Remove dangerous CanonicalCookie::Create method.

net/cookies/cookie_monster_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cookies/cookie_monster.h"
 
 #include <algorithm>
 #include <memory>
 #include <string>
 #include <vector>
@@ skipping 1022 matching lines @@
   EXPECT_CALL(set_cookies_callback, Run(true)).WillOnce(QuitRunLoop(&loop));
 
   CompleteLoading();
   loop.Run();
 }
 
 TEST_F(DeferredCookieTaskTest, DeferredSetAllCookies) {
   MockSetCookiesCallback set_cookies_callback;
   CookieList list;
   list.push_back(*CanonicalCookie::Create(
-      http_www_google_.url(), "A", "B", http_www_google_.domain(), "/",
-      base::Time::Now(), base::Time(), false, true,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT));
+      "A", "B", "." + http_www_google_.domain(), "/", base::Time::Now(),
+      base::Time(), base::Time(), false, true, CookieSameSite::DEFAULT_MODE,
+      COOKIE_PRIORITY_DEFAULT));
   list.push_back(*CanonicalCookie::Create(
-      http_www_google_.url(), "C", "D", http_www_google_.domain(), "/",
-      base::Time::Now(), base::Time(), false, true,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT));
+      "C", "D", "." + http_www_google_.domain(), "/", base::Time::Now(),
+      base::Time(), base::Time(), false, true, CookieSameSite::DEFAULT_MODE,
+      COOKIE_PRIORITY_DEFAULT));
 
   BeginWith(
       SetAllCookiesAction(&cookie_monster(), list, &set_cookies_callback));
 
   WaitForLoadCall();
 
   EXPECT_CALL(set_cookies_callback, Run(true))
       .WillOnce(
           SetAllCookiesAction(&cookie_monster(), list, &set_cookies_callback));
   base::RunLoop loop;
@@ skipping 1467 matching lines @@
   scoped_refptr<FlushablePersistentStore> store(new FlushablePersistentStore());
   std::unique_ptr<CookieMonster> cm(new CookieMonster(store.get(), nullptr));
   cm->SetPersistSessionCookies(true);
 
   EXPECT_TRUE(SetCookie(cm.get(), http_www_google_.url(), "U=V; path=/"));
   EXPECT_TRUE(SetCookie(cm.get(), http_www_google_.url(), "W=X; path=/foo"));
   EXPECT_TRUE(SetCookie(cm.get(), http_www_google_.url(), "Y=Z; path=/"));
 
   CookieList list;
   list.push_back(*CanonicalCookie::Create(
-      http_www_google_.url(), "A", "B", http_www_google_.url().host(), "/",
-      base::Time::Now(), base::Time(), false, false,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT));
+      "A", "B", "." + http_www_google_.url().host(), "/", base::Time::Now(),
+      base::Time(), base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      COOKIE_PRIORITY_DEFAULT));
   list.push_back(*CanonicalCookie::Create(
-      http_www_google_.url(), "W", "X", http_www_google_.url().host(), "/bar",
-      base::Time::Now(), base::Time(), false, false,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT));
+      "W", "X", "." + http_www_google_.url().host(), "/bar", base::Time::Now(),
+      base::Time(), base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      COOKIE_PRIORITY_DEFAULT));
   list.push_back(*CanonicalCookie::Create(
-      http_www_google_.url(), "Y", "Z", http_www_google_.url().host(), "/",
-      base::Time::Now(), base::Time(), false, false,
-      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT));
+      "Y", "Z", "." + http_www_google_.url().host(), "/", base::Time::Now(),
+      base::Time(), base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      COOKIE_PRIORITY_DEFAULT));
 
   // SetAllCookies must not flush.
   ASSERT_EQ(0, store->flush_count());
   EXPECT_TRUE(SetAllCookies(cm.get(), list));
   EXPECT_EQ(0, store->flush_count());
 
   CookieList cookies = GetAllCookies(cm.get());
   size_t expected_size = 3;  // "A", "W" and "Y". "U" is gone.
   EXPECT_EQ(expected_size, cookies.size());
   CookieList::iterator it = cookies.begin();
@@ skipping 12 matching lines @@
   EXPECT_EQ("Z", it->Value());
 }
 
 TEST_F(CookieMonsterTest, ComputeCookieDiff) {
   std::unique_ptr<CookieMonster> cm(new CookieMonster(nullptr, nullptr));
 
   base::Time now = base::Time::Now();
   base::Time creation_time = now - base::TimeDelta::FromSeconds(1);
 
   std::unique_ptr<CanonicalCookie> cookie1(CanonicalCookie::Create(
-      http_www_google_.url(), "A", "B", http_www_google_.url().host(), "/",
-      creation_time, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      "A", "B", "." + http_www_google_.url().host(), "/", creation_time,
+      base::Time(), base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
       COOKIE_PRIORITY_DEFAULT));
   std::unique_ptr<CanonicalCookie> cookie2(CanonicalCookie::Create(
-      http_www_google_.url(), "C", "D", http_www_google_.url().host(), "/",
-      creation_time, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      "C", "D", "." + http_www_google_.url().host(), "/", creation_time,
+      base::Time(), base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
       COOKIE_PRIORITY_DEFAULT));
   std::unique_ptr<CanonicalCookie> cookie3(CanonicalCookie::Create(
-      http_www_google_.url(), "E", "F", http_www_google_.url().host(), "/",
-      creation_time, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      "E", "F", "." + http_www_google_.url().host(), "/", creation_time,
+      base::Time(), base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
       COOKIE_PRIORITY_DEFAULT));
   std::unique_ptr<CanonicalCookie> cookie4(CanonicalCookie::Create(
-      http_www_google_.url(), "G", "H", http_www_google_.url().host(), "/",
-      creation_time, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      "G", "H", "." + http_www_google_.url().host(), "/", creation_time,
+      base::Time(), base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
       COOKIE_PRIORITY_DEFAULT));
   std::unique_ptr<CanonicalCookie> cookie4_with_new_value(
       CanonicalCookie::Create(
-          http_www_google_.url(), "G", "iamnew", http_www_google_.url().host(),
-          "/", creation_time, base::Time(), false, false,
+          "G", "iamnew", "." + http_www_google_.url().host(), "/",
+          creation_time, base::Time(), base::Time(), false, false,
           CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT));
   std::unique_ptr<CanonicalCookie> cookie5(CanonicalCookie::Create(
-      http_www_google_.url(), "I", "J", http_www_google_.url().host(), "/",
-      creation_time, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      "I", "J", "." + http_www_google_.url().host(), "/", creation_time,
+      base::Time(), base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
       COOKIE_PRIORITY_DEFAULT));
   std::unique_ptr<CanonicalCookie> cookie5_with_new_creation_time(
-      CanonicalCookie::Create(
-          http_www_google_.url(), "I", "J", http_www_google_.url().host(), "/",
-          now, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
-          COOKIE_PRIORITY_DEFAULT));
+      CanonicalCookie::Create("I", "J", "." + http_www_google_.url().host(),
+                              "/", now, base::Time(), base::Time(), false,
+                              false, CookieSameSite::DEFAULT_MODE,
+                              COOKIE_PRIORITY_DEFAULT));
   std::unique_ptr<CanonicalCookie> cookie6(CanonicalCookie::Create(
-      http_www_google_.url(), "K", "L", http_www_google_.url().host(), "/foo",
-      creation_time, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      "K", "L", "." + http_www_google_.url().host(), "/foo", creation_time,
+      base::Time(), base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
       COOKIE_PRIORITY_DEFAULT));
   std::unique_ptr<CanonicalCookie> cookie6_with_new_path(
-      CanonicalCookie::Create(
-          http_www_google_.url(), "K", "L", http_www_google_.url().host(),
-          "/bar", creation_time, base::Time(), false, false,
-          CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT));
+      CanonicalCookie::Create("K", "L", "." + http_www_google_.url().host(),
+                              "/bar", creation_time, base::Time(), base::Time(),
+                              false, false, CookieSameSite::DEFAULT_MODE,
+                              COOKIE_PRIORITY_DEFAULT));
   std::unique_ptr<CanonicalCookie> cookie7(CanonicalCookie::Create(
-      http_www_google_.url(), "M", "N", http_www_google_.url().host(), "/foo",
-      creation_time, base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
+      "M", "N", "." + http_www_google_.url().host(), "/foo", creation_time,
+      base::Time(), base::Time(), false, false, CookieSameSite::DEFAULT_MODE,
       COOKIE_PRIORITY_DEFAULT));
   std::unique_ptr<CanonicalCookie> cookie7_with_new_path(
-      CanonicalCookie::Create(
-          http_www_google_.url(), "M", "N", http_www_google_.url().host(),
-          "/bar", creation_time, base::Time(), false, false,
-          CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT));
+      CanonicalCookie::Create("M", "N", "." + http_www_google_.url().host(),
+                              "/bar", creation_time, base::Time(), base::Time(),
+                              false, false, CookieSameSite::DEFAULT_MODE,
+                              COOKIE_PRIORITY_DEFAULT));
 
   CookieList old_cookies;
   old_cookies.push_back(*cookie1);
   old_cookies.push_back(*cookie2);
   old_cookies.push_back(*cookie4);
   old_cookies.push_back(*cookie5);
   old_cookies.push_back(*cookie6);
   old_cookies.push_back(*cookie7);
 
