Implement permissions embargo for prompts which are repeatedly ignored.

chrome/browser/permissions/permission_decision_auto_blocker_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/permissions/permission_decision_auto_blocker.h"
 
 #include <map>
 
 #include "base/bind.h"
 #include "base/run_loop.h"
@@ skipping 71 matching lines @@
 
 }  // namespace
 
 class PermissionDecisionAutoBlockerUnitTest
     : public ChromeRenderViewHostTestHarness {
  protected:
   void SetUp() override {
     ChromeRenderViewHostTestHarness::SetUp();
     autoblocker_ = PermissionDecisionAutoBlocker::GetForProfile(profile());
     feature_list_.InitWithFeatures({features::kBlockPromptsIfDismissedOften,
+                                    features::kBlockPromptsIfIgnoredOften,
                                     features::kPermissionsBlacklist},
                                    {});
     last_embargoed_status_ = false;
     std::unique_ptr<base::SimpleTestClock> clock =
         base::MakeUnique<base::SimpleTestClock>();
     clock_ = clock.get();
     autoblocker_->SetClockForTesting(std::move(clock));
     callback_was_run_ = false;
   }
 
@@ skipping 81 matching lines @@
       url2, CONTENT_SETTINGS_TYPE_GEOLOCATION));
   EXPECT_EQ(1, autoblocker()->GetDismissCount(
                    url2, CONTENT_SETTINGS_TYPE_GEOLOCATION));
 
   EXPECT_FALSE(autoblocker()->RecordDismissAndEmbargo(
       url1, CONTENT_SETTINGS_TYPE_NOTIFICATIONS));
   EXPECT_EQ(1, autoblocker()->GetDismissCount(
                    url1, CONTENT_SETTINGS_TYPE_NOTIFICATIONS));
 
   // Record some ignores.
+  EXPECT_FALSE(autoblocker()->RecordIgnoreAndEmbargo(
+      url1, CONTENT_SETTINGS_TYPE_MIDI_SYSEX));
   EXPECT_EQ(
-      1, autoblocker()->RecordIgnore(url1, CONTENT_SETTINGS_TYPE_MIDI_SYSEX));
-  EXPECT_EQ(1, autoblocker()->RecordIgnore(
+      1, autoblocker()->GetIgnoreCount(url1, CONTENT_SETTINGS_TYPE_MIDI_SYSEX));
+  EXPECT_FALSE(autoblocker()->RecordIgnoreAndEmbargo(
+      url1, CONTENT_SETTINGS_TYPE_DURABLE_STORAGE));
+  EXPECT_EQ(1, autoblocker()->GetIgnoreCount(
                    url1, CONTENT_SETTINGS_TYPE_DURABLE_STORAGE));
-  EXPECT_EQ(
-      1, autoblocker()->RecordIgnore(url2, CONTENT_SETTINGS_TYPE_GEOLOCATION));
-  EXPECT_EQ(
-      2, autoblocker()->RecordIgnore(url2, CONTENT_SETTINGS_TYPE_GEOLOCATION));
+  EXPECT_FALSE(autoblocker()->RecordIgnoreAndEmbargo(
+      url2, CONTENT_SETTINGS_TYPE_GEOLOCATION));
+  EXPECT_FALSE(autoblocker()->RecordIgnoreAndEmbargo(
+      url2, CONTENT_SETTINGS_TYPE_GEOLOCATION));
+  EXPECT_EQ(2, autoblocker()->GetIgnoreCount(
+                   url2, CONTENT_SETTINGS_TYPE_GEOLOCATION));
 
   autoblocker()->RemoveCountsByUrl(base::Bind(&FilterGoogle));
 
