Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(514)

Issues Search
    My Issues | Starred     Open | Closed | All

Side by Side Diff: net/http/http_security_headers_unittest.cc

Issue 2753703002: Add Expect-CT header parsing (Closed)
Patch Set: comment tweaks Created 3 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« net/http/http_security_headers.cc ('K') | « net/http/http_security_headers_expect_ct_fuzzer.cc ('k') | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include <stdint.h> 5 #include <stdint.h>
6 #include <algorithm> 6 #include <algorithm>
7 7
8 #include "base/base64.h" 8 #include "base/base64.h"
9 #include "base/strings/string_piece.h" 9 #include "base/strings/string_piece.h"
10 #include "crypto/sha2.h" 10 #include "crypto/sha2.h"
(...skipping 887 matching lines...) Expand 10 before | Expand all | Expand 10 after
898 898
899 // The old pins must still exist. 899 // The old pins must still exist.
900 EXPECT_TRUE(state.HasPublicKeyPins("example.com")); 900 EXPECT_TRUE(state.HasPublicKeyPins("example.com"));
901 EXPECT_EQ(TransportSecurityState::PKPStatus::OK, 901 EXPECT_EQ(TransportSecurityState::PKPStatus::OK,
902 state.CheckPublicKeyPins( 902 state.CheckPublicKeyPins(
903 domain_port, is_issued_by_known_root, 903 domain_port, is_issued_by_known_root,
904 ssl_info.public_key_hashes, nullptr, nullptr, 904 ssl_info.public_key_hashes, nullptr, nullptr,
905 TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log)); 905 TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log));
906 } 906 }
907 907
908 TEST_F(HttpSecurityHeadersTest, BogusExpectCTHeaders) {
909 base::TimeDelta max_age;
910 bool enforce = false;
911 GURL report_uri;
912 EXPECT_FALSE(
913 ParseExpectCTHeader(std::string(), &max_age, &enforce, &report_uri));
914 EXPECT_FALSE(ParseExpectCTHeader(" ", &max_age, &enforce, &report_uri));
915 EXPECT_FALSE(ParseExpectCTHeader("abc", &max_age, &enforce, &report_uri));
916 EXPECT_FALSE(ParseExpectCTHeader(" abc", &max_age, &enforce, &report_uri));
917 EXPECT_FALSE(
918 ParseExpectCTHeader(" abc ", &max_age, &enforce, &report_uri));
919 EXPECT_FALSE(ParseExpectCTHeader("max-age", &max_age, &enforce, &report_uri));
920 EXPECT_FALSE(
921 ParseExpectCTHeader(" max-age", &max_age, &enforce, &report_uri));
922 EXPECT_FALSE(
923 ParseExpectCTHeader(" max-age ", &max_age, &enforce, &report_uri));
924 EXPECT_FALSE(
925 ParseExpectCTHeader("max-age=", &max_age, &enforce, &report_uri));
926 EXPECT_FALSE(
927 ParseExpectCTHeader(" max-age=", &max_age, &enforce, &report_uri));
928 EXPECT_FALSE(
929 ParseExpectCTHeader(" max-age =", &max_age, &enforce, &report_uri));
930 EXPECT_FALSE(
931 ParseExpectCTHeader(" max-age= ", &max_age, &enforce, &report_uri));
932 EXPECT_FALSE(ParseExpectCTHeader(" max-age = ", &max_age, &enforce,
933 &report_uri));
934 EXPECT_FALSE(ParseExpectCTHeader(" max-age = xy", &max_age, &enforce,
935 &report_uri));
936 EXPECT_FALSE(ParseExpectCTHeader(" max-age = 3488a923", &max_age,
937 &enforce, &report_uri));
938 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488a923 ", &max_age, &enforce,
939 &report_uri));
940 EXPECT_FALSE(
941 ParseExpectCTHeader("max-ag=3488923", &max_age, &enforce, &report_uri));
942 EXPECT_FALSE(
