First experimental implementation of the Clear-Site-Data header

content/browser/browsing_data/clear_site_data_throttle_unittest.cc

Index: content/browser/browsing_data/clear_site_data_throttle_unittest.cc
diff --git a/content/browser/browsing_data/clear_site_data_throttle_unittest.cc b/content/browser/browsing_data/clear_site_data_throttle_unittest.cc
new file mode 100644
index 0000000000000000000000000000000000000000..cbb180daba75a2f3d31c4d7f20879d1a8cd51808
--- /dev/null
+++ b/content/browser/browsing_data/clear_site_data_throttle_unittest.cc
@@ -0,0 +1,134 @@
+// Copyright 2016 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "content/browser/browsing_data/clear_site_data_throttle.h"
+
+#include <memory>
+
+#include "base/command_line.h"
+#include "content/public/common/content_switches.h"
+#include "testing/gmock/include/gmock/gmock.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace content {
+
+class ClearSiteDataThrottleTest : public testing::Test {
+ public:
+  void SetUp() override {
+    base::CommandLine::ForCurrentProcess()->AppendSwitch(
+        switches::kEnableExperimentalWebPlatformFeatures);
+    throttle_ = ClearSiteDataThrottle::CreateThrottleForNavigation(nullptr);
+  }
+
+  ClearSiteDataThrottle* GetThrottle() {
+    return static_cast<ClearSiteDataThrottle*>(throttle_.get());
+  }
+
+ private:
+  std::unique_ptr<NavigationThrottle> throttle_;
+};
+
+TEST_F(ClearSiteDataThrottleTest, ParseHeader) {
+  struct TestCase {
+    const char* header;
+    bool cookies;
+    bool storage;
+    bool cache;
+  } test_cases[] = {
+      // One data type.
+      {"{ \"types\": [\"cookies\"] }", true, false, false},
+      {"{ \"types\": [\"storage\"] }", false, true, false},
+      {"{ \"types\": [\"cache\"] }", false, false, true},
+
+      // Two data types.
+      {"{ \"types\": [\"cookies\", \"storage\"] }", true, true, false},
+      {"{ \"types\": [\"cookies\", \"cache\"] }", true, false, true},
+      {"{ \"types\": [\"storage\", \"cache\"] }", false, true, true},
+
+      // Three data types.
+      {"{ \"types\": [\"storage\", \"cache\", \"cookies\"] }", true, true,
+       true},
+      {"{ \"types\": [\"cache\", \"cookies\", \"storage\"] }", true, true,
+       true},
+      {"{ \"types\": [\"cookies\", \"storage\", \"cache\"] }", true, true,
+       true},
+
+      // Different formatting.
+      {"  { \"types\":   [\"cookies\" ]}", true, false, false},
+
+      // Duplicates.
+      {"{ \"types\": [\"cookies\", \"cookies\"] }", true, false, false},
+
+      // Other entries in the dictionary.
+      {"{ \"types\": [\"storage\"], \"other_params\": {} }", false, true,

[nasko, 2016/08/11 20:07:22]

Shouldn't we be failing the parsing in this case?

[msramek, 2016/08/12 15:06:28]

See the comment about compatibility below.

If the header specification changes and new entries are added, it's probably
better to at least delete what we know we can than to bail out.

+       false},
+
+      // Unknown types are ignored, but we still proceed with the deletion for
+      // those that we recognize.
+      {"{ \"types\": [\"cache\", \"foo\"] }", false, false, true},

[nasko, 2016/08/11 20:07:22]

Typos are easy to occur, so I think it is best for us to either fail fully the
parsing (probably not) or at least emit an error message that unrecognized data
was seen. This way if I put "cookie" and my eyes glance over thinking the "s" is
there, I wouldn't be surprised when I still see cookies around.

[msramek, 2016/08/12 15:06:28]

We do handle that :) See the "Invalid type:" error message in
clear_site_data_throttle.cc, and the "passwords" example in the InvalidHeader
test below.

But we do not interpret this as a failure. If there is at least one valid type
specified, we go forward.

Note that this is good for compatibility. If we add a new datatype, old versions
of Chrome will not be able to delete it, but will still delete at least the ones
they know. And this is not hypothetical - the spec mentions "executionContexts"
which we don't have in this first version but we will have it in the future.

[nasko, 2016/08/12 21:44:53]

Acknowledged.

+  };
+
+  for (const TestCase& test_case : test_cases) {
+    SCOPED_TRACE(test_case.header);
+
+    bool actual_cookies;
+    bool actual_storage;
+    bool actual_cache;
+
+    std::vector<ClearSiteDataThrottle::ConsoleMessage> messages;
+
+    EXPECT_TRUE(GetThrottle()->ParseHeader(test_case.header, &actual_cookies,
+                                           &actual_storage, &actual_cache,
+                                           &messages));
+
+    EXPECT_EQ(test_case.cookies, actual_cookies);
+    EXPECT_EQ(test_case.storage, actual_storage);
+    EXPECT_EQ(test_case.cache, actual_cache);
+  }
+}
+
+TEST_F(ClearSiteDataThrottleTest, InvalidHeader) {

[nasko, 2016/08/11 20:07:22]

I would also suggest looking at libFuzzer and writing a simple fuzzer for the
parsing code. It should be fairly easy to do so. Doing it in a separate CL will
be great :).

https://security.googleblog.com/2016/08/guided-in-process-fuzzing-of-chrome.html

[msramek, 2016/08/12 15:06:28]

Yep, that sounds like something we might want :) Added a TODO.

+  struct TestCase {
+    const char* header;
+    const char* console_message;
+  } test_cases[] = {
+      {"", "Not a valid JSON or non-ASCII characters present.\n"},
+      {"\"unclosed quote",
+       "Not a valid JSON or non-ASCII characters present.\n"},
+      {"\"some text\"", "Expecting a JSON dictionary with a 'types' field.\n"},
+      {"{ \"field\" : {} }",
+       "Expecting a JSON dictionary with a 'types' field.\n"},
+      {"{ \"types\" : [ \"passwords\" ] }",
+       "Invalid type: \"passwords\".\n"
+       "No valid types specified in the 'types' field.\n"},
+      {"{ \"types\" : [ [ \"list in a list\" ] ] }",
+       "Invalid type: [\"list in a list\"].\n"
+       "No valid types specified in the 'types' field.\n"},
+      {"{ \"types\" : [ \"кукис\", \"сторидж\", \"кэш\" ]",
+       "Not a valid JSON or non-ASCII characters present.\n"}};
+
+  for (const TestCase& test_case : test_cases) {
+    SCOPED_TRACE(test_case.header);
+
+    bool actual_cookies;
+    bool actual_storage;
+    bool actual_cache;
+
+    std::vector<ClearSiteDataThrottle::ConsoleMessage> messages;
+
+    EXPECT_FALSE(GetThrottle()->ParseHeader(test_case.header, &actual_cookies,
+                                            &actual_storage, &actual_cache,
+                                            &messages));
+
+    std::string multiline_message;
+    for (const auto& message : messages) {
+      EXPECT_EQ(CONSOLE_MESSAGE_LEVEL_ERROR, message.level);
+      multiline_message += message.text + "\n";
+    }
+
+    EXPECT_EQ(test_case.console_message, multiline_message);
+  }
+}
+
+}  // namespace content