   // Expect that url1's actions are gone, but url2's remain.
   EXPECT_EQ(0, autoblocker()->GetDismissCount(
                    url1, CONTENT_SETTINGS_TYPE_GEOLOCATION));
   EXPECT_EQ(0, autoblocker()->GetDismissCount(
                    url1, CONTENT_SETTINGS_TYPE_NOTIFICATIONS));
   EXPECT_EQ(
       0, autoblocker()->GetIgnoreCount(url1, CONTENT_SETTINGS_TYPE_MIDI_SYSEX));
@@ skipping 14 matching lines @@
   EXPECT_FALSE(autoblocker()->RecordDismissAndEmbargo(
       url1, CONTENT_SETTINGS_TYPE_NOTIFICATIONS));
   EXPECT_EQ(1, autoblocker()->GetDismissCount(
                    url1, CONTENT_SETTINGS_TYPE_NOTIFICATIONS));
 
   EXPECT_FALSE(autoblocker()->RecordDismissAndEmbargo(
       url2, CONTENT_SETTINGS_TYPE_GEOLOCATION));
   EXPECT_EQ(2, autoblocker()->GetDismissCount(
                    url2, CONTENT_SETTINGS_TYPE_GEOLOCATION));
 
+  EXPECT_FALSE(autoblocker()->RecordIgnoreAndEmbargo(
+      url1, CONTENT_SETTINGS_TYPE_GEOLOCATION));
+  EXPECT_EQ(1, autoblocker()->GetIgnoreCount(
+                   url1, CONTENT_SETTINGS_TYPE_GEOLOCATION));
+  EXPECT_FALSE(autoblocker()->RecordIgnoreAndEmbargo(
+      url1, CONTENT_SETTINGS_TYPE_NOTIFICATIONS));
+  EXPECT_EQ(1, autoblocker()->GetIgnoreCount(
+                   url1, CONTENT_SETTINGS_TYPE_NOTIFICATIONS));
+  EXPECT_FALSE(autoblocker()->RecordIgnoreAndEmbargo(
+      url1, CONTENT_SETTINGS_TYPE_DURABLE_STORAGE));
+  EXPECT_EQ(1, autoblocker()->GetIgnoreCount(
+                   url1, CONTENT_SETTINGS_TYPE_DURABLE_STORAGE));
+  EXPECT_FALSE(autoblocker()->RecordIgnoreAndEmbargo(
+      url2, CONTENT_SETTINGS_TYPE_MIDI_SYSEX));
   EXPECT_EQ(
-      1, autoblocker()->RecordIgnore(url1, CONTENT_SETTINGS_TYPE_GEOLOCATION));
-  EXPECT_EQ(1, autoblocker()->RecordIgnore(
-                   url1, CONTENT_SETTINGS_TYPE_NOTIFICATIONS));
-  EXPECT_EQ(1, autoblocker()->RecordIgnore(
-                   url1, CONTENT_SETTINGS_TYPE_DURABLE_STORAGE));
-  EXPECT_EQ(
-      1, autoblocker()->RecordIgnore(url2, CONTENT_SETTINGS_TYPE_MIDI_SYSEX));
+      1, autoblocker()->GetIgnoreCount(url2, CONTENT_SETTINGS_TYPE_MIDI_SYSEX));
 
   // Remove everything and expect that it's all gone.
   autoblocker()->RemoveCountsByUrl(base::Bind(&FilterAll));
 
   EXPECT_EQ(0, autoblocker()->GetDismissCount(
                    url1, CONTENT_SETTINGS_TYPE_GEOLOCATION));
   EXPECT_EQ(0, autoblocker()->GetDismissCount(
                    url1, CONTENT_SETTINGS_TYPE_NOTIFICATIONS));
   EXPECT_EQ(0, autoblocker()->GetDismissCount(
                    url2, CONTENT_SETTINGS_TYPE_GEOLOCATION));
@@ skipping 27 matching lines @@
   EXPECT_TRUE(callback_was_run());
   EXPECT_TRUE(last_embargoed_status());
   histograms.ExpectUniqueSample(
       "Permissions.AutoBlocker.SafeBrowsingResponse",
       static_cast<int>(SafeBrowsingResponse::BLACKLISTED), 1);
   histograms.ExpectTotalCount(
       "Permissions.AutoBlocker.SafeBrowsingResponseTime", 1);
 }
 
 // Test that an origin that is blacklisted for a permission will not be placed
-// under embargoed for another.
+// under embargo for another permission.
 TEST_F(PermissionDecisionAutoBlockerUnitTest, TestRequestNotBlacklisted) {
   GURL url("https://www.google.com");
   clock()->SetNow(base::Time::Now());
   base::HistogramTester histograms;
 
   scoped_refptr<MockSafeBrowsingDatabaseManager> db_manager =
       new MockSafeBrowsingDatabaseManager(true /* perform_callback */,
                                           true /* enabled */);
   std::set<std::string> blacklisted_permissions{"GEOLOCATION"};
   db_manager->BlacklistUrlPermissions(url, blacklisted_permissions);
   SetSafeBrowsingDatabaseManagerAndTimeoutForTesting(db_manager,
                                                      0 /* timeout in ms */);
 
   CheckSafeBrowsingBlacklist(url, CONTENT_SETTINGS_TYPE_NOTIFICATIONS);
   EXPECT_FALSE(last_embargoed_status());
   histograms.ExpectUniqueSample(
       "Permissions.AutoBlocker.SafeBrowsingResponse",
       static_cast<int>(SafeBrowsingResponse::NOT_BLACKLISTED), 1);
   histograms.ExpectTotalCount(
       "Permissions.AutoBlocker.SafeBrowsingResponseTime", 1);
 }
 
 // Check that we do not apply embargo to the plugins content type, as prompts
 // should be triggered only when necessary by Html5ByDefault.
 TEST_F(PermissionDecisionAutoBlockerUnitTest,
-       PluginsNotEmbargoedByMultipleDismisses) {
+       PluginsNotEmbargoedByMultipleDismissesOrIgnores) {
   GURL url("https://www.google.com");
+
+  // Check dismisses first.
   autoblocker()->RecordDismissAndEmbargo(url, CONTENT_SETTINGS_TYPE_PLUGINS);
   autoblocker()->RecordDismissAndEmbargo(url, CONTENT_SETTINGS_TYPE_PLUGINS);
   PermissionResult result =
       autoblocker()->GetEmbargoResult(url, CONTENT_SETTINGS_TYPE_PLUGINS);
 
   EXPECT_EQ(CONTENT_SETTING_ASK, result.content_setting);
   EXPECT_EQ(PermissionStatusSource::UNSPECIFIED, result.source);
   EXPECT_EQ(2,
             autoblocker()->GetDismissCount(url, CONTENT_SETTINGS_TYPE_PLUGINS));
 
   // The third dismiss would normally embargo, but this shouldn't happen for
   // plugins.
-  autoblocker()->RecordDismissAndEmbargo(url, CONTENT_SETTINGS_TYPE_PLUGINS);
+  EXPECT_FALSE(autoblocker()->RecordDismissAndEmbargo(
+      url, CONTENT_SETTINGS_TYPE_PLUGINS));
   result = autoblocker()->GetEmbargoResult(url, CONTENT_SETTINGS_TYPE_PLUGINS);
 
   EXPECT_EQ(CONTENT_SETTING_ASK, result.content_setting);
   EXPECT_EQ(PermissionStatusSource::UNSPECIFIED, result.source);
   EXPECT_EQ(3,
             autoblocker()->GetDismissCount(url, CONTENT_SETTINGS_TYPE_PLUGINS));
 
   // Extra one for sanity checking.
-  autoblocker()->RecordDismissAndEmbargo(url, CONTENT_SETTINGS_TYPE_PLUGINS);
+  EXPECT_FALSE(autoblocker()->RecordDismissAndEmbargo(
+      url, CONTENT_SETTINGS_TYPE_PLUGINS));
   result = autoblocker()->GetEmbargoResult(url, CONTENT_SETTINGS_TYPE_PLUGINS);
 
