// Copyright 2021 The Chromium Authors // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #include #include "base/files/file_path.h" #include "base/functional/callback.h" #include "base/memory/raw_ptr.h" #include "base/memory/scoped_refptr.h" #include "base/memory/weak_ptr.h" #include "base/strings/stringprintf.h" #include "base/test/bind.h" #include "base/test/scoped_feature_list.h" #include "base/test/values_test_util.h" #include "base/values.h" #include "build/build_config.h" #include "chrome/browser/chrome_content_browser_client.h" #include "chrome/browser/extensions/api/messaging/native_messaging_test_util.h" #include "chrome/browser/extensions/extension_browsertest.h" #include "chrome/browser/extensions/extension_tab_util.h" #include "chrome/browser/profiles/profile.h" #include "chrome/browser/ui/browser_window/public/browser_window_interface.h" #include "content/public/browser/browser_task_traits.h" #include "content/public/browser/browser_thread.h" #include "content/public/browser/render_frame_host.h" #include "content/public/browser/render_process_host.h" #include "content/public/browser/web_contents.h" #include "content/public/common/content_client.h" #include "content/public/test/browser_test.h" #include "content/public/test/browser_test_utils.h" #include "content/public/test/test_navigation_observer.h" #include "extensions/browser/api/automation_internal/automation_event_router.h" #include "extensions/browser/api/messaging/channel_endpoint.h" #include "extensions/browser/api/messaging/message_service.h" #include "extensions/browser/api/storage/storage_api.h" #include "extensions/browser/background_script_executor.h" #include "extensions/browser/bad_message.h" #include "extensions/browser/browsertest_util.h" #include "extensions/browser/event_router.h" #include "extensions/browser/extension_frame_host.h" #include "extensions/browser/extension_web_contents_observer.h" #include "extensions/browser/process_manager.h" #include "extensions/browser/renderer_startup_helper.h" #include "extensions/browser/script_injection_tracker.h" #include "extensions/browser/service_worker/service_worker_host.h" #include "extensions/common/api/messaging/messaging_endpoint.h" #include "extensions/common/api/messaging/port_id.h" #include "extensions/common/constants.h" #include "extensions/common/extension_features.h" #include "extensions/common/mojom/automation_registry.mojom.h" #include "extensions/common/mojom/event_router.mojom.h" #include "extensions/common/mojom/frame.mojom-test-utils.h" #include "extensions/common/mojom/message_port.mojom.h" #include "extensions/common/mojom/service_worker_host.mojom-test-utils.h" #include "extensions/test/extension_test_message_listener.h" #include "extensions/test/test_extension_dir.h" #include "mojo/public/cpp/bindings/associated_remote.h" #include "mojo/public/cpp/test_support/test_utils.h" #include "net/dns/mock_host_resolver.h" #include "net/test/embedded_test_server/embedded_test_server.h" #include "testing/gmock/include/gmock/gmock.h" #include "testing/gtest/include/gtest/gtest.h" #include "third_party/blink/public/mojom/service_worker/service_worker_database.mojom.h" #include "url/gurl.h" namespace extensions { namespace { // Helper to serve a page with CSP that blocks subframe navigations. std::unique_ptr HandleCspBlockRequest( const net::test_server::HttpRequest& request) { if (request.relative_url != "/csp_block.html") { return nullptr; } auto response = std::make_unique(); response->set_code(net::HTTP_OK); response->set_content_type("text/html"); response->AddCustomHeader("Content-Security-Policy", "frame-src 'none'"); response->set_content( "" "" ""); return response; } // A mock `mojom::MessagePort` implementation that allows tests to intercept // communication from the browser-side `MessageService` (e.g., to verify // connection success/failure and capture disconnect errors). class TestMessagePort : public mojom::MessagePort { public: explicit TestMessagePort(base::RepeatingClosure