1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
|
/* Any copyright is dedicated to the Public Domain.
* http://creativecommons.org/publicdomain/zero/1.0/ */
/*
* Tests the persistence of the "disable protection" option for Mixed Content
* Blocker in child tabs (bug 906190).
*/
requestLongerTimeout(2);
// We use the different urls for testing same origin checks before allowing
// mixed content on child tabs.
const gHttpTestRoot1 = "https://test1.example.com/browser/browser/base/content/test/general/";
const gHttpTestRoot2 = "https://test2.example.com/browser/browser/base/content/test/general/";
/**
* For all tests, we load the pages over HTTPS and test both:
* - |CTRL+CLICK|
* - |RIGHT CLICK -> OPEN LINK IN TAB|
*/
function* doTest(parentTabSpec, childTabSpec, testTaskFn, waitForMetaRefresh) {
yield BrowserTestUtils.withNewTab({
gBrowser,
url: parentTabSpec,
}, function* (browser) {
// As a sanity check, test that active content has been blocked as expected.
yield assertMixedContentBlockingState(gBrowser, {
activeLoaded: false, activeBlocked: true, passiveLoaded: false,
});
// Disable the Mixed Content Blocker for the page, which reloads it.
let promiseReloaded = BrowserTestUtils.browserLoaded(browser);
gIdentityHandler.disableMixedContentProtection();
yield promiseReloaded;
// Wait for the script in the page to update the contents of the test div.
let testDiv = content.document.getElementById('mctestdiv');
yield promiseWaitForCondition(
() => testDiv.innerHTML == "Mixed Content Blocker disabled");
// Add the link for the child tab to the page.
let mainDiv = content.document.createElement("div");
mainDiv.innerHTML =
'<p><a id="linkToOpenInNewTab" href="' + childTabSpec + '">Link</a></p>';
content.document.body.appendChild(mainDiv);
// Execute the test in the child tabs with the two methods to open it.
for (let openFn of [simulateCtrlClick, simulateContextMenuOpenInTab]) {
let promiseTabLoaded = waitForSomeTabToLoad();
openFn(browser);
yield promiseTabLoaded;
gBrowser.selectTabAtIndex(2);
if (waitForMetaRefresh) {
yield waitForSomeTabToLoad();
}
yield testTaskFn();
gBrowser.removeCurrentTab();
}
});
}
function simulateCtrlClick(browser) {
BrowserTestUtils.synthesizeMouseAtCenter("#linkToOpenInNewTab",
{ ctrlKey: true, metaKey: true },
browser);
}
function simulateContextMenuOpenInTab(browser) {
BrowserTestUtils.waitForEvent(document, "popupshown", false, event => {
// These are operations that must be executed synchronously with the event.
document.getElementById("context-openlinkintab").doCommand();
event.target.hidePopup();
return true;
});
BrowserTestUtils.synthesizeMouseAtCenter("#linkToOpenInNewTab",
{ type: "contextmenu", button: 2 },
browser);
}
// Waits for a load event somewhere in the browser but ignore events coming
// from <xul:browser>s without a tab assigned. That are most likely browsers
// that preload the new tab page.
function waitForSomeTabToLoad() {
return new Promise(resolve => {
gBrowser.addEventListener("load", function onLoad(event) {
let tab = gBrowser._getTabForContentWindow(event.target.defaultView.top);
if (tab) {
gBrowser.removeEventListener("load", onLoad, true);
resolve();
}
}, true);
});
}
/**
* Ensure the Mixed Content Blocker is enabled.
*/
add_task(function* test_initialize() {
yield new Promise(resolve => SpecialPowers.pushPrefEnv({
"set": [["security.mixed_content.block_active_content", true]],
}, resolve));
});
/**
* 1. - Load a html page which has mixed content
* - Doorhanger to disable protection appears - we disable it
* - Load a subpage from the same origin in a new tab simulating a click
* - Doorhanger should >> NOT << appear anymore!
*/
add_task(function* test_same_origin() {
yield doTest(gHttpTestRoot1 + "file_bug906190_1.html",
gHttpTestRoot1 + "file_bug906190_2.html", function* () {
// The doorhanger should appear but activeBlocked should be >> NOT << true,
// because our decision of disabling the mixed content blocker is persistent
// across tabs.
yield assertMixedContentBlockingState(gBrowser, {
activeLoaded: true, activeBlocked: false, passiveLoaded: false,
});
is(content.document.getElementById('mctestdiv').innerHTML,
"Mixed Content Blocker disabled", "OK: Executed mixed script");
});
});
/**
* 2. - Load a html page which has mixed content
* - Doorhanger to disable protection appears - we disable it
* - Load a new page from a different origin in a new tab simulating a click
* - Doorhanger >> SHOULD << appear again!