   EXPECT_EQ(CONTENT_SETTING_ASK, result.content_setting);
   EXPECT_EQ(PermissionStatusSource::UNSPECIFIED, result.source);
   EXPECT_EQ(4,
             autoblocker()->GetDismissCount(url, CONTENT_SETTINGS_TYPE_PLUGINS));
+
+  // Check ignores.
+  autoblocker()->RecordIgnoreAndEmbargo(url, CONTENT_SETTINGS_TYPE_PLUGINS);
+  autoblocker()->RecordIgnoreAndEmbargo(url, CONTENT_SETTINGS_TYPE_PLUGINS);
+  autoblocker()->RecordIgnoreAndEmbargo(url, CONTENT_SETTINGS_TYPE_PLUGINS);
+  result = autoblocker()->GetEmbargoResult(url, CONTENT_SETTINGS_TYPE_PLUGINS);
+
+  EXPECT_EQ(CONTENT_SETTING_ASK, result.content_setting);
+  EXPECT_EQ(PermissionStatusSource::UNSPECIFIED, result.source);
+  EXPECT_EQ(3,
+            autoblocker()->GetIgnoreCount(url, CONTENT_SETTINGS_TYPE_PLUGINS));
+
+  // The fourth ignore would normally embargo, but this shouldn't happen for
+  // plugins.
+  EXPECT_FALSE(autoblocker()->RecordIgnoreAndEmbargo(
+      url, CONTENT_SETTINGS_TYPE_PLUGINS));
+  result = autoblocker()->GetEmbargoResult(url, CONTENT_SETTINGS_TYPE_PLUGINS);
+
+  EXPECT_EQ(CONTENT_SETTING_ASK, result.content_setting);
+  EXPECT_EQ(PermissionStatusSource::UNSPECIFIED, result.source);
+  EXPECT_EQ(4,
+            autoblocker()->GetIgnoreCount(url, CONTENT_SETTINGS_TYPE_PLUGINS));
+
+  // Extra one for sanity checking.
+  EXPECT_FALSE(autoblocker()->RecordIgnoreAndEmbargo(
+      url, CONTENT_SETTINGS_TYPE_PLUGINS));
+  result = autoblocker()->GetEmbargoResult(url, CONTENT_SETTINGS_TYPE_PLUGINS);
+
+  EXPECT_EQ(CONTENT_SETTING_ASK, result.content_setting);
+  EXPECT_EQ(PermissionStatusSource::UNSPECIFIED, result.source);
+  EXPECT_EQ(5,
+            autoblocker()->GetIgnoreCount(url, CONTENT_SETTINGS_TYPE_PLUGINS));
 }
 
 // Check that GetEmbargoResult returns the correct value when the embargo is set
 // and expires.
 TEST_F(PermissionDecisionAutoBlockerUnitTest, CheckEmbargoStatus) {
   GURL url("https://www.google.com");
   clock()->SetNow(base::Time::Now());
 
   // Check the default state.
   PermissionResult result =
@@ skipping 110 matching lines @@
   result =
       autoblocker()->GetEmbargoResult(url, CONTENT_SETTINGS_TYPE_GEOLOCATION);
   EXPECT_EQ(CONTENT_SETTING_BLOCK, result.content_setting);
   EXPECT_EQ(PermissionStatusSource::MULTIPLE_DISMISSALS, result.source);
   histograms.ExpectTotalCount("Permissions.AutoBlocker.SafeBrowsingResponse",
                               0);
   histograms.ExpectTotalCount(
       "Permissions.AutoBlocker.SafeBrowsingResponseTime", 0);
 }
 