943 ParseExpectCTHeader("max-aged=3488923", &max_age, &enforce, &report_uri));
944 EXPECT_FALSE(
945 ParseExpectCTHeader("max-age==3488923", &max_age, &enforce, &report_uri));
946 EXPECT_FALSE(
947 ParseExpectCTHeader("amax-age=3488923", &max_age, &enforce, &report_uri));
948 EXPECT_FALSE(
949 ParseExpectCTHeader("max-age=-3488923", &max_age, &enforce, &report_uri));
950 EXPECT_FALSE(
951 ParseExpectCTHeader("max-age=+3488923", &max_age, &enforce, &report_uri));
952 EXPECT_FALSE(
953 ParseExpectCTHeader("max-age=13####", &max_age, &enforce, &report_uri));
954 EXPECT_FALSE(ParseExpectCTHeader("max-age=9223372036854775807#####", &max_age,
955 &enforce, &report_uri));
956 EXPECT_FALSE(ParseExpectCTHeader("max-age=18446744073709551615####", &max_age,
957 &enforce, &report_uri));
958 EXPECT_FALSE(ParseExpectCTHeader("max-age=999999999999999999999999$.&#!",
959 &max_age, &enforce, &report_uri));
960 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 e", &max_age, &enforce,
961 &report_uri));
962 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomain",
963 &max_age, &enforce, &report_uri));
964 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923includesubdomains", &max_age,
965 &enforce, &report_uri));
966 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923=includesubdomains",
967 &max_age, &enforce, &report_uri));
968 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomainx",
969 &max_age, &enforce, &report_uri));
970 EXPECT_FALSE(ParseExpectCTHeader(
971 "max-age=3488923 includesubdomain=", &max_age, &enforce, &report_uri));
972 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomain=true",
973 &max_age, &enforce, &report_uri));
974 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomainsx",
975 &max_age, &enforce, &report_uri));
976 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomains x",
977 &max_age, &enforce, &report_uri));
978 EXPECT_FALSE(ParseExpectCTHeader("max-age=34889.23 includesubdomains",
979 &max_age, &enforce, &report_uri));
980 EXPECT_FALSE(ParseExpectCTHeader("max-age=34889 includesubdomains", &max_age,
981 &enforce, &report_uri));
982 EXPECT_FALSE(
983 ParseExpectCTHeader(",,,, ,,,", &max_age, &enforce, &report_uri));
984 EXPECT_FALSE(ParseExpectCTHeader(",,,, includeSubDomains,,,", &max_age,
985 &enforce, &report_uri));
986 EXPECT_FALSE(ParseExpectCTHeader(" includeSubDomains, ", &max_age,
987 &enforce, &report_uri));
988 EXPECT_FALSE(ParseExpectCTHeader(",", &max_age, &enforce, &report_uri));
989 EXPECT_FALSE(
990 ParseExpectCTHeader("max-age, ,", &max_age, &enforce, &report_uri));
991
992 // Test that the parser rejects misquoted or invalid report-uris.
993 EXPECT_FALSE(ParseExpectCTHeader("max-age=999, report-uri=\"http://foo;bar\'",
994 &max_age, &enforce, &report_uri));
995 EXPECT_FALSE(ParseExpectCTHeader("max-age=999, report-uri=\"foo;bar\"",
996 &max_age, &enforce, &report_uri));
997 EXPECT_FALSE(ParseExpectCTHeader("max-age=999, report-uri=http://blah",
998 &max_age, &enforce, &report_uri));
999 EXPECT_FALSE(ParseExpectCTHeader("max-age=999, report-uri=\"\"", &max_age,
1000 &enforce, &report_uri));
1001
1002 // Check the out args were not updated by checking the default
1003 // values for its predictable fields.