quit_closure) : quit_closure_(std::move(quit_closure)) {} bool got_message() const { return got_message_; } const std::optional& disconnect_error() const { return disconnect_error_; } private: void DispatchDisconnect(const std::string& error) override { disconnect_error_ = error; quit_closure_.Run(); } void DeliverMessage(Message message) override { got_message_ = true; quit_closure_.Run(); } bool got_message_ = false; std::optional disconnect_error_; base::RepeatingClosure quit_closure_; }; } // namespace // ExtensionFrameHostInterceptor is a helper for: // - Intercepting mojom::LocalFrameHost method calls (e.g. methods // that would normally be handled / implemented by ExtensionFrameHost). // - Allowing the test to mutate the method arguments (e.g. to simulate a // compromised renderer) before passing the method call to the usual handler. class ExtensionFrameHostInterceptor : mojom::LocalFrameHostInterceptorForTesting { public: // The caller needs to ensure that `frame` stays alive longer than the // constructed ExtensionFrameHostInterceptor. explicit ExtensionFrameHostInterceptor(content::RenderFrameHost* frame) : frame_(frame), extension_frame_host_( ExtensionWebContentsObserver::GetForWebContents( content::WebContents::FromRenderFrameHost(frame_)) ->extension_frame_host_for_testing()), scoped_swap_impl_(extension_frame_host_->receivers_for_testing(), this) {} ~ExtensionFrameHostInterceptor() override = default; using RequestMutator = base::RepeatingCallback; void SetRequestMutator(RequestMutator request_mutator) { request_mutator_ = std::move(request_mutator); } using RequestCallbackHook = base::RepeatingCallback; void SetRequestCallbackHook(RequestCallbackHook interceptor) { request_callback_hook_ = std::move(interceptor); } using OpenChannelToExtensionMutator = base::RepeatingCallback; void SetOpenChannelToExtensionMutator( OpenChannelToExtensionMutator open_extension_mutator) { open_extension_mutator_ = std::move(open_extension_mutator); } void SimulateWatchedPageChange( const std::vector& css_selectors) { GetForwardingInterface()->WatchedPageChange(css_selectors); } using WatchedPageChangeMutator = base::RepeatingCallback& css_selectors)>; void SetWatchedPageChangeMutator( WatchedPageChangeMutator watched_page_change_mutator) { watched_page_change_mutator_ = std::move(watched_page_change_mutator); } // We cannot call `FlushForTesting()` on the receiver side because // `ExtensionFrameHost` uses `content::RenderFrameHostReceiverSet` which does // not expose `FlushForTesting()`. Instead, we do a Mojo round-trip by calling // a method with a callback (`GetAppInstallState`) to ensure all previous // messages on the pipe have been processed. void FlushForTesting() { base::RunLoop run_loop; GetForwardingInterface()->GetAppInstallState( GURL("http://example.com"), base::BindOnce( [](base::OnceClosure quit_closure, const std::string&) { std::move(quit_closure).Run(); }, run_loop.QuitClosure())); run_loop.Run(); } private: mojom::LocalFrameHost* GetForwardingInterface() override { return scoped_swap_impl_.old_impl(); } void Request(mojom::RequestParamsPtr params, RequestCallback callback) override { // `//extensions/common/mojom/frame.mojom` specifies that `params` is // non-optional. CHECK(params); content::RenderFrameHost* current_target_frame = &extension_frame_host_->receivers_for_testing().CurrentTargetFrame(); if (request_mutator_ && frame_ == current_target_frame) { request_mutator_.Run(*params); } // Notify the optional `request_callback_hook_` of the value of the // response. auto wrapped_callback = base::BindOnce( [](RequestCallback original_callback, RequestCallbackHook interceptor, bool success, base::ListValue response_wrapper, const std::string& error, mojom::ExtraResponseDataPtr extra_data) { if (interceptor) { interceptor.Run(success, error); } std::move(original_callback) .Run(success, std::move(response_wrapper), error, std::move(extra_data)); }, std::move(callback), request_callback_hook_); GetForwardingInterface()->Request(std::move(params), std::move(wrapped_callback)); } void