1// Copyright (c) 2013 The Chromium Authors. All rights reserved. 2// Use of this source code is governed by a BSD-style license that can be 3// found in the LICENSE file. 4 5#include "base/command_line.h" 6#include "base/containers/hash_tables.h" 7#include "content/browser/dom_storage/dom_storage_context_wrapper.h" 8#include "content/browser/dom_storage/session_storage_namespace_impl.h" 9#include "content/browser/frame_host/navigator.h" 10#include "content/browser/renderer_host/render_view_host_factory.h" 11#include "content/browser/renderer_host/render_view_host_impl.h" 12#include "content/browser/web_contents/web_contents_impl.h" 13#include "content/common/view_messages.h" 14#include "content/public/browser/browser_context.h" 15#include "content/public/browser/storage_partition.h" 16#include "content/public/common/content_switches.h" 17#include "content/public/test/browser_test_utils.h" 18#include "content/public/test/content_browser_test.h" 19#include "content/public/test/content_browser_test_utils.h" 20#include "content/public/test/test_utils.h" 21#include "content/shell/browser/shell.h" 22 23namespace content { 24 25namespace { 26 27// This is a helper function for the tests which attempt to create a 28// duplicate RenderViewHost or RenderWidgetHost. It tries to create two objects 29// with the same process and routing ids, which causes a collision. 30// It creates a couple of windows in process 1, which causes a few routing ids 31// to be allocated. Then a cross-process navigation is initiated, which causes a 32// new process 2 to be created and have a pending RenderViewHost for it. The 33// routing id of the RenderViewHost which is target for a duplicate is set 34// into |target_routing_id| and the pending RenderViewHost which is used for 35// the attempt is the return value. 36RenderViewHostImpl* PrepareToDuplicateHosts(Shell* shell, 37 int* target_routing_id) { 38 GURL foo("http://foo.com/files/simple_page.html"); 39 40 // Start off with initial navigation, so we get the first process allocated. 41 NavigateToURL(shell, foo); 42 43 // Open another window, so we generate some more routing ids. 44 ShellAddedObserver shell2_observer; 45 EXPECT_TRUE(ExecuteScript( 46 shell->web_contents(), "window.open(document.URL + '#2');")); 47 Shell* shell2 = shell2_observer.GetShell(); 48 49 // The new window must be in the same process, but have a new routing id. 50 EXPECT_EQ(shell->web_contents()->GetRenderViewHost()->GetProcess()->GetID(), 51 shell2->web_contents()->GetRenderViewHost()->GetProcess()->GetID()); 52 *target_routing_id = 53 shell2->web_contents()->GetRenderViewHost()->GetRoutingID(); 54 EXPECT_NE(*target_routing_id, 55 shell->web_contents()->GetRenderViewHost()->GetRoutingID()); 56 57 // Now, simulate a link click coming from the renderer. 58 GURL extension_url("https://bar.com/files/simple_page.html"); 59 WebContentsImpl* wc = static_cast<WebContentsImpl*>(shell->web_contents()); 60 wc->GetFrameTree()->root()->navigator()->RequestOpenURL( 61 wc->GetFrameTree()->root()->current_frame_host(), extension_url, 62 Referrer(), CURRENT_TAB, 63 false, true); 64 65 // Since the navigation above requires a cross-process swap, there will be a 66 // pending RenderViewHost. Ensure it exists and is in a different process 67 // than the initial page. 68 RenderViewHostImpl* pending_rvh = 69 wc->GetRenderManagerForTesting()->pending_render_view_host(); 70 EXPECT_TRUE(pending_rvh != NULL); 71 EXPECT_NE(shell->web_contents()->GetRenderViewHost()->GetProcess()->GetID(), 72 pending_rvh->GetProcess()->GetID()); 73 74 return pending_rvh; 75} 76 77} // namespace 78 79 80// The goal of these tests will be to "simulate" exploited renderer processes, 81// which can send arbitrary IPC messages and confuse browser process internal 82// state, leading to security bugs. We are trying to verify that the browser 83// doesn't perform any dangerous operations in such cases. 