Skip to content

Commit c2f35d3

Browse files
committed
[Merge to M-58] Add a warning for the deprecation of content-initiated data URL navigations
This CL adds a console warning when a page navigates the top level frame to a data URL. The browser tests are added to WebContentsImpl tests to be consistent with the view-source URL tests. This CL also updates most of the layout tests to avoid loading data URLs at the top level. The only exceptions are xss-DENIED-* tests which will be updated when the actual blocking happens. BUG=594215,699277 CQ_INCLUDE_TRYBOTS=master.tryserver.chromium.linux:linux_site_isolation Review-Url: https://codereview.chromium.org/2694903007 Cr-Commit-Position: refs/heads/master@{#455226} (cherry picked from commit b29954e) Review-Url: https://codereview.chromium.org/2734783010 . Cr-Commit-Position: refs/branch-heads/3029@{#68} Cr-Branched-From: 939b32e-refs/heads/master@{#454471}
1 parent 20ec407 commit c2f35d3

File tree

86 files changed

+287
-123
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

86 files changed

+287
-123
lines changed

content/browser/frame_host/navigation_handle_impl.cc

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -656,6 +656,14 @@ void NavigationHandleImpl::DidCommitNavigation(
656656
} else {
657657
state_ = DID_COMMIT;
658658
}
659+
660+
if (url_.SchemeIs(url::kDataScheme) && IsInMainFrame() &&
661+
IsRendererInitiated()) {
662+
GetRenderFrameHost()->AddMessageToConsole(
663+
CONSOLE_MESSAGE_LEVEL_WARNING,
664+
"Upcoming versions will block content-initiated top frame navigations "
665+
"to data: URLs. For more information, see https://goo.gl/BaZAea.");
666+
}
659667
}
660668

661669
void NavigationHandleImpl::Transfer() {

content/browser/web_contents/web_contents_impl_browsertest.cc

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
#include "base/macros.h"
66
#include "base/run_loop.h"
7+
#include "base/strings/pattern.h"
78
#include "base/strings/utf_string_conversions.h"
89
#include "base/values.h"
910
#include "build/build_config.h"
@@ -845,6 +846,90 @@ IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, ViewSourceWebUI) {
845846
->IsViewSourceMode());
846847
}
847848