+// Tests the alternating pattern of the block on multiple ignores behaviour.
+TEST_F(PermissionDecisionAutoBlockerUnitTest, TestIgnoreEmbargoBackoff) {
+  GURL url("https://www.google.com");
+  clock()->SetNow(base::Time::Now());
+  base::HistogramTester histograms;
+
+  // Record some ignores.
+  EXPECT_FALSE(autoblocker()->RecordIgnoreAndEmbargo(
+      url, CONTENT_SETTINGS_TYPE_MIDI_SYSEX));
+  EXPECT_FALSE(autoblocker()->RecordIgnoreAndEmbargo(
+      url, CONTENT_SETTINGS_TYPE_MIDI_SYSEX));
+
+  // A request with < 4 prior ignores should not be automatically blocked.
+  PermissionResult result =
+      autoblocker()->GetEmbargoResult(url, CONTENT_SETTINGS_TYPE_MIDI_SYSEX);
+  EXPECT_EQ(CONTENT_SETTING_ASK, result.content_setting);
+  EXPECT_EQ(PermissionStatusSource::UNSPECIFIED, result.source);
+
+  // After the 4th ignore subsequent permission requests should be autoblocked.
+  EXPECT_FALSE(autoblocker()->RecordIgnoreAndEmbargo(
+      url, CONTENT_SETTINGS_TYPE_MIDI_SYSEX));
+  EXPECT_TRUE(autoblocker()->RecordIgnoreAndEmbargo(
+      url, CONTENT_SETTINGS_TYPE_MIDI_SYSEX));
+  result =
+      autoblocker()->GetEmbargoResult(url, CONTENT_SETTINGS_TYPE_MIDI_SYSEX);
+  EXPECT_EQ(CONTENT_SETTING_BLOCK, result.content_setting);
+  EXPECT_EQ(PermissionStatusSource::MULTIPLE_IGNORES, result.source);
+
+  histograms.ExpectTotalCount("Permissions.AutoBlocker.SafeBrowsingResponse",
+                              0);
+  histograms.ExpectTotalCount(
+      "Permissions.AutoBlocker.SafeBrowsingResponseTime", 0);
+  // Accelerate time forward, check that the embargo status is lifted and the
+  // request won't be automatically blocked.
+  clock()->Advance(base::TimeDelta::FromDays(8));
+  result =
+      autoblocker()->GetEmbargoResult(url, CONTENT_SETTINGS_TYPE_MIDI_SYSEX);
+  EXPECT_EQ(CONTENT_SETTING_ASK, result.content_setting);
+  EXPECT_EQ(PermissionStatusSource::UNSPECIFIED, result.source);
+
+  // Record another dismiss, subsequent requests should be autoblocked again.
+  EXPECT_TRUE(autoblocker()->RecordIgnoreAndEmbargo(
+      url, CONTENT_SETTINGS_TYPE_MIDI_SYSEX));
+  result =
+      autoblocker()->GetEmbargoResult(url, CONTENT_SETTINGS_TYPE_MIDI_SYSEX);
+  EXPECT_EQ(CONTENT_SETTING_BLOCK, result.content_setting);
+  EXPECT_EQ(PermissionStatusSource::MULTIPLE_IGNORES, result.source);
+
+  // Accelerate time again, check embargo is lifted and another permission
+  // request is let through.
+  clock()->Advance(base::TimeDelta::FromDays(8));
+  result =
+      autoblocker()->GetEmbargoResult(url, CONTENT_SETTINGS_TYPE_MIDI_SYSEX);
+  EXPECT_EQ(CONTENT_SETTING_ASK, result.content_setting);
+  EXPECT_EQ(PermissionStatusSource::UNSPECIFIED, result.source);
+
+  // Record another dismiss, subsequent requests should be autoblocked again.
+  EXPECT_TRUE(autoblocker()->RecordIgnoreAndEmbargo(
+      url, CONTENT_SETTINGS_TYPE_MIDI_SYSEX));
+  result =
+      autoblocker()->GetEmbargoResult(url, CONTENT_SETTINGS_TYPE_MIDI_SYSEX);
+  EXPECT_EQ(CONTENT_SETTING_BLOCK, result.content_setting);
+  EXPECT_EQ(PermissionStatusSource::MULTIPLE_IGNORES, result.source);
+  histograms.ExpectTotalCount("Permissions.AutoBlocker.SafeBrowsingResponse",
+                              0);
+  histograms.ExpectTotalCount(
+      "Permissions.AutoBlocker.SafeBrowsingResponseTime", 0);
+}
+
 // Test the logic for a combination of blacklisting and dismissal embargo.
-TEST_F(PermissionDecisionAutoBlockerUnitTest, TestExpiredBlacklistEmbargo) {
+TEST_F(PermissionDecisionAutoBlockerUnitTest, TestExpiringOverlappingEmbargo) {
   GURL url("https://www.google.com");
   clock()->SetNow(base::Time::Now());
 
