| OLD | NEW |
|---|
| (Empty) |
| 1 // Copyright 2014 The Chromium Authors. All rights reserved. | |
| 2 // Use of this source code is governed by a BSD-style license that can be | |
| 3 // found in the LICENSE file. | |
| 4 | |
| 5 #include <string> | |
| 6 | |
| 7 #include "base/command_line.h" | |
| 8 #include "base/file_util.h" | |
| 9 #include "base/files/file_path.h" | |
| 10 #include "base/json/json_file_value_serializer.h" | |
| 11 #include "base/memory/scoped_ptr.h" | |
| 12 #include "base/metrics/histogram_base.h" | |
| 13 #include "base/metrics/histogram_samples.h" | |
| 14 #include "base/metrics/statistics_recorder.h" | |
| 15 #include "base/path_service.h" | |
| 16 #include "base/prefs/pref_service.h" | |
| 17 #include "base/prefs/scoped_user_pref_update.h" | |
| 18 #include "base/strings/string_number_conversions.h" | |
| 19 #include "base/strings/string_util.h" | |
| 20 #include "base/values.h" | |
| 21 #include "build/build_config.h" | |
| 22 #include "chrome/browser/extensions/extension_browsertest.h" | |
| 23 #include "chrome/browser/extensions/extension_service.h" | |
| 24 #include "chrome/browser/prefs/chrome_pref_service_factory.h" | |
| 25 #include "chrome/browser/prefs/profile_pref_store_manager.h" | |
| 26 #include "chrome/browser/prefs/session_startup_pref.h" | |
| 27 #include "chrome/browser/profiles/profile.h" | |
| 28 #include "chrome/browser/ui/browser.h" | |
| 29 #include "chrome/common/chrome_constants.h" | |
| 30 #include "chrome/common/chrome_paths.h" | |
| 31 #include "chrome/common/pref_names.h" | |
| 32 #include "chrome/test/base/testing_profile.h" | |
| 33 #include "components/search_engines/default_search_manager.h" | |
| 34 #include "content/public/common/content_switches.h" | |
| 35 #include "extensions/browser/pref_names.h" | |
| 36 #include "extensions/common/extension.h" | |
| 37 | |
| 38 #if defined(OS_CHROMEOS) | |
| 39 #include "chromeos/chromeos_switches.h" | |
| 40 #endif | |
| 41 | |
| 42 namespace { | |
| 43 | |
| 44 // Extension ID of chrome/test/data/extensions/good.crx | |
| 45 const char kGoodCrxId[] = "ldnnhddmnhbkjipkidpdiheffobcpfmf"; | |
| 46 | |
| 47 // Explicit expectations from the caller of GetTrackedPrefHistogramCount(). This | |
| 48 // enables detailed reporting of the culprit on failure. | |
| 49 enum AllowedBuckets { | |
| 50 // Allow no samples in any buckets. | |
| 51 ALLOW_NONE = -1, | |
| 52 // Any integer between BEGIN_ALLOW_SINGLE_BUCKET and END_ALLOW_SINGLE_BUCKET | |
| 53 // indicates that only this specific bucket is allowed to have a sample. | |
| 54 BEGIN_ALLOW_SINGLE_BUCKET = 0, | |
| 55 END_ALLOW_SINGLE_BUCKET = 100, | |
| 56 // Allow any buckets (no extra verifications performed). | |
| 57 ALLOW_ANY | |
| 58 }; | |
| 59 | |
| 60 // Returns the number of times |histogram_name| was reported so far; adding the | |
| 61 // results of the first 100 buckets (there are only ~19 reporting IDs as of this | |
| 62 // writing; varies depending on the platform). |allowed_buckets| hints at extra | |
| 63 // requirements verified in this method (see AllowedBuckets for details). | |
| 64 int GetTrackedPrefHistogramCount(const char* histogram_name, | |
| 65 int allowed_buckets) { | |
| 66 const base::HistogramBase* histogram = | |
| 67 base::StatisticsRecorder::FindHistogram(histogram_name); | |
| 68 if (!histogram) | |
| 69 return 0; | |
| 70 | |
| 71 scoped_ptr<base::HistogramSamples> samples(histogram->SnapshotSamples()); | |
| 72 int sum = 0; | |
| 73 for (int i = 0; i < 100; ++i) { | |
| 74 int count_for_id = samples->GetCount(i); | |
| 75 EXPECT_GE(count_for_id, 0); | |
| 76 sum += count_for_id; | |
| 77 | |
| 78 if (allowed_buckets == ALLOW_NONE || | |
| 79 (allowed_buckets != ALLOW_ANY && i != allowed_buckets)) { | |
| 80 EXPECT_EQ(0, count_for_id) << "Unexpected reporting_id: " << i; | |
| 81 } | |
| 82 } | |
| 83 return sum; | |
| 84 } | |
| 85 | |
| 86 scoped_ptr<base::DictionaryValue> ReadPrefsDictionary( | |
| 87 const base::FilePath& pref_file) { | |
| 88 JSONFileValueSerializer serializer(pref_file); | |
| 89 int error_code = JSONFileValueSerializer::JSON_NO_ERROR; | |
| 90 std::string error_str; | |
| 91 scoped_ptr<base::Value> prefs( | |
| 92 serializer.Deserialize(&error_code, &error_str)); | |
| 93 if (!prefs || error_code != JSONFileValueSerializer::JSON_NO_ERROR) { | |
| 94 ADD_FAILURE() << "Error #" << error_code << ": " << error_str; | |
| 95 return scoped_ptr<base::DictionaryValue>(); | |
