chrome.platformKeys.getKeyPair: Check requested algorithm against certificate.

chrome/test/data/extensions/api_test/platform_keys/basic.js

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 'use strict';
 
 var systemTokenEnabled = (location.search.indexOf("systemTokenEnabled") != -1);
 var selectedTestSuite = location.hash.slice(1);
 console.log('[SELECTED TEST SUITE] ' + selectedTestSuite +
             ', systemTokenEnable ' + systemTokenEnabled);
 
 var assertEq = chrome.test.assertEq;
 var assertTrue = chrome.test.assertTrue;
 var fail = chrome.test.fail;
 var succeed = chrome.test.succeed;
 var callbackPass = chrome.test.callbackPass;
 var callbackFail= chrome.test.callbackFail;
 
 // Each value is the path to a file in this extension's folder that will be
 // loaded and replaced by a Uint8Array in the setUp() function below.
 var data = {
-  // X.509 client certificates in DER encoding.
+  // X.509 client certificate in DER encoding.
+  // Algorithm in SPKI: rsaEncryption.
   // openssl x509 -in net/data/ssl/certificates/client_1.pem -outform DER -out
   //   client_1.der
   client_1: 'client_1.der',
 
+  // X.509 client certificate in DER encoding.
+  // Algorithm in SPKI: rsaEncryption.
   // openssl x509 -in net/data/ssl/certificates/client_2.pem -outform DER -out
   //   client_2.der
   client_2: 'client_2.der',
 
   // The public key of client_1 as Subject Public Key Info in DER encoding.
   // openssl rsa -in net/data/ssl/certificates/client_1.key -inform PEM -out
   //   pubkey.der -pubout -outform DER
   client_1_spki: 'client_1_spki.der',
 
   // The distinguished name of the CA that issued client_1 in DER encoding.
@@ skipping 223 matching lines @@
         data.client_1.buffer, keyParams, function(error) {
           fail('getKeyPair call was expected to fail.');
         });
     fail('getKeyPair did not throw error');
   } catch (e) {
     assertEq('Algorithm: name: Missing or not a String', e.message);
     succeed();
   }
 }
 
+function testGetKeyPairRejectsRSAPSS() {
+  var keyParams = {
+    name: 'RSA-PSS',
+    hash: {name: 'SHA-1'}
+  };
+  chrome.platformKeys.getKeyPair(
+      data.client_1.buffer, keyParams,
+      callbackFail(
+          'The requested Algorithm is not permitted by the certificate.'));
+}
+
 function testGetKeyPair() {
   var keyParams = {
     // Algorithm names are case-insensitive.
     name: 'RSASSA-Pkcs1-V1_5',
     hash: {name: 'sha-1'}
   };
   chrome.platformKeys.getKeyPair(
       data.client_1.buffer, keyParams,
       callbackPass(function(publicKey, privateKey) {
         var expectedAlgorithm = {
@@ skipping 103 matching lines @@
   // On interactive selectClientCertificates calls, the simulated user does not
   // select any cert.
   basicTests: function() {
     var tests = [
       testStaticMethods,
       testSelectAllCerts,
       testSelectCA1Certs,
       testInteractiveSelectNoCerts,
       testMatchResult,
       testGetKeyPairMissingAlgorithName,
+      testGetKeyPairRejectsRSAPSS,
       testGetKeyPair,
       testSignNoHash,
       testSignSha1Client1,
     ];
 
     chrome.test.runTests(tests);
   },
 
   // This test suite starts without any granted permissions.
   // On interactive selectClientCertificates calls, the simulated user selects
@@ skipping 21 matching lines @@
       // Verify that client_1 but not client_2 is selected in non-interactive
       // calls.
       testSelectAllReturnsClient1,
     ];
 
     chrome.test.runTests(tests);
   }
 };
 
 setUp(testSuites[selectedTestSuite]);