WIP: Move 'Upgrade-Insecure-Requests' to the browser process.

net/url_request/url_request_http_job_unittest.cc

 // Copyright (c) 2013 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/url_request/url_request_http_job.h"
 
 #include <stdint.h>
 
 #include <cstddef>
 #include <memory>
@@ skipping 733 matching lines @@
       EXPECT_EQ(1, d.received_redirect_count());
       EXPECT_EQ(2u, r->url_chain().size());
     } else {
       EXPECT_EQ(0, d.received_redirect_count());
       EXPECT_EQ(1u, r->url_chain().size());
     }
     EXPECT_EQ(GURL(test.url_expected), r->url());
   }
 }
 
+TEST_F(URLRequestHttpJobTest, UpgradeInsecureRequestRewritesTest) {
+  const char* kHttpOrigin1 = "http://origin1.test/";
+  const char* kHttpOrigin1WithPort = "http://origin1.test:999/";
+  const char* kHttpOrigin2 = "http://origin2.test/";
+  const char* kHttpsOrigin1 = "https://origin1.test/";
+  const char* kHttpsOrigin1WithPort = "https://origin1.test:999/";
+  const char* kHttpsOrigin2 = "https://origin2.test/";
+  const char* kWsOrigin1 = "ws://origin1.test/";
+  const char* kWsOrigin1WithPort = "ws://origin1.test:999/";
+  const char* kWsOrigin2 = "ws://origin2.test/";
+  const char* kWssOrigin1 = "wss://origin1.test/";
+  const char* kWssOrigin1WithPort = "wss://origin1.test:999/";
+  const char* kWssOrigin2 = "wss://origin2.test/";
+  const char* kWeirdOrigin1 = "weird://origin1.test/";
+
+  struct TestCase {
+    const char* url;
+    const char* initiator;
+    URLRequest::InsecureRequestPolicy policy;
+    bool upgrade_expected;
+    const char* upgraded_url;
+  } cases[] = {
+      // HTTP Requests
+      // Secure origins are not upgraded:
+      {kHttpsOrigin1, kHttpOrigin1,
+       URLRequest::DO_NOT_UPGRADE_INSECURE_REQUESTS, false, ""},
+      {kHttpsOrigin1, kHttpOrigin1,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, false, ""},
+      {kHttpsOrigin1, kHttpOrigin1, URLRequest::UPGRADE_ALL_INSECURE_REQUESTS,
+       false, ""},
+      {kHttpsOrigin1, kHttpOrigin2,
+       URLRequest::DO_NOT_UPGRADE_INSECURE_REQUESTS, false, ""},
+      {kHttpsOrigin1, kHttpOrigin2,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, false, ""},
+      {kHttpsOrigin1, kHttpOrigin2, URLRequest::UPGRADE_ALL_INSECURE_REQUESTS,
+       false, ""},
+
+      // DO_NOT_UPGRADE_INSECURE_REQUESTS doesn't upgrade insecure requests.
+      {kHttpOrigin1, kHttpOrigin1, URLRequest::DO_NOT_UPGRADE_INSECURE_REQUESTS,
+       false, ""},
+      {kHttpOrigin1, kHttpOrigin2, URLRequest::DO_NOT_UPGRADE_INSECURE_REQUESTS,
+       false, ""},
+      {kHttpOrigin1, kHttpsOrigin1,
+       URLRequest::DO_NOT_UPGRADE_INSECURE_REQUESTS, false, ""},
+      {kHttpOrigin1, kHttpsOrigin2,
+       URLRequest::DO_NOT_UPGRADE_INSECURE_REQUESTS, false, ""},
+
+      // UPGRADE_ALL_INSECURE_REQUESTS does upgrade insecure requests.
+      {kHttpOrigin1, kHttpOrigin1, URLRequest::UPGRADE_ALL_INSECURE_REQUESTS,
+       true, kHttpsOrigin1},
+      {kHttpOrigin1, kHttpOrigin2, URLRequest::UPGRADE_ALL_INSECURE_REQUESTS,
