permissions_manager_unittest.cc 17 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427
  1. // Copyright 2021 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "extensions/browser/permissions_manager.h"
  5. #include "base/memory/raw_ptr.h"
  6. #include "extensions/browser/extension_prefs.h"
  7. #include "extensions/browser/extension_registry.h"
  8. #include "extensions/browser/extension_util.h"
  9. #include "extensions/browser/extensions_test.h"
  10. #include "extensions/browser/pref_types.h"
  11. #include "extensions/common/extension_builder.h"
  12. #include "extensions/common/extension_icon_set.h"
  13. #include "extensions/common/extensions_client.h"
  14. #include "extensions/common/permissions/permissions_data.h"
  15. #include "extensions/common/url_pattern_set.h"
  16. #include "testing/gmock/include/gmock/gmock.h"
  17. #include "testing/gtest/include/gtest/gtest.h"
  18. #include "url/origin.h"
  19. namespace {
  20. std::unique_ptr<KeyedService> SetTestingPermissionsManager(
  21. content::BrowserContext* browser_context) {
  22. return std::make_unique<extensions::PermissionsManager>(browser_context);
  23. }
  24. } // namespace
  25. namespace extensions {
  26. using UserSiteSetting = PermissionsManager::UserSiteSetting;
  27. class PermissionsManagerUnittest : public ExtensionsTest {
  28. public:
  29. PermissionsManagerUnittest() = default;
  30. ~PermissionsManagerUnittest() override = default;
  31. PermissionsManagerUnittest(const PermissionsManagerUnittest&) = delete;
  32. PermissionsManagerUnittest& operator=(const PermissionsManagerUnittest&) =
  33. delete;
  34. scoped_refptr<const Extension> AddExtensionWithHostPermission(
  35. const std::string& name,
  36. const std::string& host_permission);
  37. // Returns the restricted sites stored in `manager_`.
  38. std::set<url::Origin> GetRestrictedSitesFromManager();
  39. // Returns the permittes sites stored in `manager_`.
  40. std::set<url::Origin> GetPermittedSitesFromManager();
  41. // Returns the restricted sites stored in `extension_prefs_`.
  42. const base::Value* GetRestrictedSitesFromPrefs();
  43. // Returns the permitted sites stored in `extension_prefs_`.
  44. const base::Value* GetPermittedSitesFromPrefs();
  45. // Returns the restricted sites stored in `PermissionsData`.
  46. std::set<std::string> GetRestrictedSitesFromPermissionsData();
  47. // Returns the permitted sites stored in `PermissionsData`.
  48. std::set<std::string> GetPermittedSitesFromPermissionsData();
  49. protected:
  50. // ExtensionsTest:
  51. void SetUp() override;
  52. // PermissionsManager being tested.
  53. raw_ptr<PermissionsManager> manager_;
  54. raw_ptr<ExtensionPrefs> extension_prefs_;
  55. };
  56. void PermissionsManagerUnittest::SetUp() {
  57. ExtensionsTest::SetUp();
  58. manager_ = static_cast<PermissionsManager*>(
  59. PermissionsManager::GetFactory()->SetTestingFactoryAndUse(
  60. browser_context(),
  61. base::BindRepeating(&SetTestingPermissionsManager)));
  62. extension_prefs_ = ExtensionPrefs::Get(browser_context());
  63. }
  64. scoped_refptr<const Extension>
  65. PermissionsManagerUnittest::AddExtensionWithHostPermission(
  66. const std::string& name,
  67. const std::string& host_permission) {
  68. scoped_refptr<const extensions::Extension> extension =
  69. extensions::ExtensionBuilder(name)
  70. .SetManifestVersion(3)
  71. .SetManifestKey(
  72. "host_permissions",
  73. extensions::ListBuilder().Append(host_permission).Build())
  74. .Build();
  75. ExtensionRegistryFactory::GetForBrowserContext(browser_context())
  76. ->AddEnabled(extension);
  77. return extension;
  78. }
