Don't force non-session only cookies to be session only cookies, instead delete on shutdown

chrome/browser/net/sqlite_server_bound_cert_store_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/bind.h"
 #include "base/file_util.h"
 #include "base/memory/ref_counted.h"
 #include "base/memory/scoped_vector.h"
 #include "base/message_loop.h"
 #include "base/scoped_temp_dir.h"
 #include "base/stl_util.h"
 #include "base/test/thread_test_helper.h"
+#include "chrome/browser/net/clear_on_exit_policy.h"
 #include "chrome/browser/net/sqlite_server_bound_cert_store.h"
 #include "chrome/common/chrome_constants.h"
 #include "content/test/test_browser_thread.h"
 #include "net/base/cert_test_util.h"
 #include "sql/statement.h"
 #include "testing/gtest/include/gtest/gtest.h"
+#include "webkit/quota/mock_special_storage_policy.h"
 
 using content::BrowserThread;
 
 class SQLiteServerBoundCertStoreTest : public testing::Test {
  public:
   SQLiteServerBoundCertStoreTest()
       : db_thread_(BrowserThread::DB) {
   }
 
  protected:
@@ skipping 25 matching lines @@
     exploded_time.minute = 23;
     exploded_time.second = 45;
     exploded_time.millisecond = 0;
     return base::Time::FromUTCExploded(exploded_time);
   }
 
   virtual void SetUp() {
     db_thread_.Start();
     ASSERT_TRUE(temp_dir_.CreateUniqueTempDir());
     store_ = new SQLiteServerBoundCertStore(
-        temp_dir_.path().Append(chrome::kOBCertFilename));
+        temp_dir_.path().Append(chrome::kOBCertFilename), NULL);
     ScopedVector<net::DefaultServerBoundCertStore::ServerBoundCert> certs;
     ASSERT_TRUE(store_->Load(&certs.get()));
     ASSERT_EQ(0u, certs.size());
     // Make sure the store gets written at least once.
     store_->AddServerBoundCert(
         net::DefaultServerBoundCertStore::ServerBoundCert(
             "google.com",
             net::CLIENT_CERT_RSA_SIGN,
             base::Time::FromInternalValue(1),
             base::Time::FromInternalValue(2),
@@ skipping 50 matching lines @@
   // Replace the store effectively destroying the current one and forcing it
   // to write its data to disk. Then we can see if after loading it again it
   // is still there.
   store_ = NULL;
   scoped_refptr<base::ThreadTestHelper> helper(
       new base::ThreadTestHelper(
           BrowserThread::GetMessageLoopProxyForThread(BrowserThread::DB)));
   // Make sure we wait until the destructor has run.
   ASSERT_TRUE(helper->Run());
   store_ = new SQLiteServerBoundCertStore(
-      temp_dir_.path().Append(chrome::kOBCertFilename));
+      temp_dir_.path().Append(chrome::kOBCertFilename), NULL);
 
   // Reload and test for persistence
   ASSERT_TRUE(store_->Load(&certs.get()));
   ASSERT_EQ(2U, certs.size());
   net::DefaultServerBoundCertStore::ServerBoundCert* ec_cert;
   net::DefaultServerBoundCertStore::ServerBoundCert* rsa_cert;
   if (net::CLIENT_CERT_RSA_SIGN == certs[0]->type()) {
     rsa_cert = certs[0];
     ec_cert = certs[1];
   } else {
@@ skipping 14 matching lines @@
   ASSERT_EQ(4, ec_cert->expiration_time().ToInternalValue());
 
   // Now delete the cert and check persistence again.
   store_->DeleteServerBoundCert(*certs[0]);
   store_->DeleteServerBoundCert(*certs[1]);
   store_ = NULL;
   // Make sure we wait until the destructor has run.
   ASSERT_TRUE(helper->Run());
   certs.reset();
   store_ = new SQLiteServerBoundCertStore(
-      temp_dir_.path().Append(chrome::kOBCertFilename));
+      temp_dir_.path().Append(chrome::kOBCertFilename), NULL);
 
   // Reload and check if the cert has been removed.
   ASSERT_TRUE(store_->Load(&certs.get()));
   ASSERT_EQ(0U, certs.size());
 }
 
 TEST_F(SQLiteServerBoundCertStoreTest, TestUpgradeV1) {
   // Reset the store.  We'll be using a different database for this test.
   store_ = NULL;
 
@@ skipping 30 matching lines @@
         ));
   }
 
   // Load and test the DB contents twice.  First time ensures that we can use
   // the updated values immediately.  Second time ensures that the updated
   // values are stored and read correctly on next load.
   for (int i = 0; i < 2; ++i) {
     SCOPED_TRACE(i);
 
     ScopedVector<net::DefaultServerBoundCertStore::ServerBoundCert> certs;
-    store_ = new SQLiteServerBoundCertStore(v1_db_path);
+    store_ = new SQLiteServerBoundCertStore(v1_db_path, NULL);
 
     // Load the database and ensure the certs can be read and are marked as RSA.
     ASSERT_TRUE(store_->Load(&certs.get()));
     ASSERT_EQ(2U, certs.size());
 
     ASSERT_STREQ("google.com", certs[0]->server_identifier().c_str());
     ASSERT_EQ(net::CLIENT_CERT_RSA_SIGN, certs[0]->type());
     ASSERT_EQ(GetTestCertExpirationTime(),
               certs[0]->expiration_time());
     ASSERT_EQ(key_data, certs[0]->private_key());
@@ skipping 67 matching lines @@
         ));
   }
 