849+
namespace {
850+
const char kDataUrlWarningPattern[] =
851+
"Upcoming versions will block content-initiated top frame navigations*";
852+
853+
// This class listens for console messages other than the data: URL warning. It
854+
// fails the test if it sees a data: URL warning.
855+
class NoDataURLWarningConsoleObserverDelegate : public ConsoleObserverDelegate {
856+
public:
857+
using ConsoleObserverDelegate::ConsoleObserverDelegate;
858+
// WebContentsDelegate method:
859+
bool DidAddMessageToConsole(WebContents* source,
860+
int32_t level,
861+
const base::string16& message,
862+
int32_t line_no,
863+
const base::string16& source_id) override {
864+
std::string ascii_message = base::UTF16ToASCII(message);
865+
EXPECT_FALSE(base::MatchPattern(ascii_message, kDataUrlWarningPattern));
866+
return ConsoleObserverDelegate::DidAddMessageToConsole(
867+
source, level, message, line_no, source_id);
868+
}
869+
};
870+
871+
} // namespace
872+
873+
// Test that a direct navigation to a data URL doesn't show a console warning.
874+
IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, DataURLDirectNavigation) {
875+
ASSERT_TRUE(embedded_test_server()->Start());
876+
const GURL kUrl(embedded_test_server()->GetURL("/simple_page.html"));
877+
878+
NoDataURLWarningConsoleObserverDelegate console_delegate(
879+
shell()->web_contents(), "FINISH");
880+
shell()->web_contents()->SetDelegate(&console_delegate);
881+
882+
NavigateToURL(
883+
shell(),
884+
GURL("data:text/html,<html><script>console.log('FINISH');</script>"));
885+
console_delegate.Wait();
886+
EXPECT_TRUE(shell()->web_contents()->GetURL().SchemeIs(url::kDataScheme));
887+
EXPECT_FALSE(
888+
base::MatchPattern(console_delegate.message(), kDataUrlWarningPattern));
889+
}
890+
891+
// Test that window.open to a data URL shows a console warning.
892+
IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest,
893+
DataURLWindowOpen_ShouldWarn) {
894+
ASSERT_TRUE(embedded_test_server()->Start());
895+
const GURL kUrl(embedded_test_server()->GetURL("/simple_page.html"));
896+
NavigateToURL(shell(), kUrl);
897+
898+
ShellAddedObserver new_shell_observer;
899+
EXPECT_TRUE(ExecuteScript(shell()->web_contents(),
900+
"window.open('data:text/plain,test');"));
901+
Shell* new_shell = new_shell_observer.GetShell();
902+
903+
ConsoleObserverDelegate console_delegate(
904+
new_shell->web_contents(),
905+
"Upcoming versions will block content-initiated top frame navigations*");
906+
new_shell->web_contents()->SetDelegate(&console_delegate);
907+
console_delegate.Wait();
908+
EXPECT_TRUE(new_shell->web_contents()->GetURL().SchemeIs(url::kDataScheme));
909+
}
910+
911+
// Test that a content initiated navigation to a data URL shows a console
912+
// warning.
913+
IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, DataURLRedirect_ShouldWarn) {
914+
ASSERT_TRUE(embedded_test_server()->Start());
915+
const GURL kUrl(embedded_test_server()->GetURL("/simple_page.html"));
916+
NavigateToURL(shell(), kUrl);
917+
918+
ConsoleObserverDelegate console_delegate(
919+
shell()->web_contents(),
920+
"Upcoming versions will block content-initiated top frame navigations*");
921+
shell()->web_contents()->SetDelegate(&console_delegate);
922+
EXPECT_TRUE(ExecuteScript(shell()->web_contents(),
923+
"window.location.href = 'data:text/plain,test';"));
924+
console_delegate.Wait();
925+
EXPECT_TRUE(shell()
926+
->web_contents()
927+
->GetController()
928+
.GetLastCommittedEntry()
929+
->GetURL()
930+
.SchemeIs(url::kDataScheme));
931+
}
932+
848933
IN_PROC_BROWSER_TEST_F(WebContentsImplBrowserTest, NewNamedWindow) {
849934
ASSERT_TRUE(embedded_test_server()->Start());
850935

third_party/WebKit/LayoutTests/fast/dom/Window/mozilla-focus-blur-expected.txt

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ This test is adopted from mozilla's tests.
44

55
PASS: The focus should not have been changed!
66
PASS: The focus should not have been changed!
7-
PASS: The focus should not have been changed with URL=data:text/html,<script>opener.focus();opener.postMessage("", "*");</script>
8-
PASS: The focus should not have been changed with URL=data:text/html,<script>blur();opener.postMessage("", "*");</script>
7+
PASS: The focus should not have been changed with URL=resources/mozilla-focus-blur-popup-opener-focus.html
8+
PASS: The focus should not have been changed with URL=resources/mozilla-focus-blur-popup-blur.html
99
PASS: The last opened window should be able to get focus
1010
PASS: All tests finished
1111

third_party/WebKit/LayoutTests/fast/dom/Window/mozilla-focus-blur.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -73,11 +73,11 @@
7373
}
7474

7575
function test3() {
76-
focusShouldNotChange2('data:text/html,<script>opener.focus();opener.postMessage("", "*");<\/script>', test4);
76+
focusShouldNotChange2('resources/mozilla-focus-blur-popup-opener-focus.html', test4);
7777
}
7878

7979
function test4() {
80-
focusShouldNotChange2('data:text/html,<script>blur();opener.postMessage("", "*");<\/script>', test5);
80+
focusShouldNotChange2('resources/mozilla-focus-blur-popup-blur.html', test5);
8181
}
8282