| 96 } | |
| 97 if (!prefs->IsType(base::Value::TYPE_DICTIONARY)) { | |
| 98 ADD_FAILURE(); | |
| 99 return scoped_ptr<base::DictionaryValue>(); | |
| 100 } | |
| 101 return scoped_ptr<base::DictionaryValue>( | |
| 102 static_cast<base::DictionaryValue*>(prefs.release())); | |
| 103 } | |
| 104 | |
| 105 #define PREF_HASH_BROWSER_TEST(fixture, test_name) \ | |
| 106 IN_PROC_BROWSER_TEST_P(fixture, PRE_##test_name) { \ | |
| 107 SetupPreferences(); \ | |
| 108 } \ | |
| 109 IN_PROC_BROWSER_TEST_P(fixture, test_name) { \ | |
| 110 VerifyReactionToPrefAttack(); \ | |
| 111 } \ | |
| 112 INSTANTIATE_TEST_CASE_P( \ | |
| 113 fixture##Instance, \ | |
| 114 fixture, \ | |
| 115 testing::Values( \ | |
| 116 chrome_prefs::internals::kSettingsEnforcementGroupNoEnforcement, \ | |
| 117 chrome_prefs::internals::kSettingsEnforcementGroupEnforceAlways, \ | |
| 118 chrome_prefs::internals:: \ | |
| 119 kSettingsEnforcementGroupEnforceAlwaysWithDSE, \ | |
| 120 chrome_prefs::internals:: \ | |
| 121 kSettingsEnforcementGroupEnforceAlwaysWithExtensionsAndDSE)); | |
| 122 | |
| 123 // A base fixture designed such that implementations do two things: | |
| 124 // 1) Override all three pure-virtual methods below to setup, attack, and | |
| 125 // verify preferenes throughout the tests provided by this fixture. | |
| 126 // 2) Instantiate their test via the PREF_HASH_BROWSER_TEST macro above. | |
| 127 // Based on top of ExtensionBrowserTest to allow easy interaction with the | |
| 128 // ExtensionService. | |
| 129 class PrefHashBrowserTestBase | |
| 130 : public ExtensionBrowserTest, | |
| 131 public testing::WithParamInterface<std::string> { | |
| 132 public: | |
| 133 // List of potential protection levels for this test in strict increasing | |
| 134 // order of protection levels. | |
| 135 enum SettingsProtectionLevel { | |
| 136 PROTECTION_DISABLED_ON_PLATFORM, | |
| 137 PROTECTION_DISABLED_FOR_GROUP, | |
| 138 PROTECTION_ENABLED_BASIC, | |
| 139 PROTECTION_ENABLED_DSE, | |
| 140 PROTECTION_ENABLED_EXTENSIONS, | |
| 141 // Represents the strongest level (i.e. always equivalent to the last one in | |
| 142 // terms of protection), leave this one last when adding new levels. | |
| 143 PROTECTION_ENABLED_ALL | |
| 144 }; | |
| 145 | |
| 146 PrefHashBrowserTestBase() | |
| 147 : protection_level_(GetProtectionLevelFromTrialGroup(GetParam())) { | |
| 148 } | |
| 149 | |
| 150 virtual void SetUpCommandLine(CommandLine* command_line) OVERRIDE { | |
| 151 ExtensionBrowserTest::SetUpCommandLine(command_line); | |
| 152 EXPECT_FALSE(command_line->HasSwitch(switches::kForceFieldTrials)); | |
| 153 command_line->AppendSwitchASCII( | |
| 154 switches::kForceFieldTrials, | |
| 155 std::string(chrome_prefs::internals::kSettingsEnforcementTrialName) + | |
| 156 "/" + GetParam() + "/"); | |
| 157 #if defined(OS_CHROMEOS) | |
| 158 command_line->AppendSwitch( | |
| 159 chromeos::switches::kIgnoreUserProfileMappingForTests); | |
| 160 #endif | |
| 161 } | |
| 162 | |
| 163 virtual bool SetUpUserDataDirectory() OVERRIDE { | |
| 164 // Do the normal setup in the PRE test and attack preferences in the main | |
| 165 // test. | |
| 166 if (IsPRETest()) | |
| 167 return ExtensionBrowserTest::SetUpUserDataDirectory(); | |
| 168 | |
| 169 #if defined(OS_CHROMEOS) | |
| 170 // For some reason, the Preferences file does not exist in the location | |
| 171 // below on Chrome OS. Since protection is disabled on Chrome OS, it's okay | |
| 172 // to simply not attack preferences at all (and still assert that no | |
| 173 // hardening related histogram kicked in in VerifyReactionToPrefAttack()). | |
| 174 // TODO(gab): Figure out why there is no Preferences file in this location | |
| 175 // on Chrome OS (and re-enable the section disabled for OS_CHROMEOS further | |
| 176 // below). | |
| 177 EXPECT_EQ(PROTECTION_DISABLED_ON_PLATFORM, protection_level_); | |
| 178 return true; | |
| 179 #endif | |
| 180 | |
| 181 base::FilePath profile_dir; | |
| 182 EXPECT_TRUE(PathService::Get(chrome::DIR_USER_DATA, &profile_dir)); | |
| 183 profile_dir = profile_dir.AppendASCII(TestingProfile::kTestUserProfileDir); | |
| 184 | |
| 185 // Sanity check that old protected pref file is never present in modern | |
| 186 // Chromes. | |
| 187 EXPECT_FALSE(base::PathExists( | |
| 188 profile_dir.Append(chrome::kProtectedPreferencesFilenameDeprecated))); | |
| 189 | |
| 190 // Read the preferences from disk. | |
| 191 | |
| 192 const base::FilePath unprotected_pref_file = | |
| 193 profile_dir.Append(chrome::kPreferencesFilename); | |
| 194 EXPECT_TRUE(base::PathExists(unprotected_pref_file)); | |
| 195 | |
| 196 const base::FilePath protected_pref_file = | |
| 197 profile_dir.Append(chrome::kSecurePreferencesFilename); | |
| 198 EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM, | |
| 199 base::PathExists(protected_pref_file)); | |
| 200 | |
| 201 scoped_ptr<base::DictionaryValue> unprotected_preferences( | |
| 202 ReadPrefsDictionary(unprotected_pref_file)); | |
| 203 if (!unprotected_preferences) | |
| 204 return false; | |
| 205 | |
| 206 scoped_ptr<base::DictionaryValue> protected_preferences; | |
| 207 if (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM) { | |
| 208 protected_preferences = ReadPrefsDictionary(protected_pref_file); | |
| 209 if (!protected_preferences) | |
| 210 return false; | |
| 211 } | |
| 212 | |
| 213 // Let the underlying test modify the preferences. | |
| 214 AttackPreferencesOnDisk(unprotected_preferences.get(), | |
| 215 protected_preferences.get()); | |
| 216 | |
| 217 // Write the modified preferences back to disk. | |
| 218 | |
| 219 JSONFileValueSerializer unprotected_prefs_serializer(unprotected_pref_file); | |
| 220 EXPECT_TRUE( | |
| 221 unprotected_prefs_serializer.Serialize(*unprotected_preferences)); | |
| 222 | |
| 223 if (protected_preferences) { | |
| 224 JSONFileValueSerializer protected_prefs_serializer(protected_pref_file); | |
| 225 EXPECT_TRUE(protected_prefs_serializer.Serialize(*protected_preferences)); | |
| 226 } | |
| 227 | |
| 228 return true; | |
| 229 } | |
| 230 | |
| 231 virtual void SetUpInProcessBrowserTestFixture() OVERRIDE { | |
| 232 ExtensionBrowserTest::SetUpInProcessBrowserTestFixture(); | |
| 233 | |
| 234 // Bots are on a domain, turn off the domain check for settings hardening in | |
| 235 // order to be able to test all SettingsEnforcement groups. | |
| 236 chrome_prefs::DisableDelaysAndDomainCheckForTesting(); | |
| 237 } | |
| 238 | |
| 239 // In the PRE_ test, find the number of tracked preferences that were | |
| 240 // initialized and save it to a file to be read back in the main test and used | |
| 241 // as the total number of tracked preferences. | |
| 242 virtual void SetUpOnMainThread() OVERRIDE { | |
| 243 ExtensionBrowserTest::SetUpOnMainThread(); | |
| 244 | |
| 245 // File in which the PRE_ test will save the number of tracked preferences | |
| 246 // on this platform. | |
| 247 const char kNumTrackedPrefFilename[] = "NumTrackedPrefs"; | |
| 248 | |
| 249 base::FilePath num_tracked_prefs_file; | |
| 250 ASSERT_TRUE( | |
| 251 PathService::Get(chrome::DIR_USER_DATA, &num_tracked_prefs_file)); | |
| 252 num_tracked_prefs_file = | |
| 253 num_tracked_prefs_file.AppendASCII(kNumTrackedPrefFilename); | |
| 254 | |
| 255 if (IsPRETest()) { | |
| 256 num_tracked_prefs_ = GetTrackedPrefHistogramCount( | |
| 257 "Settings.TrackedPreferenceTrustedInitialized", ALLOW_ANY); | |
| 258 EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM, | |
| 259 num_tracked_prefs_ > 0); | |
| 260 | |
| 261 // Split tracked prefs are reported as Unchanged not as TrustedInitialized | |
| 262 // when an empty dictionary is encountered on first run (this should only | |
| 263 // hit for pref #5 in the current design). | |
| 264 int num_split_tracked_prefs = GetTrackedPrefHistogramCount( | |
| 265 "Settings.TrackedPreferenceUnchanged", BEGIN_ALLOW_SINGLE_BUCKET + 5); | |
| 266 EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0, | |
| 267 num_split_tracked_prefs); | |
| 268 | |
| 269 num_tracked_prefs_ += num_split_tracked_prefs; | |
| 270 | |
| 271 std::string num_tracked_prefs_str = base::IntToString(num_tracked_prefs_); | |
| 272 EXPECT_EQ(static_cast<int>(num_tracked_prefs_str.size()), | |
| 273 base::WriteFile(num_tracked_prefs_file, | |
| 274 num_tracked_prefs_str.c_str(), | |
| 275 num_tracked_prefs_str.size())); | |
| 276 } else { | |
| 277 std::string num_tracked_prefs_str; | |
| 278 EXPECT_TRUE(base::ReadFileToString(num_tracked_prefs_file, | |
| 279 &num_tracked_prefs_str)); | |
| 280 EXPECT_TRUE( | |
| 281 base::StringToInt(num_tracked_prefs_str, &num_tracked_prefs_)); | |
| 282 } | |
| 283 } | |
| 284 | |
| 285 protected: | |
| 286 // Called from the PRE_ test's body. Overrides should use it to setup | |
| 287 // preferences through Chrome. | |
