Reject JWK key import when key_ops contains duplicate values.

content/child/webcrypto/test/aes_cbc_unittest.cc

 // Copyright 2014 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/stl_util.h"
 #include "content/child/webcrypto/algorithm_dispatch.h"
 #include "content/child/webcrypto/crypto_data.h"
 #include "content/child/webcrypto/status.h"
 #include "content/child/webcrypto/test/test_helpers.h"
 #include "content/child/webcrypto/webcrypto_util.h"
@@ skipping 384 matching lines @@
           dict,
           CreateAlgorithm(blink::WebCryptoAlgorithmIdAesCbc),
           false,
           blink::WebCryptoKeyUsageDecrypt | blink::WebCryptoKeyUsageEncrypt,
           &key));
 
   EXPECT_EQ(blink::WebCryptoKeyUsageEncrypt | blink::WebCryptoKeyUsageDecrypt,
             key.usages());
 }
 
+// Tests that importing a JWK containing duplicate key_ops values fails.
+TEST(WebCryptoAesCbcTest, ImportKeyJwkDuplicateKeyOps) {
+  blink::WebCryptoKey key;
+  base::DictionaryValue dict;
+  dict.SetString("kty", "oct");
+  dict.SetString("k", "GADWrMRHwQfoNaXU5fZvTg==");
+  // key_ops will be owned by |dict|.
+  base::ListValue* key_ops = new base::ListValue;
+  dict.Set("key_ops", key_ops);
+
+  // The "encrypt" operation appears twice.
+  key_ops->AppendString("encrypt");
+  key_ops->AppendString("decrypt");
+  key_ops->AppendString("encrypt");
+
+  EXPECT_EQ(Status::ErrorJwkDuplicateKeyOps(),
+            ImportKeyJwkFromDict(
+                dict, CreateAlgorithm(blink::WebCryptoAlgorithmIdAesCbc), false,
+                0, &key));
+}
+
+// Tests that importing a JWK containing duplicate key_ops values fails.
+TEST(WebCryptoAesCbcTest, ImportKeyJwkDuplicateUnrecognizedKeyOps) {
+  blink::WebCryptoKey key;
+  base::DictionaryValue dict;
+  dict.SetString("kty", "oct");
+  dict.SetString("k", "GADWrMRHwQfoNaXU5fZvTg==");
+  // key_ops will be owned by |dict|.
+  base::ListValue* key_ops = new base::ListValue;
+  dict.Set("key_ops", key_ops);
+
+  // The (unknown) "foopy" operation appears twice.
+  key_ops->AppendString("foopy");
+  key_ops->AppendString("decrypt");
+  key_ops->AppendString("foopy");
+
+  EXPECT_EQ(Status::ErrorJwkDuplicateKeyOps(),
+            ImportKeyJwkFromDict(
+                dict, CreateAlgorithm(blink::WebCryptoAlgorithmIdAesCbc), false,
+                0, &key));
+}
+
 // Test failure if input usage is NOT a strict subset of the JWK usage.
 TEST(WebCryptoAesCbcTest, ImportKeyJwkKeyOpsNotSuperset) {
   blink::WebCryptoKey key;
   base::DictionaryValue dict;
   dict.SetString("kty", "oct");
   dict.SetString("k", "GADWrMRHwQfoNaXU5fZvTg==");
   base::ListValue* key_ops = new base::ListValue;
   dict.Set("key_ops", key_ops);  // Takes ownership.
 
   key_ops->AppendString("encrypt");
@@ skipping 617 matching lines @@
 
   EXPECT_NE(public_key_spki, wrapped_public_key);
   EXPECT_NE(private_key_pkcs8, wrapped_private_key);
 }
 
 }  // namespace
 
 }  // namespace webcrypto
 
 }  // namespace content