OpenChannelToExtension( mojom::ExternalConnectionInfoPtr info, mojom::ChannelType channel_type, const std::string& channel_name, const PortId& port_id, mojo::PendingAssociatedRemote port, mojo::PendingAssociatedReceiver port_host) override { CHECK(info); content::RenderFrameHost* current_target_frame = &extension_frame_host_->receivers_for_testing().CurrentTargetFrame(); if (open_extension_mutator_ && frame_ == current_target_frame) { open_extension_mutator_.Run(*info); } GetForwardingInterface()->OpenChannelToExtension( std::move(info), channel_type, channel_name, port_id, std::move(port), std::move(port_host)); } void WatchedPageChange( const std::vector& css_selectors) override { std::vector mutated_selectors = css_selectors; content::RenderFrameHost* current_target_frame = &extension_frame_host_->receivers_for_testing().CurrentTargetFrame(); if (watched_page_change_mutator_ && frame_ == current_target_frame) { watched_page_change_mutator_.Run(mutated_selectors); } GetForwardingInterface()->WatchedPageChange(mutated_selectors); } const raw_ptr frame_ = nullptr; RequestMutator request_mutator_; RequestCallbackHook request_callback_hook_; OpenChannelToExtensionMutator open_extension_mutator_; WatchedPageChangeMutator watched_page_change_mutator_; const raw_ptr extension_frame_host_ = nullptr; const mojo::test::ScopedSwapImplForTesting scoped_swap_impl_; }; class ServiceWorkerHostInterceptorForProcessDeath : public mojom::ServiceWorkerHostInterceptorForTesting { public: // We use `worker_id` to have an weak handle to the `ServiceWorkerHost` // which will be destroyed when this object mutates the IPC to cause // a bad message resulting in process death. explicit ServiceWorkerHostInterceptorForProcessDeath( const WorkerId& worker_id) : worker_id_(worker_id) { auto* host = extensions::ServiceWorkerHost::GetWorkerFor(worker_id_); CHECK(host); std::ignore = host->receiver_for_testing().SwapImplForTesting(this); } mojom::ServiceWorkerHost* GetForwardingInterface() override { // This should be non-null if this interface is still receiving events. auto* host = extensions::ServiceWorkerHost::GetWorkerFor(worker_id_); CHECK(host); return host; } void OpenChannelToExtension( mojom::ExternalConnectionInfoPtr info, mojom::ChannelType channel_type, const std::string& channel_name, const PortId& port_id, mojo::PendingAssociatedRemote port, mojo::PendingAssociatedReceiver port_host) override { CHECK(info); if (open_extension_mutator_) { open_extension_mutator_.Run(*info); } GetForwardingInterface()->OpenChannelToExtension( std::move(info), channel_type, channel_name, port_id, std::move(port), std::move(port_host)); } using OpenChannelToExtensionMutator = base::RepeatingCallback; void SetOpenChannelToExtensionMutator( OpenChannelToExtensionMutator open_extension_mutator) { open_extension_mutator_ = std::move(open_extension_mutator); } private: OpenChannelToExtensionMutator open_extension_mutator_; const WorkerId worker_id_; }; // Waits for a kill of the given RenderProcessHost and returns the // BadMessageReason that caused an //extensions-triggerred kill. // // Example usage: // RenderProcessHostBadIpcMessageWaiter kill_waiter(render_process_host); // ... test code that triggers a renderer kill ... // EXPECT_EQ(bad_message::EFD_BAD_MESSAGE_PROCESS, kill_waiter.Wait()); class RenderProcessHostBadIpcMessageWaiter { public: explicit RenderProcessHostBadIpcMessageWaiter( content::RenderProcessHost* render_process_host) : internal_waiter_(render_process_host, "Stability.BadMessageTerminated.Extensions") {} // Waits until the renderer process exits. Returns the bad message that made // //extensions kill the renderer. `std::nullopt` is returned if the // renderer was killed outside of //extensions or exited normally. [[nodiscard]] std::optional Wait() { std::optional internal_result = internal_waiter_.Wait(); if (!internal_result.has_value()) return