84class SecurityExploitBrowserTest : public ContentBrowserTest { 85 public: 86 SecurityExploitBrowserTest() {} 87 virtual void SetUpCommandLine(CommandLine* command_line) OVERRIDE { 88 ASSERT_TRUE(test_server()->Start()); 89 90 // Add a host resolver rule to map all outgoing requests to the test server. 91 // This allows us to use "real" hostnames in URLs, which we can use to 92 // create arbitrary SiteInstances. 93 command_line->AppendSwitchASCII( 94 switches::kHostResolverRules, 95 "MAP * " + test_server()->host_port_pair().ToString() + 96 ",EXCLUDE localhost"); 97 } 98}; 99 100// Ensure that we kill the renderer process if we try to give it WebUI 101// properties and it doesn't have enabled WebUI bindings. 102IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, SetWebUIProperty) { 103 GURL foo("http://foo.com/files/simple_page.html"); 104 105 NavigateToURL(shell(), foo); 106 EXPECT_EQ(0, 107 shell()->web_contents()->GetRenderViewHost()->GetEnabledBindings()); 108 109 content::RenderProcessHostWatcher terminated( 110 shell()->web_contents(), 111 content::RenderProcessHostWatcher::WATCH_FOR_PROCESS_EXIT); 112 shell()->web_contents()->GetRenderViewHost()->SetWebUIProperty( 113 "toolkit", "views"); 114 terminated.Wait(); 115} 116 117// This is a test for crbug.com/312016 attempting to create duplicate 118// RenderViewHosts. SetupForDuplicateHosts sets up this test case and leaves 119// it in a state with pending RenderViewHost. Before the commit of the new 120// pending RenderViewHost, this test case creates a new window through the new 121// process. 122IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, 123 AttemptDuplicateRenderViewHost) { 124 int duplicate_routing_id = MSG_ROUTING_NONE; 125 RenderViewHostImpl* pending_rvh = 126 PrepareToDuplicateHosts(shell(), &duplicate_routing_id); 127 EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id); 128 129 // Since this test executes on the UI thread and hopping threads might cause 130 // different timing in the test, let's simulate a CreateNewWindow call coming 131 // from the IO thread. 132 ViewHostMsg_CreateWindow_Params params; 133 DOMStorageContextWrapper* dom_storage_context = 134 static_cast<DOMStorageContextWrapper*>( 135 BrowserContext::GetStoragePartition( 136 shell()->web_contents()->GetBrowserContext(), 137 pending_rvh->GetSiteInstance())->GetDOMStorageContext()); 138 scoped_refptr<SessionStorageNamespaceImpl> session_storage( 139 new SessionStorageNamespaceImpl(dom_storage_context)); 140 // Cause a deliberate collision in routing ids. 141 int main_frame_routing_id = duplicate_routing_id + 1; 142 pending_rvh->CreateNewWindow(duplicate_routing_id, 143 main_frame_routing_id, 144 params, 145 session_storage.get()); 146 147 // If the above operation doesn't cause a crash, the test has succeeded! 148} 149 150// This is a test for crbug.com/312016. It tries to create two RenderWidgetHosts 151// with the same process and routing ids, which causes a collision. It is almost 152// identical to the AttemptDuplicateRenderViewHost test case. 153IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, 154 AttemptDuplicateRenderWidgetHost) { 155 int duplicate_routing_id = MSG_ROUTING_NONE; 156 RenderViewHostImpl* pending_rvh = 157 PrepareToDuplicateHosts(shell(), &duplicate_routing_id); 158 EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id); 159 160 // Since this test executes on the UI thread and hopping threads might cause 161 // different timing in the test, let's simulate a CreateNewWidget call coming 162 // from the IO thread. Use the existing window routing id to cause a 163 // deliberate collision. 164 pending_rvh->CreateNewWidget(duplicate_routing_id, blink::WebPopupTypeSelect); 165 166 // If the above operation doesn't crash, the test has succeeded! 167} 168 169} // namespace content 170