SameSite: Implement 'Strict'/'Lax' attribute parsing.

net/cookies/parsed_cookie_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <string>
 
 #include "net/cookies/cookie_constants.h"
 #include "net/cookies/parsed_cookie.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
@@ skipping 74 matching lines @@
   EXPECT_TRUE(pc.IsValid());
   EXPECT_TRUE(pc.IsSecure());
   EXPECT_TRUE(pc.HasPath());
   EXPECT_EQ("/", pc.Path());
   EXPECT_EQ("", pc.Name());
   EXPECT_EQ("BLAHHH", pc.Value());
   EXPECT_EQ(COOKIE_PRIORITY_DEFAULT, pc.Priority());
 }
 
 TEST(ParsedCookieTest, TestAttributeCase) {
-  ParsedCookie pc("BLAHHH; Path=/; sECuRe; httpONLY; sAmESitE; pRIoRitY=hIgH");
+  ParsedCookie pc(
+      "BLAHHH; Path=/; sECuRe; httpONLY; sAmESitE=StrIct; pRIoRitY=hIgH");
   EXPECT_TRUE(pc.IsValid());
   EXPECT_TRUE(pc.IsSecure());
   EXPECT_TRUE(pc.IsHttpOnly());
-  EXPECT_TRUE(pc.IsSameSite());
+  EXPECT_TRUE(pc.HasSameSite());
+  EXPECT_EQ(COOKIE_SAME_SITE_STRICT, pc.SameSite());
   EXPECT_TRUE(pc.HasPath());
   EXPECT_EQ("/", pc.Path());
   EXPECT_EQ("", pc.Name());
   EXPECT_EQ("BLAHHH", pc.Value());
   EXPECT_EQ(COOKIE_PRIORITY_HIGH, pc.Priority());
   EXPECT_EQ(5U, pc.NumberOfAttributes());
 }
 
 TEST(ParsedCookieTest, TestDoubleQuotedNameless) {
   ParsedCookie pc("\"BLA\\\"HHH\"; path=/; secure;");
@@ skipping 30 matching lines @@
   EXPECT_TRUE(pc.IsValid());
   EXPECT_EQ("ABC", pc.Name());
   EXPECT_EQ("", pc.Value());
   EXPECT_TRUE(pc.HasPath());
   EXPECT_EQ("/wee", pc.Path());
   EXPECT_EQ(COOKIE_PRIORITY_DEFAULT, pc.Priority());
   EXPECT_EQ(1U, pc.NumberOfAttributes());
 }
 
 TEST(ParsedCookieTest, Whitespace) {
-  ParsedCookie pc("  A  = BC  ;secure;;;   samesite     ");
+  ParsedCookie pc("  A  = BC  ;secure;;;   samesite = lax     ");
   EXPECT_TRUE(pc.IsValid());
   EXPECT_EQ("A", pc.Name());
   EXPECT_EQ("BC", pc.Value());
   EXPECT_FALSE(pc.HasPath());
   EXPECT_FALSE(pc.HasDomain());
   EXPECT_TRUE(pc.IsSecure());
   EXPECT_FALSE(pc.IsHttpOnly());
-  EXPECT_TRUE(pc.IsSameSite());
+  EXPECT_TRUE(pc.HasSameSite());
+  EXPECT_EQ(COOKIE_SAME_SITE_LAX, pc.SameSite());
   EXPECT_EQ(COOKIE_PRIORITY_DEFAULT, pc.Priority());
   // We parse anything between ; as attributes, so we end up with two
   // attributes with an empty string name and value.
   EXPECT_EQ(4U, pc.NumberOfAttributes());
 }
 TEST(ParsedCookieTest, MultipleEquals) {
   ParsedCookie pc("  A=== BC  ;secure;;;   httponly");
   EXPECT_TRUE(pc.IsValid());
   EXPECT_EQ("A", pc.Name());
   EXPECT_EQ("== BC", pc.Value());
   EXPECT_FALSE(pc.HasPath());
   EXPECT_FALSE(pc.HasDomain());
   EXPECT_TRUE(pc.IsSecure());
   EXPECT_TRUE(pc.IsHttpOnly());
-  EXPECT_FALSE(pc.IsSameSite());
+  EXPECT_FALSE(pc.HasSameSite());
   EXPECT_EQ(COOKIE_PRIORITY_DEFAULT, pc.Priority());
   EXPECT_EQ(4U, pc.NumberOfAttributes());
 }
 
