[Proximity auth] Disallow '+' and '/' in incoming base64-encoded strings.

components/proximity_auth/cryptauth/base64url_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/proximity_auth/cryptauth/base64url.h"
 
 #include "base/base64.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace proximity_auth {
@@ skipping 46 matching lines @@
   std::string decoded;
   ASSERT_TRUE(Base64UrlDecode(encoded, &decoded));
 
   // Decoded strings that encode to special characters are non-printable, so,
   // for ease of testing, just compare the web-safe and non-web-safe encodings.
   std::string non_web_safe_encoded;
   base::Base64Encode(decoded, &non_web_safe_encoded);
   EXPECT_EQ("/+Y=", non_web_safe_encoded);
 }
 
+TEST(ProximityAuthBase64UrlTest, DecodeBailsOnPlus) {
+  const std::string encoded = "_+Y=";
+  std::string decoded;
+  EXPECT_FALSE(Base64UrlDecode(encoded, &decoded));
+}
+
+TEST(ProximityAuthBase64UrlTest, DecodeBailsOnSlash) {
+  const std::string encoded = "/-Y=";

[Ryan Sleevi, 2015/06/09 22:39:48]

Just to confirm: Are these valid b64strings otherwise? That is, is "/+Y=" valid?

It may help to add a comment to these tests to indicate what the encoded value
is, just so it's clear to not just stuff "any" value in here but it needs to be
one that would be easily confused if doing a 'dumb' search/replace

[Ilya Sherman, 2015/06/09 23:08:40]

Done.  "/+Y=" is the string that's tested above; but I've now added explicit
comments to make this even clearer.

+  std::string decoded;
+  EXPECT_FALSE(Base64UrlDecode(encoded, &decoded));
+}
+
 }  // namespace proximity_auth