Support for recording registered LSPs

chrome/browser/safe_browsing/environment_data_collection_win_unittest.cc

+// Copyright 2014 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "chrome/browser/safe_browsing/environment_data_collection_win.h"
+
+#include <string>
+
+#include "base/files/file_path.h"
+#include "base/scoped_native_library.h"
+#include "chrome/common/safe_browsing/csd.pb.h"
+#include "testing/gtest/include/gtest/gtest.h"
+
+namespace {
+
+// Helper function that returns true if a dll with filename |dll_name| is
+// found in |process_report|.
+bool ProcessReportContainsDll(
+    const safe_browsing::ClientIncidentReport_EnvironmentData_Process&
+        process_report,
+    const base::FilePath& dll_name) {
+  for (int i = 0; i < process_report.dlls_size(); ++i) {
+    base::FilePath current_dll =
+        base::FilePath::FromUTF8Unsafe(process_report.dlls(i).path());
+
+    if (current_dll.BaseName() == dll_name)
+      return true;
+  }
+
+  return false;
+}
+
+}  // namespace
+
+TEST(SafeBrowsingEnvironmentDataCollectionWinTest, CollectDlls) {
+  // This test will check if the CollectDlls method works by loading
+  // a dll and then checking if we can find it within the process report.
+  // Pick msvidc32.dll as it is present from WinXP to Win8 and yet rarely used.
+  base::FilePath msvdc32_dll(L"msvidc32.dll");
+
+  safe_browsing::ClientIncidentReport_EnvironmentData_Process process_report;
+  safe_browsing::CollectDlls(&process_report);
+
+  ASSERT_FALSE(ProcessReportContainsDll(process_report, msvdc32_dll));
+
+  // Redo the same verification after loading a new dll.
+  base::ScopedNativeLibrary library(msvdc32_dll);
+
+  process_report.clear_dlls();
+  safe_browsing::CollectDlls(&process_report);
+
+  ASSERT_TRUE(ProcessReportContainsDll(process_report, msvdc32_dll));
+}
+
+TEST(SafeBrowsingEnvironmentDataCollectionWinTest, RecordLspFeatures) {
+  // Populate our incident report with loaded modules.
+  safe_browsing::ClientIncidentReport_EnvironmentData_Process process_report;
+  safe_browsing::CollectDlls(&process_report);
+
+  // We'll test RecordLspFeatures against a real dll registered as a LSP.
+  std::string lsp_path = "C:\\Windows\\system32\\mswsock.dll";
+  int base_address = 0x77770000;
+  int length = 0x180000;
+
+  // Look for dlls that are registered as a LSP.
+  safe_browsing::RecordLspFeatures(&process_report);
+
+  // Look through dll entries and check that none contains the LSP feature.
+  bool lsp_feature_found = false;
+  for (int i = 0; i < process_report.dlls_size(); ++i) {
+    if (process_report.dlls(i).path() == lsp_path) {
+      // Look for ClientIncidentReport_EnvironmentData_Process_DLL_Feature_LSP
+      // through the features of each dll.
+      for (int j = 0; j < process_report.dlls(i).features_size(); ++j) {
+        if (process_report.dlls(i).features(j) ==
+            safe_browsing::
+                ClientIncidentReport_EnvironmentData_Process_Dll_Feature_LSP)
+          lsp_feature_found = true;
+      }
+    }
+  }
+
+  ASSERT_FALSE(lsp_feature_found);
+
+  // Manually add an entry to the process report that will get marked as a LSP.
+  safe_browsing::ClientIncidentReport_EnvironmentData_Process_Dll* dll =
+      process_report.add_dlls();
+  dll->set_path(lsp_path);
+  dll->set_base_address(base_address);
+  dll->set_length(length);
+
+  // Look for dlls that are registered as a LSP.
+  safe_browsing::RecordLspFeatures(&process_report);
+
+  // Look through dll entries and check if the one we added contains the LSP
+  // feature.
+  lsp_feature_found = false;
+  for (int i = 0; i < process_report.dlls_size(); ++i) {
+    if (process_report.dlls(i).path() == lsp_path) {
+      // Look for ClientIncidentReport_EnvironmentData_Process_DLL_Feature_LSP
+      // through the features of each dll.
+      for (int j = 0; j < process_report.dlls(i).features_size(); ++j) {
+        if (process_report.dlls(i).features(j) ==
+            safe_browsing::
+                ClientIncidentReport_EnvironmentData_Process_Dll_Feature_LSP)

[grt (UTC plus 2), 2014/06/10 20:57:53]

ClientIncidentReport_EnvironmentData_Process_Dll::LSP

[pmonette_google.com, 2014/06/10 21:39:04]

Done.

+          lsp_feature_found = true;
+      }
+    }
+  }
+
+  ASSERT_TRUE(lsp_feature_found);
+}