[Proximity auth] Disallow '+' and '/' in incoming base64-encoded strings.

components/proximity_auth/cryptauth/base64url_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/proximity_auth/cryptauth/base64url.h"
 
 #include "base/base64.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace proximity_auth {
@@ skipping 46 matching lines @@
   std::string decoded;
   ASSERT_TRUE(Base64UrlDecode(encoded, &decoded));
 
   // Decoded strings that encode to special characters are non-printable, so,
   // for ease of testing, just compare the web-safe and non-web-safe encodings.
   std::string non_web_safe_encoded;
   base::Base64Encode(decoded, &non_web_safe_encoded);
   EXPECT_EQ("/+Y=", non_web_safe_encoded);
 }
 
+TEST(ProximityAuthBase64UrlTest, DecodeBailsOnPlus) {
+  // Note that "_-Y=" is a valid encoded string, as tested above. This test
+  // simply verifies that an otherwise correctly encoded string cannot use '+'
+  // in place of '-', since the proximity auth code expects websafe encodings.
+  const std::string encoded = "_+Y=";
+  std::string decoded;
+  EXPECT_FALSE(Base64UrlDecode(encoded, &decoded));
+}
+
+TEST(ProximityAuthBase64UrlTest, DecodeBailsOnSlash) {
+  // Note that "_-Y=" is a valid encoded string, as tested above. This test
+  // simply verifies that an otherwise correctly encoded string cannot use '/'
+  // in place of '_', since the proximity auth code expects websafe encodings.
+  const std::string encoded = "/-Y=";
+  std::string decoded;
+  EXPECT_FALSE(Base64UrlDecode(encoded, &decoded));
+}
+
 }  // namespace proximity_auth