Fixes for Safe Browsing with unrelated pending navigations.

chrome/browser/safe_browsing/safe_browsing_blocking_page_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <list>
 
 #include "base/prefs/pref_service.h"
 #include "base/run_loop.h"
 #include "chrome/browser/profiles/profile.h"
 #include "chrome/browser/safe_browsing/safe_browsing_blocking_page.h"
 #include "chrome/browser/safe_browsing/safe_browsing_service.h"
 #include "chrome/browser/safe_browsing/threat_details.h"
 #include "chrome/browser/safe_browsing/ui_manager.h"
 #include "chrome/common/pref_names.h"
 #include "chrome/test/base/chrome_render_view_host_test_harness.h"
 #include "content/public/browser/interstitial_page.h"
 #include "content/public/browser/navigation_entry.h"
 #include "content/public/browser/render_process_host.h"
 #include "content/public/browser/web_contents.h"
 #include "content/public/test/web_contents_tester.h"
 
 using content::InterstitialPage;
 using content::NavigationEntry;
 using content::WebContents;
 using content::WebContentsTester;
 
 static const char* kGoogleURL = "http://www.google.com/";
 static const char* kGoodURL = "http://www.goodguys.com/";
+static const char* kGoodHTTPSURL = "https://www.goodguys.com/";
 static const char* kBadURL = "http://www.badguys.com/";
 static const char* kBadURL2 = "http://www.badguys2.com/";
 static const char* kBadURL3 = "http://www.badguys3.com/";
+static const char* kBadHTTPSURL = "https://www.badguys.com/";
 
 namespace safe_browsing {
 
 namespace {
 
 // A SafeBrowingBlockingPage class that does not create windows.
 class TestSafeBrowsingBlockingPage : public SafeBrowsingBlockingPage {
  public:
   TestSafeBrowsingBlockingPage(SafeBrowsingUIManager* manager,
-                                 WebContents* web_contents,
-                                 const UnsafeResourceList& unsafe_resources)
-      : SafeBrowsingBlockingPage(manager, web_contents, unsafe_resources) {
+                               WebContents* web_contents,
+                               const GURL& main_frame_url,
+                               const UnsafeResourceList& unsafe_resources)
+      : SafeBrowsingBlockingPage(manager,
+                                 web_contents,
+                                 main_frame_url,
+                                 unsafe_resources) {
     // Don't delay details at all for the unittest.
     malware_details_proceed_delay_ms_ = 0;
     DontCreateViewForTesting();
   }
 };
 
 class TestSafeBrowsingUIManager: public SafeBrowsingUIManager {
  public:
   explicit TestSafeBrowsingUIManager(SafeBrowsingService* service)
       : SafeBrowsingUIManager(service) {
@@ skipping 15 matching lines @@
 
 class TestSafeBrowsingBlockingPageFactory
     : public SafeBrowsingBlockingPageFactory {
  public:
   TestSafeBrowsingBlockingPageFactory() { }
   ~TestSafeBrowsingBlockingPageFactory() override {}
 
   SafeBrowsingBlockingPage* CreateSafeBrowsingPage(
       SafeBrowsingUIManager* manager,
       WebContents* web_contents,
+      const GURL& main_frame_url,
       const SafeBrowsingBlockingPage::UnsafeResourceList& unsafe_resources)
       override {
     return new TestSafeBrowsingBlockingPage(manager, web_contents,
-                                              unsafe_resources);
+                                            main_frame_url, unsafe_resources);
   }
 };
 
 }  // namespace
 
 class SafeBrowsingBlockingPageTest : public ChromeRenderViewHostTestHarness {
  public:
   // The decision the user made.
   enum UserResponse {
     PENDING,
@@ skipping 537 matching lines @@
       prefs::kSafeBrowsingExtendedReportingEnabled, false);
 
   // Start a load.
   controller().LoadURL(GURL(kBadURL), content::Referrer(),
                        ui::PAGE_TRANSITION_TYPED, std::string());
 
   // Simulate the load causing a safe browsing interstitial to be shown.
   ShowInterstitial(false, kBadURL);
   SafeBrowsingBlockingPage* sb_interstitial = GetSafeBrowsingBlockingPage();
   ASSERT_TRUE(sb_interstitial);
+  EXPECT_TRUE(sb_interstitial->CanShowThreatDetailsOption());
 
   base::RunLoop().RunUntilIdle();
 
   // Simulate the user clicking "don't proceed".
   DontProceedThroughInterstitial(sb_interstitial);
 
   // The interstitial should be gone.
   EXPECT_EQ(CANCEL, user_response());
   EXPECT_FALSE(GetSafeBrowsingBlockingPage());
 
@@ skipping 14 matching lines @@
       prefs::kSafeBrowsingExtendedReportingEnabled, false);
 
