Chromium Code Reviews Chromium Code Reviews
Issue 2643083003:
Show form not secure warnings for blob and filesystem URLs. (Closed)
| OLD | NEW |
|---|---|
| 1 // Copyright 2015 The Chromium Authors. All rights reserved. | 1 // Copyright 2015 The Chromium Authors. All rights reserved. |
| 2 // Use of this source code is governed by a BSD-style license that can be | 2 // Use of this source code is governed by a BSD-style license that can be |
| 3 // found in the LICENSE file. | 3 // found in the LICENSE file. |
| 4 | 4 |
| 5 #include "components/security_state/core/security_state.h" | 5 #include "components/security_state/core/security_state.h" |
| 6 | 6 |
| 7 #include <stdint.h> | 7 #include <stdint.h> |
| 8 | 8 |
| 9 #include "base/bind.h" | 9 #include "base/bind.h" |
| 10 #include "base/command_line.h" | 10 #include "base/command_line.h" |
| 11 #include "base/memory/ptr_util.h" | 11 #include "base/memory/ptr_util.h" |
| 12 #include "base/test/histogram_tester.h" | 12 #include "base/test/histogram_tester.h" |
| 13 #include "components/security_state/core/switches.h" | 13 #include "components/security_state/core/switches.h" |
| 14 #include "net/cert/x509_certificate.h" | 14 #include "net/cert/x509_certificate.h" |
| 15 #include "net/ssl/ssl_cipher_suite_names.h" | 15 #include "net/ssl/ssl_cipher_suite_names.h" |
| 16 #include "net/ssl/ssl_connection_status_flags.h" | 16 #include "net/ssl/ssl_connection_status_flags.h" |
| 17 #include "net/test/cert_test_util.h" | 17 #include "net/test/cert_test_util.h" |
| 18 #include "net/test/test_certificate_data.h" | 18 #include "net/test/test_certificate_data.h" |
| 19 #include "net/test/test_data_directory.h" | 19 #include "net/test/test_data_directory.h" |
| 20 #include "testing/gtest/include/gtest/gtest.h" | 20 #include "testing/gtest/include/gtest/gtest.h" |
| 21 | 21 |
| 22 namespace security_state { | 22 namespace security_state { |
| 23 | 23 |
| 24 namespace { | 24 namespace { |
| 25 | 25 |
| 26 const char kHttpsUrl[] = "https://foo.test/"; | 26 const char kHttpsUrl[] = "https://foo.test/"; |
| 27 const char kHttpUrl[] = "http://foo.test/"; | 27 const char kHttpUrl[] = "http://foo.test/"; |
| 28 | 28 |
| 29 const char* const kPseudoUrls[] = { | |
| 30 "data:text/html,<html>test</html>", "blob:http://test/some-guid", | |
| 31 "filesystem:http://test/some-guid", | |
| 32 }; | |
| 33 | |
| 29 bool IsOriginSecure(const GURL& url) { | 34 bool IsOriginSecure(const GURL& url) { |
| 30 return url == kHttpsUrl; | 35 return url == kHttpsUrl; |
| 31 } | 36 } |
| 32 | 37 |
| 33 class TestSecurityStateHelper { | 38 class TestSecurityStateHelper { |
| 34 public: | 39 public: |
| 35 TestSecurityStateHelper() | 40 TestSecurityStateHelper() |
| 36 : url_(kHttpsUrl), | 41 : url_(kHttpsUrl), |
| 42 cert_(net::ImportCertFromFile(net::GetTestCertsDirectory(), | |
| 43 "sha1_2016.pem")), | |
| 37 connection_status_(net::SSL_CONNECTION_VERSION_TLS1_2 | 44 connection_status_(net::SSL_CONNECTION_VERSION_TLS1_2 |
| 38 << net::SSL_CONNECTION_VERSION_SHIFT), | 45 << net::SSL_CONNECTION_VERSION_SHIFT), |
| 39 cert_status_(net::CERT_STATUS_SHA1_SIGNATURE_PRESENT), | 46 cert_status_(net::CERT_STATUS_SHA1_SIGNATURE_PRESENT), |
| 40 displayed_mixed_content_(false), | 47 displayed_mixed_content_(false), |
| 41 ran_mixed_content_(false), | 48 ran_mixed_content_(false), |
| 42 malicious_content_status_(MALICIOUS_CONTENT_STATUS_NONE), | 49 malicious_content_status_(MALICIOUS_CONTENT_STATUS_NONE), |
