Mac Sandbox: Clean up forward declaration of internal sandbox functions.

chrome/common/sandbox_mac_diraccess_unittest.mm

 // Copyright (c) 2009 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #import <Cocoa/Cocoa.h>
 #include <dirent.h>
 
 extern "C" {
 #include <sandbox.h>
 }
 
 #include "base/file_util.h"
 #include "base/file_path.h"
-#include "base/hash_tables.h"
 #include "base/test/multiprocess_test.h"
 #include "base/sys_string_conversions.h"
 #include "base/utf_string_conversions.h"
 #include "chrome/common/sandbox_mac.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "testing/multiprocess_func_list.h"
 
-// Tests to exercise directory-access-related restrictions of Mac sandbox.
-
-namespace sandbox {
-
-typedef base::hash_map<std::string, SandboxSubstring>
-    SandboxVariableSubstitions;
-
-bool QuotePlainString(const std::string& str_utf8, std::string* dst);
-bool QuoteStringForRegex(const std::string& str_utf8, std::string* dst);
-NSString* BuildAllowDirectoryAccessSandboxString(
-    const FilePath& allowed_dir,
-    SandboxVariableSubstitions* substitutions);
-bool PostProcessSandboxProfile(NSString* in_sandbox_data,
-                               NSArray* comments_to_remove,
-                               SandboxVariableSubstitions& substitutions,
-                               std::string *final_sandbox_profile_str);
-
-}  // namespace sandbox
-
 namespace {
 
 static const char* kSandboxAccessPathKey = "sandbox_dir";
 static const char* kDeniedSuffix = "_denied";
 
+}  // namespace
+
+// Tests need to be in the same namespace as the sandbox::Sandbox class to be
+// useable with FRIEND_TEST() declaration.
+namespace sandbox {
+
 class MacDirAccessSandboxTest : public base::MultiProcessTest {
  public:
   bool CheckSandbox(const std::string& directory_to_try) {
     setenv(kSandboxAccessPathKey, directory_to_try.c_str(), 1);
     base::ProcessHandle child_process = SpawnChild("mac_sandbox_path_access",
                                                    false);
     int code = -1;
     if (!base::WaitForExitCode(child_process, &code)) {
       LOG(WARNING) << "base::WaitForExitCode failed";
       return false;
     }
     return code == 0;
   }
 };
 
 TEST_F(MacDirAccessSandboxTest, StringEscape) {
-  using sandbox::QuotePlainString;
-
   const struct string_escape_test_data {
   const char* to_escape;
   const char* escaped;
   } string_escape_cases[] = {
     {"", ""},
     {"\b\f\n\r\t\\\"", "\\b\\f\\n\\r\\t\\\\\\\""},
     {"/'", "/'"},
     {"sandwich", "sandwich"},
     {"(sandwich)", "(sandwich)"},
     {"^\u2135.\u2136$", "^\\u2135.\\u2136$"},
   };
 
   for (size_t i = 0; i < ARRAYSIZE_UNSAFE(string_escape_cases); ++i) {
     std::string out;
     std::string in(string_escape_cases[i].to_escape);
-    EXPECT_TRUE(QuotePlainString(in, &out));
+    EXPECT_TRUE(Sandbox::QuotePlainString(in, &out));
     EXPECT_EQ(string_escape_cases[i].escaped, out);
   }
 }
 
 TEST_F(MacDirAccessSandboxTest, RegexEscape) {
-  using sandbox::QuoteStringForRegex;
-
   const std::string kSandboxEscapeSuffix("(/|$)");
   const struct regex_test_data {
     const wchar_t *to_escape;
     const char* escaped;
   } regex_cases[] = {
     {L"", ""},
     {L"/'", "/'"},  // / & ' characters don't need escaping.
     {L"sandwich", "sandwich"},
     {L"(sandwich)", "\\(sandwich\\)"},
   };
 
   // Check that all characters whose values are smaller than 32 [1F] are
   // rejected by the regex escaping code.
   {
     std::string out;
     char fail_string[] = {31, 0};
     char ok_string[] = {32, 0};
-    EXPECT_FALSE(QuoteStringForRegex(fail_string, &out));
-    EXPECT_TRUE(QuoteStringForRegex(ok_string, &out));
+    EXPECT_FALSE(Sandbox::QuoteStringForRegex(fail_string, &out));
+    EXPECT_TRUE(Sandbox::QuoteStringForRegex(ok_string, &out));
   }
 
   // Check that all characters whose values are larger than 126 [7E] are
   // rejected by the regex escaping code.
   {
     std::string out;
-    EXPECT_TRUE(QuoteStringForRegex("}", &out));   // } == 0x7D == 125
-    EXPECT_FALSE(QuoteStringForRegex("~", &out));  // ~ == 0x7E == 126
-    EXPECT_FALSE(QuoteStringForRegex(WideToUTF8(L"^\u2135.\u2136$"), &out));
+    EXPECT_TRUE(Sandbox::QuoteStringForRegex("}", &out));   // } == 0x7D == 125
+    EXPECT_FALSE(Sandbox::QuoteStringForRegex("~", &out));  // ~ == 0x7E == 126
+    EXPECT_FALSE(
+        Sandbox::QuoteStringForRegex(WideToUTF8(L"^\u2135.\u2136$"), &out));
   }
 
