProcessSecurityPolicyTest, ViewSource) {
 261   ChildProcessSecurityPolicyImpl* p =
 262       ChildProcessSecurityPolicyImpl::GetInstance();
 263
 264   p->Add(kRendererID);
 265
 266   // View source is determined by the embedded scheme.
 267   EXPECT_TRUE(p->CanRequestURL(kRendererID,
 268                                GURL("view-source:http://www.google.com/")));
 269   EXPECT_FALSE(p->CanRequestURL(kRendererID,
 270                                 GURL("view-source:file:///etc/passwd")));
 271   EXPECT_FALSE(p->CanRequestURL(kRendererID, GURL("file:///etc/passwd")));
 272   EXPECT_FALSE(p->CanRequestURL(
 273       kRendererID, GURL("view-source:view-source:http://www.google.com/")));
 274
 275   p->GrantRequestURL(kRendererID, GURL("view-source:file:///etc/passwd"));
 276   // View source needs to be able to request the embedded scheme.
 277   EXPECT_TRUE(p->CanRequestURL(kRendererID,
 278                                GURL("view-source:file:///etc/passwd")));
 279   EXPECT_TRUE(p->CanRequestURL(kRendererID, GURL("file:///etc/passwd")));
 280
 281   p->Remove(kRendererID);
 282 }
 283
 284 TEST_F(ChildProcessSecurityPolicyTest, SpecificFile) {
 285   ChildProcessSecurityPolicyImpl* p =
 286       ChildProcessSecurityPolicyImpl::GetInstance();
 287
 288   p->Add(kRendererID);
 289
 290   GURL icon_url("file:///tmp/foo.png");
 291   GURL sensitive_url("file:///etc/passwd");
 292   EXPECT_FALSE(p->CanRequestURL(kRendererID, icon_url));
 293   EXPECT_FALSE(p->CanRequestURL(kRendererID, sensitive_url));
 294
 295   p->GrantRequestSpecificFileURL(kRendererID, icon_url);
 296   EXPECT_TRUE(p->CanRequestURL(kRendererID, icon_url));
 297   EXPECT_FALSE(p->CanRequestURL(kRendererID, sensitive_url));
 298
 299   p->GrantRequestURL(kRendererID, icon_url);
 300   EXPECT_TRUE(p->CanRequestURL(kRendererID, icon_url));
 301   EXPECT_TRUE(p->CanRequestURL(kRendererID, sensitive_url));
 302
 303   p->Remove(kRendererID);
 304 }
 305
 306 TEST_F(ChildProcessSecurityPolicyTest, FileSystemGrantsTest) {
 307   ChildProcessSecurityPolicyImpl* p =
 308       ChildProcessSecurityPolicyImpl::GetInstance();
 309
 310   p->Add(kRendererID);
 311   std::string read_id = fileapi::IsolatedContext::GetInstance()->
 312       RegisterFileSystemForVirtualPath(fileapi::kFileSystemTypeTest,
 313                                        "read_filesystem",
 314                                        base::FilePath());
 315   std::string read_write_id = fileapi::IsolatedContext::GetInstance()->
 316       RegisterFileSystemForVirtualPath(fileapi::kFileSystemTypeTest,
 317                                        "read_write_filesystem",
 318                                        base::FilePath());
 319   std::string copy_into_id = fileapi::IsolatedContext::GetInstance()->
 320       RegisterFileSystemForVirtualPath(fileapi::kFileSystemTypeTest,
 321                                        "copy_into_filesystem",
 322                                        base::FilePath());
 323   std::string delete_from_id = fileapi::IsolatedContext::GetInstance()->
 324       RegisterFileSystemForVirtualPath(fileapi::kFileSystemTypeTest,
 325                                        "delete_from_filesystem",
 326                                        base::FilePath());
 327
 328   // Test initially having no permissions.
 329   CheckHasNoFileSystemPermission(p, read_id);
 330   CheckHasNoFileSystemPermission(p, read_write_id);
 331   CheckHasNoFileSystemPermission(p, copy_into_id);
 332   CheckHasNoFileSystemPermission(p, delete_from_id);
 333
 334   // Testing varying combinations of grants and checks.