1004 EXPECT_EQ(0, max_age.InSeconds());
1005 EXPECT_FALSE(enforce);
1006 EXPECT_TRUE(report_uri.is_empty());
1007 }
1008
1009 TEST_F(HttpSecurityHeadersTest, ValidExpectCTHeaders) {
1010 base::TimeDelta max_age;
1011 bool enforce = false;
1012 GURL report_uri;
1013
1014 EXPECT_TRUE(
1015 ParseExpectCTHeader("max-age=243", &max_age, &enforce, &report_uri));
1016 EXPECT_EQ(base::TimeDelta::FromSeconds(243), max_age);
1017 EXPECT_FALSE(enforce);
1018 EXPECT_TRUE(report_uri.is_empty());
1019
1020 EXPECT_TRUE(ParseExpectCTHeader(" Max-agE = 567", &max_age, &enforce,
1021 &report_uri));
1022 EXPECT_EQ(base::TimeDelta::FromSeconds(567), max_age);
1023 EXPECT_FALSE(enforce);
1024 EXPECT_TRUE(report_uri.is_empty());
1025
1026 EXPECT_TRUE(ParseExpectCTHeader(" mAx-aGe = 890 ", &max_age,
1027 &enforce, &report_uri));
1028 EXPECT_EQ(base::TimeDelta::FromSeconds(890), max_age);
1029 EXPECT_FALSE(enforce);
1030 EXPECT_TRUE(report_uri.is_empty());
1031
1032 EXPECT_TRUE(ParseExpectCTHeader("max-age=123,enFoRce", &max_age, &enforce,
1033 &report_uri));
1034 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1035 EXPECT_TRUE(enforce);
1036 EXPECT_TRUE(report_uri.is_empty());
1037
1038 enforce = false;
1039 EXPECT_TRUE(ParseExpectCTHeader("enFoRCE, max-age=123", &max_age, &enforce,
1040 &report_uri));
1041 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1042 EXPECT_TRUE(enforce);
1043 EXPECT_TRUE(report_uri.is_empty());
1044
1045 enforce = false;
1046 EXPECT_TRUE(ParseExpectCTHeader(" enFORce, max-age=123", &max_age, &enforce,
1047 &report_uri));
1048 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1049 EXPECT_TRUE(enforce);
1050 EXPECT_TRUE(report_uri.is_empty());
1051
1052 enforce = false;
1053 EXPECT_TRUE(ParseExpectCTHeader(
1054 "report-uri=\"https://foo.test\", enFORce, max-age=123", &max_age,
1055 &enforce, &report_uri));
1056 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1057 EXPECT_TRUE(enforce);
1058 EXPECT_EQ(GURL("https://foo.test"), report_uri);
1059
1060 enforce = false;
1061 report_uri = GURL();
1062 EXPECT_TRUE(
1063 ParseExpectCTHeader("enforce,report-uri=\"https://foo.test\",max-age=123",
1064 &max_age, &enforce, &report_uri));
1065 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1066 EXPECT_TRUE(enforce);
1067 EXPECT_EQ(GURL("https://foo.test"), report_uri);
1068
1069 report_uri = GURL();
1070 enforce = false;
1071 EXPECT_TRUE(ParseExpectCTHeader("report-uri=\"https://foo.test\",max-age=123",
1072 &max_age, &enforce, &report_uri));
1073 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1074 EXPECT_FALSE(enforce);
1075 EXPECT_EQ(GURL("https://foo.test"), report_uri);
1076
1077 report_uri = GURL();
1078 EXPECT_TRUE(ParseExpectCTHeader(" enFORcE, max-age=123, pumpkin=kitten",
1079 &max_age, &enforce, &report_uri));
1080 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1081 EXPECT_TRUE(enforce);
1082 EXPECT_TRUE(report_uri.is_empty());
1083
1084 enforce = false;
1085 EXPECT_TRUE(ParseExpectCTHeader(
1086 " pumpkin=894, report-uri= \"https://bar\", enFORce, max-age=123 ",
1087 &max_age, &enforce, &report_uri));
1088 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1089 EXPECT_TRUE(enforce);
1090 EXPECT_EQ(GURL("https://bar"), report_uri);
1091
1092 enforce = false;
1093 report_uri = GURL();