std::nullopt; return static_cast(internal_result.value()); } RenderProcessHostBadIpcMessageWaiter( const RenderProcessHostBadIpcMessageWaiter&) = delete; RenderProcessHostBadIpcMessageWaiter& operator=( const RenderProcessHostBadIpcMessageWaiter&) = delete; private: content::RenderProcessHostKillWaiter internal_waiter_; }; // Test suite covering how mojo/IPC messages are verified after being received // from a (potentially compromised) renderer process. class ExtensionSecurityExploitBrowserTest : public ExtensionBrowserTest { public: ExtensionSecurityExploitBrowserTest() = default; void SetUpOnMainThread() override { ExtensionBrowserTest::SetUpOnMainThread(); host_resolver()->AddRule("*", "127.0.0.1"); content::SetupCrossSiteRedirector(embedded_test_server()); embedded_test_server()->RegisterRequestHandler( base::BindRepeating(&HandleCspBlockRequest)); ASSERT_TRUE(embedded_test_server()->Start()); } // Asks the `extension_id` to inject `content_script` into `web_contents`. // Returns true if the content script execution started successfully. bool ExecuteProgrammaticContentScript(content::WebContents* web_contents, const ExtensionId& extension_id, const std::string& content_script) { DCHECK(web_contents); int tab_id = ExtensionTabUtil::GetTabId(web_contents); const char kScriptTemplate[] = R"( chrome.scripting.executeScript({ target: {tabId: %d}, injectImmediately: true, func: () => { %s } }); )"; std::string background_script = base::StringPrintf(kScriptTemplate, tab_id, content_script.c_str()); return BackgroundScriptExecutor::ExecuteScriptAsync(profile(), extension_id, background_script); } // (Asynchronously) executes the given `script` in a user script world in // `web_contents`, associated with the given `extension_id` void ExecuteUserScript(content::WebContents& web_contents, const ExtensionId& extension_id, const std::string& script) { browsertest_util::ExecuteUserScriptNoWait(&web_contents, extension_id, script); } // Allows messaging APIs for user scripts created by the given `extension`. void AllowUserScriptMessaging(const Extension& extension) { RendererStartupHelperFactory::GetForBrowserContext(profile()) ->SetUserScriptWorldProperties( extension, mojom::UserScriptWorldInfo::New( extension.id(), /*world_id=*/std::nullopt, /*csp=*/std::nullopt, /*enable_messaging=*/true)); } const Extension& active_extension() { return *active_extension_; } const ExtensionId& active_extension_id() { return active_extension_->id(); } const Extension& spoofed_extension() { return *spoofed_extension_; } const ExtensionId& spoofed_extension_id() { return spoofed_extension_->id(); } // Installs an `active_extension` and a separate, but otherwise identical // `spoofed_extension` (the only difference will be the extension id). void InstallTestExtensions() { auto install_extension = [this](TestExtensionDir& dir, const char* extra_manifest_bits) -> const Extension* { const char kManifestTemplate[] = R"( { %s "name": "ScriptInjectionTrackerBrowserTest - Programmatic", "version": "1.0", "manifest_version": 3, "host_permissions": ["http://foo.com/*"], "permissions": [ "scripting", "tabs", "nativeMessaging", "storage" ], "background": {"service_worker": "background_script.js"} } )"; dir.WriteManifest( base::StringPrintf(kManifestTemplate, extra_manifest_bits)); dir.WriteFile(FILE_PATH_LITERAL("background_script.js"), ""); dir.WriteFile(FILE_PATH_LITERAL("page.html"), "

page