*/
add_task(function* test_different_origin() {
yield doTest(gHttpTestRoot1 + "file_bug906190_2.html",
gHttpTestRoot2 + "file_bug906190_2.html", function* () {
// The doorhanger should appear and activeBlocked should be >> TRUE <<,
// because our decision of disabling the mixed content blocker should only
// persist if pages are from the same domain.
yield assertMixedContentBlockingState(gBrowser, {
activeLoaded: false, activeBlocked: true, passiveLoaded: false,
});
is(content.document.getElementById('mctestdiv').innerHTML,
"Mixed Content Blocker enabled", "OK: Blocked mixed script");
});
});
/**
* 3. - Load a html page which has mixed content
* - Doorhanger to disable protection appears - we disable it
* - Load a new page from the same origin in a new tab simulating a click
* - Redirect to another page from the same origin using meta-refresh
* - Doorhanger should >> NOT << appear again!
*/
add_task(function* test_same_origin_metarefresh_same_origin() {
// file_bug906190_3_4.html redirects to page test1.example.com/* using meta-refresh
yield doTest(gHttpTestRoot1 + "file_bug906190_1.html",
gHttpTestRoot1 + "file_bug906190_3_4.html", function* () {
// The doorhanger should appear but activeBlocked should be >> NOT << true!
yield assertMixedContentBlockingState(gBrowser, {
activeLoaded: true, activeBlocked: false, passiveLoaded: false,
});
is(content.document.getElementById('mctestdiv').innerHTML,
"Mixed Content Blocker disabled", "OK: Executed mixed script");
}, true);
});
/**
* 4. - Load a html page which has mixed content
* - Doorhanger to disable protection appears - we disable it
* - Load a new page from the same origin in a new tab simulating a click
* - Redirect to another page from a different origin using meta-refresh
* - Doorhanger >> SHOULD << appear again!
*/
add_task(function* test_same_origin_metarefresh_different_origin() {
yield doTest(gHttpTestRoot2 + "file_bug906190_1.html",
gHttpTestRoot2 + "file_bug906190_3_4.html", function* () {
// The doorhanger should appear and activeBlocked should be >> TRUE <<.
yield assertMixedContentBlockingState(gBrowser, {
activeLoaded: false, activeBlocked: true, passiveLoaded: false,
});
is(content.document.getElementById('mctestdiv').innerHTML,
"Mixed Content Blocker enabled", "OK: Blocked mixed script");
}, true);
});
/**
* 5. - Load a html page which has mixed content
* - Doorhanger to disable protection appears - we disable it
* - Load a new page from the same origin in a new tab simulating a click
* - Redirect to another page from the same origin using 302 redirect
*/
add_task(function* test_same_origin_302redirect_same_origin() {
// the sjs files returns a 302 redirect- note, same origins
yield doTest(gHttpTestRoot1 + "file_bug906190_1.html",
gHttpTestRoot1 + "file_bug906190.sjs", function* () {
// The doorhanger should appear but activeBlocked should be >> NOT << true.
// Currently it is >> TRUE << - see follow up bug 914860
ok(!gIdentityHandler._identityBox.classList.contains("mixedActiveBlocked"),
"OK: Mixed Content is NOT being blocked");
is(content.document.getElementById('mctestdiv').innerHTML,
"Mixed Content Blocker disabled", "OK: Executed mixed script");
});
});
/**
* 6. - Load a html page which has mixed content
* - Doorhanger to disable protection appears - we disable it
* - Load a new page from the same origin in a new tab simulating a click
* - Redirect to another page from a different origin using 302 redirect
*/
add_task(function* test_same_origin_302redirect_different_origin() {
// the sjs files returns a 302 redirect - note, different origins
yield doTest(gHttpTestRoot2 + "file_bug906190_1.html",
gHttpTestRoot2 + "file_bug906190.sjs", function* () {
// The doorhanger should appear and activeBlocked should be >> TRUE <<.
yield assertMixedContentBlockingState(gBrowser, {
activeLoaded: false, activeBlocked: true, passiveLoaded: false,
});
is(content.document.getElementById('mctestdiv').innerHTML,
"Mixed Content Blocker enabled", "OK: Blocked mixed script");
});
});
/**
* 7. - Test memory leak issue on redirection error. See Bug 1269426.
*/
add_task(function* test_bad_redirection() {
// the sjs files returns a 302 redirect - note, different origins
yield doTest(gHttpTestRoot2 + "file_bug906190_1.html",
gHttpTestRoot2 + "file_bug906190.sjs?bad-redirection=1", function* () {
// Nothing to do. Just see if memory leak is reported in the end.
ok(true, "Nothing to do");
});
});
|
