Sanitize referrers for programmatic downloads.

content/browser/loader/resource_dispatcher_host_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <vector>
 
 #include "base/basictypes.h"
 #include "base/bind.h"
 #include "base/file_util.h"
 #include "base/files/file_path.h"
@@ skipping 2917 matching lines @@
   // The release callback runs before the delete is scheduled, so pump the
   // message loop for the delete itself. (This relies on the delete happening on
   // the FILE thread which is mapped to main thread in this test.)
   base::RunLoop().RunUntilIdle();
 
   EXPECT_FALSE(base::PathExists(response_head.download_file_path));
   EXPECT_FALSE(ChildProcessSecurityPolicyImpl::GetInstance()->CanReadFile(
       filter_->child_id(), response_head.download_file_path));
 }
 
+namespace {
+
+void MatchSanitizedReferrer(
+    const std::string& original_referrer_url,
+    blink::WebReferrerPolicy referrer_policy,
+    const std::string& request_url,
+    const std::string& expected_sanitized_referrer_url) {
+  Referrer sanitized_referrer = SanitizeReferrerForRequest(
+      GURL(request_url),
+      Referrer(GURL(original_referrer_url), referrer_policy));
+  EXPECT_EQ(GURL(expected_sanitized_referrer_url), sanitized_referrer.url);
+  EXPECT_EQ(referrer_policy, sanitized_referrer.policy);
+}
+
+}
+
+TEST(SanitizeReferrerForRequestTest, HttpReferrerHttpRequest) {
+  MatchSanitizedReferrer("http://user:pass@foo.example.com/path#frag",
+                         blink::WebReferrerPolicyAlways,
+                         "http://bar.example.com",
+                         "http://foo.example.com/path");
+  MatchSanitizedReferrer("http://user:pass@foo.example.com/path#frag",
+                         blink::WebReferrerPolicyDefault,
+                         "http://bar.example.com",
+                         "http://foo.example.com/path");
+  MatchSanitizedReferrer("http://user:pass@foo.example.com/path#frag",
+                         blink::WebReferrerPolicyOrigin,
+                         "http://bar.example.com",
+                         "http://foo.example.com");
+  MatchSanitizedReferrer("http://user:pass@foo.example.com/path#frag",
+                         blink::WebReferrerPolicyNever,
+                         "http://bar.example.com",
+                         "");
+}
+
+TEST(SanitizeReferrerForRequestTest, HttpReferrerHttpsRequest) {
+  MatchSanitizedReferrer("http://user:pass@foo.example.com/path#frag",
+                         blink::WebReferrerPolicyAlways,
+                         "https://bar.example.com",
+                         "http://foo.example.com/path");
+  MatchSanitizedReferrer("http://user:pass@foo.example.com/path#frag",
+                         blink::WebReferrerPolicyDefault,
+                         "https://bar.example.com",
+                         "http://foo.example.com/path");
+  MatchSanitizedReferrer("http://user:pass@foo.example.com/path#frag",
+                         blink::WebReferrerPolicyOrigin,
+                         "https://bar.example.com",
+                         "http://foo.example.com");
+  MatchSanitizedReferrer("http://user:pass@foo.example.com/path#frag",
+                         blink::WebReferrerPolicyNever,
+                         "https://bar.example.com",
+                         "");
+}
+
+TEST(SanitizeReferrerForRequestTest, HttpsReferrerHttpRequest) {
+  MatchSanitizedReferrer("https://user:pass@foo.example.com/path#frag",
+                         blink::WebReferrerPolicyAlways,
+                         "http://bar.example.com",
+                         "https://foo.example.com/path");
+  MatchSanitizedReferrer("https://user:pass@foo.example.com/path#frag",
+                         blink::WebReferrerPolicyDefault,
+                         "http://bar.example.com",
+                         "");
+  MatchSanitizedReferrer("https://user:pass@foo.example.com/path#frag",
+                         blink::WebReferrerPolicyOrigin,
+                         "http://bar.example.com",
+                         "https://foo.example.com");
+  MatchSanitizedReferrer("https://user:pass@foo.example.com/path#frag",
+                         blink::WebReferrerPolicyNever,
+                         "http://bar.example.com",
+                         "");
+}
+
+TEST(SanitizeReferrerForRequestTest, HttpsReferrerHttpsRequest) {
+  MatchSanitizedReferrer("https://user:pass@foo.example.com/path#frag",
+                         blink::WebReferrerPolicyAlways,
+                         "https://bar.example.com",
+                         "https://foo.example.com/path");
+  MatchSanitizedReferrer("https://user:pass@foo.example.com/path#frag",
+                         blink::WebReferrerPolicyDefault,
+                         "https://bar.example.com",
+                         "https://foo.example.com/path");
+  MatchSanitizedReferrer("https://user:pass@foo.example.com/path#frag",
+                         blink::WebReferrerPolicyOrigin,
+                         "https://bar.example.com",
+                         "https://foo.example.com");
+  MatchSanitizedReferrer("https://user:pass@foo.example.com/path#frag",
+                         blink::WebReferrerPolicyNever,
+                         "https://bar.example.com",
+                         "");
+}
+
 }  // namespace content