   {
     for (size_t i = 0; i < ARRAYSIZE_UNSAFE(regex_cases); ++i) {
       std::string out;
       std::string in = WideToUTF8(regex_cases[i].to_escape);
-      EXPECT_TRUE(QuoteStringForRegex(in, &out));
+      EXPECT_TRUE(Sandbox::QuoteStringForRegex(in, &out));
       std::string expected("^");
       expected.append(regex_cases[i].escaped);
       expected.append(kSandboxEscapeSuffix);
       EXPECT_EQ(expected, out);
     }
   }
 
   {
     std::string in_utf8("\\^.$|()[]*+?{}");
     std::string expected;
     expected.push_back('^');
     for (size_t i = 0; i < in_utf8.length(); ++i) {
       expected.push_back('\\');
       expected.push_back(in_utf8[i]);
     }
     expected.append(kSandboxEscapeSuffix);
 
     std::string out;
-    EXPECT_TRUE(QuoteStringForRegex(in_utf8, &out));
+    EXPECT_TRUE(Sandbox::QuoteStringForRegex(in_utf8, &out));
     EXPECT_EQ(expected, out);
 
   }
 }
 
 // A class to handle auto-deleting a directory.
 class ScopedDirectoryDelete {
  public:
   inline void operator()(FilePath* x) const {
     if (x) {
       file_util::Delete(*x, true);
     }
   }
 };
 
 typedef scoped_ptr_malloc<FilePath, ScopedDirectoryDelete> ScopedDirectory;
 
 TEST_F(MacDirAccessSandboxTest, SandboxAccess) {
   using file_util::CreateDirectory;
 
   FilePath tmp_dir;
   ASSERT_TRUE(file_util::CreateNewTempDirectory("", &tmp_dir));
   // This step is important on OS X since the sandbox only understands "real"
   // paths and the paths CreateNewTempDirectory() returns are empirically in
   // /var which is a symlink to /private/var .
-  sandbox::GetCanonicalSandboxPath(&tmp_dir);
+  Sandbox::GetCanonicalSandboxPath(&tmp_dir);
   ScopedDirectory cleanup(&tmp_dir);
 
   const char* sandbox_dir_cases[] = {
     "simple_dir_name",
     "^hello++ $",       // Regex.
     "\\^.$|()[]*+?{}",  // All regex characters.
   };
 
   for (size_t i = 0; i < ARRAYSIZE_UNSAFE(sandbox_dir_cases); ++i) {
     const char* sandbox_dir_name = sandbox_dir_cases[i];
@@ skipping 21 matching lines @@
 
   // Build up a sandbox profile that only allows access to a single directory.
   NSString *sandbox_profile =
       @"(version 1)" \
       "(deny default)" \
       "(allow signal (target self))" \
       "(allow sysctl-read)" \
       ";ENABLE_DIRECTORY_ACCESS";
 
   std::string allowed_dir(sandbox_allowed_dir);
-  sandbox::SandboxVariableSubstitions substitutions;
+  Sandbox::SandboxVariableSubstitions substitutions;
   NSString* allow_dir_sandbox_code =
-      sandbox::BuildAllowDirectoryAccessSandboxString(
+      Sandbox::BuildAllowDirectoryAccessSandboxString(
           FilePath(sandbox_allowed_dir),
           &substitutions);
   sandbox_profile = [sandbox_profile
       stringByReplacingOccurrencesOfString:@";ENABLE_DIRECTORY_ACCESS"
                                 withString:allow_dir_sandbox_code];
 
   std::string final_sandbox_profile_str;
-  if (!PostProcessSandboxProfile(sandbox_profile,
-                                 [NSArray array],
-                                 substitutions,
-                                 &final_sandbox_profile_str)) {
+  if (!Sandbox::PostProcessSandboxProfile(sandbox_profile,
+                                          [NSArray array],
+                                          substitutions,
+                                          &final_sandbox_profile_str)) {
     LOG(ERROR) << "Call to PostProcessSandboxProfile() failed";
     return -1;
   }
 
-
   // Enable Sandbox.
   char* error_buff = NULL;
   int error = sandbox_init(final_sandbox_profile_str.c_str(), 0, &error_buff);
   if (error == -1) {
     LOG(ERROR) << "Failed to Initialize Sandbox: " << error_buff;
     return -1;
   }
   sandbox_free_error(error_buff);
 
   // Test Sandbox.
@@ skipping 75 matching lines @@
   if (open(denied_file2.value().c_str(), O_WRONLY | O_CREAT) > 0) {
     PLOG(ERROR) << "Sandbox breach: was able to write ("
                 << denied_file2.value()
                 << ")";
     return -1;
   }
 
   return 0;
 }
 
-}  // namespace
+}  // namespace sandbox