test_referrer.js (9215B)
1 "use strict"; 2 3 const ReferrerInfo = Components.Constructor( 4 "@mozilla.org/referrer-info;1", 5 "nsIReferrerInfo", 6 "init" 7 ); 8 9 function getTestReferrer(server_uri, referer_uri, isPrivate = false) { 10 var uri = NetUtil.newURI(server_uri); 11 let referrer = NetUtil.newURI(referer_uri); 12 let principal = Services.scriptSecurityManager.createContentPrincipal( 13 referrer, 14 { privateBrowsingId: isPrivate ? 1 : 0 } 15 ); 16 var chan = NetUtil.newChannel({ 17 uri, 18 loadingPrincipal: principal, 19 contentPolicyType: Ci.nsIContentPolicy.TYPE_OTHER, 20 securityFlags: Ci.nsILoadInfo.SEC_ALLOW_CROSS_ORIGIN_SEC_CONTEXT_IS_NULL, 21 }); 22 23 chan.QueryInterface(Ci.nsIHttpChannel); 24 chan.referrerInfo = new ReferrerInfo( 25 Ci.nsIReferrerInfo.EMPTY, 26 true, 27 referrer 28 ); 29 var header = null; 30 try { 31 header = chan.getRequestHeader("Referer"); 32 } catch (NS_ERROR_NOT_AVAILABLE) {} 33 return header; 34 } 35 36 function run_test() { 37 var prefs = Services.prefs; 38 39 var server_uri = "http://bar.examplesite.com/path2"; 40 var server_uri_2 = "http://bar.example.com/anotherpath"; 41 var referer_uri = "http://foo.example.com/path"; 42 var referer_uri_2 = "http://bar.examplesite.com/path3?q=blah"; 43 var referer_uri_2_anchor = "http://bar.examplesite.com/path3?q=blah#anchor"; 44 var referer_uri_idn = "http://sub1.\xe4lt.example/path"; 45 46 // for https tests 47 var server_uri_https = "https://bar.example.com/anotherpath"; 48 var referer_uri_https = "https://bar.example.com/path3?q=blah"; 49 var referer_uri_2_https = "https://bar.examplesite.com/path3?q=blah"; 50 51 // tests for sendRefererHeader 52 prefs.setIntPref("network.http.sendRefererHeader", 0); 53 Assert.equal(null, getTestReferrer(server_uri, referer_uri)); 54 prefs.setIntPref("network.http.sendRefererHeader", 2); 55 Assert.equal( 56 getTestReferrer(server_uri, referer_uri), 57 "http://foo.example.com/" 58 ); 59 60 // test that https ref is not sent to http 61 Assert.equal(null, getTestReferrer(server_uri_2, referer_uri_https)); 62 63 // tests for referer.defaultPolicy 64 prefs.setIntPref("network.http.referer.defaultPolicy", 0); 65 Assert.equal(null, getTestReferrer(server_uri, referer_uri)); 66 prefs.setIntPref("network.http.referer.defaultPolicy", 1); 67 Assert.equal(null, getTestReferrer(server_uri, referer_uri)); 68 Assert.equal(getTestReferrer(server_uri, referer_uri_2), referer_uri_2); 69 prefs.setIntPref("network.http.referer.defaultPolicy", 2); 70 Assert.equal(null, getTestReferrer(server_uri, referer_uri_https)); 71 Assert.equal( 72 getTestReferrer(server_uri_https, referer_uri_https), 73 referer_uri_https 74 ); 75 Assert.equal( 76 getTestReferrer(server_uri_https, referer_uri_2_https), 77 "https://bar.examplesite.com/" 78 ); 79 Assert.equal(getTestReferrer(server_uri, referer_uri_2), referer_uri_2); 80 Assert.equal( 81 getTestReferrer(server_uri, referer_uri), 82 "http://foo.example.com/" 83 ); 84 prefs.setIntPref("network.http.referer.defaultPolicy", 3); 85 Assert.equal(getTestReferrer(server_uri, referer_uri), referer_uri); 86 Assert.equal(null, getTestReferrer(server_uri_2, referer_uri_https)); 87 88 // tests