// Copyright 2026 The Chromium Authors // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #include "chrome/browser/extensions/extension_apitest.h" #include "content/public/browser/web_contents.h" #include "content/public/test/browser_test.h" #include "extensions/common/manifest.h" #include "extensions/test/result_catcher.h" #include "extensions/test/test_extension_dir.h" #include "net/dns/mock_host_resolver.h" namespace extensions { // Exercises CSP properties in "user-script" type extensions. class UserScriptCspBrowserTest : public ExtensionApiTest { public: void SetUpOnMainThread() override { ExtensionApiTest::SetUpOnMainThread(); host_resolver()->AddRule("*", "127.0.0.1"); ASSERT_TRUE(StartEmbeddedTestServer()); } }; // Tests that the background service worker has its eval blocked by CSP. IN_PROC_BROWSER_TEST_F(UserScriptCspBrowserTest, ServiceWorkerEvalBlocked) { TestExtensionDir dir; dir.WriteManifest(R"({ "name": "User Script CSP SW Test", "manifest_version": 3, "version": "1.0", "converted_from_user_script": true, "background": { "service_worker": "sw.js" } })"); dir.WriteFile(FILE_PATH_LITERAL("sw.js"), R"( try { eval('self.foo = 3;'); chrome.test.fail('Unexpected val success'); } catch(e) { if (e.message.includes('Content Security Policy')) { chrome.test.succeed(); } else { chrome.test.fail(`Unexpected eval failure: ${e.message}`); } } )"); ResultCatcher result_catcher; const Extension* extension = LoadExtension(dir.UnpackedPath()); ASSERT_TRUE(extension); ASSERT_EQ(Manifest::Type::kUserScript, extension->GetType()); ASSERT_TRUE(result_catcher.GetNextResult()) << result_catcher.message(); } // Tests that an extension page has its eval blocked by CSP. IN_PROC_BROWSER_TEST_F(UserScriptCspBrowserTest, ExtensionPageEvalBlocked) { TestExtensionDir dir; dir.WriteManifest(R"({ "name": "User Script CSP Page Test", "manifest_version": 3, "version": "1.0", "converted_from_user_script": true })"); dir.WriteFile(FILE_PATH_LITERAL("page.html"), R"( Page )"); dir.WriteFile(FILE_PATH_LITERAL("page.js"), R"( window.onload = function() { try { eval('window.foo = 3;'); chrome.test.fail('Unexpected eval success'); } catch(e) { if (e.message.includes('Content Security Policy')) { chrome.test.succeed(); } else { chrome.test.fail(`Unexpected eval failure: ${e.message}`); } } }; )"); const Extension* extension = LoadExtension(dir.UnpackedPath()); ASSERT_TRUE(extension); ASSERT_EQ(Manifest::Type::kUserScript, extension->GetType()); ResultCatcher result_catcher; content::WebContents* web_contents = GetActiveWebContents(); GURL page_url = extension->GetResourceURL("page.html"); ASSERT_TRUE(NavigateToURL(web_contents, page_url)); ASSERT_TRUE(result_catcher.GetNextResult()) << result_catcher.message(); } // Tests that a content script has its eval blocked by isolated world CSP. IN_PROC_BROWSER_TEST_F(UserScriptCspBrowserTest, ContentScriptEvalBlocked) { TestExtensionDir dir; dir.WriteManifest(R"({ "name": "User Script CSP CS Test", "manifest_version": 3, "version": "1.0", "converted_from_user_script": true, "content_scripts": [{ "matches": ["*://*/*"], "js": ["content_script.js"] }] })"); dir.WriteFile(FILE_PATH_LITERAL("content_script.js"), R"( try { eval('window.foo = 3;'); chrome.test.fail('Unexpected eval success'); } catch(e) { if (e.message.includes('Content Security Policy')) { chrome.test.succeed(); } else { chrome.test.fail(`Unexpected eval failure: ${e.message}`); } } )"); const Extension* extension = LoadExtension(dir.UnpackedPath()); ASSERT_TRUE(extension); ASSERT_EQ(Manifest::Type::kUserScript, extension->GetType()); GURL test_url = embedded_test_server()->GetURL("example.com", "/empty.html"); content::WebContents* web_contents = GetActiveWebContents(); ResultCatcher result_catcher; ASSERT_TRUE(NavigateToURL(web_contents, test_url)); ASSERT_TRUE(result_catcher.GetNextResult()) << result_catcher.message(); } } // namespace extensions