Commit f64a3fd8 authored by Lukasz Anforowicz's avatar Lukasz Anforowicz Committed by Commit Bot

Enable extra test assertions in the CorsFromContentScript test case.

The CorbAllowlistAlsoAppliesToOorCors feature allows to enable extra
test assertions in the CrossOriginReadBlockingExtensionAllowlistingTest,
CorsFromContentScript testcase.

Bug: 1061567
Change-Id: Ia9e7c77d48086c68b7c641ff988f21f25da52370
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/2116935Reviewed-by: default avatarKaran Bhatia <karandeepb@chromium.org>
Commit-Queue: Łukasz Anforowicz <lukasza@chromium.org>
Cr-Commit-Position: refs/heads/master@{#753766}
parent b94c1511
...@@ -1725,7 +1725,7 @@ IN_PROC_BROWSER_TEST_P(CorbAndCorsExtensionBrowserTest, CorsFromContentScript) { ...@@ -1725,7 +1725,7 @@ IN_PROC_BROWSER_TEST_P(CorbAndCorsExtensionBrowserTest, CorsFromContentScript) {
// Verify the request headers (e.g. Origin and Sec-Fetch-Site headers). // Verify the request headers (e.g. Origin and Sec-Fetch-Site headers).
cors_request.WaitForRequest(); cors_request.WaitForRequest();
if (IsExtensionAllowlisted()) { if (IsExtensionAllowlisted() || !ShouldAllowlistAlsoApplyToOorCors()) {
// Content scripts of allowlisted extensions should be exempted from CORS, // Content scripts of allowlisted extensions should be exempted from CORS,
// based on the websites the extension has permission for, via extension // based on the websites the extension has permission for, via extension
// manifest. Therefore, there should be no "Origin" header. // manifest. Therefore, there should be no "Origin" header.
...@@ -1733,9 +1733,6 @@ IN_PROC_BROWSER_TEST_P(CorbAndCorsExtensionBrowserTest, CorsFromContentScript) { ...@@ -1733,9 +1733,6 @@ IN_PROC_BROWSER_TEST_P(CorbAndCorsExtensionBrowserTest, CorsFromContentScript) {
cors_request.http_request()->headers, cors_request.http_request()->headers,
testing::Not(testing::Contains(testing::Pair("Origin", testing::_)))); testing::Not(testing::Contains(testing::Pair("Origin", testing::_))));
} else { } else {
#if 0
// TODO(lukasza): https://crbug.com/920638:
//
// Content scripts of non-allowlisted extensions should participate in // Content scripts of non-allowlisted extensions should participate in
// regular CORS, just as if the request was issued from the webpage that the // regular CORS, just as if the request was issued from the webpage that the
// content script got injected into. Therefore we should expect the Origin // content script got injected into. Therefore we should expect the Origin
...@@ -1743,7 +1740,6 @@ IN_PROC_BROWSER_TEST_P(CorbAndCorsExtensionBrowserTest, CorsFromContentScript) { ...@@ -1743,7 +1740,6 @@ IN_PROC_BROWSER_TEST_P(CorbAndCorsExtensionBrowserTest, CorsFromContentScript) {
EXPECT_THAT( EXPECT_THAT(
cors_request.http_request()->headers, cors_request.http_request()->headers,
testing::Contains(testing::Pair("Origin", page_origin_string.c_str()))); testing::Contains(testing::Pair("Origin", page_origin_string.c_str())));
#endif
} }
// Respond with Access-Control-Allow-Origin that matches the origin of the web // Respond with Access-Control-Allow-Origin that matches the origin of the web
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment