Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(25)

Issues Search
    My Issues | Starred     Open | Closed | All

Side by Side Diff: net/http/http_security_headers_unittest.cc

Issue 2753703002: Add Expect-CT header parsing (Closed)
Patch Set: add txt extensions to seed corpus Created 3 years, 8 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View unified diff | Download patch
« no previous file with comments | « net/http/http_security_headers_expect_ct_fuzzer.cc ('k') | no next file » | no next file with comments »
Toggle Intra-line Diffs ('i') | Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
OLDNEW
1 // Copyright (c) 2012 The Chromium Authors. All rights reserved. 1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
2 // Use of this source code is governed by a BSD-style license that can be 2 // Use of this source code is governed by a BSD-style license that can be
3 // found in the LICENSE file. 3 // found in the LICENSE file.
4 4
5 #include <stdint.h> 5 #include <stdint.h>
6 #include <algorithm> 6 #include <algorithm>
7 7
8 #include "base/base64.h" 8 #include "base/base64.h"
9 #include "base/strings/string_piece.h" 9 #include "base/strings/string_piece.h"
10 #include "crypto/sha2.h" 10 #include "crypto/sha2.h"
(...skipping 887 matching lines...) Expand 10 before | Expand all | Expand 10 after
898 898
899 // The old pins must still exist. 899 // The old pins must still exist.
900 EXPECT_TRUE(state.HasPublicKeyPins("example.com")); 900 EXPECT_TRUE(state.HasPublicKeyPins("example.com"));
901 EXPECT_EQ(TransportSecurityState::PKPStatus::OK, 901 EXPECT_EQ(TransportSecurityState::PKPStatus::OK,
902 state.CheckPublicKeyPins( 902 state.CheckPublicKeyPins(
903 domain_port, is_issued_by_known_root, 903 domain_port, is_issued_by_known_root,
904 ssl_info.public_key_hashes, nullptr, nullptr, 904 ssl_info.public_key_hashes, nullptr, nullptr,
905 TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log)); 905 TransportSecurityState::DISABLE_PIN_REPORTS, &failure_log));
906 } 906 }
907 907
908 TEST_F(HttpSecurityHeadersTest, BogusExpectCTHeaders) {
909 base::TimeDelta max_age;
910 bool enforce = false;
911 GURL report_uri;
912 EXPECT_FALSE(
913 ParseExpectCTHeader(std::string(), &max_age, &enforce, &report_uri));
914 EXPECT_FALSE(ParseExpectCTHeader(" ", &max_age, &enforce, &report_uri));
915 EXPECT_FALSE(ParseExpectCTHeader("abc", &max_age, &enforce, &report_uri));
916 EXPECT_FALSE(ParseExpectCTHeader(" abc", &max_age, &enforce, &report_uri));
917 EXPECT_FALSE(
918 ParseExpectCTHeader(" abc ", &max_age, &enforce, &report_uri));
919 EXPECT_FALSE(ParseExpectCTHeader("max-age", &max_age, &enforce, &report_uri));
920 EXPECT_FALSE(
921 ParseExpectCTHeader(" max-age", &max_age, &enforce, &report_uri));
922 EXPECT_FALSE(
923 ParseExpectCTHeader(" max-age ", &max_age, &enforce, &report_uri));
924 EXPECT_FALSE(
925 ParseExpectCTHeader("max-age=", &max_age, &enforce, &report_uri));
926 EXPECT_FALSE(
927 ParseExpectCTHeader(" max-age=", &max_age, &enforce, &report_uri));
928 EXPECT_FALSE(
929 ParseExpectCTHeader(" max-age =", &max_age, &enforce, &report_uri));
930 EXPECT_FALSE(
931 ParseExpectCTHeader(" max-age= ", &max_age, &enforce, &report_uri));
932 EXPECT_FALSE(ParseExpectCTHeader(" max-age = ", &max_age, &enforce,
933 &report_uri));
934 EXPECT_FALSE(ParseExpectCTHeader(" max-age = xy", &max_age, &enforce,
935 &report_uri));
936 EXPECT_FALSE(ParseExpectCTHeader(" max-age = 3488a923", &max_age,
937 &enforce, &report_uri));
938 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488a923 ", &max_age, &enforce,
939 &report_uri));
940 EXPECT_FALSE(
941 ParseExpectCTHeader("max-ag=3488923", &max_age, &enforce, &report_uri));
942 EXPECT_FALSE(
943 ParseExpectCTHeader("max-aged=3488923", &max_age, &enforce, &report_uri));
