1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
|
// Copyright 2018 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include <stddef.h>
#include "base/strings/utf_string_conversions.h"
#include "chrome/browser/extensions/extension_action_test_util.h"
#include "chrome/browser/extensions/extension_browsertest.h"
#include "chrome/browser/extensions/extension_tab_util.h"
#include "chrome/browser/ui/browser.h"
#include "chrome/browser/ui/browser_window.h"
#include "chrome/browser/ui/tabs/tab_strip_model.h"
#include "chrome/test/base/ui_test_utils.h"
#include "content/public/test/browser_test.h"
#include "content/public/test/browser_test_utils.h"
#include "extensions/browser/extension_action.h"
#include "extensions/browser/extension_action_manager.h"
#include "extensions/browser/extension_registry.h"
#include "extensions/common/constants.h"
#include "extensions/common/extension.h"
#include "net/test/embedded_test_server/embedded_test_server.h"
namespace extensions {
namespace {
// Tests that the chrome-extension scheme disallows running Javascript URLs.
IN_PROC_BROWSER_TEST_F(ExtensionBrowserTest,
ChromeExtensionSchemeNotAllowJavascript) {
ASSERT_TRUE(embedded_test_server()->Start());
const Extension* extension =
LoadExtension(test_data_dir_.AppendASCII("simple_with_file"));
ASSERT_TRUE(extension);
// Navigate to the extension's page.
const GURL extension_file_url(extension->GetResourceURL("file.html"));
ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), extension_file_url));
content::WebContents* web_contents =
browser()->tab_strip_model()->GetActiveWebContents();
const std::u16string expected_title = u"foo";
ASSERT_EQ(expected_title, web_contents->GetTitle());
// Attempt to set the page title via Javascript. Don't try to block since
// the javascript URL won't actually navigate anywhere.
const GURL script_url("javascript:void(document.title='Bad Title')");
NavigateToURLWithDisposition(browser(), script_url,
WindowOpenDisposition::CURRENT_TAB,
ui_test_utils::BROWSER_TEST_NO_WAIT);
// Force serialization with the renderer by executing a no-op script.
EXPECT_EQ(true, content::EvalJs(web_contents, "true"));
// Expect the title hasn't changed since the javascript URL was blocked
// from executing.
EXPECT_EQ(expected_title, web_contents->GetTitle());
}
} // namespace
} // namespace extensions
|
