capability_delegation_browsertest.cc 7.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185
  1. // Copyright 2021 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "base/command_line.h"
  5. #include "base/feature_list.h"
  6. #include "chrome/browser/ui/browser.h"
  7. #include "chrome/test/base/ui_test_utils.h"
  8. #include "chrome/test/payments/payment_request_platform_browsertest_base.h"
  9. #include "content/public/browser/render_frame_host.h"
  10. #include "content/public/browser/web_contents.h"
  11. #include "content/public/common/content_features.h"
  12. #include "content/public/test/browser_test.h"
  13. #include "net/dns/mock_host_resolver.h"
  14. #include "url/gurl.h"
  15. class CapabilityDelegationBrowserTest
  16. : public payments::PaymentRequestPlatformBrowserTestBase {
  17. public:
  18. CapabilityDelegationBrowserTest() = default;
  19. CapabilityDelegationBrowserTest(const CapabilityDelegationBrowserTest&) =
  20. delete;
  21. CapabilityDelegationBrowserTest& operator=(
  22. const CapabilityDelegationBrowserTest&) = delete;
  23. ~CapabilityDelegationBrowserTest() override = default;
  24. void SetUpOnMainThread() override {
  25. host_resolver()->AddRule("*", "127.0.0.1");
  26. ASSERT_TRUE(https_server()->InitializeAndListen());
  27. content::SetupCrossSiteRedirector(https_server());
  28. https_server()->ServeFilesFromSourceDirectory(
  29. "chrome/test/data/capability_delegation");
  30. https_server()->ServeFilesFromSourceDirectory(
  31. "components/test/data/payments");
  32. https_server()->StartAcceptingConnections();
  33. }
  34. private:
  35. base::test::ScopedFeatureList feature_list_;
  36. };
  37. IN_PROC_BROWSER_TEST_F(CapabilityDelegationBrowserTest,
  38. CrossOriginPaymentRequest) {
  39. // Install a payment app that responds to the abortpayment event, which is
  40. // used by this test to determine that the app was successfully run.
  41. std::string payment_method;
  42. InstallPaymentApp("a.com", "abort_responder_app.js", &payment_method);
  43. // Navigate the top frame.
  44. GURL main_url(
  45. https_server()->GetURL("a.com", "/payment_request_delegation.html"));
  46. ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), main_url));
  47. // Navigate the sub-frame cross-site.
  48. content::WebContents* active_web_contents =
  49. browser()->tab_strip_model()->GetActiveWebContents();
  50. GURL cross_site_url(
  51. https_server()->GetURL("b.com", "/payment_request_delegation_sub.html"));
  52. EXPECT_TRUE(
  53. NavigateIframeToURL(active_web_contents, "iframe", cross_site_url));
  54. const std::string subframe_origin =
  55. https_server()->GetOrigin("b.com").Serialize();
  56. // Confirm that the subframe is cross-process depending on the process
  57. // model.
  58. content::RenderFrameHost* frame_host =
  59. ChildFrameAt(active_web_contents->GetPrimaryMainFrame(), 0);
  60. ASSERT_TRUE(frame_host);
  61. EXPECT_EQ(cross_site_url, frame_host->GetLastCommittedURL());
  62. auto* main_instance =
  63. active_web_contents->GetPrimaryMainFrame()->GetSiteInstance();
  64. auto* subframe_instance = frame_host->GetSiteInstance();
  65. if (main_instance->RequiresDedicatedProcess()) {
  66. // Subframe is cross process because it can't be place in the main frame's
  67. // process.
  68. EXPECT_TRUE(frame_host->IsCrossProcessSubframe());
  69. } else {
  70. // The main frame does not require a dedicated process so the subframe will
  71. // be placed in the same process as the main frame.
  72. EXPECT_FALSE(frame_host->IsCrossProcessSubframe());
  73. EXPECT_FALSE(subframe_instance->RequiresDedicatedProcess());
  74. EXPECT_EQ(content::AreDefaultSiteInstancesEnabled(),
  75. main_instance == subframe_instance);
  76. }
  77. // Without either user activation or payment request token, PaymentRequest
  78. // dialog is not allowed.