| 43 displayed_password_field_on_http_(false), | 50 displayed_password_field_on_http_(false), |
| 44 displayed_credit_card_field_on_http_(false) { | 51 displayed_credit_card_field_on_http_(false) {} |
| 45 cert_ = | |
| 46 net::ImportCertFromFile(net::GetTestCertsDirectory(), "sha1_2016.pem"); | |
| 47 } | |
| 48 virtual ~TestSecurityStateHelper() {} | 52 virtual ~TestSecurityStateHelper() {} |
| 49 | 53 |
| 50 void set_connection_status(int connection_status) { | 54 void set_connection_status(int connection_status) { |
| 51 connection_status_ = connection_status; | 55 connection_status_ = connection_status; |
| 52 } | 56 } |
| 53 void SetCipherSuite(uint16_t ciphersuite) { | 57 void SetCipherSuite(uint16_t ciphersuite) { |
| 54 net::SSLConnectionStatusSetCipherSuite(ciphersuite, &connection_status_); | 58 net::SSLConnectionStatusSetCipherSuite(ciphersuite, &connection_status_); |
| 55 } | 59 } |
| 56 void AddCertStatus(net::CertStatus cert_status) { | 60 void AddCertStatus(net::CertStatus cert_status) { |
| 57 cert_status_ |= cert_status; | 61 cert_status_ |= cert_status; |
| (...skipping 10 matching lines...) Expand all Loading... | |
| 68 } | 72 } |
| 69 void set_displayed_password_field_on_http( | 73 void set_displayed_password_field_on_http( |
| 70 bool displayed_password_field_on_http) { | 74 bool displayed_password_field_on_http) { |
| 71 displayed_password_field_on_http_ = displayed_password_field_on_http; | 75 displayed_password_field_on_http_ = displayed_password_field_on_http; |
| 72 } | 76 } |
| 73 void set_displayed_credit_card_field_on_http( | 77 void set_displayed_credit_card_field_on_http( |
| 74 bool displayed_credit_card_field_on_http) { | 78 bool displayed_credit_card_field_on_http) { |
| 75 displayed_credit_card_field_on_http_ = displayed_credit_card_field_on_http; | 79 displayed_credit_card_field_on_http_ = displayed_credit_card_field_on_http; |
| 76 } | 80 } |
| 77 | 81 |
| 78 void UseHttpUrl() { url_ = GURL(kHttpUrl); } | 82 void SetUrl(const GURL& url) { url_ = url; } |
| 79 | 83 |
| 80 std::unique_ptr<VisibleSecurityState> GetVisibleSecurityState() { | 84 std::unique_ptr<VisibleSecurityState> GetVisibleSecurityState() const { |
| 81 auto state = base::MakeUnique<VisibleSecurityState>(); | 85 auto state = base::MakeUnique<VisibleSecurityState>(); |
| 82 state->connection_info_initialized = true; | 86 state->connection_info_initialized = true; |
| 83 state->url = url_; | 87 state->url = url_; |
| 84 state->certificate = cert_; | 88 state->certificate = cert_; |
| 85 state->cert_status = cert_status_; | 89 state->cert_status = cert_status_; |
| 86 state->connection_status = connection_status_; | 90 state->connection_status = connection_status_; |
| 87 state->security_bits = 256; | 91 state->security_bits = 256; |
| 88 state->displayed_mixed_content = displayed_mixed_content_; | 92 state->displayed_mixed_content = displayed_mixed_content_; |
| 89 state->ran_mixed_content = ran_mixed_content_; | 93 state->ran_mixed_content = ran_mixed_content_; |
| 90 state->malicious_content_status = malicious_content_status_; | 94 state->malicious_content_status = malicious_content_status_; |
| 91 state->displayed_password_field_on_http = displayed_password_field_on_http_; | 95 state->displayed_password_field_on_http = displayed_password_field_on_http_; |
| 92 state->displayed_credit_card_field_on_http = | 96 state->displayed_credit_card_field_on_http = |