 TEST(ParsedCookieTest, QuotedTrailingWhitespace) {
   ParsedCookie pc(
       "ANCUUID=\"zohNumRKgI0oxyhSsV3Z7D\"  ; "
       "expires=Sun, 18-Apr-2027 21:06:29 GMT ; "
       "path=/  ;  ");
   EXPECT_TRUE(pc.IsValid());
@@ skipping 165 matching lines @@
   EXPECT_TRUE(pc.IsValid());
 
   // Set all other attributes and check that they are appended in order.
   EXPECT_TRUE(pc.SetDomain("domain.com"));
   EXPECT_TRUE(pc.SetPath("/"));
   EXPECT_TRUE(pc.SetExpires("Sun, 18-Apr-2027 21:06:29 GMT"));
   EXPECT_TRUE(pc.SetMaxAge("12345"));
   EXPECT_TRUE(pc.SetIsSecure(true));
   EXPECT_TRUE(pc.SetIsHttpOnly(true));
   EXPECT_TRUE(pc.SetIsHttpOnly(true));
-  EXPECT_TRUE(pc.SetIsSameSite(true));
+  EXPECT_TRUE(pc.SetSameSite("LAX"));
   EXPECT_TRUE(pc.SetPriority("HIGH"));
   EXPECT_EQ(
       "name=value; domain=domain.com; path=/; "
       "expires=Sun, 18-Apr-2027 21:06:29 GMT; max-age=12345; secure; "
-      "httponly; samesite; priority=HIGH",
+      "httponly; samesite=LAX; priority=HIGH",
       pc.ToCookieLine());
   EXPECT_TRUE(pc.HasDomain());
   EXPECT_TRUE(pc.HasPath());
   EXPECT_TRUE(pc.HasExpires());
   EXPECT_TRUE(pc.HasMaxAge());
   EXPECT_TRUE(pc.IsSecure());
   EXPECT_TRUE(pc.IsHttpOnly());
-  EXPECT_TRUE(pc.IsSameSite());
+  EXPECT_TRUE(pc.HasSameSite());
+  EXPECT_EQ(COOKIE_SAME_SITE_LAX, pc.SameSite());
   EXPECT_EQ(COOKIE_PRIORITY_HIGH, pc.Priority());
 
   // Clear one attribute from the middle.
   EXPECT_TRUE(pc.SetPath("/foo"));
   EXPECT_TRUE(pc.HasDomain());
   EXPECT_TRUE(pc.HasPath());
   EXPECT_TRUE(pc.HasExpires());
   EXPECT_TRUE(pc.IsSecure());
   EXPECT_TRUE(pc.IsHttpOnly());
   EXPECT_EQ(
       "name=value; domain=domain.com; path=/foo; "
       "expires=Sun, 18-Apr-2027 21:06:29 GMT; max-age=12345; secure; "
-      "httponly; samesite; priority=HIGH",
+      "httponly; samesite=LAX; priority=HIGH",
       pc.ToCookieLine());
 
   // Set priority to medium.
   EXPECT_TRUE(pc.SetPriority("medium"));
   EXPECT_EQ(
       "name=value; domain=domain.com; path=/foo; "
       "expires=Sun, 18-Apr-2027 21:06:29 GMT; max-age=12345; secure; "
-      "httponly; samesite; priority=medium",
+      "httponly; samesite=LAX; priority=medium",
       pc.ToCookieLine());
 
   // Clear the rest and change the name and value.
   EXPECT_TRUE(pc.SetDomain(std::string()));
   EXPECT_TRUE(pc.SetPath(std::string()));
   EXPECT_TRUE(pc.SetExpires(std::string()));
   EXPECT_TRUE(pc.SetMaxAge(std::string()));
   EXPECT_TRUE(pc.SetIsSecure(false));
   EXPECT_TRUE(pc.SetIsHttpOnly(false));
-  EXPECT_TRUE(pc.SetIsSameSite(false));
+  EXPECT_TRUE(pc.SetSameSite(std::string()));
   EXPECT_TRUE(pc.SetName("name2"));
   EXPECT_TRUE(pc.SetValue("value2"));
   EXPECT_TRUE(pc.SetPriority(std::string()));
   EXPECT_FALSE(pc.HasDomain());
   EXPECT_FALSE(pc.HasPath());
   EXPECT_FALSE(pc.HasExpires());
   EXPECT_FALSE(pc.HasMaxAge());
+  EXPECT_FALSE(pc.HasSameSite());
   EXPECT_FALSE(pc.IsSecure());
   EXPECT_FALSE(pc.IsHttpOnly());
-  EXPECT_FALSE(pc.IsSameSite());
+  EXPECT_EQ(COOKIE_SAME_SITE_NONE, pc.SameSite());
   EXPECT_EQ("name2=value2", pc.ToCookieLine());
 }
 