944 EXPECT_FALSE(
945 ParseExpectCTHeader("max-age==3488923", &max_age, &enforce, &report_uri));
946 EXPECT_FALSE(
947 ParseExpectCTHeader("amax-age=3488923", &max_age, &enforce, &report_uri));
948 EXPECT_FALSE(
949 ParseExpectCTHeader("max-age=-3488923", &max_age, &enforce, &report_uri));
950 EXPECT_FALSE(
951 ParseExpectCTHeader("max-age=+3488923", &max_age, &enforce, &report_uri));
952 EXPECT_FALSE(
953 ParseExpectCTHeader("max-age=13####", &max_age, &enforce, &report_uri));
954 EXPECT_FALSE(ParseExpectCTHeader("max-age=9223372036854775807#####", &max_age,
955 &enforce, &report_uri));
956 EXPECT_FALSE(ParseExpectCTHeader("max-age=18446744073709551615####", &max_age,
957 &enforce, &report_uri));
958 EXPECT_FALSE(ParseExpectCTHeader("max-age=999999999999999999999999$.&#!",
959 &max_age, &enforce, &report_uri));
960 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 e", &max_age, &enforce,
961 &report_uri));
962 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomain",
963 &max_age, &enforce, &report_uri));
964 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923includesubdomains", &max_age,
965 &enforce, &report_uri));
966 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923=includesubdomains",
967 &max_age, &enforce, &report_uri));
968 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomainx",
969 &max_age, &enforce, &report_uri));
970 EXPECT_FALSE(ParseExpectCTHeader(
971 "max-age=3488923 includesubdomain=", &max_age, &enforce, &report_uri));
972 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomain=true",
973 &max_age, &enforce, &report_uri));
974 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomainsx",
975 &max_age, &enforce, &report_uri));
976 EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomains x",
977 &max_age, &enforce, &report_uri));
978 EXPECT_FALSE(ParseExpectCTHeader("max-age=34889.23 includesubdomains",
979 &max_age, &enforce, &report_uri));
980 EXPECT_FALSE(ParseExpectCTHeader("max-age=34889 includesubdomains", &max_age,
981 &enforce, &report_uri));
982 EXPECT_FALSE(
983 ParseExpectCTHeader(",,,, ,,,", &max_age, &enforce, &report_uri));
984 EXPECT_FALSE(ParseExpectCTHeader(",,,, includeSubDomains,,,", &max_age,
985 &enforce, &report_uri));
986 EXPECT_FALSE(ParseExpectCTHeader(" includeSubDomains, ", &max_age,
987 &enforce, &report_uri));
988 EXPECT_FALSE(ParseExpectCTHeader(",", &max_age, &enforce, &report_uri));
989 EXPECT_FALSE(
990 ParseExpectCTHeader("max-age, ,", &max_age, &enforce, &report_uri));
991
992 // Test that the parser rejects misquoted or invalid report-uris.
993 EXPECT_FALSE(ParseExpectCTHeader("max-age=999, report-uri=\"http://foo;bar\'",
994 &max_age, &enforce, &report_uri));
995 EXPECT_FALSE(ParseExpectCTHeader("max-age=999, report-uri=\"foo;bar\"",
996 &max_age, &enforce, &report_uri));
997 EXPECT_FALSE(ParseExpectCTHeader("max-age=999, report-uri=http://blah",
998 &max_age, &enforce, &report_uri));
999 EXPECT_FALSE(ParseExpectCTHeader("max-age=999, report-uri=\"\"", &max_age,
1000 &enforce, &report_uri));
1001
1002 // Test that the parser does not fix up misquoted values.
1003 EXPECT_FALSE(
1004 ParseExpectCTHeader("max-age=\"999", &max_age, &enforce, &report_uri));
1005
1006 // Test that the parser rejects headers that contain duplicate directives.
1007 EXPECT_FALSE(ParseExpectCTHeader("max-age=999, enforce, max-age=99999",
1008 &max_age, &enforce, &report_uri));
1009 EXPECT_FALSE(ParseExpectCTHeader("enforce, max-age=999, enforce", &max_age,
1010 &enforce, &report_uri));
1011 EXPECT_FALSE(
1012 ParseExpectCTHeader("report-uri=\"http://foo\", max-age=999, enforce, "
1013 "report-uri=\"http://foo\"",
1014 &max_age, &enforce, &report_uri));
1015
1016 // Test that the parser rejects headers with values for the valueless
1017 // 'enforce' directive.