| 288 virtual void SetupPreferences() = 0; | |
| 289 | |
| 290 // Called prior to the main test launching its browser. Overrides should use | |
| 291 // it to attack preferences. |(un)protected_preferences| represent the state | |
| 292 // on disk prior to launching the main test, they can be modified by this | |
| 293 // method and modifications will be flushed back to disk before launching the | |
| 294 // main test. |unprotected_preferences| is never NULL, |protected_preferences| | |
| 295 // may be NULL if in PROTECTION_DISABLED_ON_PLATFORM mode. | |
| 296 virtual void AttackPreferencesOnDisk( | |
| 297 base::DictionaryValue* unprotected_preferences, | |
| 298 base::DictionaryValue* protected_preferences) = 0; | |
| 299 | |
| 300 // Called from the body of the main test. Overrides should use it to verify | |
| 301 // that the browser had the desired reaction when faced when the attack | |
| 302 // orchestrated in AttackPreferencesOnDisk(). | |
| 303 virtual void VerifyReactionToPrefAttack() = 0; | |
| 304 | |
| 305 int num_tracked_prefs() const { return num_tracked_prefs_; } | |
| 306 | |
| 307 const SettingsProtectionLevel protection_level_; | |
| 308 | |
| 309 private: | |
| 310 // Returns true if this is the PRE_ phase of the test. | |
| 311 bool IsPRETest() { | |
| 312 return StartsWithASCII( | |
| 313 testing::UnitTest::GetInstance()->current_test_info()->name(), | |
| 314 "PRE_", | |
| 315 true /* case_sensitive */); | |
| 316 } | |
| 317 | |
| 318 SettingsProtectionLevel GetProtectionLevelFromTrialGroup( | |
| 319 const std::string& trial_group) { | |
| 320 if (!ProfilePrefStoreManager::kPlatformSupportsPreferenceTracking) | |
| 321 return PROTECTION_DISABLED_ON_PLATFORM; | |
| 322 | |
| 323 // Protection levels can't be adjusted via --force-fieldtrials in official | |
| 324 // builds. | |
| 325 #if defined(OFFICIAL_BUILD) | |
| 326 #if defined(OS_WIN) | |
| 327 // The strongest mode is enforced on Windows in the absence of a field | |
| 328 // trial. | |
| 329 return PROTECTION_ENABLED_ALL; | |
| 330 #else | |
| 331 return PROTECTION_DISABLED_FOR_GROUP; | |
| 332 #endif | |
| 333 #endif | |
| 334 | |
| 335 using namespace chrome_prefs::internals; | |
| 336 if (trial_group == kSettingsEnforcementGroupNoEnforcement) { | |
| 337 return PROTECTION_DISABLED_FOR_GROUP; | |
| 338 } else if (trial_group == kSettingsEnforcementGroupEnforceAlways) { | |
| 339 return PROTECTION_ENABLED_BASIC; | |
| 340 } else if (trial_group == kSettingsEnforcementGroupEnforceAlwaysWithDSE) { | |
| 341 return PROTECTION_ENABLED_DSE; | |
| 342 } else if (trial_group == | |
| 343 kSettingsEnforcementGroupEnforceAlwaysWithExtensionsAndDSE) { | |
| 344 return PROTECTION_ENABLED_EXTENSIONS; | |
| 345 } else { | |
| 346 ADD_FAILURE(); | |
| 347 return static_cast<SettingsProtectionLevel>(-1); | |
| 348 } | |
| 349 } | |
| 350 | |
| 351 int num_tracked_prefs_; | |
| 352 }; | |
| 353 | |
| 354 } // namespace | |
| 355 | |
| 356 // Verifies that nothing is reset when nothing is tampered with. | |
| 357 // Also sanity checks that the expected preferences files are in place. | |
| 358 class PrefHashBrowserTestUnchangedDefault : public PrefHashBrowserTestBase { | |
| 359 public: | |
| 360 virtual void SetupPreferences() OVERRIDE { | |
| 361 // Default Chrome setup. | |
| 362 } | |
| 363 | |
| 364 virtual void AttackPreferencesOnDisk( | |
| 365 base::DictionaryValue* unprotected_preferences, | |
| 366 base::DictionaryValue* protected_preferences) OVERRIDE { | |
| 367 // No attack. | |
| 368 } | |
| 369 | |
| 370 virtual void VerifyReactionToPrefAttack() OVERRIDE { | |
| 371 // Expect all prefs to be reported as Unchanged with no resets. | |
| 372 EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM | |
| 373 ? num_tracked_prefs() : 0, | |
| 374 GetTrackedPrefHistogramCount( | |
| 375 "Settings.TrackedPreferenceUnchanged", ALLOW_ANY)); | |
| 376 EXPECT_EQ(0, | |
| 377 GetTrackedPrefHistogramCount( | |
| 378 "Settings.TrackedPreferenceWantedReset", ALLOW_NONE)); | |
| 379 EXPECT_EQ(0, | |
| 380 GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset", | |
| 381 ALLOW_NONE)); | |
| 382 | |
| 383 // Nothing else should have triggered. | |
| 384 EXPECT_EQ(0, | |
| 385 GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged", | |
| 386 ALLOW_NONE)); | |
| 387 EXPECT_EQ(0, | |
| 388 GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared", | |
| 389 ALLOW_NONE)); | |
| 390 EXPECT_EQ(0, | |
