Allows AwCookieManager to block ThirdParty cookies

android_webview/javatests/src/org/chromium/android_webview/test/CookieManagerTest.java

 // Copyright 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 package org.chromium.android_webview.test;
 
 import android.test.MoreAsserts;
 import android.test.suitebuilder.annotation.MediumTest;
 import android.test.suitebuilder.annotation.SmallTest;
 import android.util.Pair;
@@ skipping 216 matching lines @@
         });
 
         mCookieManager.removeAllCookie();
         poll(new Callable<Boolean>() {
             @Override
             public Boolean call() throws Exception {
                 return mCookieManager.getCookie(url) == null;
             }
         });
     }
+
+    @MediumTest
+    @Feature({"AndroidWebView", "Privacy"})
+    public void testThirdPartyCookie() throws Throwable {

[mkosiba (inactive), 2014/04/23 12:51:22]

like I mentioned offline - you probably want a test that uses the JS API too.

[hjd_google, 2014/04/24 12:48:30]

Done.

I added it as a separate test for clarity.

+        TestWebServer webServer = null;
+        try {
+            // In theory we need two servers to test this, one server ('the first party')
+            // which returns a response with a link to a second server ('the third party')
+            // at different origin. This second server attempts to set a cookie which should
+            // fail if AcceptThirdPartyCookie() is false.
+            // Strictly according to the letter of RFC6454 it should be possible to set this
+            // situation up with two TestServers on different ports (these count as having
+            // different origins) but Chrome is not strict about this and does not check the
+            // port. Instead we cheat making some of the urls come from localhost and some
+            // from 127.0.0.1 which count (both in theory and pratice) as having different
+            // origins.
+            webServer = new TestWebServer(false);
+            TestWebServer thirdParty = webServer;
+            TestWebServer firstParty = webServer;
+
+            // Turn global allow on.
+            mCookieManager.setAcceptCookie(true);
+            mCookieManager.removeAllCookie();
+            assertTrue(mCookieManager.acceptCookie());
+            assertFalse(mCookieManager.hasCookies());
+
+            // When third party cookies are disabled...
+            mCookieManager.setAcceptThirdPartyCookie(false);
+            assertFalse(mCookieManager.acceptThirdPartyCookie());
+
+            String cookieUrl, url;

[mkosiba (inactive), 2014/04/23 12:51:22]

I think the style is to declare + initialize. If the line is too long break
after =, so

  String cookieUrl =
      makeUrl...

cant't remember if indent is supposed to be 4 or 8 spaces in this case though.

[hjd_google, 2014/04/24 12:48:30]

Done.

+
+            // ...we can't set third party cookies.
+            // First on the third party server we create a url which tries to set a cookie.
+            cookieUrl = makeUrlWithCookie(thirdParty, "/cookie_1.js", "test1", "value1", true);
+            // Then we create a url on the first party server which links to the first url.
+            url = makeUrlWithScriptLink(firstParty, "/content_1.html", cookieUrl);
+            loadUrlSync(mAwContents, mContentsClient.getOnPageFinishedHelper(), url);
+            assertNull(mCookieManager.getCookie(cookieUrl));
+
+            // When third party cookies are enabled...
+            mCookieManager.setAcceptThirdPartyCookie(true);
+            assertTrue(mCookieManager.acceptThirdPartyCookie());
+
+            // ...we can set third party cookies.
+            cookieUrl = makeUrlWithCookie(thirdParty, "/cookie_2.js", "test2", "value2", true);
+            url = makeUrlWithScriptLink(firstParty, "/content_2.html", cookieUrl);
+            loadUrlSync(mAwContents, mContentsClient.getOnPageFinishedHelper(), url);
+            waitForCookie(cookieUrl);
+            String cookie = mCookieManager.getCookie(cookieUrl);
+            assertNotNull(cookie);
+            validateCookies(cookie, "test2");
+        } finally {
+            if (webServer != null) webServer.shutdown();
+        }
+    }
+
+    /**
+     * Creates a response on the TestWebServer which attempts to set a cookie when fetched.
+     * @param  webServer  the webServer on which to create the response
+     * @param  path the path component of the url (e.g "/cookie_test.html")
+     * @param  key the key of the cookie
+     * @param  value the value of the cookie
+     * @param  thirdParty if true we should fake the url to look like a diffrent domain.
+     * @return  the url which gets the response
+     */
+    private String makeUrlWithCookie(TestWebServer webServer, String path, String key,

[mkosiba (inactive), 2014/04/23 12:51:22]

seems like you only ever call this with thirdParty == true, so maybe rename
method to makeThridPartyUrlWithCookie(...) and drop the extra bool?
Alternatively have two methods:
makeUrlWithCookie(...) and toThirdPartyUrl(String url) { return url.replace... }

[hjd_google, 2014/04/24 12:48:30]

Done.

+            String value, boolean thirdParty) {
+        String response = "";
+        List<Pair<String, String>> responseHeaders = new ArrayList<Pair<String, String>>();
+        responseHeaders.add(
+            Pair.create("Set-Cookie", key + "=" + value + "; path=" + path));
+        String url = webServer.setResponse(path, response, responseHeaders);
+        if (thirdParty) {
+            return url.replace("localhost", "127.0.0.1");
+        }
+        return url;
+    }
+
+    /**
+     * Creates a response on the TestWebServer which contains a script tag with an external src.
+     * @param  webServer  the webServer on which to create the response
+     * @param  path the path component of the url (e.g "my_thing_with_script.html")
+     * @param  url the url which which should appear as the src or the script tag.
+     * @return  the url which gets the response
+     */
+    private String makeUrlWithScriptLink(TestWebServer webServer, String path, String url) {
+        String responseStr = "<html><head><title>Content!</title></head>" +
+                    "<body><script src=" + url + "></script></body></html>";
+        return webServer.setResponse(path, responseStr, null);
+    }
 }