[SafeBrowsing] Block dangerous unchecked downloads based on a Finch trial.

ppapi/tests/test_file_chooser.cc

Index: ppapi/tests/test_file_chooser.cc
diff --git a/ppapi/tests/test_file_chooser.cc b/ppapi/tests/test_file_chooser.cc
new file mode 100644
index 0000000000000000000000000000000000000000..93a1f3f4f8cbb35103c6d44074da758e7f1fe4f7
--- /dev/null
+++ b/ppapi/tests/test_file_chooser.cc
@@ -0,0 +1,173 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "ppapi/tests/test_file_chooser.h"
+
+#include "ppapi/c/pp_errors.h"
+#include "ppapi/c/ppb_file_io.h"
+#include "ppapi/cpp/dev/file_chooser_dev.h"
+#include "ppapi/cpp/file_io.h"
+#include "ppapi/cpp/trusted/file_chooser_trusted.h"
+#include "ppapi/cpp/var.h"
+
+REGISTER_TEST_CASE(FileChooser);
+
+bool TestFileChooser::Init() {
+  return true;

[bbudge, 2015/10/21 21:16:04]

The other PPB_File* tests Init like this:

bool TestFileRef::Init() {
  return CheckTestingInterface() && EnsureRunningOverHTTP();
}

[asanka, 2015/10/22 21:55:12]

Done.

+}
+
+bool TestFileChooser::WriteDefaultContentsToFile(const pp::FileRef& file_ref) {

[bbudge, 2015/10/21 21:16:04]

nit: Move this below RunTests method to match header.

[asanka, 2015/10/22 21:55:12]

Done.