| 391 GetTrackedPrefHistogramCount( | |
| 392 "Settings.TrackedPreferenceInitialized", ALLOW_NONE)); | |
| 393 EXPECT_EQ(0, | |
| 394 GetTrackedPrefHistogramCount( | |
| 395 "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE)); | |
| 396 EXPECT_EQ( | |
| 397 0, | |
| 398 GetTrackedPrefHistogramCount( | |
| 399 "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE)); | |
| 400 } | |
| 401 }; | |
| 402 | |
| 403 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUnchangedDefault, UnchangedDefault); | |
| 404 | |
| 405 // Augments PrefHashBrowserTestUnchangedDefault to confirm that nothing is reset | |
| 406 // when nothing is tampered with, even if Chrome itself wrote custom prefs in | |
| 407 // its last run. | |
| 408 class PrefHashBrowserTestUnchangedCustom | |
| 409 : public PrefHashBrowserTestUnchangedDefault { | |
| 410 public: | |
| 411 virtual void SetupPreferences() OVERRIDE { | |
| 412 profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com"); | |
| 413 | |
| 414 InstallExtensionWithUIAutoConfirm( | |
| 415 test_data_dir_.AppendASCII("good.crx"), 1, browser()); | |
| 416 } | |
| 417 | |
| 418 virtual void VerifyReactionToPrefAttack() OVERRIDE { | |
| 419 // Make sure the settings written in the last run stuck. | |
| 420 EXPECT_EQ("http://example.com", | |
| 421 profile()->GetPrefs()->GetString(prefs::kHomePage)); | |
| 422 | |
| 423 EXPECT_TRUE(extension_service()->GetExtensionById(kGoodCrxId, false)); | |
| 424 | |
| 425 // Reaction should be identical to unattacked default prefs. | |
| 426 PrefHashBrowserTestUnchangedDefault::VerifyReactionToPrefAttack(); | |
| 427 } | |
| 428 }; | |
| 429 | |
| 430 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUnchangedCustom, UnchangedCustom); | |
| 431 | |
| 432 // Verifies that cleared prefs are reported. | |
| 433 class PrefHashBrowserTestClearedAtomic : public PrefHashBrowserTestBase { | |
| 434 public: | |
| 435 virtual void SetupPreferences() OVERRIDE { | |
| 436 profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com"); | |
| 437 } | |
| 438 | |
| 439 virtual void AttackPreferencesOnDisk( | |
| 440 base::DictionaryValue* unprotected_preferences, | |
| 441 base::DictionaryValue* protected_preferences) OVERRIDE { | |
| 442 base::DictionaryValue* selected_prefs = | |
| 443 protection_level_ >= PROTECTION_ENABLED_BASIC ? protected_preferences | |
| 444 : unprotected_preferences; | |
| 445 // |selected_prefs| should never be NULL under the protection level picking | |
| 446 // it. | |
| 447 EXPECT_TRUE(selected_prefs); | |
| 448 EXPECT_TRUE(selected_prefs->Remove(prefs::kHomePage, NULL)); | |
| 449 } | |
| 450 | |
| 451 virtual void VerifyReactionToPrefAttack() OVERRIDE { | |
| 452 // The clearance of homepage should have been noticed (as pref #2 being | |
| 453 // cleared), but shouldn't have triggered a reset (as there is nothing we | |
| 454 // can do when the pref is already gone). | |
| 455 EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0, | |
| 456 GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared", | |
| 457 BEGIN_ALLOW_SINGLE_BUCKET + 2)); | |
| 458 EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM | |
| 459 ? num_tracked_prefs() - 1 : 0, | |
| 460 GetTrackedPrefHistogramCount( | |
| 461 "Settings.TrackedPreferenceUnchanged", ALLOW_ANY)); | |
| 462 EXPECT_EQ(0, | |
| 463 GetTrackedPrefHistogramCount( | |
| 464 "Settings.TrackedPreferenceWantedReset", ALLOW_NONE)); | |
| 465 EXPECT_EQ(0, | |
| 466 GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset", | |
| 467 ALLOW_NONE)); | |
| 468 | |
| 469 // Nothing else should have triggered. | |
| 470 EXPECT_EQ(0, | |
| 471 GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged", | |
| 472 ALLOW_NONE)); | |
| 473 EXPECT_EQ(0, | |
| 474 GetTrackedPrefHistogramCount( | |
| 475 "Settings.TrackedPreferenceInitialized", ALLOW_NONE)); | |
| 476 EXPECT_EQ(0, | |
| 477 GetTrackedPrefHistogramCount( | |
| 478 "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE)); | |
| 479 EXPECT_EQ( | |
| 480 0, | |
| 481 GetTrackedPrefHistogramCount( | |
| 482 "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE)); | |
| 483 } | |
| 484 }; | |
| 485 | |
| 486 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestClearedAtomic, ClearedAtomic); | |
| 487 | |
| 488 // Verifies that clearing the MACs results in untrusted Initialized pings for | |
| 489 // non-null protected prefs. | |