  79. const base::Value* PermissionsManagerUnittest::GetRestrictedSitesFromPrefs() {
  80. const base::DictionaryValue* permissions =
  81. extension_prefs_->GetPrefAsDictionary(kUserPermissions);
  82. return permissions->FindKey("restricted_sites");
  83. }
  84. const base::Value* PermissionsManagerUnittest::GetPermittedSitesFromPrefs() {
  85. const base::DictionaryValue* permissions =
  86. extension_prefs_->GetPrefAsDictionary(kUserPermissions);
  87. return permissions->FindKey("permitted_sites");
  88. }
  89. std::set<url::Origin>
  90. PermissionsManagerUnittest::GetRestrictedSitesFromManager() {
  91. const PermissionsManager::UserPermissionsSettings& permissions =
  92. manager_->GetUserPermissionsSettings();
  93. return permissions.restricted_sites;
  94. }
  95. std::set<url::Origin>
  96. PermissionsManagerUnittest::GetPermittedSitesFromManager() {
  97. const PermissionsManager::UserPermissionsSettings& permissions =
  98. manager_->GetUserPermissionsSettings();
  99. return permissions.permitted_sites;
  100. }
  101. std::set<std::string>
  102. PermissionsManagerUnittest::GetRestrictedSitesFromPermissionsData() {
  103. std::set<std::string> string_patterns;
  104. URLPatternSet patterns = PermissionsData::GetUserBlockedHosts(
  105. util::GetBrowserContextId(browser_context()));
  106. for (const auto& pattern : patterns)
  107. string_patterns.insert(pattern.GetAsString());
  108. return string_patterns;
  109. }
  110. std::set<std::string>
  111. PermissionsManagerUnittest::GetPermittedSitesFromPermissionsData() {
  112. std::set<std::string> string_patterns;
  113. URLPatternSet patterns = PermissionsData::GetUserAllowedHosts(
  114. util::GetBrowserContextId(browser_context()));
  115. for (const auto& pattern : patterns)
  116. string_patterns.insert(pattern.GetAsString());
  117. return string_patterns;
  118. }
  119. TEST_F(PermissionsManagerUnittest, AddAndRemoveRestrictedSite) {
  120. const url::Origin url = url::Origin::Create(GURL("http://a.example.com"));
  121. const std::string expected_url_pattern = "http://a.example.com/*";
  122. std::set<url::Origin> set_with_url;
  123. set_with_url.insert(url);
  124. base::Value value_with_url(base::Value::Type::LIST);
  125. value_with_url.Append(url.Serialize());
  126. // Verify the restricted sites list is empty.
  127. EXPECT_EQ(GetRestrictedSitesFromManager(), std::set<url::Origin>());
  128. EXPECT_EQ(GetRestrictedSitesFromPrefs(), nullptr);
  129. EXPECT_THAT(GetRestrictedSitesFromPermissionsData(), testing::IsEmpty());
  130. EXPECT_EQ(manager_->GetUserSiteSetting(url),
  131. UserSiteSetting::kCustomizeByExtension);
  132. // Add `url` to restricted sites. Verify the site is stored both in manager
  133. // and prefs restricted sites.
  134. manager_->AddUserRestrictedSite(url);
  135. EXPECT_EQ(GetRestrictedSitesFromManager(), set_with_url);
  136. EXPECT_EQ(*GetRestrictedSitesFromPrefs(), value_with_url);
  137. EXPECT_THAT(GetRestrictedSitesFromPermissionsData(),
  138. testing::UnorderedElementsAre(expected_url_pattern));
  139. EXPECT_EQ(manager_->GetUserSiteSetting(url),
  140. UserSiteSetting::kBlockAllExtensions);
  141. // Adding an existent restricted site. Verify the entry is not duplicated.
  142. manager_->AddUserRestrictedSite(url);
  143. EXPECT_EQ(GetRestrictedSitesFromManager(), set_with_url);
  144. EXPECT_EQ(*GetRestrictedSitesFromPrefs(), value_with_url);
  145. EXPECT_THAT(GetRestrictedSitesFromPermissionsData(),
  146. testing::UnorderedElementsAre(expected_url_pattern));
  147. // Remove `url` from restricted sites. Verify the site is removed from both
  148. // manager and prefs restricted sites.