| 93 displayed_credit_card_field_on_http_; | 97 displayed_credit_card_field_on_http_; |
| 94 return state; | 98 return state; |
| 95 } | 99 } |
| 96 | 100 |
| 97 void GetSecurityInfo(SecurityInfo* security_info) { | 101 void GetSecurityInfo(SecurityInfo* security_info) const { |
|
estark
2017/01/19 22:42:51
thanks :)
meacer
2017/01/20 00:06:26
You're welcome :)
| |
| 98 security_state::GetSecurityInfo( | 102 security_state::GetSecurityInfo( |
| 99 GetVisibleSecurityState(), | 103 GetVisibleSecurityState(), |
| 100 false /* used policy installed certificate */, | 104 false /* used policy installed certificate */, |
| 101 base::Bind(&IsOriginSecure), security_info); | 105 base::Bind(&IsOriginSecure), security_info); |
| 102 } | 106 } |
| 103 | 107 |
| 104 private: | 108 private: |
| 105 GURL url_; | 109 GURL url_; |
| 106 scoped_refptr<net::X509Certificate> cert_; | 110 const scoped_refptr<net::X509Certificate> cert_; |
| 107 int connection_status_; | 111 int connection_status_; |
| 108 net::CertStatus cert_status_; | 112 net::CertStatus cert_status_; |
| 109 bool displayed_mixed_content_; | 113 bool displayed_mixed_content_; |
| 110 bool ran_mixed_content_; | 114 bool ran_mixed_content_; |
| 111 MaliciousContentStatus malicious_content_status_; | 115 MaliciousContentStatus malicious_content_status_; |
| 112 bool displayed_password_field_on_http_; | 116 bool displayed_password_field_on_http_; |
| 113 bool displayed_credit_card_field_on_http_; | 117 bool displayed_credit_card_field_on_http_; |
| 114 }; | 118 }; |
| 115 | 119 |
| 116 } // namespace | 120 } // namespace |
| (...skipping 128 matching lines...) Expand 10 before | Expand all | Expand 10 after Loading... | |
| 245 security_info.malicious_content_status); | 249 security_info.malicious_content_status); |
| 246 EXPECT_EQ(DANGEROUS, security_info.security_level); | 250 EXPECT_EQ(DANGEROUS, security_info.security_level); |
| 247 } | 251 } |
| 248 | 252 |
| 249 // Tests that password fields cause the security level to be downgraded | 253 // Tests that password fields cause the security level to be downgraded |
| 250 // to HTTP_SHOW_WARNING when the command-line switch is set. | 254 // to HTTP_SHOW_WARNING when the command-line switch is set. |
| 251 TEST(SecurityStateTest, PasswordFieldWarning) { | 255 TEST(SecurityStateTest, PasswordFieldWarning) { |
| 252 base::CommandLine::ForCurrentProcess()->AppendSwitchASCII( | 256 base::CommandLine::ForCurrentProcess()->AppendSwitchASCII( |
| 253 switches::kMarkHttpAs, switches::kMarkHttpWithPasswordsOrCcWithChip); | 257 switches::kMarkHttpAs, switches::kMarkHttpWithPasswordsOrCcWithChip); |
| 254 TestSecurityStateHelper helper; | 258 TestSecurityStateHelper helper; |
| 255 helper.UseHttpUrl(); | 259 helper.SetUrl(GURL(kHttpUrl)); |
| 256 helper.set_displayed_password_field_on_http(true); | 260 helper.set_displayed_password_field_on_http(true); |
| 257 SecurityInfo security_info; | 261 SecurityInfo security_info; |
| 258 helper.GetSecurityInfo(&security_info); | 262 helper.GetSecurityInfo(&security_info); |
| 259 EXPECT_TRUE(security_info.displayed_password_field_on_http); | 263 EXPECT_TRUE(security_info.displayed_password_field_on_http); |
| 260 EXPECT_EQ(HTTP_SHOW_WARNING, security_info.security_level); | 264 EXPECT_EQ(HTTP_SHOW_WARNING, security_info.security_level); |
| 261 } | 265 } |
| 262 | 266 |
| 267 // Tests that password fields cause the security level to be downgraded | |