| 490 class PrefHashBrowserTestUntrustedInitialized : public PrefHashBrowserTestBase { | |
| 491 public: | |
| 492 virtual void SetupPreferences() OVERRIDE { | |
| 493 // Explicitly set the DSE (it's otherwise NULL by default, preventing | |
| 494 // thorough testing of the PROTECTION_ENABLED_DSE level). | |
| 495 DefaultSearchManager default_search_manager( | |
| 496 profile()->GetPrefs(), DefaultSearchManager::ObserverCallback()); | |
| 497 DefaultSearchManager::Source dse_source = | |
| 498 static_cast<DefaultSearchManager::Source>(-1); | |
| 499 | |
| 500 const TemplateURLData* default_template_url_data = | |
| 501 default_search_manager.GetDefaultSearchEngine(&dse_source); | |
| 502 EXPECT_EQ(DefaultSearchManager::FROM_FALLBACK, dse_source); | |
| 503 | |
| 504 default_search_manager.SetUserSelectedDefaultSearchEngine( | |
| 505 *default_template_url_data); | |
| 506 | |
| 507 default_search_manager.GetDefaultSearchEngine(&dse_source); | |
| 508 EXPECT_EQ(DefaultSearchManager::FROM_USER, dse_source); | |
| 509 | |
| 510 // Also explicitly set an atomic pref that falls under | |
| 511 // PROTECTION_ENABLED_BASIC. | |
| 512 profile()->GetPrefs()->SetInteger(prefs::kRestoreOnStartup, | |
| 513 SessionStartupPref::URLS); | |
| 514 } | |
| 515 | |
| 516 virtual void AttackPreferencesOnDisk( | |
| 517 base::DictionaryValue* unprotected_preferences, | |
| 518 base::DictionaryValue* protected_preferences) OVERRIDE { | |
| 519 EXPECT_TRUE(unprotected_preferences->Remove("protection.macs", NULL)); | |
| 520 if (protected_preferences) | |
| 521 EXPECT_TRUE(protected_preferences->Remove("protection.macs", NULL)); | |
| 522 } | |
| 523 | |
| 524 virtual void VerifyReactionToPrefAttack() OVERRIDE { | |
| 525 // Preferences that are NULL by default will be TrustedInitialized. | |
| 526 int num_null_values = GetTrackedPrefHistogramCount( | |
| 527 "Settings.TrackedPreferenceTrustedInitialized", ALLOW_ANY); | |
| 528 EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM, | |
| 529 num_null_values > 0); | |
| 530 if (num_null_values > 0) { | |
| 531 // This test requires that at least 3 prefs be non-null (extensions, DSE, | |
| 532 // and 1 atomic pref explictly set for this test above). | |
| 533 EXPECT_LT(num_null_values, num_tracked_prefs() - 3); | |
| 534 } | |
| 535 | |
| 536 // Expect all non-null prefs to be reported as Initialized (with | |
| 537 // accompanying resets or wanted resets based on the current protection | |
| 538 // level). | |
| 539 EXPECT_EQ(num_tracked_prefs() - num_null_values, | |
| 540 GetTrackedPrefHistogramCount( | |
| 541 "Settings.TrackedPreferenceInitialized", ALLOW_ANY)); | |
| 542 | |
| 543 int num_protected_prefs = 0; | |
| 544 // A switch statement falling through each protection level in decreasing | |
| 545 // levels of protection to add expectations for each level which augments | |
| 546 // the previous one. | |
| 547 switch (protection_level_) { | |
| 548 case PROTECTION_ENABLED_ALL: | |
| 549 // Falls through. | |
| 550 case PROTECTION_ENABLED_EXTENSIONS: | |
| 551 ++num_protected_prefs; | |
| 552 // Falls through. | |
| 553 case PROTECTION_ENABLED_DSE: | |
| 554 ++num_protected_prefs; | |
| 555 // Falls through. | |
| 556 case PROTECTION_ENABLED_BASIC: | |
| 557 num_protected_prefs += num_tracked_prefs() - num_null_values - 2; | |
| 558 // Falls through. | |
| 559 case PROTECTION_DISABLED_FOR_GROUP: | |
| 560 // No protection. Falls through. | |
| 561 case PROTECTION_DISABLED_ON_PLATFORM: | |
| 562 // No protection. | |
| 563 break; | |
| 564 } | |
| 565 | |
| 566 EXPECT_EQ(num_tracked_prefs() - num_null_values - num_protected_prefs, | |
| 567 GetTrackedPrefHistogramCount( | |
| 568 "Settings.TrackedPreferenceWantedReset", ALLOW_ANY)); | |
| 569 EXPECT_EQ(num_protected_prefs, | |
| 570 GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset", | |
| 571 ALLOW_ANY)); | |
| 572 | |
| 573 // Explicitly verify the result of reported resets. | |
| 574 | |
| 575 DefaultSearchManager default_search_manager( | |
| 576 profile()->GetPrefs(), DefaultSearchManager::ObserverCallback()); | |
| 577 DefaultSearchManager::Source dse_source = | |
| 578 static_cast<DefaultSearchManager::Source>(-1); | |
| 579 default_search_manager.GetDefaultSearchEngine(&dse_source); | |
| 580 EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_DSE | |
| 581 ? DefaultSearchManager::FROM_USER | |
| 582 : DefaultSearchManager::FROM_FALLBACK, | |
| 583 dse_source); | |
| 584 | |