   // Start a load.
   controller().LoadURL(GURL(kBadURL), content::Referrer(),
                        ui::PAGE_TRANSITION_TYPED, std::string());
 
   // Simulate the load causing a safe browsing interstitial to be shown.
   ShowInterstitial(false, kBadURL);
   SafeBrowsingBlockingPage* sb_interstitial = GetSafeBrowsingBlockingPage();
   ASSERT_TRUE(sb_interstitial);
+  EXPECT_TRUE(sb_interstitial->CanShowThreatDetailsOption());
 
   base::RunLoop().RunUntilIdle();
 
   EXPECT_FALSE(profile->GetPrefs()->GetBoolean(
       prefs::kSafeBrowsingExtendedReportingEnabled));
 
   // Simulate the user check the report agreement checkbox.
   sb_interstitial->SetReportingPreference(true);
 
   EXPECT_TRUE(profile->GetPrefs()->GetBoolean(
       prefs::kSafeBrowsingExtendedReportingEnabled));
 
   // Simulate the user uncheck the report agreement checkbox.
   sb_interstitial->SetReportingPreference(false);
 
   EXPECT_FALSE(profile->GetPrefs()->GetBoolean(
       prefs::kSafeBrowsingExtendedReportingEnabled));
 }
 
+// Test that extended reporting option is not shown on blocking an HTTPS main
+// page, and no report is sent.
+TEST_F(SafeBrowsingBlockingPageTest, ExtendedReportingNotShownOnSecurePage) {
+  // Enable malware details.
+  Profile* profile = Profile::FromBrowserContext(
+      web_contents()->GetBrowserContext());
+  profile->GetPrefs()->SetBoolean(
+      prefs::kSafeBrowsingExtendedReportingEnabled, true);
+
+  // Start a load.
+  controller().LoadURL(GURL(kBadHTTPSURL), content::Referrer(),
+                       ui::PAGE_TRANSITION_TYPED, std::string());
+
+  // Simulate the load causing a safe browsing interstitial to be shown.
+  ShowInterstitial(false, kBadHTTPSURL);
+  SafeBrowsingBlockingPage* sb_interstitial = GetSafeBrowsingBlockingPage();
+  ASSERT_TRUE(sb_interstitial);
+  EXPECT_FALSE(sb_interstitial->CanShowThreatDetailsOption());
+
+  base::RunLoop().RunUntilIdle();
+
+  // Simulate the user clicking "don't proceed".
+  DontProceedThroughInterstitial(sb_interstitial);
+
+  // The interstitial should be gone.
+  EXPECT_EQ(CANCEL, user_response());
+  EXPECT_FALSE(GetSafeBrowsingBlockingPage());
+
+  // No report should have been sent.
+  EXPECT_EQ(0u, ui_manager_->GetDetails()->size());
+  ui_manager_->GetDetails()->clear();
+}
+
+// Test that extended reporting option is not shown on blocking an HTTPS
+// subresource on an HTTPS page, and no report is sent.
+TEST_F(SafeBrowsingBlockingPageTest,
+       ExtendedReportingNotShownOnSecurePageWithSecureSubresource) {
+  // Enable malware details.
+  Profile* profile = Profile::FromBrowserContext(
+      web_contents()->GetBrowserContext());
+  profile->GetPrefs()->SetBoolean(
+      prefs::kSafeBrowsingExtendedReportingEnabled, true);
+
+  // Commit a load.
+  content::WebContentsTester::For(web_contents())
+        ->NavigateAndCommit(GURL(kGoodHTTPSURL));
+
+  // Simulate a subresource load causing a safe browsing interstitial to be
+  // shown.
+  ShowInterstitial(true, kBadHTTPSURL);
+  SafeBrowsingBlockingPage* sb_interstitial = GetSafeBrowsingBlockingPage();
+  ASSERT_TRUE(sb_interstitial);
+  EXPECT_FALSE(sb_interstitial->CanShowThreatDetailsOption());
+
+  base::RunLoop().RunUntilIdle();
+
+  // Simulate the user clicking "don't proceed".
+  DontProceedThroughInterstitial(sb_interstitial);
+
+  // The interstitial should be gone.
+  EXPECT_EQ(CANCEL, user_response());
+  EXPECT_FALSE(GetSafeBrowsingBlockingPage());
+
+  // No report should have been sent.
+  EXPECT_EQ(0u, ui_manager_->GetDetails()->size());
+  ui_manager_->GetDetails()->clear();
+}
+
+// Test that extended reporting option is not shown on blocking an HTTP
+// subresource on an HTTPS page, and no report is sent.
+TEST_F(SafeBrowsingBlockingPageTest,
+       ExtendedReportingNotShownOnSecurePageWithInsecureSubresource) {
+  // Enable malware details.
+  Profile* profile = Profile::FromBrowserContext(
+      web_contents()->GetBrowserContext());