8383
function test5()

third_party/WebKit/LayoutTests/fast/dom/Window/resources/file-origin-window-open-frame.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,5 +8,5 @@
88
}
99
top.postMessage(exc ? '' + exc : null, '*');
1010
});
11-
newWindow = window.open('data:text/html,<script>opener.postMessage("runTest","*");</scr' + 'ipt>');
11+
newWindow = window.open('file-origin-window-open-popup.html');
1212
</script>
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<script>opener.postMessage("runTest","*");</script>
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<script>blur();opener.postMessage("", "*");</script>
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<script>opener.focus();opener.postMessage("", "*");</script>
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
PASS
1+
Hooray, you got here! That means the test succeeded!

third_party/WebKit/LayoutTests/fast/dom/id-attribute-shared.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@
2424
document.body.appendChild(object1);
2525
input = iframe.contentDocument.createElement('input');
2626
document.body.appendChild(input);
27-
noderef1 = input.parentElement;
27+
noderef1 = input.parentElement;
2828
node2.appendChild(noderef1);
2929
embed = document.createElement('embed');
3030
object1.id = 4294967294;
@@ -43,7 +43,7 @@
4343
template2content.appendChild(object2);
4444
gc();
4545
object2.cloneNode();
46-
document.location='data:text/html,<body>PASS<script>if (window.testRunner) testRunner.notifyDone()</scr' + 'ipt></body>';
46+
document.location = 'Window/resources/destination.html';
4747
}
4848

4949
runTest();

third_party/WebKit/LayoutTests/fast/events/move-event-handler-between-framehosts.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
testRunner.waitUntilDone();
2626
testRunner.setCanOpenWindows();
2727
}
28-
window2 = window.open('data:text/html,<div id="div" onscroll="function() {}"></div>');
28+
window2 = window.open('resources/move-event-handler-between-framehosts-popup.html');
2929
window2.addEventListener("load", window2Loaded, false);
3030
}
3131

third_party/WebKit/LayoutTests/fast/events/onunload-clears-onbeforeunload.html

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
}
1010

1111
window.addEventListener('beforeunload', before, false);
12-
window.onunload = unload;
12+
window.onunload = unload;
1313

1414
function before()
1515
{
@@ -24,7 +24,7 @@
2424

2525
function load()
2626
{
27-
location = "data:text/html,If you didn't hit an assert you PASS.<script>if (window.testRunner) testRunner.notifyDone(); </" + "script>";
27+
location = "resources/onunload-clears-onbeforeunload-success.html";
2828
}
2929

3030
</script>
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
CONSOLE ERROR: Blocked alert('unload') during unload.
2-
You should have seen an unload alert appear.
2+
You should only see one unload alert appear.
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
CONSOLE ERROR: Blocked alert('unload') during unload.
2-
you should only see one unload alert appear.
2+
You should only see one unload alert appear.

third_party/WebKit/LayoutTests/fast/events/onunload-not-on-body.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88

99
function load()
1010
{
11-
location = "data:text/html,you should only see one unload alert appear.<script>if (window.testRunner) testRunner.notifyDone(); </" + "script>";
11+
location = "resources/onunload-single-alert-success.html";
1212
}
1313

1414
function unload()
Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,2 +1,2 @@
11
CONSOLE ERROR: Blocked alert('unload') during unload.
2-
You should have seen an unload alert appear.
2+
You should only see one unload alert appear.

third_party/WebKit/LayoutTests/fast/events/onunload-window-property.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,7 @@
1616
function load()
1717
{
1818
window.onunload = unload;
19-
location = "data:text/html,You should have seen an unload alert appear.<script>if (window.testRunner) testRunner.notifyDone(); </" + "script>";
19+
location = "resources/onunload-single-alert-success.html";
2020
}
2121

2222
</script>

third_party/WebKit/LayoutTests/fast/events/onunload.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@
88