+       true, kHttpsOrigin1},
+      {kHttpOrigin1, kHttpsOrigin1, URLRequest::UPGRADE_ALL_INSECURE_REQUESTS,
+       true, kHttpsOrigin1},
+      {kHttpOrigin1, kHttpsOrigin2, URLRequest::UPGRADE_ALL_INSECURE_REQUESTS,
+       true, kHttpsOrigin1},
+
+      // UPGRADE_SAME_HOST_INSECURE_REQUESTS does upgrade insecure requests
+      // when the url's and initiator's hosts match.
+      {kHttpOrigin1, kHttpOrigin1,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, true, kHttpsOrigin1},
+      {kHttpOrigin1, kHttpOrigin2,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, false, ""},
+      {kHttpOrigin1, kHttpsOrigin1,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, true, kHttpsOrigin1},
+      {kHttpOrigin1, kHttpsOrigin2,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, false, ""},
+
+      // Upgrades do not affect ports:
+      {kHttpOrigin1WithPort, kHttpOrigin1,
+       URLRequest::UPGRADE_ALL_INSECURE_REQUESTS, true, kHttpsOrigin1WithPort},
+      {kHttpOrigin1WithPort, kHttpOrigin2,
+       URLRequest::UPGRADE_ALL_INSECURE_REQUESTS, true, kHttpsOrigin1WithPort},
+      {kHttpOrigin1WithPort, kHttpOrigin1WithPort,
+       URLRequest::UPGRADE_ALL_INSECURE_REQUESTS, true, kHttpsOrigin1WithPort},
+      {kHttpOrigin1WithPort, kHttpsOrigin1,
+       URLRequest::UPGRADE_ALL_INSECURE_REQUESTS, true, kHttpsOrigin1WithPort},
+      {kHttpOrigin1WithPort, kHttpsOrigin2,
+       URLRequest::UPGRADE_ALL_INSECURE_REQUESTS, true, kHttpsOrigin1WithPort},
+      {kHttpOrigin1WithPort, kHttpsOrigin1WithPort,
+       URLRequest::UPGRADE_ALL_INSECURE_REQUESTS, true, kHttpsOrigin1WithPort},
+
+      // Ports do not affect same-hostness:
+      {kHttpOrigin1WithPort, kHttpOrigin1,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, true,
+       kHttpsOrigin1WithPort},
+      {kHttpOrigin1WithPort, kHttpOrigin2,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, false, ""},
+      {kHttpOrigin1WithPort, kHttpsOrigin1,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, true,
+       kHttpsOrigin1WithPort},
+      {kHttpOrigin1WithPort, kHttpsOrigin2,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, false, ""},
+
+      // WebSocket Requests
+      // Secure origins are not upgraded:
+      {kWssOrigin1, kWsOrigin1, URLRequest::DO_NOT_UPGRADE_INSECURE_REQUESTS,
+       false, ""},
+      {kWssOrigin1, kWsOrigin1, URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS,
+       false, ""},
+      {kWssOrigin1, kWsOrigin1, URLRequest::UPGRADE_ALL_INSECURE_REQUESTS,
+       false, ""},
+      {kWssOrigin1, kWsOrigin2, URLRequest::DO_NOT_UPGRADE_INSECURE_REQUESTS,
+       false, ""},
+      {kWssOrigin1, kWsOrigin2, URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS,
+       false, ""},
+      {kWssOrigin1, kWsOrigin2, URLRequest::UPGRADE_ALL_INSECURE_REQUESTS,
+       false, ""},
+
+      // DO_NOT_UPGRADE_INSECURE_REQUESTS doesn't upgrade insecure requests.
+      {kWsOrigin1, kWsOrigin1, URLRequest::DO_NOT_UPGRADE_INSECURE_REQUESTS,
+       false, ""},