  149. manager_->RemoveUserRestrictedSite(url);
  150. EXPECT_EQ(GetRestrictedSitesFromManager(), std::set<url::Origin>());
  151. EXPECT_EQ(*GetRestrictedSitesFromPrefs(),
  152. base::Value(base::Value::Type::LIST));
  153. EXPECT_THAT(GetRestrictedSitesFromPermissionsData(), testing::IsEmpty());
  154. EXPECT_EQ(manager_->GetUserSiteSetting(url),
  155. UserSiteSetting::kCustomizeByExtension);
  156. }
  157. TEST_F(PermissionsManagerUnittest, AddAndRemovePermittedSite) {
  158. const url::Origin url = url::Origin::Create(GURL("http://a.example.com"));
  159. const std::string expected_url_pattern = "http://a.example.com/*";
  160. std::set<url::Origin> set_with_url;
  161. set_with_url.insert(url);
  162. base::Value value_with_url(base::Value::Type::LIST);
  163. value_with_url.Append(url.Serialize());
  164. // Verify the permitted sites list is empty.
  165. EXPECT_EQ(GetPermittedSitesFromManager(), std::set<url::Origin>());
  166. EXPECT_EQ(GetPermittedSitesFromPrefs(), nullptr);
  167. EXPECT_THAT(GetPermittedSitesFromPermissionsData(), testing::IsEmpty());
  168. EXPECT_EQ(manager_->GetUserSiteSetting(url),
  169. PermissionsManager::UserSiteSetting::kCustomizeByExtension);
  170. // Add `url` to permitted sites. Verify the site is stored both in manager
  171. // and prefs permitted sites.
  172. manager_->AddUserPermittedSite(url);
  173. EXPECT_EQ(GetPermittedSitesFromManager(), set_with_url);
  174. EXPECT_EQ(*GetPermittedSitesFromPrefs(), value_with_url);
  175. EXPECT_THAT(GetPermittedSitesFromPermissionsData(),
  176. testing::UnorderedElementsAre(expected_url_pattern));
  177. EXPECT_EQ(manager_->GetUserSiteSetting(url),
  178. PermissionsManager::UserSiteSetting::kGrantAllExtensions);
  179. // Adding an existent permitted site. Verify the entry is not duplicated.
  180. manager_->AddUserPermittedSite(url);
  181. EXPECT_EQ(GetPermittedSitesFromManager(), set_with_url);
  182. EXPECT_EQ(*GetPermittedSitesFromPrefs(), value_with_url);
  183. EXPECT_THAT(GetPermittedSitesFromPermissionsData(),
  184. testing::UnorderedElementsAre(expected_url_pattern));
  185. // Remove `url` from permitted sites. Verify the site is removed from both
  186. // manager and prefs permitted sites.
  187. manager_->RemoveUserPermittedSite(url);
  188. EXPECT_EQ(GetPermittedSitesFromManager(), std::set<url::Origin>());
  189. EXPECT_EQ(*GetPermittedSitesFromPrefs(),
  190. base::Value(base::Value::Type::LIST));
  191. EXPECT_THAT(GetPermittedSitesFromPermissionsData(), testing::IsEmpty());
  192. EXPECT_EQ(manager_->GetUserSiteSetting(url),
  193. PermissionsManager::UserSiteSetting::kCustomizeByExtension);
  194. }
  195. TEST_F(PermissionsManagerUnittest,
  196. RestrictedAndPermittedSitesAreMutuallyExclusive) {
  197. const url::Origin url = url::Origin::Create(GURL("http://a.example.com"));
  198. std::set<url::Origin> empty_set;
  199. std::set<url::Origin> set_with_url;
  200. set_with_url.insert(url);
  201. {
  202. manager_->AddUserRestrictedSite(url);
  203. const PermissionsManager::UserPermissionsSettings& actual_permissions =
  204. manager_->GetUserPermissionsSettings();
  205. EXPECT_EQ(actual_permissions.restricted_sites, set_with_url);
  206. EXPECT_EQ(actual_permissions.permitted_sites, empty_set);
  207. EXPECT_EQ(manager_->GetUserSiteSetting(url),
  208. PermissionsManager::UserSiteSetting::kBlockAllExtensions);
  209. }
  210. {
  211. // Adding an url to the permitted sites that is already in the restricted
  212. // sites should remove it from restricted sites and add it to permitted
  213. // sites.