   CookieList new_cookies;
@@ skipping 192 matching lines @@
 
   scoped_refptr<MockPersistentCookieStore> store(new MockPersistentCookieStore);
 
   std::vector<std::unique_ptr<CanonicalCookie>> initial_cookies;
 
   AddCookieToList(url, "foo=bar; path=" + path, now1, &initial_cookies);
 
   // We have to manually build this cookie because it contains a control
   // character, and our cookie line parser rejects control characters.
   std::unique_ptr<CanonicalCookie> cc = CanonicalCookie::Create(
-      url, "baz",
+      "baz",
       "\x05"
       "boo",
-      domain, path, now2, later, false, false, CookieSameSite::DEFAULT_MODE,
-      COOKIE_PRIORITY_DEFAULT);
+      "." + domain, path, now2, later, base::Time(), false, false,
+      CookieSameSite::DEFAULT_MODE, COOKIE_PRIORITY_DEFAULT);
   initial_cookies.push_back(std::move(cc));
 
   AddCookieToList(url, "hello=world; path=" + path, now3, &initial_cookies);
 
   // Inject our initial cookies into the mock PersistentCookieStore.
   store->SetLoadExpectation(true, std::move(initial_cookies));
 
   std::unique_ptr<CookieMonster> cm(new CookieMonster(store.get(), nullptr));
 
   EXPECT_EQ("foo=bar; hello=world", GetCookies(cm.get(), url));
@@ skipping 360 matching lines @@
   EXPECT_TRUE(SetCookie(cm.get(), https_url, "A=C; path=/some/other/path"));
   EXPECT_FALSE(SetCookie(cm.get(), http_url, "A=D; path=/some/other/path"));
 
   // Tests that non-equivalent cookies because of the domain attribute can be
   // set successfully.
   EXPECT_TRUE(SetCookie(cm.get(), https_url, "A=B; Secure"));
   EXPECT_TRUE(SetCookie(cm.get(), https_url, "A=C; domain=google.com"));
   EXPECT_FALSE(SetCookie(cm.get(), http_url, "A=D; domain=google.com"));
 }
 
+TEST_F(CookieMonsterTest, SetCookieWithDetailsSecureEnforcement) {

[mmenke, 2017/05/10 15:51:54]

Should this be in the shared test (cookie_store_unittest.h), so it's run on iOS,
too, since the same logic was added there?

[Randy Smith (Not in Mondays), 2017/05/10 20:31:51]

Done.

+  std::unique_ptr<CookieMonster> cm(new CookieMonster(nullptr, nullptr));
+  GURL http_url("http://www.google.com");
+  GURL https_url("https://www.google.com");
+
+  // Confirm that setting the secure attribute on an HTTP URL fails, but
+  // the other combinations work.
+  EXPECT_TRUE(SetCookieWithDetails(
+      cm.get(), http_url, "A", "B", "www.google.com", "/", base::Time::Now(),
+      base::Time(), base::Time(), false, false, CookieSameSite::NO_RESTRICTION,
+      COOKIE_PRIORITY_DEFAULT));
+  EXPECT_FALSE(SetCookieWithDetails(
+      cm.get(), http_url, "A", "B", "www.google.com", "/", base::Time::Now(),
+      base::Time(), base::Time(), true, false, CookieSameSite::NO_RESTRICTION,
+      COOKIE_PRIORITY_DEFAULT));
+  EXPECT_TRUE(SetCookieWithDetails(
+      cm.get(), https_url, "A", "B", "www.google.com", "/", base::Time::Now(),
+      base::Time(), base::Time(), false, false, CookieSameSite::NO_RESTRICTION,
+      COOKIE_PRIORITY_DEFAULT));
+  EXPECT_TRUE(SetCookieWithDetails(
+      cm.get(), https_url, "A", "B", "www.google.com", "/", base::Time::Now(),
+      base::Time(), base::Time(), true, false, CookieSameSite::NO_RESTRICTION,
+      COOKIE_PRIORITY_DEFAULT));
+}
+
 class CookieMonsterNotificationTest : public CookieMonsterTest {
  public:
   CookieMonsterNotificationTest()
       : test_url_("http://www.google.com/foo"),
         store_(new MockPersistentCookieStore),
         monster_(new CookieMonster(store_.get(), nullptr)) {}
 
   ~CookieMonsterNotificationTest() override {}
 
   CookieMonster* monster() { return monster_.get(); }
@@ skipping 137 matching lines @@
       monster()->AddCallbackForCookie(
           test_url_, "abc",
           base::Bind(&RecordCookieChanges, &cookies1, nullptr)));
   SetCookie(monster(), test_url_, "abc=def");
   base::RunLoop().RunUntilIdle();
   EXPECT_EQ(1U, cookies0.size());
   EXPECT_EQ(1U, cookies0.size());
 }
 
 }  // namespace net