+      {kWsOrigin1, kWsOrigin2, URLRequest::DO_NOT_UPGRADE_INSECURE_REQUESTS,
+       false, ""},
+      {kWsOrigin1, kWssOrigin1, URLRequest::DO_NOT_UPGRADE_INSECURE_REQUESTS,
+       false, ""},
+      {kWsOrigin1, kWssOrigin2, URLRequest::DO_NOT_UPGRADE_INSECURE_REQUESTS,
+       false, ""},
+
+      // UPGRADE_ALL_INSECURE_REQUESTS does upgrade insecure requests.
+      {kWsOrigin1, kWsOrigin1, URLRequest::UPGRADE_ALL_INSECURE_REQUESTS, true,
+       kWssOrigin1},
+      {kWsOrigin1, kWsOrigin2, URLRequest::UPGRADE_ALL_INSECURE_REQUESTS, true,
+       kWssOrigin1},
+      {kWsOrigin1, kWssOrigin1, URLRequest::UPGRADE_ALL_INSECURE_REQUESTS, true,
+       kWssOrigin1},
+      {kWsOrigin1, kWssOrigin2, URLRequest::UPGRADE_ALL_INSECURE_REQUESTS, true,
+       kWssOrigin1},
+
+      // UPGRADE_SAME_HOST_INSECURE_REQUESTS does upgrade insecure requests
+      // when the url's and initiator's hosts match.
+      {kWsOrigin1, kWsOrigin1, URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS,
+       true, kWssOrigin1},
+      {kWsOrigin1, kWsOrigin2, URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS,
+       false, ""},
+      {kWsOrigin1, kWssOrigin1, URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS,
+       true, kWssOrigin1},
+      {kWsOrigin1, kWssOrigin2, URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS,
+       false, ""},
+
+      // Upgrades do not affect ports:
+      {kWsOrigin1WithPort, kWsOrigin1,
+       URLRequest::UPGRADE_ALL_INSECURE_REQUESTS, true, kWssOrigin1WithPort},
+      {kWsOrigin1WithPort, kWsOrigin2,
+       URLRequest::UPGRADE_ALL_INSECURE_REQUESTS, true, kWssOrigin1WithPort},
+      {kWsOrigin1WithPort, kWsOrigin1WithPort,
+       URLRequest::UPGRADE_ALL_INSECURE_REQUESTS, true, kWssOrigin1WithPort},
+      {kWsOrigin1WithPort, kWssOrigin1,
+       URLRequest::UPGRADE_ALL_INSECURE_REQUESTS, true, kWssOrigin1WithPort},
+      {kWsOrigin1WithPort, kWssOrigin2,
+       URLRequest::UPGRADE_ALL_INSECURE_REQUESTS, true, kWssOrigin1WithPort},
+      {kWsOrigin1WithPort, kWssOrigin1WithPort,
+       URLRequest::UPGRADE_ALL_INSECURE_REQUESTS, true, kWssOrigin1WithPort},
+
+      // Ports do not affect same-hostness:
+      {kWsOrigin1WithPort, kWsOrigin1,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, true,
+       kWssOrigin1WithPort},
+      {kWsOrigin1WithPort, kWsOrigin2,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, false, ""},
+      {kWsOrigin1WithPort, kWssOrigin1,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, true,
+       kWssOrigin1WithPort},
+      {kWsOrigin1WithPort, kWssOrigin2,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, false, ""},
+
+      // Weird Origins are not upgraded:
+      {kWeirdOrigin1, kWeirdOrigin1,
+       URLRequest::DO_NOT_UPGRADE_INSECURE_REQUESTS, false, ""},
+      {kWeirdOrigin1, kWeirdOrigin1,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, false, ""},
+      {kWeirdOrigin1, kWeirdOrigin1, URLRequest::UPGRADE_ALL_INSECURE_REQUESTS,
+       false, ""},
+      {kWeirdOrigin1, kHttpOrigin1,
