1 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file.
4
5 #include "base/command_line.h"
6 #include "base/containers/hash_tables.h"
7 #include "content/browser/dom_storage/dom_storage_context_wrapper.h"
8 #include "content/browser/dom_storage/session_storage_namespace_impl.h"
9 #include "content/browser/renderer_host/render_view_host_factory.h"
10 #include "content/browser/renderer_host/render_view_host_impl.h"
11 #include "content/browser/web_contents/web_contents_impl.h"
12 #include "content/common/view_messages.h"
13 #include "content/public/browser/browser_context.h"
14 #include "content/public/browser/notification_service.h"
15 #include "content/public/browser/notification_types.h"
16 #include "content/public/browser/storage_partition.h"
17 #include "content/public/common/content_switches.h"
18 #include "content/public/test/browser_test_utils.h"
19 #include "content/public/test/test_utils.h"
20 #include "content/shell/browser/shell.h"
21 #include "content/test/content_browser_test.h"
22 #include "content/test/content_browser_test_utils.h"
23
24 namespace content {
25
26 namespace {
27
28 // This is a helper function for the tests which attempt to create a
29 // duplicate RenderViewHost or RenderWidgetHost. It tries to create two objects
30 // with the same process and routing ids, which causes a collision.
31 // It creates a couple of windows in process 1, which causes a few routing ids
32 // to be allocated. Then a cross-process navigation is initiated, which causes a
33 // new process 2 to be created and have a pending RenderViewHost for it. The
34 // routing id of the RenderViewHost which is target for a duplicate is set
35 // into |target_routing_id| and the pending RenderViewHost which is used for
36 // the attempt is the return value.
PrepareToDuplicateHosts(Shell * shell,int * target_routing_id)37 RenderViewHostImpl* PrepareToDuplicateHosts(Shell* shell,
38 int* target_routing_id) {
39 GURL foo("http://foo.com/files/simple_page.html");
40
41 // Start off with initial navigation, so we get the first process allocated.
42 NavigateToURL(shell, foo);
43
44 // Open another window, so we generate some more routing ids.
45 ShellAddedObserver shell2_observer;
46 EXPECT_TRUE(ExecuteScript(
47 shell->web_contents(), "window.open(document.URL + '#2');"));
48 Shell* shell2 = shell2_observer.GetShell();
49
50 // The new window must be in the same process, but have a new routing id.
51 EXPECT_EQ(shell->web_contents()->GetRenderViewHost()->GetProcess()->GetID(),
52 shell2->web_contents()->GetRenderViewHost()->GetProcess()->GetID());
53 *target_routing_id =
54 shell2->web_contents()->GetRenderViewHost()->GetRoutingID();
55 EXPECT_NE(*target_routing_id,
56 shell->web_contents()->GetRenderViewHost()->GetRoutingID());
57
58 // Now, simulate a link click coming from the renderer.
59 GURL extension_url("https://bar.com/files/simple_page.html");
60 WebContentsImpl* wc = static_cast<WebContentsImpl*>(shell->web_contents());
61 wc->RequestOpenURL(
62 shell->web_contents()->GetRenderViewHost(), extension_url,
63 Referrer(), CURRENT_TAB, wc->GetFrameTree()->root()->frame_id(),
64 false, true);
65
66 // Since the navigation above requires a cross-process swap, there will be a
67 // pending RenderViewHost. Ensure it exists and is in a different process
68 // than the initial page.
69 RenderViewHostImpl* pending_rvh =
70 wc->GetRenderManagerForTesting()->pending_render_view_host();
71 EXPECT_TRUE(pending_rvh != NULL);
72 EXPECT_NE(shell->web_contents()->GetRenderViewHost()->GetProcess()->GetID(),
73 pending_rvh->GetProcess()->GetID());
74
75 return pending_rvh;
76 }
77
78 } // namespace
79
80
81 // The goal of these tests will be to "simulate" exploited renderer processes,
82 // which can send arbitrary IPC messages and confuse browser process internal
83 // state, leading to security bugs. We are trying to verify that the browser
84 // doesn't perform any dangerous operations in such cases.