"); return LoadExtension(dir.UnpackedPath()); }; // The key below corresponds to the extension ID used by // ScopedTestNativeMessagingHost::kExtensionId. const char kActiveExtensionKey[] = R"( "key": "MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDcBHwzDvyBQ6bDppkIs9MP4ksKqCMyXQ/A52JivHZKh4YO/9vJsT3oaYhSpDCE9RPocOEQvwsHsFReW2nUEc6OLLyoCFFxIb7KkLGsmfakkut/fFdNJYh0xOTbSN8YvLWcqph09XAY2Y/f0AL7vfO1cuCqtkMt8hFrBGWxDdf9CQIDAQAB", )"; active_extension_ = install_extension(active_dir_, kActiveExtensionKey); spoofed_extension_ = install_extension(spoofed_dir_, ""); ASSERT_TRUE(active_extension_); ASSERT_TRUE(spoofed_extension_); ASSERT_EQ(active_extension_id(), ScopedTestNativeMessagingHost::kExtensionId); ASSERT_NE(active_extension_id(), spoofed_extension_id()); } private: TestExtensionDir active_dir_; TestExtensionDir spoofed_dir_; raw_ptr active_extension_ = nullptr; raw_ptr spoofed_extension_ = nullptr; }; // Test suite for covering ExtensionHostMsg_OpenChannelToExtension IPC. class OpenChannelToExtensionExploitTest : public ExtensionSecurityExploitBrowserTest { public: OpenChannelToExtensionExploitTest() = default; void SetUpOnMainThread() override { ExtensionSecurityExploitBrowserTest::SetUpOnMainThread(); // Navigate to an arbitrary, mostly empty test page. Make sure that a new // RenderProcessHost is created to make sure it is covered by the // `ipc_message_waiter_`. (A WebUI -> http navigation should swap the // RenderProcessHost on all platforms.) GURL test_page_url = embedded_test_server()->GetURL("foo.com", "/title1.html"); auto* web_contents = GetActiveWebContents(); int old_process_id = web_contents->GetPrimaryMainFrame()->GetProcess()->GetDeprecatedID(); EXPECT_TRUE(NavigateToURL(web_contents, GURL("chrome://version"))); EXPECT_TRUE(NavigateToURL(web_contents, test_page_url)); int new_process_id = web_contents->GetPrimaryMainFrame()->GetProcess()->GetDeprecatedID(); EXPECT_NE(old_process_id, new_process_id); // Install the extensions (and potentially spawn new RenderProcessHosts) // only *after* the `ipc_message_waiter_` has been constructed. InstallTestExtensions(); } // Helper method to set up and load an extension with a manifest-sandboxed // page `sandbox.html` containing `sandbox_content`. const Extension* LoadSandboxedExtension(const std::string& sandbox_content) { sandboxed_dir_.WriteManifest(R"({ "name": "Sandboxed Spoofing Test", "version": "1.0", "manifest_version": 3, "sandbox": { "pages": ["sandbox.html"] } })"); sandboxed_dir_.WriteFile(FILE_PATH_LITERAL("sandbox.html"), sandbox_content); sandboxed_dir_.WriteFile(FILE_PATH_LITERAL("main.html"), "

main

"); const Extension* extension = LoadExtension(sandboxed_dir_.UnpackedPath()); EXPECT_TRUE(extension); return extension; } // Helper method to initiate an `OpenChannelToExtension` IPC from `frame` // using `source_url`. void OpenChannelToExtension(content::RenderFrameHost* frame, const Extension* extension, const GURL& source_url) { content::RenderProcessHost* process = frame->GetProcess(); ChannelEndpoint source(profile(), process->GetDeprecatedID(), PortContext::ForFrame(frame->GetRoutingID())); mojom::ExternalConnectionInfo info; info.target_id = extension->id(); info.source_endpoint = MessagingEndpoint::ForExtension(extension->id()); info.source_url = source_url; mojo::PendingAssociatedRemote port; mojo::PendingAssociatedReceiver port_host; std::ignore = port.InitWithNewEndpointAndPassReceiver(); std::ignore = port_host.InitWithNewEndpointAndPassRemote(); MessageService::Get(profile())->OpenChannelToExtension( source, PortId(base::UnguessableToken::Create(), 0, true, mojom::SerializationFormat::kJson), info, mojom::ChannelType::kSendMessage, "test_channel", std::move(port), std::move(port_host)); } private: TestExtensionDir sandboxed_dir_; }; IN_PROC_BROWSER_TEST_F(OpenChannelToExtensionExploitTest, FromContentScript_BadExtensionIdInMessagingSource) { // Trigger sending of a valid ExtensionHostMsg_OpenChannelToExtension IPC // from a content script of an `active_extension_id`. auto* web_contents = GetActiveWebContents(); ASSERT_TRUE(ExecuteProgrammaticContentScript( web_contents, active_extension_id(), "chrome.runtime.sendMessage({greeting: 'hello'}, (response) => {});")); content::RenderProcessHost* main_frame_process = web_contents->GetPrimaryMainFrame()->GetProcess(); RenderProcessHostBadIpcMessageWaiter kill_waiter(main_frame_process); auto interceptor = std::make_unique( web_contents->GetPrimaryMainFrame()); interceptor->SetOpenChannelToExtensionMutator( base::BindLambdaForTesting([this](mojom::ExternalConnectionInfo& info) { EXPECT_EQ(MessagingEndpoint::Type::kContentScript, info.source_endpoint.type); EXPECT_EQ(active_extension_id(), info.source_endpoint.extension_id); // Mutate the IPC payload. info.source_endpoint.extension_id = spoofed_extension_id(); })); EXPECT_EQ(bad_message::EMF_INVALID_EXTENSION_ID_FOR_CONTENT_SCRIPT, kill_waiter.Wait()); } IN_PROC_BROWSER_TEST_F(OpenChannelToExtensionExploitTest, FromContentScript_UnexpectedNativeAppType) { // Trigger sending of a valid ExtensionHostMsg_OpenChannelToExtension IPC // from a content script of an `active_extension_id`. auto* web_contents = GetActiveWebContents(); ASSERT_TRUE(ExecuteProgrammaticContentScript( web_contents, active_extension_id(), "chrome.runtime.sendMessage({greeting: 'hello'}, (response) => {});")); content::RenderProcessHost* main_frame_process = web_contents->GetPrimaryMainFrame()->GetProcess(); RenderProcessHostBadIpcMessageWaiter kill_waiter(main_frame_process); auto interceptor = std::make_unique( web_contents->GetPrimaryMainFrame()); interceptor->SetOpenChannelToExtensionMutator( base::BindLambdaForTesting([this](mojom::ExternalConnectionInfo& info) { EXPECT_EQ(MessagingEndpoint::Type::kContentScript, info.source_endpoint.type); EXPECT_EQ(active_extension_id(), info.source_endpoint.extension_id); // Mutate the IPC payload. info.source_endpoint.type = MessagingEndpoint::Type::kNativeApp; })); EXPECT_EQ(bad_message::EMF_INVALID_CHANNEL_SOURCE_TYPE, kill_waiter.Wait()); } IN_PROC_BROWSER_TEST_F(OpenChannelToExtensionExploitTest, FromContentScript_UnexpectedExtensionType) { // Trigger sending of a valid ExtensionHostMsg_OpenChannelToExtension IPC // from a content script of an `active_extension_id`. auto* web_contents = GetActiveWebContents(); ASSERT_TRUE(ExecuteProgrammaticContentScript( web_contents, active_extension_id(), "chrome.runtime.sendMessage({greeting: 'hello'}, (response) => {});")); content::RenderProcessHost* main_frame_process = web_contents->GetPrimaryMainFrame()->GetProcess(); RenderProcessHostBadIpcMessageWaiter kill_waiter(main_frame_process); auto interceptor = std::make_unique( web_contents->GetPrimaryMainFrame()); interceptor->SetOpenChannelToExtensionMutator( base::BindLambdaForTesting([this](mojom::ExternalConnectionInfo& info) { EXPECT_EQ(MessagingEndpoint::Type::kContentScript, info.source_endpoint.type); EXPECT_EQ(active_extension_id(), info.source_endpoint.extension_id); // Mutate the IPC payload. info.source_endpoint.type = MessagingEndpoint::Type::kExtension; })); EXPECT_EQ(bad_message::EMF_INVALID_EXTENSION_ID_FOR_EXTENSION_SOURCE, kill_waiter.Wait()); } IN_PROC_BROWSER_TEST_F(OpenChannelToExtensionExploitTest, FromContentScript_NoExtensionIdForExtensionType) { // Trigger sending of a valid ExtensionHostMsg_OpenChannelToExtension IPC // from a content script of an `active_extension_id`. auto* web_contents = GetActiveWebContents(); ASSERT_TRUE(ExecuteProgrammaticContentScript( web_contents, active_extension_id(), "chrome.runtime.sendMessage({greeting: 'hello'}, (response) => {});")); content::RenderProcessHost* main_frame_process = web_contents->GetPrimaryMainFrame()->GetProcess(); RenderProcessHostBadIpcMessageWaiter kill_waiter(main_frame_process); auto interceptor = std::make_unique( web_contents->GetPrimaryMainFrame()); interceptor->SetOpenChannelToExtensionMutator( base::BindLambdaForTesting([this](mojom::ExternalConnectionInfo& info) { EXPECT_EQ(MessagingEndpoint::Type::kContentScript, info.source_endpoint.type); EXPECT_EQ(active_extension_id(), info.source_endpoint.extension_id); // Mutate the IPC payload. info.source_endpoint.type = MessagingEndpoint::Type::kExtension; info.source_endpoint.extension_id = std::nullopt; })); EXPECT_EQ(bad_message::EMF_NO_EXTENSION_ID_FOR_EXTENSION_SOURCE, kill_waiter.Wait()); } IN_PROC_BROWSER_TEST_F(OpenChannelToExtensionExploitTest, FromContentScript_BadSourceUrl_FromFrame) { // Trigger sending of a valid ExtensionHostMsg_OpenChannelToExtension