Unescape username/passwords obtained from URLs before using them for HTTP aut...

net/http/http_network_transaction_unittest.cc

 // Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <math.h>  // ceil
 
 #include "base/compiler_specific.h"
 #include "net/base/completion_callback.h"
 #include "net/base/mock_host_resolver.h"
 #include "net/base/ssl_info.h"
@@ skipping 2074 matching lines @@
 TEST_F(HttpNetworkTransactionTest, AuthIdentityInUrl) {
   SessionDependencies session_deps;
   scoped_ptr<HttpTransaction> trans(
       new HttpNetworkTransaction(
           CreateSession(&session_deps),
           &session_deps.socket_factory));
 
   HttpRequestInfo request;
   request.method = "GET";
   // Note: the URL has a username:password in it.
-  request.url = GURL("http://foo:bar@www.google.com/");
+  request.url = GURL("http://foo:b@r@www.google.com/");
+
+  // The password contains an escaped character -- for this test to pass it
+  // will need to be unescaped by HttpNetworkTransaction.
+  EXPECT_EQ("b%40r", request.url.password());
+
   request.load_flags = 0;
 
   MockWrite data_writes1[] = {
     MockWrite("GET / HTTP/1.1\r\n"
               "Host: www.google.com\r\n"
               "Connection: keep-alive\r\n\r\n"),
   };
 
   MockRead data_reads1[] = {
     MockRead("HTTP/1.0 401 Unauthorized\r\n"),
     MockRead("WWW-Authenticate: Basic realm=\"MyRealm1\"\r\n"),
     MockRead("Content-Length: 10\r\n\r\n"),
     MockRead(false, ERR_FAILED),
   };
 
   // After the challenge above, the transaction will be restarted using the
   // identity from the url (foo, bar) to answer the challenge.
   MockWrite data_writes2[] = {
     MockWrite("GET / HTTP/1.1\r\n"
               "Host: www.google.com\r\n"
               "Connection: keep-alive\r\n"
-              "Authorization: Basic Zm9vOmJhcg==\r\n\r\n"),
+              "Authorization: Basic Zm9vOmJAcg==\r\n\r\n"),
   };
 
   MockRead data_reads2[] = {
     MockRead("HTTP/1.0 200 OK\r\n"),
     MockRead("Content-Length: 100\r\n\r\n"),
     MockRead(false, OK),
   };
 
   StaticMockSocket data1(data_reads1, data_writes1);
   StaticMockSocket data2(data_reads2, data_writes2);
@@ skipping 1373 matching lines @@
   TestCompletionCallback callback;
   rv = trans->Start(NULL, &request, &callback);
   ASSERT_EQ(ERR_IO_PENDING, rv);
   rv = callback.WaitForResult();
 
   // If we bypassed the cache, we would have gotten a failure while resolving
   // "www.google.com".
   EXPECT_EQ(ERR_NAME_NOT_RESOLVED, rv);
 }
 
+TEST_F(HttpNetworkTransactionTest, GetIdentifyFromUrl) {
+  struct {
+    const char* input_url;
+    const wchar_t* expected_username;
+    const wchar_t* expected_password;
+  } tests[] = {
+    {
+      "http://username:password@google.com",
+      L"username",
+      L"password",
+    },
+    { // Test for http://crbug.com/19200
+      "http://username:p@ssword@google.com",
+      L"username",
+      L"p@ssword",
+    },
+    { // Username contains %20.
+      "http://use rname:password@google.com",
+      L"use rname",
+      L"password",
+    },
+    { // The URL canonicalizer for userinfo does not recognize non-ascii
+      // escapes it seems... So things like %00 will NOT be unescapable,
+      // since they are canonicalized by escaping the %...
+      "http://use%00rname:password@google.com",
+      L"use%2500rname",
+      L"password",
+    },
+    { // Use a '+' in the username.
+      "http://use+rname:password@google.com",
+      L"use+rname",
+      L"password",
+    },
+    { // Use a '&' in the password.
+      "http://username:p&ssword@google.com",
+      L"username",
+      L"p&ssword",
+    },
+  };
+  for (size_t i = 0; i < ARRAYSIZE_UNSAFE(tests); ++i) {
+    SCOPED_TRACE(StringPrintf("Test[%d]: %s", i, tests[i].input_url));
+    GURL url(tests[i].input_url);
+
+    std::wstring username, password;
+    HttpNetworkTransaction::GetIdentifyFromUrl(url, &username, &password);
+
+    EXPECT_EQ(tests[i].expected_username, username);
+    EXPECT_EQ(tests[i].expected_password, password);
+  }
+}
+
+// Try extracting a username which was encoded with UTF8.
+TEST_F(HttpNetworkTransactionTest, GetIdentifyFromUrl_UTF8) {
+  GURL url(WideToUTF16(L"http://foo:\x4f60\x597d@blah.com"));
+
+  EXPECT_EQ("foo", url.username());
+  EXPECT_EQ("%E4%BD%A0%E5%A5%BD", url.password());
+
+  // Extract the unescaped identity.
+  std::wstring username, password;
+  HttpNetworkTransaction::GetIdentifyFromUrl(url, &username, &password);
+
+  // Verify that it was decoded as UTF8.
+  EXPECT_EQ(L"foo", username);
+  EXPECT_EQ(L"\x4f60\x597d", password);
+}
+
 }  // namespace net