99
function load()
1010
{
11-
location = "data:text/html,You should have seen an unload alert appear.<script>if (window.testRunner) testRunner.notifyDone(); </" + "script>";
11+
location = "resources/onunload-single-alert-success.html";
1212
}
1313

1414
function unload()

third_party/WebKit/LayoutTests/fast/events/page-visibility-unload.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
function load()
1010
{
1111
document.addEventListener("visibilitychange", onVisibilityChange, false);
12-
location = "data:text/html,You should have seen a warning message for alert dialog.<script>if (window.testRunner) testRunner.notifyDone(); </" + "script>";
12+
location = "resources/page-visibility-alert-success.html";
1313
}
1414

1515
function onVisibilityChange()

third_party/WebKit/LayoutTests/fast/events/pageshow-pagehide-on-back-uncached.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414
setTimeout(function() { if (window.testRunner) testRunner.notifyDone(); }, 10);
1515
} else {
1616
window.name = "pageshow/pagehide";
17-
setTimeout('window.location = "data:text/html,<script>history.back();</scr" + "ipt>"', 0);
17+
setTimeout('window.location = "../../resources/back.html"', 0);
1818
}
1919
}
2020

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
11

2-
open a new window
2+
open a new window
33
The JavaScript created (untrusted) event inside a user-initiated (trusted) event should not cache the UserGesture status. This test is for bug https://bugs.webkit.org/show_bug.cgi?id=50508.
44
PASSED

third_party/WebKit/LayoutTests/fast/events/popup-blocked-from-untrusted-mouse-click.html

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@
2727
}
2828
}
2929

30-
function dispatchEvent(obj, evt) {
30+
function dispatchEvent(obj, evt) {
3131
return function() {
3232
return obj.dispatchEvent(evt);
3333
}
@@ -37,12 +37,13 @@
3737
var evt = document.createEvent("MouseEvents");
3838
evt.initMouseEvent("click", true, true, window,
3939
0, 0, 0, 0, 0, false, false, false, false, 0, null);
40-
var cb = document.getElementById("anchor");
40+
var cb = document.getElementById("anchor");
4141
setTimeout(dispatchEvent(cb, evt), 100);
4242
}
4343

4444
function openWindow(evt) {
45-
window.open("data:text/html\, try to open new window", "_blank");
45+
// Try to open a new window.
46+
window.open("about:blank", "_blank");
4647
// If we enabled the popup blocker, the new window should be blocked.
4748
// The windowCount should still be 1.
4849
var expectedWindowCount = 1;
@@ -78,6 +79,6 @@
7879
</script>
7980
<body onload="window.setTimeout(test, 0);">
8081
<input type="button" onclick="simulateClick();" value="click me" id="btn"><br>
81-
<a onclick="openWindow(event)" id="anchor"> open a new window </a><br>
82+
<a onclick="openWindow(event)" id="anchor">open a new window</a><br>
8283
The JavaScript created (untrusted) event inside a user-initiated (trusted) event should not cache the UserGesture status. This test is for bug https://bugs.webkit.org/show_bug.cgi?id=50508.
8384
<div id="console">FAILED</div>
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<div id="div" onscroll="function() {}"></div>
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
If you didn't hit an assert you PASS.
2+
<script>if (window.testRunner) testRunner.notifyDone(); </script>
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
You should only see one unload alert appear.
2+
<script>if (window.testRunner) testRunner.notifyDone(); </script>
Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
You should have seen a warning message for alert dialog.
2+
<script>if (window.testRunner) testRunner.notifyDone(); </script>
3+

third_party/WebKit/LayoutTests/fast/files/null-origin-string.html

Lines changed: 15 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,10 @@
11
<!DOCTYPE html>
22
<html>
33
<body>
4-
<script> /* This script will be executed in a subframe. */
4+
<script>
5+
/* This script will be executed in a subframe. Do not use double slash comments
6+
or double quotes in this script tag, they break the test because of innerText
7+
call below. */
58
function runTest()
69
{
710
eventSender.beginDragWithFiles(['resources/UTF8.txt']);
@@ -15,8 +18,7 @@
1518
var reader = new FileReader();
1619
reader.readAsText(file);
1720
console.log('Started reading...');
18-
19-
top.location = 'data:text/html,<p>PASS if no crash.</p><script>testRunner.notifyDone()</scr' + 'ipt>';
21+
top.postMessage('navigateToSuccess', '*');
2022
}
2123
</script>
2224