  79. EXPECT_EQ(
  80. "SecurityError",
  81. content::EvalJs(active_web_contents,
  82. content::JsReplace("sendRequestToSubframe(false, $1, $2)",
  83. payment_method, subframe_origin),
  84. content::EXECUTE_SCRIPT_NO_USER_GESTURE));
  85. // Without user activation but with the delegation option, the delegation
  86. // postMessage is not allowed.
  87. EXPECT_EQ(
  88. "NotAllowedError",
  89. content::EvalJs(active_web_contents,
  90. content::JsReplace("sendRequestToSubframe(true, $1, $2)",
  91. payment_method, subframe_origin),
  92. content::EXECUTE_SCRIPT_NO_USER_GESTURE));
  93. // With user activation but without the delegation option, PaymentRequest
  94. // dialog is not allowed.
  95. EXPECT_EQ(
  96. "SecurityError",
  97. content::EvalJs(active_web_contents,
  98. content::JsReplace("sendRequestToSubframe(false, $1, $2)",
  99. payment_method, subframe_origin)));
  100. // With both user activation and the delegation option, PaymentRequest dialog
  101. // is shown and then successfully aborted by the script.
  102. EXPECT_EQ(
  103. "AbortError",
  104. content::EvalJs(active_web_contents,
  105. content::JsReplace("sendRequestToSubframe(true, $1, $2)",
  106. payment_method, subframe_origin)));
  107. }
  108. IN_PROC_BROWSER_TEST_F(CapabilityDelegationBrowserTest,
  109. SameOriginPaymentRequest) {
  110. // Install a payment app that responds to the abortpayment event, which is
  111. // used by this test to determine that the app was successfully run.
  112. std::string payment_method;
  113. InstallPaymentApp("a.com", "abort_responder_app.js", &payment_method);
  114. // Navigate the top frame.
  115. GURL main_url(
  116. https_server()->GetURL("a.com", "/payment_request_delegation.html"));
  117. ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), main_url));
  118. // Navigate the sub-frame cross-site.
  119. content::WebContents* active_web_contents =
  120. browser()->tab_strip_model()->GetActiveWebContents();
  121. GURL subframe_url(
  122. https_server()->GetURL("a.com", "/payment_request_delegation_sub.html"));
  123. EXPECT_TRUE(NavigateIframeToURL(active_web_contents, "iframe", subframe_url));
  124. const std::string subframe_origin = "/";
  125. // Confirm that the subframe is same-process.
  126. content::RenderFrameHost* frame_host =
  127. ChildFrameAt(active_web_contents->GetPrimaryMainFrame(), 0);
  128. ASSERT_TRUE(frame_host);
  129. EXPECT_EQ(subframe_url, frame_host->GetLastCommittedURL());
  130. EXPECT_FALSE(frame_host->IsCrossProcessSubframe());
  131. // Without either user activation or payment request token, PaymentRequest
  132. // dialog is not allowed.
  133. EXPECT_EQ(
  134. "SecurityError",
  135. content::EvalJs(active_web_contents,
  136. content::JsReplace("sendRequestToSubframe(false, $1, $2)",
  137. payment_method, subframe_origin),
  138. content::EXECUTE_SCRIPT_NO_USER_GESTURE));
  139. // Without user activation but with the delegation option, the delegation
  140. // postMessage is not allowed.
  141. EXPECT_EQ(
  142. "NotAllowedError",
  143. content::EvalJs(active_web_contents,
  144. content::JsReplace("sendRequestToSubframe(true, $1, $2)",
  145. payment_method, subframe_origin),
  146. content::EXECUTE_SCRIPT_NO_USER_GESTURE));
  147. // With user activation but without the delegation option, PaymentRequest
  148. // dialog is shown and then successfully aborted by the script.
  149. EXPECT_EQ(
  150. "AbortError",
  151. content::EvalJs(active_web_contents,
  152. content::JsReplace("sendRequestToSubframe(false, $1, $2)",
  153. payment_method, subframe_origin)));
  154. // With both user activation and the delegation option, PaymentRequest dialog
  155. // is shown and then successfully aborted by the script.
  156. EXPECT_EQ(
  157. "AbortError",
  158. content::EvalJs(active_web_contents,
  159. content::JsReplace("sendRequestToSubframe(true, $1, $2)",
  160. payment_method, subframe_origin)));
  161. }