for referer.defaultPolicy.pbmode 89 prefs.setIntPref("network.http.referer.defaultPolicy.pbmode", 0); 90 Assert.equal(null, getTestReferrer(server_uri, referer_uri, true)); 91 prefs.setIntPref("network.http.referer.defaultPolicy.pbmode", 1); 92 Assert.equal(null, getTestReferrer(server_uri, referer_uri, true)); 93 Assert.equal(getTestReferrer(server_uri, referer_uri_2, true), referer_uri_2); 94 prefs.setIntPref("network.http.referer.defaultPolicy.pbmode", 2); 95 Assert.equal(null, getTestReferrer(server_uri, referer_uri_https, true)); 96 Assert.equal( 97 getTestReferrer(server_uri_https, referer_uri_https, true), 98 referer_uri_https 99 ); 100 Assert.equal( 101 getTestReferrer(server_uri_https, referer_uri_2_https, true), 102 "https://bar.examplesite.com/" 103 ); 104 Assert.equal(getTestReferrer(server_uri, referer_uri_2, true), referer_uri_2); 105 Assert.equal( 106 getTestReferrer(server_uri, referer_uri, true), 107 "http://foo.example.com/" 108 ); 109 prefs.setIntPref("network.http.referer.defaultPolicy.pbmode", 3); 110 Assert.equal(getTestReferrer(server_uri, referer_uri, true), referer_uri); 111 Assert.equal(null, getTestReferrer(server_uri_2, referer_uri_https, true)); 112 113 // tests for referer.spoofSource 114 prefs.setBoolPref("network.http.referer.spoofSource", true); 115 Assert.equal(getTestReferrer(server_uri, referer_uri), server_uri); 116 prefs.setBoolPref("network.http.referer.spoofSource", false); 117 Assert.equal(getTestReferrer(server_uri, referer_uri), referer_uri); 118 119 // tests for referer.XOriginPolicy 120 prefs.setIntPref("network.http.referer.XOriginPolicy", 2); 121 Assert.equal(null, getTestReferrer(server_uri_2, referer_uri)); 122 Assert.equal(getTestReferrer(server_uri, referer_uri_2), referer_uri_2); 123 prefs.setIntPref("network.http.referer.XOriginPolicy", 1); 124 Assert.equal(getTestReferrer(server_uri_2, referer_uri), referer_uri); 125 Assert.equal(null, getTestReferrer(server_uri, referer_uri)); 126 // https test 127 Assert.equal( 128 getTestReferrer(server_uri_https, referer_uri_https), 129 referer_uri_https 130 ); 131 prefs.setIntPref("network.http.referer.XOriginPolicy", 0); 132 Assert.equal(getTestReferrer(server_uri, referer_uri), referer_uri); 133 134 // tests for referer.trimmingPolicy 135 prefs.setIntPref("network.http.referer.trimmingPolicy", 1); 136 Assert.equal( 137 getTestReferrer(server_uri, referer_uri_2), 138 "http://bar.examplesite.com/path3" 139 ); 140 Assert.equal( 141 getTestReferrer(server_uri, referer_uri_idn), 142 "http://sub1.xn--lt-uia.example/path" 143 ); 144 prefs.setIntPref("network.http.referer.trimmingPolicy", 2); 145 Assert.equal( 146 getTestReferrer(server_uri, referer_uri_2), 147 "http://bar.examplesite.com/" 148 ); 149 Assert.equal( 150 getTestReferrer(server_uri, referer_uri_idn), 151 "http://sub1.xn--lt-uia.example/" 152 ); 153 // https test 154 Assert.equal( 155 getTestReferrer(server_uri_https, referer_uri_https), 156 "https://bar.example.com/" 157 ); 158 prefs.setIntPref("network.http.referer.trimmingPolicy", 0); 159 // test that anchor is lopped off in ordinary case 160 Assert.equal( 161 getTestReferrer(server_uri, referer_uri_2_anchor), 162 