@@ -25,7 +27,16 @@
2527
testRunner.dumpAsText();
2628
testRunner.waitUntilDone();
2729
}
28-
document.write('<iframe src="data:text/html,<input type=file id=file onchange=\'onInputFileChange()\'><script>' + document.getElementsByTagName("script")[0].innerText + 'runTest()</scr' + 'ipt>" style="left:0px;top:0px"></iframe>');
30+
document.write(
31+
'<script>' +
32+
'window.onmessage = function(evt){' +
33+
' if (evt.data == "navigateToSuccess") {' +
34+
' window.location = "resources/notify-no-crash.html";' +
35+
' }' +
36+
'}' +
37+
'</scr' + 'ipt>' +
38+
'<iframe src="data:text/html,<input type=file id=file onchange=\'onInputFileChange()\'><script>' +
39+
document.getElementsByTagName("script")[0].innerText + 'runTest()</scr' + 'ipt>" style="left:0px;top:0px"></iframe>');
2940
</script>
3041

3142
<p>Test that using FileReader from a document with unique origin doesn't cause a crash.</p>
Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
PASS if no crash.
2+
<script>if (window.testRunner) testRunner.notifyDone()</script>

third_party/WebKit/LayoutTests/fast/forms/button-state-restore.html

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -31,8 +31,8 @@
3131
input.value = "FAIL";
3232

3333
var form = document.getElementById("form");
34-
35-
// Submit form in a timeout to make sure that we create a new back/forward list item.
34+
35+
// Submit form in a timeout to make sure that we create a new back/forward list item.
3636
setTimeout(function() {form.submit();}, 0);
3737
}
3838
</script>
@@ -49,6 +49,6 @@
4949
<button type="button" name="foo">Button</button>
5050
<input id="input" type="button" name="foo" value="PASS">
5151
<input id="beenHere">
52-
<form action="data:text/html,<script>history.back()</script>" method="POST" id="form"></form>
52+
<form action="../../resources/back.html" method="POST" id="form"></form>
5353
</body>
5454
</html>

third_party/WebKit/LayoutTests/fast/forms/multiple-form-submission-protection-mouse.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@
4343
<li>Click on "Click 2" to submit form to this window. Single word "SUCCESS" should replace the contents of this document.
4444
</ol>
4545
<p>If either event doesn't occur, the test has failed.
46-
<form method="post" name="test" action="data:text/html,<script>if (opener) { opener.postMessage('trololo', '*'); window.close(); } else { document.write('SUCCESS'); window.testRunner && testRunner.notifyDone(); }</script>">
46+
<form method="post" name="test" action="resources/multiple-form-submission-protection-post-target.html">
4747
<input type="button" id="button1" value="Click 1" onclick="submitTo('_new')">
4848
<input type="button" id="button2" value="Click 2" onclick="submitTo('_self')">
4949
</form>

third_party/WebKit/LayoutTests/fast/forms/radio/state-restore-radio-group.html

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99

1010
<input id=emptyOnFirstVisit>
1111
<div id=parent>
12-
<form action="data:text/html,<script>history.back()&lt;/script>" id=form1>
12+
<form action="../../../resources/back.html" id=form1>
1313
<input name=user type=radio id=input1>
1414
<input checked name=user type=radio id=input2>
1515
</form>
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<script>
2+
if (opener) {
3+
opener.postMessage('trololo', '*');
4+
window.close();
5+
} else {
6+
document.write('SUCCESS');
7+
window.testRunner && testRunner.notifyDone();
8+
}
9+
</script>

0 commit comments

Comments
 (0)