| 268 // to HTTP_SHOW_WARNING on pseudo URLs when the command-line switch is set. | |
| 269 TEST(SecurityStateTest, PasswordFieldWarningOnPseudoUrls) { | |
| 270 base::CommandLine::ForCurrentProcess()->AppendSwitchASCII( | |
| 271 switches::kMarkHttpAs, switches::kMarkHttpWithPasswordsOrCcWithChip); | |
| 272 for (const char* const url : kPseudoUrls) { | |
| 273 TestSecurityStateHelper helper; | |
| 274 helper.SetUrl(GURL(url)); | |
| 275 helper.set_displayed_password_field_on_http(true); | |
| 276 SecurityInfo security_info; | |
| 277 helper.GetSecurityInfo(&security_info); | |
| 278 EXPECT_TRUE(security_info.displayed_password_field_on_http); | |
| 279 EXPECT_EQ(HTTP_SHOW_WARNING, security_info.security_level); | |
| 280 } | |
| 281 } | |
| 282 | |
| 263 // Tests that credit card fields cause the security level to be downgraded | 283 // Tests that credit card fields cause the security level to be downgraded |
| 264 // to HTTP_SHOW_WARNING when the command-line switch is set. | 284 // to HTTP_SHOW_WARNING when the command-line switch is set. |
| 265 TEST(SecurityStateTest, CreditCardFieldWarning) { | 285 TEST(SecurityStateTest, CreditCardFieldWarning) { |
| 266 base::CommandLine::ForCurrentProcess()->AppendSwitchASCII( | 286 base::CommandLine::ForCurrentProcess()->AppendSwitchASCII( |
| 267 switches::kMarkHttpAs, switches::kMarkHttpWithPasswordsOrCcWithChip); | 287 switches::kMarkHttpAs, switches::kMarkHttpWithPasswordsOrCcWithChip); |
| 268 TestSecurityStateHelper helper; | 288 TestSecurityStateHelper helper; |
| 269 helper.UseHttpUrl(); | 289 helper.SetUrl(GURL(kHttpUrl)); |
| 270 helper.set_displayed_credit_card_field_on_http(true); | 290 helper.set_displayed_credit_card_field_on_http(true); |
| 271 SecurityInfo security_info; | 291 SecurityInfo security_info; |
| 272 helper.GetSecurityInfo(&security_info); | 292 helper.GetSecurityInfo(&security_info); |
| 273 EXPECT_TRUE(security_info.displayed_credit_card_field_on_http); | 293 EXPECT_TRUE(security_info.displayed_credit_card_field_on_http); |
| 274 EXPECT_EQ(HTTP_SHOW_WARNING, security_info.security_level); | 294 EXPECT_EQ(HTTP_SHOW_WARNING, security_info.security_level); |
| 275 } | 295 } |
| 276 | 296 |
| 297 // Tests that credit card fields cause the security level to be downgraded | |
| 298 // to HTTP_SHOW_WARNING on pseudo URLs when the command-line switch is set. | |
| 299 TEST(SecurityStateTest, CreditCardFieldWarningOnPseudoUrls) { | |
| 300 base::CommandLine::ForCurrentProcess()->AppendSwitchASCII( | |
| 301 switches::kMarkHttpAs, switches::kMarkHttpWithPasswordsOrCcWithChip); | |
| 302 for (const char* const url : kPseudoUrls) { | |
| 303 TestSecurityStateHelper helper; | |
| 304 helper.SetUrl(GURL(url)); | |
| 305 helper.set_displayed_credit_card_field_on_http(true); | |
| 306 SecurityInfo security_info; | |
| 307 helper.GetSecurityInfo(&security_info); | |
| 308 EXPECT_TRUE(security_info.displayed_credit_card_field_on_http); | |
| 309 EXPECT_EQ(HTTP_SHOW_WARNING, security_info.security_level); | |
| 310 } | |
| 311 } | |
| 312 | |
| 277 // Tests that neither password nor credit fields cause the security | 313 // Tests that neither password nor credit fields cause the security |
| 278 // level to be downgraded to HTTP_SHOW_WARNING when the command-line switch | 314 // level to be downgraded to HTTP_SHOW_WARNING when the command-line switch |
| 279 // is NOT set. | 315 // is NOT set. |