 335   p->GrantReadFileSystem(kRendererID, read_id);
 336   EXPECT_TRUE(p->CanReadFileSystem(kRendererID, read_id));
 337   EXPECT_FALSE(p->CanReadWriteFileSystem(kRendererID, read_id));
 338   EXPECT_FALSE(p->CanCopyIntoFileSystem(kRendererID, read_id));
 339   EXPECT_FALSE(p->CanDeleteFromFileSystem(kRendererID, read_id));
 340
 341   p->GrantReadFileSystem(kRendererID, read_write_id);
 342   p->GrantWriteFileSystem(kRendererID, read_write_id);
 343   EXPECT_TRUE(p->CanReadFileSystem(kRendererID, read_write_id));
 344   EXPECT_TRUE(p->CanReadWriteFileSystem(kRendererID, read_write_id));
 345   EXPECT_FALSE(p->CanCopyIntoFileSystem(kRendererID, read_write_id));
 346   EXPECT_FALSE(p->CanDeleteFromFileSystem(kRendererID, read_write_id));
 347
 348   p->GrantCopyIntoFileSystem(kRendererID, copy_into_id);
 349   EXPECT_FALSE(p->CanReadFileSystem(kRendererID, copy_into_id));
 350   EXPECT_FALSE(p->CanReadWriteFileSystem(kRendererID, copy_into_id));
 351   EXPECT_TRUE(p->CanCopyIntoFileSystem(kRendererID, copy_into_id));
 352   EXPECT_FALSE(p->CanDeleteFromFileSystem(kRendererID, copy_into_id));
 353
 354   p->GrantDeleteFromFileSystem(kRendererID, delete_from_id);
 355   EXPECT_FALSE(p->CanReadFileSystem(kRendererID, delete_from_id));
 356   EXPECT_FALSE(p->CanReadWriteFileSystem(kRendererID, delete_from_id));
 357   EXPECT_FALSE(p->CanCopyIntoFileSystem(kRendererID, delete_from_id));
 358   EXPECT_TRUE(p->CanDeleteFromFileSystem(kRendererID, delete_from_id));
 359
 360   // Test revoke permissions on renderer ID removal.
 361   p->Remove(kRendererID);
 362   CheckHasNoFileSystemPermission(p, read_id);
 363   CheckHasNoFileSystemPermission(p, read_write_id);
 364   CheckHasNoFileSystemPermission(p, copy_into_id);
 365   CheckHasNoFileSystemPermission(p, delete_from_id);
 366
 367   // Test having no permissions upon re-adding same renderer ID.
 368   p->Add(kRendererID);
 369   CheckHasNoFileSystemPermission(p, read_id);
 370   CheckHasNoFileSystemPermission(p, read_write_id);
 371   CheckHasNoFileSystemPermission(p, copy_into_id);
 372   CheckHasNoFileSystemPermission(p, delete_from_id);
 373
 374   // Cleanup.
 375   p->Remove(kRendererID);
 376   fileapi::IsolatedContext::GetInstance()->RevokeFileSystem(read_id);
 377   fileapi::IsolatedContext::GetInstance()->RevokeFileSystem(read_write_id);
 378   fileapi::IsolatedContext::GetInstance()->RevokeFileSystem(copy_into_id);
 379   fileapi::IsolatedContext::GetInstance()->RevokeFileSystem(delete_from_id);
 380 }
 381
 382 TEST_F(ChildProcessSecurityPolicyTest, FilePermissionGrantingAndRevoking) {
 383   ChildProcessSecurityPolicyImpl* p =
 384       ChildProcessSecurityPolicyImpl::GetInstance();
 385
 386   p->RegisterFileSystemPermissionPolicy(
 387       fileapi::kFileSystemTypeTest,
 388       fileapi::FILE_PERMISSION_USE_FILE_PERMISSION);
 389
 390   p->Add(kRendererID);
 391   base::FilePath file(TEST_PATH("/dir/testfile"));
 392   file = file.NormalizePathSeparators();
 393   fileapi::FileSystemURL url = fileapi::FileSystemURL::CreateForTest(
 394       GURL("http://foo/"), fileapi::kFileSystemTypeTest, file);
 395
 396   // Test initially having no permissions.
 397   CheckHasNoFileSystemFilePermission(p, file, url);
 398
 399   // Testing every combination of permissions granting and revoking.
