Implementation of ONC signature, validator and normalizer.

chrome/browser/chromeos/cros/onc_network_parser.cc

Index: chrome/browser/chromeos/cros/onc_network_parser.cc
diff --git a/chrome/browser/chromeos/cros/onc_network_parser.cc b/chrome/browser/chromeos/cros/onc_network_parser.cc
index 213b71623b52058fc5ff077db952e8ee0ea3e329..4d3af08f58edcdc9a51ad59f4feb43d22dda8f3b 100644
--- a/chrome/browser/chromeos/cros/onc_network_parser.cc
+++ b/chrome/browser/chromeos/cros/onc_network_parser.cc
@@ -19,6 +19,8 @@
 #include "chrome/browser/chromeos/cros/native_network_parser.h"
 #include "chrome/browser/chromeos/cros/network_library.h"
 #include "chrome/browser/chromeos/cros/onc_constants.h"
+#include "chrome/browser/chromeos/network_settings/onc_signature.h"
+#include "chrome/browser/chromeos/network_settings/onc_validator.h"
 #include "chrome/browser/chromeos/proxy_config_service_impl.h"
 #include "chrome/browser/prefs/proxy_config_dictionary.h"
 #include "chrome/common/net/x509_certificate_model.h"
@@ -304,6 +306,28 @@ OncNetworkParser::OncNetworkParser(const std::string& onc_blob,
     if (!root_dict_.get())
       return;
 
+    // Validate the ONC dictionary. We are liberal and ignore unknown field
+    // names and ignore invalid field names in kRecommended arrays.
+    bool is_managed = onc_source == NetworkUIData::ONC_SOURCE_USER_POLICY ||
+        onc_source == NetworkUIData::ONC_SOURCE_DEVICE_POLICY;
+    bool error_on_unknown_field = false;
+    bool error_on_invalid_entry_in_recommended = false;
+    bool error_on_missing_field = true;
+    scoped_ptr<onc::Validator> validator(
+        new onc::Validator(error_on_unknown_field,

[Mattias Nissler (ping if slow), 2012/11/06 09:30:56]

nit: we commonly just write

false, /* error on unknown field */

[pneubeck (no reviews), 2012/11/06 13:32:22]

Done.

+                           error_on_invalid_entry_in_recommended,
+                           error_on_missing_field, is_managed));
+
+    // Unknown fields are removed from the result.
+    root_dict_ = validator->ValidateAndRepairObject(
+        &onc::kUnencryptedConfigurationSignature,
+        *root_dict_);
+
+    if (!root_dict_.get()) {
+      LOG(WARNING) << "Provided ONC is invalid and couldn't be repaired";
+      return;
+    }
+
     // At least one of NetworkConfigurations or Certificates is required.
     bool has_network_configurations =
         root_dict_->GetList("NetworkConfigurations", &network_configs_);