  214. manager_->AddUserPermittedSite(url);
  215. const PermissionsManager::UserPermissionsSettings& actual_permissions =
  216. manager_->GetUserPermissionsSettings();
  217. EXPECT_EQ(actual_permissions.restricted_sites, empty_set);
  218. EXPECT_EQ(actual_permissions.permitted_sites, set_with_url);
  219. EXPECT_EQ(manager_->GetUserSiteSetting(url),
  220. PermissionsManager::UserSiteSetting::kGrantAllExtensions);
  221. }
  222. {
  223. // Adding an url to the restricted sites that is already in the permitted
  224. // sites should remove it from permitted sites and add it to restricted
  225. // sites.
  226. manager_->AddUserRestrictedSite(url);
  227. const PermissionsManager::UserPermissionsSettings& actual_permissions =
  228. manager_->GetUserPermissionsSettings();
  229. EXPECT_EQ(actual_permissions.restricted_sites, set_with_url);
  230. EXPECT_EQ(actual_permissions.permitted_sites, empty_set);
  231. EXPECT_EQ(manager_->GetUserSiteSetting(url),
  232. PermissionsManager::UserSiteSetting::kBlockAllExtensions);
  233. }
  234. }
  235. TEST_F(PermissionsManagerUnittest, UpdateUserSiteSetting) {
  236. const url::Origin url = url::Origin::Create(GURL("http://a.example.com"));
  237. std::set<url::Origin> empty_set;
  238. std::set<url::Origin> set_with_url;
  239. set_with_url.insert(url);
  240. {
  241. manager_->UpdateUserSiteSetting(
  242. url, PermissionsManager::UserSiteSetting::kGrantAllExtensions);
  243. const PermissionsManager::UserPermissionsSettings& actual_permissions =
  244. manager_->GetUserPermissionsSettings();
  245. EXPECT_EQ(actual_permissions.restricted_sites, empty_set);
  246. EXPECT_EQ(actual_permissions.permitted_sites, set_with_url);
  247. EXPECT_EQ(manager_->GetUserSiteSetting(url),
  248. PermissionsManager::UserSiteSetting::kGrantAllExtensions);
  249. }
  250. {
  251. manager_->UpdateUserSiteSetting(
  252. url, PermissionsManager::UserSiteSetting::kBlockAllExtensions);
  253. const PermissionsManager::UserPermissionsSettings& actual_permissions =
  254. manager_->GetUserPermissionsSettings();
  255. EXPECT_EQ(actual_permissions.restricted_sites, set_with_url);
  256. EXPECT_EQ(actual_permissions.permitted_sites, empty_set);
  257. EXPECT_EQ(manager_->GetUserSiteSetting(url),
  258. PermissionsManager::UserSiteSetting::kBlockAllExtensions);
  259. }
  260. {
  261. manager_->UpdateUserSiteSetting(
  262. url, PermissionsManager::UserSiteSetting::kCustomizeByExtension);
  263. const PermissionsManager::UserPermissionsSettings& actual_permissions =
  264. manager_->GetUserPermissionsSettings();
  265. EXPECT_EQ(actual_permissions.restricted_sites, empty_set);
  266. EXPECT_EQ(actual_permissions.permitted_sites, empty_set);
  267. EXPECT_EQ(manager_->GetUserSiteSetting(url),
  268. PermissionsManager::UserSiteSetting::kCustomizeByExtension);
  269. }
  270. }
  271. TEST_F(PermissionsManagerUnittest, GetSiteAccess_AllUrls) {
  272. auto extension =
  273. AddExtensionWithHostPermission("AllUrls Extension", "<all_urls>");
  274. const GURL non_restricted_url("https://www.non-restricted.com");
  275. {
  276. const PermissionsManager::ExtensionSiteAccess site_access =
  277. manager_->GetSiteAccess(*extension, non_restricted_url);
  278. EXPECT_TRUE(site_access.has_site_access);
  279. EXPECT_FALSE(site_access.withheld_site_access);
  280. EXPECT_TRUE(site_access.has_all_sites_access);
  281. EXPECT_FALSE(site_access.withheld_all_sites_access);
  282. }
  283. // Chrome pages should be restricted, and the extension shouldn't have grant
  284. // or withheld site access.