 400   p->GrantReadFile(kRendererID, file);
 401   EXPECT_TRUE(p->CanReadFile(kRendererID, file));
 402   EXPECT_FALSE(p->CanCreateReadWriteFile(kRendererID, file));
 403   EXPECT_TRUE(p->CanReadFileSystemFile(kRendererID, url));
 404   EXPECT_FALSE(p->CanWriteFileSystemFile(kRendererID, url));
 405   EXPECT_FALSE(p->CanCreateFileSystemFile(kRendererID, url));
 406   EXPECT_FALSE(p->CanCreateReadWriteFileSystemFile(kRendererID, url));
 407   EXPECT_FALSE(p->CanCopyIntoFileSystemFile(kRendererID, url));
 408   EXPECT_FALSE(p->CanDeleteFileSystemFile(kRendererID, url));
 409   p->RevokeAllPermissionsForFile(kRendererID, file);
 410   CheckHasNoFileSystemFilePermission(p, file, url);
 411
 412   p->GrantCreateReadWriteFile(kRendererID, file);
 413   EXPECT_TRUE(p->CanReadFile(kRendererID, file));
 414   EXPECT_TRUE(p->CanCreateReadWriteFile(kRendererID, file));
 415   EXPECT_TRUE(p->CanReadFileSystemFile(kRendererID, url));
 416   EXPECT_TRUE(p->CanWriteFileSystemFile(kRendererID, url));
 417   EXPECT_TRUE(p->CanCreateFileSystemFile(kRendererID, url));
 418   EXPECT_TRUE(p->CanCreateReadWriteFileSystemFile(kRendererID, url));
 419   EXPECT_TRUE(p->CanCopyIntoFileSystemFile(kRendererID, url));
 420   EXPECT_TRUE(p->CanDeleteFileSystemFile(kRendererID, url));
 421   p->RevokeAllPermissionsForFile(kRendererID, file);
 422   CheckHasNoFileSystemFilePermission(p, file, url);
 423
 424   // Test revoke permissions on renderer ID removal.
 425   p->GrantCreateReadWriteFile(kRendererID, file);
 426   EXPECT_TRUE(p->CanReadFile(kRendererID, file));
 427   EXPECT_TRUE(p->CanCreateReadWriteFile(kRendererID, file));
 428   EXPECT_TRUE(p->CanReadFileSystemFile(kRendererID, url));
 429   EXPECT_TRUE(p->CanWriteFileSystemFile(kRendererID, url));
 430   EXPECT_TRUE(p->CanCreateFileSystemFile(kRendererID, url));
 431   EXPECT_TRUE(p->CanCreateReadWriteFileSystemFile(kRendererID, url));
 432   EXPECT_TRUE(p->CanCopyIntoFileSystemFile(kRendererID, url));
 433   EXPECT_TRUE(p->CanDeleteFileSystemFile(kRendererID, url));
 434   p->Remove(kRendererID);
 435   CheckHasNoFileSystemFilePermission(p, file, url);
 436
 437   // Test having no permissions upon re-adding same renderer ID.
 438   p->Add(kRendererID);
 439   CheckHasNoFileSystemFilePermission(p, file, url);
 440
 441   // Cleanup.
 442   p->Remove(kRendererID);
 443 }
 444
 445 TEST_F(ChildProcessSecurityPolicyTest, FilePermissions) {
 446   base::FilePath granted_file = base::FilePath(TEST_PATH("/home/joe"));
 447   base::FilePath sibling_file = base::FilePath(TEST_PATH("/home/bob"));
 448   base::FilePath child_file = base::FilePath(TEST_PATH("/home/joe/file"));
 449   base::FilePath parent_file = base::FilePath(TEST_PATH("/home"));
 450   base::FilePath parent_slash_file = base::FilePath(TEST_PATH("/home/"));
 451   base::FilePath child_traversal1 =
 452       base::FilePath(TEST_PATH("/home/joe/././file"));
 453   base::FilePath child_traversal2 = base::FilePath(
 454       TEST_PATH("/home/joe/file/../otherfile"));
 455   base::FilePath evil_traversal1 =
 456       base::FilePath(TEST_PATH("/home/joe/../../etc/passwd"));
 457   base::FilePath evil_traversal2 = base::FilePath(
 458       TEST_PATH("/home/joe/./.././../etc/passwd"));
 459   base::FilePath self_traversal =
 460       base::FilePath(TEST_PATH("/home/joe/../joe/file"));
 461   base::FilePath relative_file = base::FilePath(FILE_PATH_LITERAL("home/joe"));
 462
 463   ChildProcessSecurityPolicyImpl* p =
 464       ChildProcessSecurityPolicyImpl::GetInstance();
 465
 466   // Grant permissions for a file.