1094 EXPECT_TRUE(ParseExpectCTHeader(" pumpkin, enFoRcE, max-age=123 ",
1095 &max_age, &enforce, &report_uri));
1096 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1097 EXPECT_TRUE(enforce);
1098 EXPECT_TRUE(report_uri.is_empty());
1099
1100 enforce = false;
1101 EXPECT_TRUE(ParseExpectCTHeader(" pumpkin, enforce, max-age=\"123\" ",
1102 &max_age, &enforce, &report_uri));
1103 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1104 EXPECT_TRUE(enforce);
1105 EXPECT_TRUE(report_uri.is_empty());
1106
1107 enforce = false;
1108 EXPECT_TRUE(ParseExpectCTHeader(
1109 "animal=\"squirrel, distinguished\", enFoRce, max-age=123", &max_age,
1110 &enforce, &report_uri));
1111 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1112 EXPECT_TRUE(enforce);
1113 EXPECT_TRUE(report_uri.is_empty());
1114
1115 enforce = false;
1116 EXPECT_TRUE(ParseExpectCTHeader("max-age=394082, enforce", &max_age,
1117 &enforce, &report_uri));
1118 EXPECT_EQ(base::TimeDelta::FromSeconds(394082), max_age);
1119 EXPECT_TRUE(enforce);
1120 EXPECT_TRUE(report_uri.is_empty());
1121
1122 enforce = false;
1123 EXPECT_TRUE(ParseExpectCTHeader("max-age=39408299 ,enforce", &max_age,
1124 &enforce, &report_uri));
1125 EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
1126 EXPECT_TRUE(enforce);
1127 EXPECT_TRUE(report_uri.is_empty());
1128
1129 enforce = false;
1130 EXPECT_TRUE(ParseExpectCTHeader(",, max-age=394082038 , enfoRce, ,",
mattm 2017/04/20 05:48:29 shouldn't this be invalid? (separators can only co
estark 2017/04/20 22:36:08 You would think so, but buried in RFC 7230, it say
1131 &max_age, &enforce, &report_uri));
1132 EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
1133 EXPECT_TRUE(enforce);
1134 EXPECT_TRUE(report_uri.is_empty());
1135
1136 enforce = false;
1137 EXPECT_TRUE(ParseExpectCTHeader(",, max-age=394082038 ,", &max_age, &enforce,
1138 &report_uri));
1139 EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
1140 EXPECT_FALSE(enforce);
1141 EXPECT_TRUE(report_uri.is_empty());
1142
1143 EXPECT_TRUE(
1144 ParseExpectCTHeader(",, , , max-age=394082038,,, enforce ,, ,",
1145 &max_age, &enforce, &report_uri));
1146 EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
1147 EXPECT_TRUE(enforce);
1148 EXPECT_TRUE(report_uri.is_empty());
1149
1150 enforce = false;
1151 EXPECT_TRUE(ParseExpectCTHeader("enfORce , max-age=394082038 ,,", &max_age,
1152 &enforce, &report_uri));
1153 EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
1154 EXPECT_TRUE(enforce);
1155 EXPECT_TRUE(report_uri.is_empty());
1156
1157 enforce = false;
1158 EXPECT_TRUE(ParseExpectCTHeader(" max-age=0 , enforce ", &max_age,
1159 &enforce, &report_uri));
1160 EXPECT_EQ(base::TimeDelta::FromSeconds(0), max_age);
1161 EXPECT_TRUE(enforce);
1162 EXPECT_TRUE(report_uri.is_empty());
1163
1164 enforce = false;
1165 EXPECT_TRUE(ParseExpectCTHeader(
1166 " max-age=999999999999999999999999999999999999999999999 ,"
1167 " enforce ",
1168 &max_age, &enforce, &report_uri));
1169 EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
1170 EXPECT_TRUE(enforce);
1171 EXPECT_TRUE(report_uri.is_empty());
1172 }
1173
908 }; // namespace net 1174 }; // namespace net
OLDNEW
« net/http/http_security_headers.cc ('K') | « net/http/http_security_headers_expect_ct_fuzzer.cc ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698