| 585 EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_BASIC, | |
| 586 profile()->GetPrefs()->GetInteger(prefs::kRestoreOnStartup) == | |
| 587 SessionStartupPref::URLS); | |
| 588 | |
| 589 // Nothing else should have triggered. | |
| 590 EXPECT_EQ(0, | |
| 591 GetTrackedPrefHistogramCount( | |
| 592 "Settings.TrackedPreferenceUnchanged", ALLOW_NONE)); | |
| 593 EXPECT_EQ(0, | |
| 594 GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged", | |
| 595 ALLOW_NONE)); | |
| 596 EXPECT_EQ(0, | |
| 597 GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared", | |
| 598 ALLOW_NONE)); | |
| 599 EXPECT_EQ( | |
| 600 0, | |
| 601 GetTrackedPrefHistogramCount( | |
| 602 "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE)); | |
| 603 } | |
| 604 }; | |
| 605 | |
| 606 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUntrustedInitialized, | |
| 607 UntrustedInitialized); | |
| 608 | |
| 609 // Verifies that changing an atomic pref results in it being reported (and reset | |
| 610 // if the protection level allows it). | |
| 611 class PrefHashBrowserTestChangedAtomic : public PrefHashBrowserTestBase { | |
| 612 public: | |
| 613 virtual void SetupPreferences() OVERRIDE { | |
| 614 profile()->GetPrefs()->SetInteger(prefs::kRestoreOnStartup, | |
| 615 SessionStartupPref::URLS); | |
| 616 | |
| 617 ListPrefUpdate update(profile()->GetPrefs(), | |
| 618 prefs::kURLsToRestoreOnStartup); | |
| 619 update->AppendString("http://example.com"); | |
| 620 } | |
| 621 | |
| 622 virtual void AttackPreferencesOnDisk( | |
| 623 base::DictionaryValue* unprotected_preferences, | |
| 624 base::DictionaryValue* protected_preferences) OVERRIDE { | |
| 625 base::DictionaryValue* selected_prefs = | |
| 626 protection_level_ >= PROTECTION_ENABLED_BASIC ? protected_preferences | |
| 627 : unprotected_preferences; | |
| 628 // |selected_prefs| should never be NULL under the protection level picking | |
| 629 // it. | |
| 630 EXPECT_TRUE(selected_prefs); | |
| 631 base::ListValue* startup_urls; | |
| 632 EXPECT_TRUE( | |
| 633 selected_prefs->GetList(prefs::kURLsToRestoreOnStartup, &startup_urls)); | |
| 634 EXPECT_TRUE(startup_urls); | |
| 635 EXPECT_EQ(1U, startup_urls->GetSize()); | |
| 636 startup_urls->AppendString("http://example.org"); | |
| 637 } | |
| 638 | |
| 639 virtual void VerifyReactionToPrefAttack() OVERRIDE { | |
| 640 // Expect a single Changed event for tracked pref #4 (startup URLs). | |
| 641 EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0, | |
| 642 GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged", | |
| 643 BEGIN_ALLOW_SINGLE_BUCKET + 4)); | |
| 644 EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM | |
| 645 ? num_tracked_prefs() - 1 : 0, | |
| 646 GetTrackedPrefHistogramCount( | |
| 647 "Settings.TrackedPreferenceUnchanged", ALLOW_ANY)); | |
| 648 | |
| 649 EXPECT_EQ( | |
| 650 (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM && | |
| 651 protection_level_ < PROTECTION_ENABLED_BASIC) ? 1 : 0, | |
| 652 GetTrackedPrefHistogramCount("Settings.TrackedPreferenceWantedReset", | |
| 653 BEGIN_ALLOW_SINGLE_BUCKET + 4)); | |
| 654 EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_BASIC ? 1 : 0, | |
| 655 GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset", | |
| 656 BEGIN_ALLOW_SINGLE_BUCKET + 4)); | |
| 657 | |
| 658 // TODO(gab): This doesn't work on OS_CHROMEOS because we fail to attack | |
| 659 // Preferences. | |
| 660 #if !defined(OS_CHROMEOS) | |
| 661 // Explicitly verify the result of reported resets. | |
| 662 EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_BASIC ? 0U : 2U, | |
| 663 profile() | |
| 664 ->GetPrefs() | |
| 665 ->GetList(prefs::kURLsToRestoreOnStartup) | |
| 666 ->GetSize()); | |
| 667 #endif | |
| 668 | |
| 669 // Nothing else should have triggered. | |
| 670 EXPECT_EQ(0, | |
| 671 GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared", | |
| 672 ALLOW_NONE)); | |
| 673 EXPECT_EQ(0, | |
| 674 GetTrackedPrefHistogramCount( | |
| 675 "Settings.TrackedPreferenceInitialized", ALLOW_NONE)); | |
| 676 EXPECT_EQ(0, | |
| 677 GetTrackedPrefHistogramCount( | |
| 678 "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE)); | |
| 679 EXPECT_EQ( | |
| 680 0, | |
| 681 GetTrackedPrefHistogramCount( | |
| 682 "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE)); | |
| 683 } | |
| 684 }; | |
| 685 | |
| 686 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestChangedAtomic, ChangedAtomic); | |