+  profile->GetPrefs()->SetBoolean(
+      prefs::kSafeBrowsingExtendedReportingEnabled, true);
+
+  // Commit a load.
+  content::WebContentsTester::For(web_contents())
+        ->NavigateAndCommit(GURL(kGoodHTTPSURL));
+
+  // Simulate a subresource load causing a safe browsing interstitial to be
+  // shown.
+  ShowInterstitial(true, kBadURL);
+  SafeBrowsingBlockingPage* sb_interstitial = GetSafeBrowsingBlockingPage();
+  ASSERT_TRUE(sb_interstitial);
+  EXPECT_FALSE(sb_interstitial->CanShowThreatDetailsOption());
+
+  base::RunLoop().RunUntilIdle();
+
+  // Simulate the user clicking "don't proceed".
+  DontProceedThroughInterstitial(sb_interstitial);
+
+  // The interstitial should be gone.
+  EXPECT_EQ(CANCEL, user_response());
+  EXPECT_FALSE(GetSafeBrowsingBlockingPage());
+
+  // No report should have been sent.
+  EXPECT_EQ(0u, ui_manager_->GetDetails()->size());
+  ui_manager_->GetDetails()->clear();
+}
+
+// Test that extended reporting option is shown on blocking an HTTPS
+// subresource on an HTTP page.
+TEST_F(SafeBrowsingBlockingPageTest,
+       ExtendedReportingOnInsecurePageWithSecureSubresource) {
+  // Enable malware details.
+  Profile* profile = Profile::FromBrowserContext(
+      web_contents()->GetBrowserContext());
+  profile->GetPrefs()->SetBoolean(
+      prefs::kSafeBrowsingExtendedReportingEnabled, true);
+
+  // Commit a load.
+  content::WebContentsTester::For(web_contents())
+        ->NavigateAndCommit(GURL(kGoodURL));
+
+  // Simulate a subresource load causing a safe browsing interstitial to be
+  // shown.
+  ShowInterstitial(true, kBadHTTPSURL);
+  SafeBrowsingBlockingPage* sb_interstitial = GetSafeBrowsingBlockingPage();
+  ASSERT_TRUE(sb_interstitial);
+  EXPECT_TRUE(sb_interstitial->CanShowThreatDetailsOption());
+
+  base::RunLoop().RunUntilIdle();
+
+  // Simulate the user clicking "don't proceed".
+  DontProceedThroughInterstitial(sb_interstitial);
+
+  // The interstitial should be gone.
+  EXPECT_EQ(CANCEL, user_response());
+  EXPECT_FALSE(GetSafeBrowsingBlockingPage());
+
+  // A report should have been sent.
+  EXPECT_EQ(1u, ui_manager_->GetDetails()->size());
+  ui_manager_->GetDetails()->clear();
+}
+
+// Test that extended reporting option is not shown on blocking an HTTPS
+// subresource on an HTTPS page while there is a pending load for an HTTP page,
+// and no report is sent.
+TEST_F(SafeBrowsingBlockingPageTest,
+       ExtendedReportingNotShownOnSecurePageWithPendingInsecureLoad) {
+  // Enable malware details.
+  Profile* profile = Profile::FromBrowserContext(
+      web_contents()->GetBrowserContext());
+  profile->GetPrefs()->SetBoolean(
+      prefs::kSafeBrowsingExtendedReportingEnabled, true);
+
+  // Commit a load.
+  content::WebContentsTester::For(web_contents())
+        ->NavigateAndCommit(GURL(kGoodHTTPSURL));
+
+  GURL pending_url("http://slow.example.com");
+
+  // Start a pending load.
+  content::WebContentsTester::For(web_contents())->StartNavigation(pending_url);
+
+  // Simulate a subresource load on the committed page causing a safe browsing
+  // interstitial to be shown.
+  ShowInterstitial(true, kBadHTTPSURL);
+  SafeBrowsingBlockingPage* sb_interstitial = GetSafeBrowsingBlockingPage();
+  ASSERT_TRUE(sb_interstitial);
+  // Threat details option should not be shown. (The blocking page is for the
+  // committed HTTPS page, not the pending HTTP page.)
+  EXPECT_FALSE(sb_interstitial->CanShowThreatDetailsOption());
+
+  base::RunLoop().RunUntilIdle();
+
+  // Simulate the user clicking "don't proceed".
+  DontProceedThroughInterstitial(sb_interstitial);
+
+  // The interstitial should be gone.
+  EXPECT_EQ(CANCEL, user_response());
+  EXPECT_FALSE(GetSafeBrowsingBlockingPage());
+
+  // No report should have been sent.
+  EXPECT_EQ(0u, ui_manager_->GetDetails()->size());
+  ui_manager_->GetDetails()->clear();
+}
+
+// TODO(mattm): Add test for extended reporting not shown or sent in incognito
+// window.
+
 }  // namespace safe_browsing