   // Load and test the DB contents twice.  First time ensures that we can use
   // the updated values immediately.  Second time ensures that the updated
   // values are saved and read correctly on next load.
   for (int i = 0; i < 2; ++i) {
     SCOPED_TRACE(i);
 
     ScopedVector<net::DefaultServerBoundCertStore::ServerBoundCert> certs;
-    store_ = new SQLiteServerBoundCertStore(v2_db_path);
+    store_ = new SQLiteServerBoundCertStore(v2_db_path, NULL);
 
     // Load the database and ensure the certs can be read and are marked as RSA.
     ASSERT_TRUE(store_->Load(&certs.get()));
     ASSERT_EQ(2U, certs.size());
 
     ASSERT_STREQ("google.com", certs[0]->server_identifier().c_str());
     ASSERT_EQ(net::CLIENT_CERT_RSA_SIGN, certs[0]->type());
     ASSERT_EQ(GetTestCertExpirationTime(),
               certs[0]->expiration_time());
     ASSERT_EQ(key_data, certs[0]->private_key());
@@ skipping 69 matching lines @@
         ));
   }
 
   // Load and test the DB contents twice.  First time ensures that we can use
   // the updated values immediately.  Second time ensures that the updated
   // values are saved and read correctly on next load.
   for (int i = 0; i < 2; ++i) {
     SCOPED_TRACE(i);
 
     ScopedVector<net::DefaultServerBoundCertStore::ServerBoundCert> certs;
-    store_ = new SQLiteServerBoundCertStore(v3_db_path);
+    store_ = new SQLiteServerBoundCertStore(v3_db_path, NULL);
 
     // Load the database and ensure the certs can be read and are marked as RSA.
     ASSERT_TRUE(store_->Load(&certs.get()));
     ASSERT_EQ(2U, certs.size());
 
     ASSERT_STREQ("google.com", certs[0]->server_identifier().c_str());
     ASSERT_EQ(net::CLIENT_CERT_RSA_SIGN, certs[0]->type());
     ASSERT_EQ(1000, certs[0]->expiration_time().ToInternalValue());
     ASSERT_EQ(GetTestCertCreationTime(),
               certs[0]->creation_time());
@@ skipping 93 matching lines @@
 
   store_->Flush(base::Bind(&CallbackCounter::Callback, counter.get()));
 
   scoped_refptr<base::ThreadTestHelper> helper(
       new base::ThreadTestHelper(
           BrowserThread::GetMessageLoopProxyForThread(BrowserThread::DB)));
   ASSERT_TRUE(helper->Run());
 
   ASSERT_EQ(1, counter->callback_count());
 }
+
+// Tests the interaction with the clear on exit policy.
+TEST_F(SQLiteServerBoundCertStoreTest, TestClearOnExitPolicy) {
+  store_->SetClearLocalStateOnExit(true);
+  // Replace the store effectively destroying the current one and forcing it
+  // to write its data to disk. Then we can see if after loading it again it
+  // is still there.
+  store_ = NULL;
+  // Make sure we wait until the destructor has run.
+  scoped_refptr<base::ThreadTestHelper> helper(
+      new base::ThreadTestHelper(
+          BrowserThread::GetMessageLoopProxyForThread(BrowserThread::DB)));
+  ASSERT_TRUE(helper->Run());
+
+  scoped_refptr<quota::MockSpecialStoragePolicy> storage_policy =
+      new quota::MockSpecialStoragePolicy;
+  scoped_refptr<ClearOnExitPolicy> clear_policy =
+      new ClearOnExitPolicy(storage_policy.get());
+  storage_policy->AddSessionOnly(GURL("https://google.com"));
+
+  store_ = new SQLiteServerBoundCertStore(
+      temp_dir_.path().Append(chrome::kOBCertFilename), clear_policy.get());
+  ScopedVector<net::DefaultServerBoundCertStore::ServerBoundCert> certs;
+  ASSERT_TRUE(store_->Load(&certs.get()));
+  ASSERT_EQ(0u, certs.size());
+  // Make sure the store gets written at least once.

[erikwright (departed), 2012/05/29 13:09:03]

It's not evident to me that this has ensured a write to the DB. A simple way to
show it would be to:

1) Create a store without a clear policy. Insert the cert, then destroy the
store (write to disk).
2) Create a store with the policy, load and verify count=1.
3) Load the store with or without the policy and verify count=0

Also, can you add one domain that is unaffected by the policy?

[jochen (gone - plz use gerrit), 2012/05/30 11:28:42]

Done.

+  store_->AddServerBoundCert(
+      net::DefaultServerBoundCertStore::ServerBoundCert(
+          "google.com",
+          net::CLIENT_CERT_RSA_SIGN,
+          base::Time::FromInternalValue(1),
+          base::Time::FromInternalValue(2),
+          "a", "b"));
+
+  store_ = NULL;
+
+  // Make sure we wait until the destructor has run.
+  ASSERT_TRUE(helper->Run());
+
+  store_ = new SQLiteServerBoundCertStore(
+      temp_dir_.path().Append(chrome::kOBCertFilename), clear_policy.get());
+
+  // Reload and test for persistence
+  ASSERT_TRUE(store_->Load(&certs.get()));
+  ASSERT_EQ(0U, certs.size());
+}