1018 EXPECT_FALSE(ParseExpectCTHeader("max-age=999, enforce=true", &max_age,
1019 &enforce, &report_uri));
1020
1021 // Check the out args were not updated by checking the default
1022 // values for its predictable fields.
1023 EXPECT_EQ(0, max_age.InSeconds());
1024 EXPECT_FALSE(enforce);
1025 EXPECT_TRUE(report_uri.is_empty());
1026 }
1027
1028 TEST_F(HttpSecurityHeadersTest, ValidExpectCTHeaders) {
1029 base::TimeDelta max_age;
1030 bool enforce = false;
1031 GURL report_uri;
1032
1033 EXPECT_TRUE(
1034 ParseExpectCTHeader("max-age=243", &max_age, &enforce, &report_uri));
1035 EXPECT_EQ(base::TimeDelta::FromSeconds(243), max_age);
1036 EXPECT_FALSE(enforce);
1037 EXPECT_TRUE(report_uri.is_empty());
1038
1039 EXPECT_TRUE(ParseExpectCTHeader(" Max-agE = 567", &max_age, &enforce,
1040 &report_uri));
1041 EXPECT_EQ(base::TimeDelta::FromSeconds(567), max_age);
1042 EXPECT_FALSE(enforce);
1043 EXPECT_TRUE(report_uri.is_empty());
1044
1045 EXPECT_TRUE(ParseExpectCTHeader(" mAx-aGe = 890 ", &max_age,
1046 &enforce, &report_uri));
1047 EXPECT_EQ(base::TimeDelta::FromSeconds(890), max_age);
1048 EXPECT_FALSE(enforce);
1049 EXPECT_TRUE(report_uri.is_empty());
1050
1051 EXPECT_TRUE(ParseExpectCTHeader("max-age=123,enFoRce", &max_age, &enforce,
1052 &report_uri));
1053 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1054 EXPECT_TRUE(enforce);
1055 EXPECT_TRUE(report_uri.is_empty());
1056
1057 enforce = false;
1058 EXPECT_TRUE(ParseExpectCTHeader("enFoRCE, max-age=123", &max_age, &enforce,
1059 &report_uri));
1060 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1061 EXPECT_TRUE(enforce);
1062 EXPECT_TRUE(report_uri.is_empty());
1063
1064 enforce = false;
1065 EXPECT_TRUE(ParseExpectCTHeader(" enFORce, max-age=123", &max_age, &enforce,
1066 &report_uri));
1067 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1068 EXPECT_TRUE(enforce);
1069 EXPECT_TRUE(report_uri.is_empty());
1070
1071 enforce = false;
1072 EXPECT_TRUE(ParseExpectCTHeader(
1073 "report-uri=\"https://foo.test\", enFORce, max-age=123", &max_age,
1074 &enforce, &report_uri));
1075 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1076 EXPECT_TRUE(enforce);
1077 EXPECT_EQ(GURL("https://foo.test"), report_uri);
1078
1079 enforce = false;
1080 report_uri = GURL();
1081 EXPECT_TRUE(
1082 ParseExpectCTHeader("enforce,report-uri=\"https://foo.test\",max-age=123",
1083 &max_age, &enforce, &report_uri));
1084 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1085 EXPECT_TRUE(enforce);
1086 EXPECT_EQ(GURL("https://foo.test"), report_uri);
1087
1088 report_uri = GURL();
1089 enforce = false;
1090 EXPECT_TRUE(ParseExpectCTHeader("report-uri=\"https://foo.test\",max-age=123",
1091 &max_age, &enforce, &report_uri));
1092 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1093 EXPECT_FALSE(enforce);
1094 EXPECT_EQ(GURL("https://foo.test"), report_uri);
1095
1096 report_uri = GURL();
1097 EXPECT_TRUE(ParseExpectCTHeader(" enFORcE, max-age=123, pumpkin=kitten",
1098 &max_age, &enforce, &report_uri));
1099 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1100 EXPECT_TRUE(enforce);
1101 EXPECT_TRUE(report_uri.is_empty());
1102
1103 enforce = false;
1104 EXPECT_TRUE(ParseExpectCTHeader(
1105 " pumpkin=894, report-uri= \"https://bar\", enFORce, max-age=123 ",
1106 &max_age, &enforce, &report_uri));
1107 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1108 EXPECT_TRUE(enforce);