IPC // from a content script of an `active_extension_id`. auto* web_contents = GetActiveWebContents(); ASSERT_TRUE(ExecuteProgrammaticContentScript( web_contents, active_extension_id(), "chrome.runtime.sendMessage({greeting: 'hello'}, (response) => {});")); content::RenderProcessHost* main_frame_process = web_contents->GetPrimaryMainFrame()->GetProcess(); RenderProcessHostBadIpcMessageWaiter kill_waiter(main_frame_process); auto interceptor = std::make_unique( web_contents->GetPrimaryMainFrame()); interceptor->SetOpenChannelToExtensionMutator( base::BindLambdaForTesting([this](mojom::ExternalConnectionInfo& info) { EXPECT_EQ(MessagingEndpoint::Type::kContentScript, info.source_endpoint.type); EXPECT_EQ(active_extension_id(), info.source_endpoint.extension_id); // Mutate `source_url` in the IPC payload. GURL actual_url = GetActiveWebContents() ->GetPrimaryMainFrame() ->GetLastCommittedURL(); ASSERT_EQ(actual_url, info.source_url); GURL spoofed_url = embedded_test_server()->GetURL("spoofed.com", "/title1.html"); ASSERT_NE(spoofed_url.GetHost(), actual_url.GetHost()); info.source_url = spoofed_url; })); EXPECT_EQ(bad_message::EMF_INVALID_SOURCE_URL, kill_waiter.Wait()); } IN_PROC_BROWSER_TEST_F(OpenChannelToExtensionExploitTest, FromServiceWorker_BadSourceUrl) { // Navigate the test tab to an extension page. // TODO(crbug.com/40874764): Remove this test step - it is only here as // a workaround for the bug that impacts how renderer kills are detected when // there are no frames in a given renderer process. GURL test_page_url = active_extension().GetResourceURL("page.html"); EXPECT_TRUE(NavigateToURL(GetActiveWebContents(), test_page_url)); // Trigger sending of a valid ExtensionHostMsg_OpenChannelToExtension IPC // from the service worker of an `active_extension_id`. ASSERT_TRUE(BackgroundScriptExecutor::ExecuteScriptAsync( profile(), active_extension_id(), "chrome.runtime.sendMessage({greeting: 'hello'});")); std::vector service_workers = ProcessManager::Get(profile())->GetServiceWorkersForExtension( active_extension_id()); ASSERT_EQ(1u, service_workers.size()); content::RenderProcessHost* service_worker_process = content::RenderProcessHost::FromID(service_workers[0].render_process_id); ASSERT_TRUE(service_worker_process); RenderProcessHostBadIpcMessageWaiter kill_waiter(service_worker_process); auto interceptor = std::make_unique( service_workers[0]); interceptor->SetOpenChannelToExtensionMutator( base::BindLambdaForTesting([this](mojom::ExternalConnectionInfo& info) { EXPECT_EQ(MessagingEndpoint::Type::kExtension, info.source_endpoint.type); EXPECT_EQ(active_extension_id(), info.source_endpoint.extension_id); EXPECT_EQ(info.source_url.GetHost(), active_extension_id()); // Mutate `source_url` in the IPC payload. info.source_url = spoofed_extension().GetResourceURL("some_resource.html"); EXPECT_EQ(info.source_url.GetHost(), spoofed_extension_id()); })); EXPECT_EQ(bad_message::EMF_INVALID_SOURCE_URL, kill_waiter.Wait()); } // Tests a sandboxed page sending a spoofed source URL. // Regression test for https://crbug.com/511765713. IN_PROC_BROWSER_TEST_F(OpenChannelToExtensionExploitTest, FromSandboxedPage_SpoofedSourceUrl) { const Extension* extension = LoadSandboxedExtension("

sandbox

"); auto* web_contents = GetActiveWebContents(); ASSERT_TRUE( NavigateToURL(web_contents, extension->GetResourceURL("sandbox.html"))); content::RenderFrameHost* main_frame = web_contents->GetPrimaryMainFrame(); RenderProcessHostBadIpcMessageWaiter kill_waiter(main_frame->GetProcess()); OpenChannelToExtension(main_frame, extension, extension->GetResourceURL("main.html")); EXPECT_EQ(bad_message::EMF_INVALID_MESSAGE_FROM_SANDBOXED_PROCESS, kill_waiter.Wait()); } // Same as `FromSandboxedPage_SpoofedSourceUrl` above, but exercises the flow // from an about:blank child. IN_PROC_BROWSER_TEST_F(OpenChannelToExtensionExploitTest, FromSandboxedPage_AboutBlankChild_SpoofedSourceUrl) { const Extension* extension = LoadSandboxedExtension( "