1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
|
// Copyright 2021 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#include <string>
#include "chrome/test/payments/payment_request_platform_browsertest_base.h"
#include "content/public/test/browser_test.h"
#include "testing/gtest/include/gtest/gtest.h"
#include "third_party/blink/public/common/features_generated.h"
namespace payments {
namespace {
class PaymentRequestSecurityPolicyBrowsertest
: public PaymentRequestPlatformBrowserTestBase {
protected:
PaymentRequestSecurityPolicyBrowsertest() = default;
~PaymentRequestSecurityPolicyBrowsertest() override = default;
void CheckCanMakePayment() {
// The CSP check happens in `new PaymentRequest()`. The test calls
// canMakePayment() to ensure the promise resolves before metrics are
// checked.
ASSERT_EQ("false", content::EvalJs(GetActiveWebContents(),
content::JsReplace(
"checkCanMakePayment($1)",
https_server()->GetURL(
"bobpay.test", "/csp-test"))));
}
};
// Ensure that the PaymentRequestCSPViolation use counter is recorded when CSP
// is bypassed.
IN_PROC_BROWSER_TEST_F(PaymentRequestSecurityPolicyBrowsertest, CSPViolation) {
NavigateTo("a.com", "/payment_request_csp_violation.html");
std::string script =
content::JsReplace("checkCanMakePayment($1)",
https_server()->GetURL("bobpay.test", "/csp-test"));
EXPECT_THAT(
content::EvalJs(GetActiveWebContents(), script).ExtractString(),
testing::MatchesRegex("RangeError: Failed to construct 'PaymentRequest': "
"https://bobpay.test:\\d+/csp-test payment method "
"identifier violates Content Security Policy."));
}
// Ensure that there is no CSP violation with `connect-src *`.
IN_PROC_BROWSER_TEST_F(PaymentRequestSecurityPolicyBrowsertest, CSPAllowAll) {
NavigateTo("a.com", "/payment_request_csp_allow_all.html");
CheckCanMakePayment();
}
// Ensure that there is no CSP violation with `connect-src
// https://bobpay.test:*`
IN_PROC_BROWSER_TEST_F(PaymentRequestSecurityPolicyBrowsertest,
CSPAllowSpecific) {
NavigateTo("a.com", "/payment_request_csp_allow_specific.html");
CheckCanMakePayment();
}
} // namespace
} // namespace payments
|