85 class SecurityExploitBrowserTest : public ContentBrowserTest {
86 public:
SecurityExploitBrowserTest()87 SecurityExploitBrowserTest() {}
SetUpCommandLine(CommandLine * command_line)88 virtual void SetUpCommandLine(CommandLine* command_line) OVERRIDE {
89 ASSERT_TRUE(test_server()->Start());
90
91 // Add a host resolver rule to map all outgoing requests to the test server.
92 // This allows us to use "real" hostnames in URLs, which we can use to
93 // create arbitrary SiteInstances.
94 command_line->AppendSwitchASCII(
95 switches::kHostResolverRules,
96 "MAP * " + test_server()->host_port_pair().ToString() +
97 ",EXCLUDE localhost");
98 }
99 };
100
101 // Ensure that we kill the renderer process if we try to give it WebUI
102 // properties and it doesn't have enabled WebUI bindings.
IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,SetWebUIProperty)103 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest, SetWebUIProperty) {
104 GURL foo("http://foo.com/files/simple_page.html");
105
106 NavigateToURL(shell(), foo);
107 EXPECT_EQ(0,
108 shell()->web_contents()->GetRenderViewHost()->GetEnabledBindings());
109
110 content::WindowedNotificationObserver terminated(
111 content::NOTIFICATION_RENDERER_PROCESS_CLOSED,
112 content::NotificationService::AllSources());
113 shell()->web_contents()->GetRenderViewHost()->SetWebUIProperty(
114 "toolkit", "views");
115 terminated.Wait();
116 }
117
118 // This is a test for crbug.com/312016 attempting to create duplicate
119 // RenderViewHosts. SetupForDuplicateHosts sets up this test case and leaves
120 // it in a state with pending RenderViewHost. Before the commit of the new
121 // pending RenderViewHost, this test case creates a new window through the new
122 // process.
IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,AttemptDuplicateRenderViewHost)123 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
124 AttemptDuplicateRenderViewHost) {
125 int duplicate_routing_id = MSG_ROUTING_NONE;
126 RenderViewHostImpl* pending_rvh =
127 PrepareToDuplicateHosts(shell(), &duplicate_routing_id);
128 EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id);
129
130 // Since this test executes on the UI thread and hopping threads might cause
131 // different timing in the test, let's simulate a CreateNewWindow call coming
132 // from the IO thread.
133 ViewHostMsg_CreateWindow_Params params;
134 DOMStorageContextWrapper* dom_storage_context =
135 static_cast<DOMStorageContextWrapper*>(
136 BrowserContext::GetStoragePartition(
137 shell()->web_contents()->GetBrowserContext(),
138 pending_rvh->GetSiteInstance())->GetDOMStorageContext());
139 scoped_refptr<SessionStorageNamespaceImpl> session_storage(
140 new SessionStorageNamespaceImpl(dom_storage_context));
141 // Cause a deliberate collision in routing ids.
142 int main_frame_routing_id = duplicate_routing_id + 1;
143 pending_rvh->CreateNewWindow(
144 duplicate_routing_id, main_frame_routing_id, params, session_storage);
145
146 // If the above operation doesn't cause a crash, the test has succeeded!
147 }
148
149 // This is a test for crbug.com/312016. It tries to create two RenderWidgetHosts
150 // with the same process and routing ids, which causes a collision. It is almost
151 // identical to the AttemptDuplicateRenderViewHost test case.
IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,AttemptDuplicateRenderWidgetHost)152 IN_PROC_BROWSER_TEST_F(SecurityExploitBrowserTest,
153 AttemptDuplicateRenderWidgetHost) {
154 int duplicate_routing_id = MSG_ROUTING_NONE;
155 RenderViewHostImpl* pending_rvh =
156 PrepareToDuplicateHosts(shell(), &duplicate_routing_id);
157 EXPECT_NE(MSG_ROUTING_NONE, duplicate_routing_id);
158
159 // Since this test executes on the UI thread and hopping threads might cause
160 // different timing in the test, let's simulate a CreateNewWidget call coming
161 // from the IO thread. Use the existing window routing id to cause a
162 // deliberate collision.
163 pending_rvh->CreateNewWidget(duplicate_routing_id, blink::WebPopupTypeSelect);
164
165 // If the above operation doesn't crash, the test has succeeded!
166 }
167
168 } // namespace content
169