1109 EXPECT_EQ(GURL("https://bar"), report_uri);
1110
1111 enforce = false;
1112 report_uri = GURL();
1113 EXPECT_TRUE(ParseExpectCTHeader(" pumpkin, enFoRcE, max-age=123 ",
1114 &max_age, &enforce, &report_uri));
1115 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1116 EXPECT_TRUE(enforce);
1117 EXPECT_TRUE(report_uri.is_empty());
1118
1119 enforce = false;
1120 EXPECT_TRUE(ParseExpectCTHeader(" pumpkin, enforce, max-age=\"123\" ",
1121 &max_age, &enforce, &report_uri));
1122 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1123 EXPECT_TRUE(enforce);
1124 EXPECT_TRUE(report_uri.is_empty());
1125
1126 enforce = false;
1127 EXPECT_TRUE(ParseExpectCTHeader(
1128 "animal=\"squirrel, distinguished\", enFoRce, max-age=123", &max_age,
1129 &enforce, &report_uri));
1130 EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
1131 EXPECT_TRUE(enforce);
1132 EXPECT_TRUE(report_uri.is_empty());
1133
1134 enforce = false;
1135 EXPECT_TRUE(ParseExpectCTHeader("max-age=394082, enforce", &max_age,
1136 &enforce, &report_uri));
1137 EXPECT_EQ(base::TimeDelta::FromSeconds(394082), max_age);
1138 EXPECT_TRUE(enforce);
1139 EXPECT_TRUE(report_uri.is_empty());
1140
1141 enforce = false;
1142 EXPECT_TRUE(ParseExpectCTHeader("max-age=39408299 ,enforce", &max_age,
1143 &enforce, &report_uri));
1144 EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
1145 EXPECT_TRUE(enforce);
1146 EXPECT_TRUE(report_uri.is_empty());
1147
1148 // Per RFC 7230, "a recipient MUST parse and ignore a reasonable number of
1149 // empty list elements".
1150 enforce = false;
1151 EXPECT_TRUE(ParseExpectCTHeader(",, max-age=394082038 , enfoRce, ,",
1152 &max_age, &enforce, &report_uri));
1153 EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
1154 EXPECT_TRUE(enforce);
1155 EXPECT_TRUE(report_uri.is_empty());
1156
1157 enforce = false;
1158 EXPECT_TRUE(ParseExpectCTHeader(",, max-age=394082038 ,", &max_age, &enforce,
1159 &report_uri));
1160 EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
1161 EXPECT_FALSE(enforce);
1162 EXPECT_TRUE(report_uri.is_empty());
1163
1164 EXPECT_TRUE(
1165 ParseExpectCTHeader(",, , , max-age=394082038,,, enforce ,, ,",
1166 &max_age, &enforce, &report_uri));
1167 EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
1168 EXPECT_TRUE(enforce);
1169 EXPECT_TRUE(report_uri.is_empty());
1170
1171 enforce = false;
1172 EXPECT_TRUE(ParseExpectCTHeader("enfORce , max-age=394082038 ,,", &max_age,
1173 &enforce, &report_uri));
1174 EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
1175 EXPECT_TRUE(enforce);
1176 EXPECT_TRUE(report_uri.is_empty());
1177
1178 enforce = false;
1179 EXPECT_TRUE(ParseExpectCTHeader(" max-age=0 , enforce ", &max_age,
1180 &enforce, &report_uri));
1181 EXPECT_EQ(base::TimeDelta::FromSeconds(0), max_age);
1182 EXPECT_TRUE(enforce);
1183 EXPECT_TRUE(report_uri.is_empty());
1184
1185 enforce = false;
1186 EXPECT_TRUE(ParseExpectCTHeader(
1187 " max-age=999999999999999999999999999999999999999999999 ,"
1188 " enforce ",
1189 &max_age, &enforce, &report_uri));
1190 EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
1191 EXPECT_TRUE(enforce);
1192 EXPECT_TRUE(report_uri.is_empty());
1193 }
1194
908 }; // namespace net 1195 }; // namespace net
OLDNEW
« no previous file with comments | « net/http/http_security_headers_expect_ct_fuzzer.cc ('k') | no next file » | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698