 467   p->Add(kRendererID);
 468   EXPECT_FALSE(p->HasPermissionsForFile(kRendererID, granted_file,
 469                                         base::File::FLAG_OPEN));
 470
 471   GrantPermissionsForFile(p, kRendererID, granted_file,
 472                              base::File::FLAG_OPEN |
 473                              base::File::FLAG_OPEN_TRUNCATED |
 474                              base::File::FLAG_READ |
 475                              base::File::FLAG_WRITE);
 476   EXPECT_TRUE(p->HasPermissionsForFile(kRendererID, granted_file,
 477                                        base::File::FLAG_OPEN |
 478                                        base::File::FLAG_OPEN_TRUNCATED |
 479                                        base::File::FLAG_READ |
 480                                        base::File::FLAG_WRITE));
 481   EXPECT_TRUE(p->HasPermissionsForFile(kRendererID, granted_file,
 482                                        base::File::FLAG_OPEN |
 483                                        base::File::FLAG_READ));
 484   EXPECT_FALSE(p->HasPermissionsForFile(kRendererID, granted_file,
 485                                         base::File::FLAG_CREATE));
 486   EXPECT_FALSE(p->HasPermissionsForFile(kRendererID, granted_file, 0));
 487   EXPECT_FALSE(p->HasPermissionsForFile(kRendererID, granted_file,
 488                                         base::File::FLAG_CREATE |
 489                                         base::File::FLAG_OPEN_TRUNCATED |
 490                                         base::File::FLAG_READ |
 491                                         base::File::FLAG_WRITE));
 492   EXPECT_FALSE(p->HasPermissionsForFile(kRendererID, sibling_file,
 493                                         base::File::FLAG_OPEN |
 494                                         base::File::FLAG_READ));
 495   EXPECT_FALSE(p->HasPermissionsForFile(kRendererID, parent_file,
 496                                         base::File::FLAG_OPEN |
 497                                         base::File::FLAG_READ));
 498   EXPECT_TRUE(p->HasPermissionsForFile(kRendererID, child_file,
 499                                         base::File::FLAG_OPEN |
 500                                         base::File::FLAG_READ));
 501   EXPECT_TRUE(p->HasPermissionsForFile(kRendererID, child_traversal1,
 502                                         base::File::FLAG_OPEN |
 503                                         base::File::FLAG_READ));
 504   EXPECT_TRUE(p->HasPermissionsForFile(kRendererID, child_traversal2,
 505                                         base::File::FLAG_OPEN |
 506                                         base::File::FLAG_READ));
 507   EXPECT_FALSE(p->HasPermissionsForFile(kRendererID, evil_traversal1,
 508                                         base::File::FLAG_OPEN |
 509                                         base::File::FLAG_READ));
 510   EXPECT_FALSE(p->HasPermissionsForFile(kRendererID, evil_traversal2,
 511                                         base::File::FLAG_OPEN |
 512                                         base::File::FLAG_READ));
 513   // CPSP doesn't allow this case for the sake of simplicity.
 514   EXPECT_FALSE(p->HasPermissionsForFile(kRendererID, self_traversal,
 515                                         base::File::FLAG_OPEN |
 516                                         base::File::FLAG_READ));
 517   p->Remove(kRendererID);
 518
 519   // Grant permissions for the directory the file is in.
 520   p->Add(kRendererID);
 521   EXPECT_FALSE(p->HasPermissionsForFile(kRendererID, granted_file,
 522                                         base::File::FLAG_OPEN));
 523   GrantPermissionsForFile(p, kRendererID, parent_file,
 524                              base::File::FLAG_OPEN |
 525                              base::File::FLAG_READ);
 526   EXPECT_TRUE(p->HasPermissionsForFile(kRendererID, granted_file,
 527                                         base::File::FLAG_OPEN));
 528   EXPECT_FALSE(p->HasPermissionsForFile(kRendererID, granted_file,
 529                                         base::File::FLAG_READ |
 530                                         base::File::FLAG_WRITE));
 531   p->Remove(kRendererID);
 532
 533   // Grant permissions for the directory the file is in (with trailing '/').
 534   p->Add(kRendererID);
 535   EXPECT_FALSE(p->HasPermissionsForFile(kRendererID, granted_file,
 536                                         base::File::FLAG_OPEN));
 537   GrantPermissionsForFile(p, kRendererID, parent_slash_file,
 538                              base::File::FLAG_OPEN |
 539                              base::File::FLAG_READ);
 540   EXPECT_TRUE(p->HasPermissionsForFile(kRendererID, granted_file,
 541                                         base::File::FLAG_OPEN));
 542   EXPECT_FALSE(p->HasPermissionsForFile(kRendererID, granted_file,
 543                                         base::File::FLAG_READ |
 544                                         base::File::FLAG_WRITE));
 545
 546   // Grant permissions for the file (should overwrite the permissions granted
 547   // for the directory).
 548   GrantPermissionsForFile(p, kRendererID, granted_file,
 549                              base::File::FLAG_TEMPORARY);
 550   EXPECT_FALSE(p->HasPermissionsForFile(kRendererID, granted_file,
 551                                         base::File::FLAG_OPEN));
 552   EXPECT_TRUE(p->HasPermissionsForFile(kRendererID, granted_file,
 553                                        base::File::FLAG_TEMPORARY));
 554
 555   // Revoke all permissions for the file (it should inherit its permissions
 556   // from the directory again).