| 687 | |
| 688 // Verifies that changing or adding an entry in a split pref results in both | |
| 689 // items being reported (and remove if the protection level allows it). | |
| 690 class PrefHashBrowserTestChangedSplitPref : public PrefHashBrowserTestBase { | |
| 691 public: | |
| 692 virtual void SetupPreferences() OVERRIDE { | |
| 693 InstallExtensionWithUIAutoConfirm( | |
| 694 test_data_dir_.AppendASCII("good.crx"), 1, browser()); | |
| 695 } | |
| 696 | |
| 697 virtual void AttackPreferencesOnDisk( | |
| 698 base::DictionaryValue* unprotected_preferences, | |
| 699 base::DictionaryValue* protected_preferences) OVERRIDE { | |
| 700 base::DictionaryValue* selected_prefs = | |
| 701 protection_level_ >= PROTECTION_ENABLED_EXTENSIONS | |
| 702 ? protected_preferences | |
| 703 : unprotected_preferences; | |
| 704 // |selected_prefs| should never be NULL under the protection level picking | |
| 705 // it. | |
| 706 EXPECT_TRUE(selected_prefs); | |
| 707 base::DictionaryValue* extensions_dict; | |
| 708 EXPECT_TRUE(selected_prefs->GetDictionary( | |
| 709 extensions::pref_names::kExtensions, &extensions_dict)); | |
| 710 EXPECT_TRUE(extensions_dict); | |
| 711 | |
| 712 // Tamper with any installed setting for good.crx | |
| 713 base::DictionaryValue* good_crx_dict; | |
| 714 EXPECT_TRUE(extensions_dict->GetDictionary(kGoodCrxId, &good_crx_dict)); | |
| 715 int good_crx_state; | |
| 716 EXPECT_TRUE(good_crx_dict->GetInteger("state", &good_crx_state)); | |
| 717 EXPECT_EQ(extensions::Extension::ENABLED, good_crx_state); | |
| 718 good_crx_dict->SetInteger("state", extensions::Extension::DISABLED); | |
| 719 | |
| 720 // Drop a fake extension (for the purpose of this test, dropped settings | |
| 721 // don't need to be valid extension settings). | |
| 722 base::DictionaryValue* fake_extension = new base::DictionaryValue; | |
| 723 fake_extension->SetString("name", "foo"); | |
| 724 extensions_dict->Set(std::string(32, 'a'), fake_extension); | |
| 725 } | |
| 726 | |
| 727 virtual void VerifyReactionToPrefAttack() OVERRIDE { | |
| 728 // Expect a single split pref changed report with a count of 2 for tracked | |
| 729 // pref #5 (extensions). | |
| 730 EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0, | |
| 731 GetTrackedPrefHistogramCount("Settings.TrackedPreferenceChanged", | |
| 732 BEGIN_ALLOW_SINGLE_BUCKET + 5)); | |
| 733 EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0, | |
| 734 GetTrackedPrefHistogramCount( | |
| 735 "Settings.TrackedSplitPreferenceChanged.extensions.settings", | |
| 736 BEGIN_ALLOW_SINGLE_BUCKET + 2)); | |
| 737 | |
| 738 // Everything else should have remained unchanged. | |
| 739 EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM | |
| 740 ? num_tracked_prefs() - 1 : 0, | |
| 741 GetTrackedPrefHistogramCount( | |
| 742 "Settings.TrackedPreferenceUnchanged", ALLOW_ANY)); | |
| 743 | |
| 744 EXPECT_EQ( | |
| 745 (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM && | |
| 746 protection_level_ < PROTECTION_ENABLED_EXTENSIONS) ? 1 : 0, | |
| 747 GetTrackedPrefHistogramCount("Settings.TrackedPreferenceWantedReset", | |
| 748 BEGIN_ALLOW_SINGLE_BUCKET + 5)); | |
| 749 EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_EXTENSIONS ? 1 : 0, | |
| 750 GetTrackedPrefHistogramCount("Settings.TrackedPreferenceReset", | |
| 751 BEGIN_ALLOW_SINGLE_BUCKET + 5)); | |
| 752 | |
| 753 EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_EXTENSIONS, | |
| 754 extension_service()->GetExtensionById(kGoodCrxId, true) != NULL); | |
| 755 | |
| 756 // Nothing else should have triggered. | |
| 757 EXPECT_EQ(0, | |
| 758 GetTrackedPrefHistogramCount("Settings.TrackedPreferenceCleared", | |
| 759 ALLOW_NONE)); | |
| 760 EXPECT_EQ(0, | |
| 761 GetTrackedPrefHistogramCount( | |
| 762 "Settings.TrackedPreferenceInitialized", ALLOW_NONE)); | |
| 763 EXPECT_EQ(0, | |
| 764 GetTrackedPrefHistogramCount( | |
| 765 "Settings.TrackedPreferenceTrustedInitialized", ALLOW_NONE)); | |
| 766 EXPECT_EQ( | |
| 767 0, | |
| 768 GetTrackedPrefHistogramCount( | |
| 769 "Settings.TrackedPreferenceMigratedLegacyDeviceId", ALLOW_NONE)); | |
| 770 } | |
| 771 }; | |
| 772 | |
| 773 PREF_HASH_BROWSER_TEST(PrefHashBrowserTestChangedSplitPref, ChangedSplitPref); | |
| OLD | NEW |
|---|
Chromium Code Reviews
Issue 448563002:
Revert 287689 "Add integration browser tests for settings harden..." (Closed)
Base URL: svn://svn.chromium.org/chrome/