Process only the first Strict-Transport-Security header.

net/url_request/url_request_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "build/build_config.h"
 
 #if defined(OS_WIN)
 #include <windows.h>
 #include <shlobj.h>
 #endif
@@ skipping 3042 matching lines @@
   EXPECT_TRUE(headers->GetNormalizedHeader("content-type", &header));
   EXPECT_EQ("text/html; charset=ISO-8859-1", header);
 
   // The response has two "X-Multiple-Entries" headers.
   // This verfies our output has them concatenated together.
   header.clear();
   EXPECT_TRUE(headers->GetNormalizedHeader("x-multiple-entries", &header));
   EXPECT_EQ("a, b", header);
 }
 
+TEST_F(URLRequestTest, ProcessSTSOnce) {

[Ryan Sleevi, 2012/10/18 19:45:34]

nit: name this URLRequestTestHTTP

[palmer, 2012/10/18 21:01:58]

Done.

+  TestServer https_test_server(
+      TestServer::TYPE_HTTPS,
+      TestServer::kLocalhost,
+      FilePath(FILE_PATH_LITERAL("net/data/url_request_unittest")));
+  ASSERT_TRUE(https_test_server.Start());
+
+  TestDelegate d;
+  URLRequest request(
+      https_test_server.GetURL("files/hsts-headers.html"),
+      &d,
+      &default_context_);
+  request.Start();
+  MessageLoop::current()->Run();
+
+  // We should have set parameters from the first header, not the second.
+  TransportSecurityState* security_state =
+      default_context_.transport_security_state();
+  bool sni_available = true;
+  TransportSecurityState::DomainState domain_state;
+  EXPECT_TRUE(security_state->GetDomainState(
+      TestServer::kLocalhost, sni_available, &domain_state));
+  EXPECT_EQ(TransportSecurityState::DomainState::MODE_FORCE_HTTPS,
+            domain_state.upgrade_mode);
+  EXPECT_FALSE(domain_state.include_subdomains);

[Ryan Sleevi, 2012/10/18 19:45:34]

test nit: I would suggest adding a positive test that ensures a single STS
header, WITH include_subdomains, IS processed correctly.

Without the positive test, this test isn't fully covering the expected
behaviour, since it could be hidden by failing to handle include_subdomains
properly

[palmer, 2012/10/18 21:01:58]

Done.

+}
+
 TEST_F(URLRequestTestHTTP, ContentTypeNormalizationTest) {
   ASSERT_TRUE(test_server_.Start());
 
   TestDelegate d;
   URLRequest req(test_server_.GetURL(
       "files/content-type-normalization.html"), &d, &default_context_);
   req.Start();
   MessageLoop::current()->Run();
 
   std::string mime_type;
@@ skipping 1760 matching lines @@
 
     EXPECT_FALSE(r.is_pending());
     EXPECT_EQ(1, d->response_started_count());
     EXPECT_FALSE(d->received_data_before_response());
     EXPECT_EQ(d->bytes_received(), static_cast<int>(file_size));
   }
 }
 #endif  // !defined(DISABLE_FTP_SUPPORT)
 
 }  // namespace net