Reject JWK key import when key_ops contains duplicate values.

content/child/webcrypto/test/aes_cbc_unittest.cc

Index: content/child/webcrypto/test/aes_cbc_unittest.cc
diff --git a/content/child/webcrypto/test/aes_cbc_unittest.cc b/content/child/webcrypto/test/aes_cbc_unittest.cc
index b7f897c6db5a3aa9794e2e094935b309de971060..95a6d2c83bffb580561fc1ca398c441be22c72f1 100644
--- a/content/child/webcrypto/test/aes_cbc_unittest.cc
+++ b/content/child/webcrypto/test/aes_cbc_unittest.cc
@@ -402,6 +402,48 @@ TEST(WebCryptoAesCbcTest, ImportKeyJwkKeyOpsEncryptDecrypt) {
             key.usages());
 }
 
+// Tests that importing a JWK containing duplicate key_ops values fails.
+TEST(WebCryptoAesCbcTest, ImportKeyJwkDuplicateKeyOps) {
+  blink::WebCryptoKey key;
+  base::DictionaryValue dict;
+  dict.SetString("kty", "oct");
+  dict.SetString("k", "GADWrMRHwQfoNaXU5fZvTg==");
+  // key_ops will be owned by |dict|.
+  base::ListValue* key_ops = new base::ListValue;
+  dict.Set("key_ops", key_ops);
+
+  // The "encrypt" operation appears twice.
+  key_ops->AppendString("encrypt");
+  key_ops->AppendString("decrypt");
+  key_ops->AppendString("encrypt");
+
+  EXPECT_EQ(Status::ErrorJwkDuplicateKeyOps(),
+            ImportKeyJwkFromDict(
+                dict, CreateAlgorithm(blink::WebCryptoAlgorithmIdAesCbc), false,
+                0, &key));
+}
+
+// Tests that importing a JWK containing duplicate key_ops values fails.
+TEST(WebCryptoAesCbcTest, ImportKeyJwkDuplicateUnrecognizedKeyOps) {
+  blink::WebCryptoKey key;
+  base::DictionaryValue dict;
+  dict.SetString("kty", "oct");
+  dict.SetString("k", "GADWrMRHwQfoNaXU5fZvTg==");
+  // key_ops will be owned by |dict|.
+  base::ListValue* key_ops = new base::ListValue;
+  dict.Set("key_ops", key_ops);
+
+  // The (unknown) "foopy" operation appears twice.
+  key_ops->AppendString("foopy");
+  key_ops->AppendString("decrypt");
+  key_ops->AppendString("foopy");
+
+  EXPECT_EQ(Status::ErrorJwkDuplicateKeyOps(),
+            ImportKeyJwkFromDict(
+                dict, CreateAlgorithm(blink::WebCryptoAlgorithmIdAesCbc), false,
+                0, &key));
+}
+
 // Test failure if input usage is NOT a strict subset of the JWK usage.
 TEST(WebCryptoAesCbcTest, ImportKeyJwkKeyOpsNotSuperset) {
   blink::WebCryptoKey key;