+       URLRequest::DO_NOT_UPGRADE_INSECURE_REQUESTS, false, ""},
+      {kWeirdOrigin1, kHttpOrigin1,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, false, ""},
+      {kWeirdOrigin1, kHttpOrigin1, URLRequest::UPGRADE_ALL_INSECURE_REQUESTS,
+       false, ""},
+      {kWeirdOrigin1, kHttpsOrigin1,
+       URLRequest::DO_NOT_UPGRADE_INSECURE_REQUESTS, false, ""},
+      {kWeirdOrigin1, kHttpsOrigin1,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, false, ""},
+      {kWeirdOrigin1, kHttpsOrigin1, URLRequest::UPGRADE_ALL_INSECURE_REQUESTS,
+       false, ""},
+      {kWeirdOrigin1, kWssOrigin1, URLRequest::DO_NOT_UPGRADE_INSECURE_REQUESTS,
+       false, ""},
+      {kWeirdOrigin1, kWssOrigin1,
+       URLRequest::UPGRADE_SAME_HOST_INSECURE_REQUESTS, false, ""},
+      {kWeirdOrigin1, kWssOrigin1, URLRequest::UPGRADE_ALL_INSECURE_REQUESTS,
+       false, ""},
+  };
+
+  for (const auto& test : cases) {
+    SCOPED_TRACE(testing::Message() << "URL: " << test.url
+                                    << " Initiator: " << test.initiator
+                                    << " Policy: " << test.policy);
+    TestDelegate d;
+    TestNetworkDelegate network_delegate;
+    std::unique_ptr<URLRequest> r(
+        context_.CreateRequest(GURL(test.url), DEFAULT_PRIORITY, &d));
+    r->set_insecure_request_policy(test.policy);
+    r->set_initiator(url::Origin(GURL(test.initiator)));
+
+    net_log_.Clear();
+    r->Start();
+    base::RunLoop().Run();
+
+    if (test.upgrade_expected) {
+      net::TestNetLogEntry::List entries;
+      net_log_.GetEntries(&entries);
+      int rewrites = 0;
+      for (const auto& entry : entries) {
+        if (entry.type == net::NetLogEventType::URL_REQUEST_REWRITTEN) {
+          rewrites++;
+          std::string value;
+          EXPECT_TRUE(entry.GetStringValue("reason", &value));
+          EXPECT_EQ("Upgrade-Insecure-Requests", value);
+        }
+      }
+      EXPECT_EQ(0, d.received_redirect_count());
+      EXPECT_EQ(2u, r->url_chain().size());
+      EXPECT_EQ(GURL(test.upgraded_url), r->url());
+    } else {
+      EXPECT_EQ(0, d.received_redirect_count());
+      EXPECT_EQ(1u, r->url_chain().size());
+      EXPECT_EQ(GURL(test.url), r->url());
+    }
+  }
+}
+
 class MockSdchObserver : public SdchObserver {
  public:
   MockSdchObserver() {}
   MOCK_METHOD2(OnDictionaryAdded,
                void(const GURL& request_url, const std::string& server_hash));
   MOCK_METHOD1(OnDictionaryRemoved, void(const std::string& server_hash));
   MOCK_METHOD1(OnDictionaryUsed, void(const std::string& server_hash));
   MOCK_METHOD2(OnGetDictionary,
                void(const GURL& request_url, const GURL& dictionary_url));
   MOCK_METHOD0(OnClearDictionaries, void());
@@ skipping 332 matching lines @@
   base::RunLoop().RunUntilIdle();
   EXPECT_THAT(delegate_.request_status(), IsError(ERR_IO_PENDING));
   EXPECT_TRUE(fake_handshake_stream->initialize_stream_was_called());
 }
 
 #endif  // BUILDFLAG(ENABLE_WEBSOCKETS)
 
 }  // namespace
 
 }  // namespace net