| 280 TEST(SecurityStateTest, HttpWarningNotSetWithoutSwitch) { | 316 TEST(SecurityStateTest, HttpWarningNotSetWithoutSwitch) { |
| 281 TestSecurityStateHelper helper; | 317 TestSecurityStateHelper helper; |
| 282 helper.UseHttpUrl(); | 318 helper.SetUrl(GURL(kHttpUrl)); |
| 283 helper.set_displayed_password_field_on_http(true); | 319 helper.set_displayed_password_field_on_http(true); |
| 284 SecurityInfo security_info; | 320 SecurityInfo security_info; |
| 285 helper.GetSecurityInfo(&security_info); | 321 helper.GetSecurityInfo(&security_info); |
| 286 EXPECT_TRUE(security_info.displayed_password_field_on_http); | 322 EXPECT_TRUE(security_info.displayed_password_field_on_http); |
| 287 EXPECT_EQ(NONE, security_info.security_level); | 323 EXPECT_EQ(NONE, security_info.security_level); |
| 288 | 324 |
| 289 helper.set_displayed_credit_card_field_on_http(true); | 325 helper.set_displayed_credit_card_field_on_http(true); |
| 290 helper.GetSecurityInfo(&security_info); | 326 helper.GetSecurityInfo(&security_info); |
| 291 EXPECT_TRUE(security_info.displayed_credit_card_field_on_http); | 327 EXPECT_TRUE(security_info.displayed_credit_card_field_on_http); |
| 292 EXPECT_EQ(NONE, security_info.security_level); | 328 EXPECT_EQ(NONE, security_info.security_level); |
| 293 } | 329 } |
| 294 | 330 |
| 331 // Tests that neither password nor credit fields cause the security | |
| 332 // level to be downgraded to HTTP_SHOW_WARNING on pseudo URLs when the | |
| 333 // command-line switch is NOT set. | |
|
estark
2017/01/19 22:42:51
This will probably conflict with https://coderevie
meacer
2017/01/20 00:06:26
Thanks for the heads up. I'll wait for that CL to
| |
| 334 TEST(SecurityStateTest, HttpWarningNotSetWithoutSwitchOnPseudoUrls) { | |
| 335 for (const char* const url : kPseudoUrls) { | |
| 336 TestSecurityStateHelper helper; | |
| 337 helper.SetUrl(GURL(url)); | |
| 338 helper.set_displayed_password_field_on_http(true); | |
| 339 SecurityInfo security_info; | |
| 340 helper.GetSecurityInfo(&security_info); | |
| 341 EXPECT_TRUE(security_info.displayed_password_field_on_http); | |
| 342 EXPECT_EQ(NONE, security_info.security_level); | |
| 343 | |
| 344 helper.set_displayed_credit_card_field_on_http(true); | |
| 345 helper.GetSecurityInfo(&security_info); | |
| 346 EXPECT_TRUE(security_info.displayed_credit_card_field_on_http); | |
| 347 EXPECT_EQ(NONE, security_info.security_level); | |
| 348 } | |
| 349 } | |
| 350 | |
| 295 // Tests that neither |displayed_password_field_on_http| nor | 351 // Tests that neither |displayed_password_field_on_http| nor |
| 296 // |displayed_credit_card_field_on_http| is set when the corresponding | 352 // |displayed_credit_card_field_on_http| is set when the corresponding |
| 297 // VisibleSecurityState flags are not set. | 353 // VisibleSecurityState flags are not set. |
| 298 TEST(SecurityStateTest, PrivateUserDataNotSet) { | 354 TEST(SecurityStateTest, PrivateUserDataNotSet) { |
| 299 TestSecurityStateHelper helper; | 355 TestSecurityStateHelper helper; |
| 300 helper.UseHttpUrl(); | 356 helper.SetUrl(GURL(kHttpUrl)); |
| 301 SecurityInfo security_info; | 357 SecurityInfo security_info; |
| 302 helper.GetSecurityInfo(&security_info); | 358 helper.GetSecurityInfo(&security_info); |
| 303 EXPECT_FALSE(security_info.displayed_password_field_on_http); | 359 EXPECT_FALSE(security_info.displayed_password_field_on_http); |