 557   p->RevokeAllPermissionsForFile(kRendererID, granted_file);
 558   EXPECT_TRUE(p->HasPermissionsForFile(kRendererID, granted_file,
 559                                        base::File::FLAG_OPEN |
 560                                        base::File::FLAG_READ));
 561   EXPECT_FALSE(p->HasPermissionsForFile(kRendererID, granted_file,
 562                                         base::File::FLAG_TEMPORARY));
 563   p->Remove(kRendererID);
 564
 565   // Grant file permissions for the file to main thread renderer process,
 566   // make sure its worker thread renderer process inherits those.
 567   p->Add(kRendererID);
 568   GrantPermissionsForFile(p, kRendererID, granted_file,
 569                              base::File::FLAG_OPEN |
 570                              base::File::FLAG_READ);
 571   EXPECT_TRUE(p->HasPermissionsForFile(kRendererID, granted_file,
 572                                        base::File::FLAG_OPEN |
 573                                        base::File::FLAG_READ));
 574   EXPECT_FALSE(p->HasPermissionsForFile(kRendererID, granted_file,
 575                                        base::File::FLAG_WRITE));
 576   p->AddWorker(kWorkerRendererID, kRendererID);
 577   EXPECT_TRUE(p->HasPermissionsForFile(kWorkerRendererID, granted_file,
 578                                        base::File::FLAG_OPEN |
 579                                        base::File::FLAG_READ));
 580   EXPECT_FALSE(p->HasPermissionsForFile(kWorkerRendererID, granted_file,
 581                                         base::File::FLAG_WRITE));
 582   p->Remove(kRendererID);
 583   EXPECT_FALSE(p->HasPermissionsForFile(kWorkerRendererID, granted_file,
 584                                         base::File::FLAG_OPEN |
 585                                         base::File::FLAG_READ));
 586   p->Remove(kWorkerRendererID);
 587
 588   p->Add(kRendererID);
 589   GrantPermissionsForFile(p, kRendererID, relative_file,
 590                              base::File::FLAG_OPEN);
 591   EXPECT_FALSE(p->HasPermissionsForFile(kRendererID, relative_file,
 592                                         base::File::FLAG_OPEN));
 593   p->Remove(kRendererID);
 594 }
 595
 596 TEST_F(ChildProcessSecurityPolicyTest, CanServiceWebUIBindings) {
 597   ChildProcessSecurityPolicyImpl* p =
 598       ChildProcessSecurityPolicyImpl::GetInstance();
 599
 600   GURL url("chrome://thumb/http://www.google.com/");
 601
 602   p->Add(kRendererID);
 603
 604   EXPECT_FALSE(p->HasWebUIBindings(kRendererID));
 605   EXPECT_FALSE(p->CanRequestURL(kRendererID, url));
 606   p->GrantWebUIBindings(kRendererID);
 607   EXPECT_TRUE(p->HasWebUIBindings(kRendererID));
 608   EXPECT_TRUE(p->CanRequestURL(kRendererID, url));
 609
 610   p->Remove(kRendererID);
 611 }
 612
 613 TEST_F(ChildProcessSecurityPolicyTest, RemoveRace) {
 614   ChildProcessSecurityPolicyImpl* p =
 615       ChildProcessSecurityPolicyImpl::GetInstance();
 616
 617   GURL url("file:///etc/passwd");
 618   base::FilePath file(TEST_PATH("/etc/passwd"));
 619
 620   p->Add(kRendererID);
 621
 622   p->GrantRequestURL(kRendererID, url);
 623   p->GrantReadFile(kRendererID, file);
 624   p->GrantWebUIBindings(kRendererID);
 625
 626   EXPECT_TRUE(p->CanRequestURL(kRendererID, url));
 627   EXPECT_TRUE(p->CanReadFile(kRendererID, file));
 628   EXPECT_TRUE(p->HasWebUIBindings(kRendererID));
 629
 630   p->Remove(kRendererID);
 631
 632   // Renderers are added and removed on the UI thread, but the policy can be
 633   // queried on the IO thread.  The ChildProcessSecurityPolicy needs to be
 634   // prepared to answer policy questions about renderers who no longer exist.
 635
 636   // In this case, we default to secure behavior.
 637   EXPECT_FALSE(p->CanRequestURL(kRendererID, url));
 638   EXPECT_FALSE(p->CanReadFile(kRendererID, file));
 639   EXPECT_FALSE(p->HasWebUIBindings(kRendererID));
 640 }
 641
 642 }  // namespace content