+  const char kContents[] = "Hello from PPAPI";
+
+  TestCompletionCallback fileio_callback(instance_->pp_instance(),
+                                         callback_type());
+  pp::FileIO fileio(instance());
+
+  fileio_callback.WaitForResult(
+      fileio.Open(file_ref, PP_FILEOPENFLAG_WRITE | PP_FILEOPENFLAG_CREATE,
+                  fileio_callback.GetCallback()));
+  if (fileio_callback.result() != PP_OK)
+    return false;
+
+  fileio_callback.WaitForResult(fileio.Write(
+      0, kContents, sizeof(kContents) - 1, fileio_callback.GetCallback()));
+  return fileio_callback.result() == sizeof(kContents) - 1;
+}
+
+void TestFileChooser::RunTests(const std::string& filter) {
+  RUN_TEST(OpenSimple, filter);
+  RUN_TEST(OpenCancel, filter);
+  RUN_TEST(SaveAsSafeDefaultName, filter);
+  RUN_TEST(SaveAsUnsafeDefaultName, filter);
+  RUN_TEST(SaveAsDangerousExecutableAllowed, filter);
+  RUN_TEST(SaveAsDangerousExecutableDisallowed, filter);
+}
+
+// Tests that the plugin can invoke a simple file chooser and that the returned
+// file can be read from. Note that this test doesn't test that the accepted
+// file type list is honored.
+std::string TestFileChooser::TestOpenSimple() {
+  pp::FileChooser_Dev file_chooser(instance(), PP_FILECHOOSERMODE_OPEN,
+                                   "text/plain,.html");
+  ASSERT_FALSE(file_chooser.is_null());
+
+  TestCompletionCallbackWithOutput<std::vector<pp::FileRef>>
+      filechooser_callback(instance_->pp_instance(), callback_type());
+  filechooser_callback.WaitForResult(
+      file_chooser.Show(filechooser_callback.GetCallback()));
+
+  const std::vector<pp::FileRef>& output_ref = filechooser_callback.output();
+  ASSERT_EQ(1u, output_ref.size());
+
+  TestCompletionCallback fileio_callback(instance_->pp_instance(),
+                                         callback_type());
+  pp::FileIO fileio(instance());
+  fileio_callback.WaitForResult(fileio.Open(
+      output_ref.front(), PP_FILEOPENFLAG_READ, fileio_callback.GetCallback()));
+  ASSERT_EQ(PP_OK, fileio_callback.result());
+  PASS();
+}
+
+// Tests the behavior when the user cancels the file chooser. Browser-side logic
+// for simulating the cancellation can be found at ppapi_browsertest.cc
+std::string TestFileChooser::TestOpenCancel() {
+  pp::FileChooser_Dev file_chooser(instance(), PP_FILECHOOSERMODE_OPEN,
+                                   "text/plain,.html");
+  ASSERT_FALSE(file_chooser.is_null());
+
+  TestCompletionCallbackWithOutput<std::vector<pp::FileRef>>
+      filechooser_callback(instance_->pp_instance(), callback_type());
+  filechooser_callback.WaitForResult(
+      file_chooser.Show(filechooser_callback.GetCallback()));
+
+  const std::vector<pp::FileRef>& output_ref = filechooser_callback.output();
+  ASSERT_EQ(0u, output_ref.size());
+  PASS();
+}
+
+// Tests that the plugin can invoke a "Save as" dialog using the
+// FileChooser_Trusted API and that the returned FileRef can be written to.
+std::string TestFileChooser::TestSaveAsSafeDefaultName() {
+  pp::FileChooser_Trusted file_chooser(instance(), PP_FILECHOOSERMODE_OPEN,
+                                       "text/plain,.html", true /* save_as */,
+                                       "innocuous.txt");
+  ASSERT_FALSE(file_chooser.is_null());
+
+  TestCompletionCallbackWithOutput<std::vector<pp::FileRef>>
+      filechooser_callback(instance_->pp_instance(), callback_type());
+  filechooser_callback.WaitForResult(
+      file_chooser.Show(filechooser_callback.GetCallback()));
+
+  const std::vector<pp::FileRef>& output_ref = filechooser_callback.output();
+  ASSERT_EQ(1u, output_ref.size());
+
+  ASSERT_TRUE(WriteDefaultContentsToFile(output_ref.front()));
+  PASS();
+}
+
+// Similar to the previous test, but tests that an unsafe filename passed as the
+// suggested name is sanitized.
+std::string TestFileChooser::TestSaveAsUnsafeDefaultName() {
+  pp::FileChooser_Trusted file_chooser(instance(), PP_FILECHOOSERMODE_OPEN,
+                                       "text/plain,.html", true /* save_as */,
+                                       "unsafe.txt ");
+  ASSERT_FALSE(file_chooser.is_null());
+
+  TestCompletionCallbackWithOutput<std::vector<pp::FileRef>>
+      filechooser_callback(instance_->pp_instance(), callback_type());
+  filechooser_callback.WaitForResult(
+      file_chooser.Show(filechooser_callback.GetCallback()));
+
+  const std::vector<pp::FileRef>& output_ref = filechooser_callback.output();
+  ASSERT_EQ(1u, output_ref.size());
+  ASSERT_EQ("unsafe.txt-", output_ref.front().GetName().AsString());
+
+  ASSERT_TRUE(WriteDefaultContentsToFile(output_ref.front()));
+  PASS();
+}
+
+// Checks that a dangerous file is allowed to be downloaded via the
+// FileChooser_Trusted API. Chrome should delegate the decision of which files
+// are allowed over to SafeBrowsing (if enabled), and the current SafeBrowsing
+// configuration should allow downloading of dangerous files for this test to
+// work.
+std::string TestFileChooser::TestSaveAsDangerousExecutableAllowed() {
+  pp::FileChooser_Trusted file_chooser(instance(), PP_FILECHOOSERMODE_OPEN,
+                                       ".exe", true /* save_as */,
+                                       "dangerous.exe");
+  ASSERT_FALSE(file_chooser.is_null());
+
+  TestCompletionCallbackWithOutput<std::vector<pp::FileRef>>
+      filechooser_callback(instance_->pp_instance(), callback_type());
+  filechooser_callback.WaitForResult(
+      file_chooser.Show(filechooser_callback.GetCallback()));
+
+  const std::vector<pp::FileRef>& output_ref = filechooser_callback.output();
+  ASSERT_EQ(1u, output_ref.size());
+  ASSERT_EQ("dangerous.exe", output_ref.front().GetName().AsString());
+
+  ASSERT_TRUE(WriteDefaultContentsToFile(output_ref.front()));
+  PASS();
+}
+
+// Checks that a dangerous file is not allowed to be downloaded via the
+// FileChooser_Trusted API. Chrome should delegate the decision of which files
+// are allowed over to SafeBrowsing (if enabled), and the current SafeBrowsing
+// configuration should disallow downloading of dangerous files for this test to
+// work.
+std::string TestFileChooser::TestSaveAsDangerousExecutableDisallowed() {
+  pp::FileChooser_Trusted file_chooser(instance(), PP_FILECHOOSERMODE_OPEN,
+                                       ".exe", true /* save_as */,
+                                       "dangerous.exe");
+  ASSERT_FALSE(file_chooser.is_null());
+
+  TestCompletionCallbackWithOutput<std::vector<pp::FileRef>>
+      filechooser_callback(instance_->pp_instance(), callback_type());
+  filechooser_callback.WaitForResult(
+      file_chooser.Show(filechooser_callback.GetCallback()));
+
+  const std::vector<pp::FileRef>& output_ref = filechooser_callback.output();
+  ASSERT_EQ(0u, output_ref.size());
+  PASS();
+}