referer_uri_2 163 ); 164 165 // tests for referer.XOriginTrimmingPolicy 166 prefs.setIntPref("network.http.referer.XOriginTrimmingPolicy", 1); 167 Assert.equal( 168 getTestReferrer(server_uri, referer_uri), 169 "http://foo.example.com/path" 170 ); 171 Assert.equal( 172 getTestReferrer(server_uri, referer_uri_idn), 173 "http://sub1.xn--lt-uia.example/path" 174 ); 175 Assert.equal( 176 getTestReferrer(server_uri, referer_uri_2), 177 "http://bar.examplesite.com/path3?q=blah" 178 ); 179 prefs.setIntPref("network.http.referer.trimmingPolicy", 1); 180 Assert.equal( 181 getTestReferrer(server_uri, referer_uri_2), 182 "http://bar.examplesite.com/path3" 183 ); 184 prefs.setIntPref("network.http.referer.XOriginTrimmingPolicy", 2); 185 Assert.equal( 186 getTestReferrer(server_uri, referer_uri), 187 "http://foo.example.com/" 188 ); 189 Assert.equal( 190 getTestReferrer(server_uri, referer_uri_idn), 191 "http://sub1.xn--lt-uia.example/" 192 ); 193 Assert.equal( 194 getTestReferrer(server_uri, referer_uri_2), 195 "http://bar.examplesite.com/path3" 196 ); 197 prefs.setIntPref("network.http.referer.trimmingPolicy", 0); 198 Assert.equal( 199 getTestReferrer(server_uri, referer_uri_2), 200 "http://bar.examplesite.com/path3?q=blah" 201 ); 202 // https tests 203 Assert.equal( 204 getTestReferrer(server_uri_https, referer_uri_https), 205 "https://bar.example.com/path3?q=blah" 206 ); 207 Assert.equal( 208 getTestReferrer(server_uri_https, referer_uri_2_https), 209 "https://bar.examplesite.com/" 210 ); 211 prefs.setIntPref("network.http.referer.XOriginTrimmingPolicy", 0); 212 // test that anchor is lopped off in ordinary case 213 Assert.equal( 214 getTestReferrer(server_uri, referer_uri_2_anchor), 215 referer_uri_2 216 ); 217 218 // test referrer length limitation 219 // referer_uri's length is 27 and origin's length is 23 220 prefs.setIntPref("network.http.referer.referrerLengthLimit", 27); 221 Assert.equal(getTestReferrer(server_uri, referer_uri), referer_uri); 222 prefs.setIntPref("network.http.referer.referrerLengthLimit", 26); 223 Assert.equal( 224 getTestReferrer(server_uri, referer_uri), 225 "http://foo.example.com/" 226 ); 227 prefs.setIntPref("network.http.referer.referrerLengthLimit", 22); 228 Assert.equal(getTestReferrer(server_uri, referer_uri), null); 229 prefs.setIntPref("network.http.referer.referrerLengthLimit", 0); 230 Assert.equal(getTestReferrer(server_uri, referer_uri), referer_uri); 231 prefs.setIntPref("network.http.referer.referrerLengthLimit", 4096); 232 Assert.equal(getTestReferrer(server_uri, referer_uri), referer_uri); 233 234 // combination test: send spoofed path-only when hosts match 235 var combo_referer_uri = "http://blah.foo.com/path?q=hot"; 236 var dest_uri = "http://blah.foo.com:9999/spoofedpath?q=bad"; 237 prefs.setIntPref("network.http.referer.trimmingPolicy", 1); 238 prefs.setBoolPref("network.http.referer.spoofSource", true); 239 prefs.setIntPref("network.http.referer.XOriginPolicy", 2); 240 Assert.equal( 241 getTestReferrer(dest_uri, combo_referer_uri), 242 "http://blah.foo.com:9999/spoofedpath" 243 ); 244 Assert.equal( 245 null, 246 getTestReferrer(dest_uri, "http://gah.foo.com/anotherpath") 247 ); 248 }