   // Place under blacklist embargo and check the status.
   PlaceUnderBlacklistEmbargo(url, CONTENT_SETTINGS_TYPE_GEOLOCATION);
   clock()->Advance(base::TimeDelta::FromDays(5));
   PermissionResult result =
       autoblocker()->GetEmbargoResult(url, CONTENT_SETTINGS_TYPE_GEOLOCATION);
   EXPECT_EQ(CONTENT_SETTING_BLOCK, result.content_setting);
   EXPECT_EQ(PermissionStatusSource::SAFE_BROWSING_BLACKLIST, result.source);
 
   // Record dismisses to place it under dismissal embargo.
   EXPECT_FALSE(autoblocker()->RecordDismissAndEmbargo(
       url, CONTENT_SETTINGS_TYPE_GEOLOCATION));
   EXPECT_FALSE(autoblocker()->RecordDismissAndEmbargo(
       url, CONTENT_SETTINGS_TYPE_GEOLOCATION));
   EXPECT_TRUE(autoblocker()->RecordDismissAndEmbargo(
       url, CONTENT_SETTINGS_TYPE_GEOLOCATION));
 
   // Accelerate time to a point where the blacklist embargo should be expired
   // and check that dismissal embargo is still set.
   clock()->Advance(base::TimeDelta::FromDays(3));
   result =
       autoblocker()->GetEmbargoResult(url, CONTENT_SETTINGS_TYPE_GEOLOCATION);
   EXPECT_EQ(CONTENT_SETTING_BLOCK, result.content_setting);
   EXPECT_EQ(PermissionStatusSource::MULTIPLE_DISMISSALS, result.source);
+
+  // Record an ignore embargo.
+  EXPECT_FALSE(autoblocker()->RecordIgnoreAndEmbargo(
+      url, CONTENT_SETTINGS_TYPE_GEOLOCATION));
+  EXPECT_FALSE(autoblocker()->RecordIgnoreAndEmbargo(
+      url, CONTENT_SETTINGS_TYPE_GEOLOCATION));
+  EXPECT_FALSE(autoblocker()->RecordIgnoreAndEmbargo(
+      url, CONTENT_SETTINGS_TYPE_GEOLOCATION));
+  EXPECT_TRUE(autoblocker()->RecordIgnoreAndEmbargo(
+      url, CONTENT_SETTINGS_TYPE_GEOLOCATION));
+
+  // Ensure the ignore embargo is still set.
+  clock()->Advance(base::TimeDelta::FromDays(5));
+  result =
+      autoblocker()->GetEmbargoResult(url, CONTENT_SETTINGS_TYPE_GEOLOCATION);
+  EXPECT_EQ(CONTENT_SETTING_BLOCK, result.content_setting);
+  EXPECT_EQ(PermissionStatusSource::MULTIPLE_IGNORES, result.source);
 }
 
 TEST_F(PermissionDecisionAutoBlockerUnitTest, TestSafeBrowsingTimeout) {
   GURL url("https://www.google.com");
   clock()->SetNow(base::Time::Now());
   base::HistogramTester histograms;
 
   scoped_refptr<MockSafeBrowsingDatabaseManager> db_manager =
       new MockSafeBrowsingDatabaseManager(false /* perform_callback */,
                                           true /* enabled */);
@@ skipping 138 matching lines @@
   db_manager->BlacklistUrlPermissions(url, blacklisted_permissions);
   SetSafeBrowsingDatabaseManagerAndTimeoutForTesting(db_manager,
                                                      0 /* timeout in ms */);
 
   CheckSafeBrowsingBlacklist(url, CONTENT_SETTINGS_TYPE_NOTIFICATIONS);
   EXPECT_FALSE(last_embargoed_status());
   histograms.ExpectUniqueSample(
       "Permissions.AutoBlocker.SafeBrowsingResponse",
       static_cast<int>(SafeBrowsingResponse::NOT_BLACKLISTED), 1);
 }