  285. const GURL restricted_url("chrome://extensions");
  286. {
  287. const PermissionsManager::ExtensionSiteAccess site_access =
  288. manager_->GetSiteAccess(*extension, restricted_url);
  289. EXPECT_FALSE(site_access.has_site_access);
  290. EXPECT_FALSE(site_access.withheld_site_access);
  291. EXPECT_TRUE(site_access.has_all_sites_access);
  292. EXPECT_FALSE(site_access.withheld_all_sites_access);
  293. }
  294. }
  295. TEST_F(PermissionsManagerUnittest, GetSiteAccess_RequestedUrl) {
  296. auto extension = AddExtensionWithHostPermission("RequestedUrl Extension",
  297. "*://*.requested.com/*");
  298. const GURL requested_url("https://www.requested.com");
  299. {
  300. const PermissionsManager::ExtensionSiteAccess site_access =
  301. manager_->GetSiteAccess(*extension, requested_url);
  302. EXPECT_TRUE(site_access.has_site_access);
  303. EXPECT_FALSE(site_access.withheld_site_access);
  304. EXPECT_FALSE(site_access.has_all_sites_access);
  305. EXPECT_FALSE(site_access.withheld_all_sites_access);
  306. }
  307. const GURL non_requested_url("https://non-requested.com");
  308. {
  309. const PermissionsManager::ExtensionSiteAccess site_access =
  310. manager_->GetSiteAccess(*extension, non_requested_url);
  311. EXPECT_FALSE(site_access.has_site_access);
  312. EXPECT_FALSE(site_access.withheld_site_access);
  313. EXPECT_FALSE(site_access.has_all_sites_access);
  314. EXPECT_FALSE(site_access.withheld_all_sites_access);
  315. }
  316. }
  317. // Tests that for the purposes of displaying an extension's site access to the
  318. // user (or granting/revoking permissions), we ignore paths in the URL. We
  319. // always strip the path from host permissions directly, but we don't strip the
  320. // path from content scripts.
  321. TEST_F(PermissionsManagerUnittest,
  322. GetSiteAccess_ContentScript_RequestedUrlWithPath) {
  323. scoped_refptr<const Extension> extension =
  324. ExtensionBuilder("extension")
  325. .AddContentScript("foo.js", {"https://www.example.com/foo"})
  326. .SetLocation(mojom::ManifestLocation::kInternal)
  327. .Build();
  328. ExtensionRegistryFactory::GetForBrowserContext(browser_context())
  329. ->AddEnabled(extension);
  330. const GURL other_path_url("https://www.example.com/bar");
  331. {
  332. const PermissionsManager::ExtensionSiteAccess site_access =
  333. manager_->GetSiteAccess(*extension, other_path_url);
  334. // Even though the path doesn't match the one requested, the domain does
  335. // match and thus we treat it as if the site was requested.
  336. EXPECT_TRUE(site_access.has_site_access);
  337. EXPECT_FALSE(site_access.withheld_site_access);
  338. EXPECT_FALSE(site_access.has_all_sites_access);
  339. EXPECT_FALSE(site_access.withheld_all_sites_access);
  340. }
  341. }
  342. TEST_F(PermissionsManagerUnittest, GetSiteAccess_ActiveTab) {
  343. auto extension =
  344. AddExtensionWithHostPermission("ActiveTab Extension", "activeTab");
  345. const GURL url("https://example.com");
  346. {
  347. const PermissionsManager::ExtensionSiteAccess site_access =
  348. manager_->GetSiteAccess(*extension, url);
  349. // The site access computation does not take into account active tab, and
  350. // therefore it does not have or withheld any access.
  351. EXPECT_FALSE(site_access.has_site_access);
  352. EXPECT_FALSE(site_access.withheld_site_access);
  353. EXPECT_FALSE(site_access.has_all_sites_access);
  354. EXPECT_FALSE(site_access.withheld_all_sites_access);
  355. }
  356. }
  357. TEST_F(PermissionsManagerUnittest, GetSiteAccess_NoHostPermissions) {
  358. auto extension = AddExtensionWithHostPermission("", "Extension");
  359. const GURL url("https://example.com");
  360. {
  361. const PermissionsManager::ExtensionSiteAccess site_access =
  362. manager_->GetSiteAccess(*extension, url);
  363. // The site access computation does not take into account active tab, and
  364. // therefore it does not have or withheld any access.
  365. EXPECT_FALSE(site_access.has_site_access);
  366. EXPECT_FALSE(site_access.withheld_site_access);
  367. EXPECT_FALSE(site_access.has_all_sites_access);
  368. EXPECT_FALSE(site_access.withheld_all_sites_access);
  369. }
  370. }
  371. } // namespace extensions