 TEST(ParsedCookieTest, SetPriority) {
   ParsedCookie pc("name=value");
   EXPECT_TRUE(pc.IsValid());
 
   EXPECT_EQ("name=value", pc.ToCookieLine());
   EXPECT_EQ(COOKIE_PRIORITY_DEFAULT, pc.Priority());
 
@@ skipping 17 matching lines @@
 
   EXPECT_TRUE(pc.SetPriority("lowerest"));
   EXPECT_EQ("name=value; priority=lowerest", pc.ToCookieLine());
   EXPECT_EQ(COOKIE_PRIORITY_DEFAULT, pc.Priority());
 
   EXPECT_TRUE(pc.SetPriority(""));
   EXPECT_EQ("name=value", pc.ToCookieLine());
   EXPECT_EQ(COOKIE_PRIORITY_DEFAULT, pc.Priority());
 }
 
+TEST(ParsedCookieTest, SetSameSite) {
+  ParsedCookie pc("name=value");
+  EXPECT_TRUE(pc.IsValid());
+
+  EXPECT_EQ("name=value", pc.ToCookieLine());
+  EXPECT_EQ(COOKIE_SAME_SITE_DEFAULT, pc.SameSite());
+
+  // Test each priority, expect case-insensitive compare.
+  EXPECT_TRUE(pc.SetSameSite("strict"));
+  EXPECT_EQ("name=value; samesite=strict", pc.ToCookieLine());
+  EXPECT_EQ(COOKIE_SAME_SITE_STRICT, pc.SameSite());
+
+  EXPECT_TRUE(pc.SetSameSite("lAx"));
+  EXPECT_EQ("name=value; samesite=lAx", pc.ToCookieLine());
+  EXPECT_EQ(COOKIE_SAME_SITE_LAX, pc.SameSite());
+
+  EXPECT_TRUE(pc.SetSameSite("LAX"));
+  EXPECT_EQ("name=value; samesite=LAX", pc.ToCookieLine());
+  EXPECT_EQ(COOKIE_SAME_SITE_LAX, pc.SameSite());
+
+  // Interpret invalid priority values as COOKIE_SAME_SITE_DEFAULT.
+  EXPECT_TRUE(pc.SetSameSite("Blah"));
+  EXPECT_EQ("name=value; samesite=Blah", pc.ToCookieLine());
+  EXPECT_EQ(COOKIE_SAME_SITE_DEFAULT, pc.SameSite());
+
+  EXPECT_TRUE(pc.SetSameSite("lowerest"));
+  EXPECT_EQ("name=value; samesite=lowerest", pc.ToCookieLine());
+  EXPECT_EQ(COOKIE_SAME_SITE_DEFAULT, pc.SameSite());
+
+  EXPECT_TRUE(pc.SetSameSite(""));
+  EXPECT_EQ("name=value", pc.ToCookieLine());
+  EXPECT_EQ(COOKIE_SAME_SITE_DEFAULT, pc.SameSite());
+}
+
 TEST(ParsedCookieTest, InvalidNonAlphanumericChars) {
   ParsedCookie pc1("name=\x05");
   ParsedCookie pc2(
       "name=foo"
       "\x1c"
       "bar");
   ParsedCookie pc3(
       "name=foobar"
       "\x11");
   ParsedCookie pc4(
@@ skipping 82 matching lines @@
   EXPECT_TRUE(pc5.IsValid());
   EXPECT_EQ(pc5_literal, pc5.ToCookieLine());
   EXPECT_TRUE(pc6.IsValid());
   EXPECT_EQ(pc6_literal, pc6.ToCookieLine());
   EXPECT_TRUE(pc7.IsValid());
   EXPECT_EQ(pc7_literal, pc7.ToCookieLine());
   EXPECT_TRUE(pc8.IsValid());
   EXPECT_EQ(pc8_literal, pc8.ToCookieLine());
 }
 }