| 304 EXPECT_FALSE(security_info.displayed_credit_card_field_on_http); | 360 EXPECT_FALSE(security_info.displayed_credit_card_field_on_http); |
| 305 EXPECT_EQ(NONE, security_info.security_level); | 361 EXPECT_EQ(NONE, security_info.security_level); |
| 306 } | 362 } |
| 307 | 363 |
| 364 // Tests that neither |displayed_password_field_on_http| nor | |
| 365 // |displayed_credit_card_field_on_http| is set on pseudo URLs when the | |
| 366 // corresponding VisibleSecurityState flags are not set. | |
| 367 TEST(SecurityStateTest, PrivateUserDataNotSetOnPseudoUrls) { | |
| 368 for (const char* const url : kPseudoUrls) { | |
| 369 TestSecurityStateHelper helper; | |
| 370 helper.SetUrl(GURL(url)); | |
| 371 SecurityInfo security_info; | |
| 372 helper.GetSecurityInfo(&security_info); | |
| 373 EXPECT_FALSE(security_info.displayed_password_field_on_http); | |
| 374 EXPECT_FALSE(security_info.displayed_credit_card_field_on_http); | |
| 375 EXPECT_EQ(NONE, security_info.security_level); | |
| 376 } | |
| 377 } | |
| 378 | |
| 308 // Tests that SSL.MarkHttpAsStatus histogram is updated when security state is | 379 // Tests that SSL.MarkHttpAsStatus histogram is updated when security state is |
| 309 // computed for a page. | 380 // computed for a page. |
| 310 TEST(SecurityStateTest, MarkHttpAsStatusHistogram) { | 381 TEST(SecurityStateTest, MarkHttpAsStatusHistogram) { |
| 311 const char* kHistogramName = "SSL.MarkHttpAsStatus"; | 382 const char* kHistogramName = "SSL.MarkHttpAsStatus"; |
| 312 base::HistogramTester histograms; | 383 base::HistogramTester histograms; |
| 313 base::CommandLine::ForCurrentProcess()->AppendSwitchASCII( | 384 base::CommandLine::ForCurrentProcess()->AppendSwitchASCII( |
| 314 switches::kMarkHttpAs, switches::kMarkHttpWithPasswordsOrCcWithChip); | 385 switches::kMarkHttpAs, switches::kMarkHttpWithPasswordsOrCcWithChip); |
| 315 TestSecurityStateHelper helper; | 386 TestSecurityStateHelper helper; |
| 316 helper.UseHttpUrl(); | 387 helper.SetUrl(GURL(kHttpUrl)); |
| 317 | 388 |
| 318 // Ensure histogram recorded correctly when a non-secure password input is | 389 // Ensure histogram recorded correctly when a non-secure password input is |
| 319 // found on the page. | 390 // found on the page. |
| 320 helper.set_displayed_password_field_on_http(true); | 391 helper.set_displayed_password_field_on_http(true); |
| 321 SecurityInfo security_info; | 392 SecurityInfo security_info; |
| 322 histograms.ExpectTotalCount(kHistogramName, 0); | 393 histograms.ExpectTotalCount(kHistogramName, 0); |
| 323 helper.GetSecurityInfo(&security_info); | 394 helper.GetSecurityInfo(&security_info); |
| 324 histograms.ExpectUniqueSample(kHistogramName, 2 /* HTTP_SHOW_WARNING */, 1); | 395 histograms.ExpectUniqueSample(kHistogramName, 2 /* HTTP_SHOW_WARNING */, 1); |
| 325 | 396 |
| 326 // Ensure histogram recorded correctly even without a password input. | 397 // Ensure histogram recorded correctly even without a password input. |
| 327 helper.set_displayed_password_field_on_http(false); | 398 helper.set_displayed_password_field_on_http(false); |
| 328 helper.GetSecurityInfo(&security_info); | 399 helper.GetSecurityInfo(&security_info); |
| 329 histograms.ExpectUniqueSample(kHistogramName, 2 /* HTTP_SHOW_WARNING */, 2); | 400 histograms.ExpectUniqueSample(kHistogramName, 2 /* HTTP_SHOW_WARNING */, 2); |
| 330 } | 401 } |
| 331 | 402 |
| 332 } // namespace security_state | 403 } // namespace security_state |
| OLD | NEW |
