Component updater must enforce that the brand length is 4.

components/update_client/utils_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/files/file_path.h"
 #include "base/path_service.h"
 #include "components/update_client/utils.h"
 #include "testing/gtest/include/gtest/gtest.h"
 #include "url/gurl.h"
 
@@ skipping 39 matching lines @@
   EXPECT_FALSE(VerifyFileHash256(
       MakeTestFilePath("jebgalgnebhfojomionfpkfelancnnkf.crx"),
       std::string("abcd")));
 
   EXPECT_FALSE(VerifyFileHash256(
       MakeTestFilePath("jebgalgnebhfojomionfpkfelancnnkf.crx"),
       std::string(
           "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa")));
 }
 
-// Tests that the brand matches ^([a-zA-Z]{4})?$
+// Tests that the brand matches ^[a-zA-Z]{4}?$
 TEST(UpdateClientUtils, IsValidBrand) {
+  // The valid brand code must be empty or exactly 4 chars long.
   EXPECT_TRUE(IsValidBrand(std::string("")));
-  EXPECT_TRUE(IsValidBrand(std::string("T")));
-  EXPECT_TRUE(IsValidBrand(std::string("TE")));
-  EXPECT_TRUE(IsValidBrand(std::string("TES")));
   EXPECT_TRUE(IsValidBrand(std::string("TEST")));
-  EXPECT_TRUE(IsValidBrand(std::string("")));
-  EXPECT_TRUE(IsValidBrand(std::string("t")));
-  EXPECT_TRUE(IsValidBrand(std::string("te")));
-  EXPECT_TRUE(IsValidBrand(std::string("tes")));
   EXPECT_TRUE(IsValidBrand(std::string("test")));
   EXPECT_TRUE(IsValidBrand(std::string("TEst")));
 
+  EXPECT_FALSE(IsValidBrand(std::string("T")));      // Too short.
+  EXPECT_FALSE(IsValidBrand(std::string("TE")));     //
+  EXPECT_FALSE(IsValidBrand(std::string("TES")));    //
   EXPECT_FALSE(IsValidBrand(std::string("TESTS")));  // Too long.
   EXPECT_FALSE(IsValidBrand(std::string("TES1")));   // Has digit.
   EXPECT_FALSE(IsValidBrand(std::string(" TES")));   // Begins with white space.
   EXPECT_FALSE(IsValidBrand(std::string("TES ")));   // Ends with white space.
   EXPECT_FALSE(IsValidBrand(std::string("T ES")));   // Contains white space.
   EXPECT_FALSE(IsValidBrand(std::string("<TE")));    // Has <.
   EXPECT_FALSE(IsValidBrand(std::string("TE>")));    // Has >.
+  EXPECT_FALSE(IsValidAp(std::string("\"")));        // Has "
+  EXPECT_FALSE(IsValidAp(std::string("\\")));        // Has backslash.
   EXPECT_FALSE(IsValidBrand(std::string("\xaa")));   // Has non-ASCII char.
 }
 
-// Tests that the ap matches ^([-+_=a-zA-Z0-9]{0,256})$
+// Tests that the ap matches ^[-+_=a-zA-Z0-9]{0,256}$
 TEST(UpdateClientUtils, IsValidAp) {
   EXPECT_TRUE(IsValidAp(std::string("a=1")));
   EXPECT_TRUE(IsValidAp(std::string("")));
   EXPECT_TRUE(IsValidAp(std::string("A")));
   EXPECT_TRUE(IsValidAp(std::string("Z")));
   EXPECT_TRUE(IsValidAp(std::string("a")));
   EXPECT_TRUE(IsValidAp(std::string("z")));
   EXPECT_TRUE(IsValidAp(std::string("0")));
   EXPECT_TRUE(IsValidAp(std::string("9")));
   EXPECT_TRUE(IsValidAp(std::string(256, 'a')));
@@ skipping 35 matching lines @@
   RemoveUnsecureUrls(&urls);
   EXPECT_EQ(0u, urls.size());
 
   const GURL test5[] = {GURL("http://foo"), GURL("http://bar")};
   urls.assign(std::begin(test5), std::end(test5));
   RemoveUnsecureUrls(&urls);
   EXPECT_EQ(0u, urls.size());
 }
 
 }  // namespace update_client