Ignore cookies with invalid 'SameSite' attribute values.

net/cookies/canonical_cookie_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cookies/canonical_cookie.h"
 
 #include "base/memory/scoped_ptr.h"
 #include "base/test/histogram_tester.h"
 #include "net/cookies/cookie_constants.h"
 #include "net/cookies/cookie_options.h"
@@ skipping 75 matching lines @@
   // Test creating SameSite cookies.
   CookieOptions same_site_options;
   same_site_options.set_same_site_cookie_mode(
       CookieOptions::SameSiteCookieMode::INCLUDE_STRICT_AND_LAX);
   cookie = CanonicalCookie::Create(url, "A=2; SameSite=Strict", creation_time,
                                    same_site_options);
   EXPECT_TRUE(cookie.get());
   EXPECT_EQ(CookieSameSite::STRICT_MODE, cookie->SameSite());
   cookie = CanonicalCookie::Create(url, "A=2; SameSite=Lax", creation_time,
                                    same_site_options);
-  EXPECT_TRUE(cookie.get());
-  EXPECT_EQ(CookieSameSite::LAX_MODE, cookie->SameSite());
-  cookie = CanonicalCookie::Create(url, "A=2; SameSite", creation_time,
-                                   same_site_options);
-  EXPECT_TRUE(cookie.get());
-  EXPECT_EQ(CookieSameSite::NO_RESTRICTION, cookie->SameSite());
 
   // Test the creating cookies using specific parameter instead of a cookie
   // string.
   cookie = CanonicalCookie::Create(url, "A", "2", "www.example.com", "/test",
                                    creation_time, base::Time(), false, false,
                                    CookieSameSite::DEFAULT_MODE, false,
                                    COOKIE_PRIORITY_DEFAULT);
   EXPECT_EQ(url.GetOrigin(), cookie->Source());
   EXPECT_EQ("A", cookie->Name());
   EXPECT_EQ("2", cookie->Value());
@@ skipping 10 matching lines @@
   EXPECT_EQ(url.GetOrigin(), cookie->Source());
   EXPECT_EQ("A", cookie->Name());
   EXPECT_EQ("2", cookie->Value());
   EXPECT_EQ(".www.example.com", cookie->Domain());
   EXPECT_EQ("/test", cookie->Path());
   EXPECT_FALSE(cookie->IsSecure());
   EXPECT_FALSE(cookie->IsHttpOnly());
   EXPECT_EQ(CookieSameSite::NO_RESTRICTION, cookie->SameSite());
 }
 
+TEST(CanonicalCookieTest, CreateInvalid) {

[mmenke, 2016/04/06 16:07:23]

CreateInvalid -> CreateInvalidSameSite?  There are other cases where
CanonicalCookie::Create fails, like trying to set cookies on other domains,
which this does not cover.

[Mike West, 2016/04/06 16:34:39]

Done.

+  GURL url("http://www.example.com/test/foo.html");
+  base::Time now = base::Time::Now();
+  scoped_ptr<CanonicalCookie> cookie;
+  CookieOptions options;
+
+  // Invalid 'SameSite' attribute values.
+  options.set_same_site_cookie_mode(
+      CookieOptions::SameSiteCookieMode::INCLUDE_STRICT_AND_LAX);
+
+  cookie = CanonicalCookie::Create(url, "A=2; SameSite=Invalid", now, options);
+  EXPECT_EQ(nullptr, cookie.get());
+
+  cookie = CanonicalCookie::Create(url, "A=2; SameSite", now, options);
+  EXPECT_EQ(nullptr, cookie.get());
+}
+
 TEST(CanonicalCookieTest, EmptyExpiry) {
   GURL url("http://www7.ipdl.inpit.go.jp/Tokujitu/tjkta.ipdl?N0000=108");
   base::Time creation_time = base::Time::Now();
   CookieOptions options;
 
   std::string cookie_line =
       "ACSTM=20130308043820420042; path=/; domain=ipdl.inpit.go.jp; Expires=";
   scoped_ptr<CanonicalCookie> cookie(
       CanonicalCookie::Create(url, cookie_line, creation_time, options));
   EXPECT_TRUE(cookie.get());
@@ skipping 566 matching lines @@
                                CanonicalCookie::COOKIE_PREFIX_SECURE, 1);
   EXPECT_TRUE(CanonicalCookie::Create(https_url, "__SecureA=B; Path=/; Secure",
                                       creation_time, options));
   histograms.ExpectBucketCount(kCookiePrefixHistogram,
                                CanonicalCookie::COOKIE_PREFIX_SECURE, 2);
   histograms.ExpectBucketCount(kCookiePrefixBlockedHistogram,
                                CanonicalCookie::COOKIE_PREFIX_SECURE, 1);
 }
 
 }  // namespace net