escape_unittest.cc 23 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572573574575576577578579580581582583584585586587588589590591592
  1. // Copyright (c) 2020 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include <algorithm>
  5. #include <string>
  6. #include "base/strings/escape.h"
  7. #include "base/strings/string_util.h"
  8. #include "base/strings/stringprintf.h"
  9. #include "base/strings/utf_string_conversions.h"
  10. #include "testing/gtest/include/gtest/gtest.h"
  11. namespace base {
  12. namespace {
  13. struct EscapeCase {
  14. const char* input;
  15. const char* output;
  16. };
  17. struct EscapeForHTMLCase {
  18. const char* input;
  19. const char* expected_output;
  20. };
  21. struct UnescapeURLCase {
  22. const char* input;
  23. UnescapeRule::Type rules;
  24. const char* output;
  25. };
  26. struct UnescapeAndDecodeCase {
  27. const char* input;
  28. // The expected output when run through UnescapeURL.
  29. const char* url_unescaped;
  30. // The expected output when run through UnescapeQuery.
  31. const char* query_unescaped;
  32. // The expected output when run through UnescapeAndDecodeURLComponent.
  33. const wchar_t* decoded;
  34. };
  35. struct AdjustOffsetCase {
  36. const char* input;
  37. size_t input_offset;
  38. size_t output_offset;
  39. };
  40. TEST(EscapeTest, EscapeTextForFormSubmission) {
  41. const EscapeCase escape_cases[] = {
  42. {"foo", "foo"}, {"foo bar", "foo+bar"}, {"foo++", "foo%2B%2B"}};
  43. for (const auto& escape_case : escape_cases) {
  44. EXPECT_EQ(escape_case.output,
  45. EscapeQueryParamValue(escape_case.input, true));
  46. }
  47. const EscapeCase escape_cases_no_plus[] = {
  48. {"foo", "foo"}, {"foo bar", "foo%20bar"}, {"foo++", "foo%2B%2B"}};
  49. for (const auto& escape_case : escape_cases_no_plus) {
  50. EXPECT_EQ(escape_case.output,
  51. EscapeQueryParamValue(escape_case.input, false));
  52. }
  53. // Test all the values in we're supposed to be escaping.
  54. const std::string no_escape(
  55. "abcdefghijklmnopqrstuvwxyz"
  56. "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
  57. "0123456789"
  58. "!'()*-._~");
  59. for (int i = 0; i < 256; ++i) {
  60. std::string in;
  61. in.push_back(i);
  62. std::string out = EscapeQueryParamValue(in, true);
  63. if (0 == i) {
  64. EXPECT_EQ(out, std::string("%00"));
  65. } else if (32 == i) {
  66. // Spaces are plus escaped like web forms.
  67. EXPECT_EQ(out, std::string("+"));
  68. } else if (no_escape.find(in) == std::string::npos) {
  69. // Check %hex escaping
  70. std::string expected = StringPrintf("%%%02X", i);
  71. EXPECT_EQ(expected, out);
  72. } else {
  73. // No change for things in the no_escape list.
  74. EXPECT_EQ(out, in);
  75. }
  76. }
  77. }
  78. TEST(EscapeTest, EscapePath) {
  79. ASSERT_EQ(
  80. // Most of the character space we care about, un-escaped
  81. EscapePath("\x02\n\x1d !\"#$%&'()*+,-./0123456789:;"
  82. "<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ"
  83. "[\\]^_`abcdefghijklmnopqrstuvwxyz"
  84. "{|}~\x7f\x80\xff"),
  85. // Escaped
  86. "%02%0A%1D%20!%22%23$%25&'()*+,-./0123456789%3A;"
  87. "%3C=%3E%3F@ABCDEFGHIJKLMNOPQRSTUVWXYZ"
  88. "%5B%5C%5D%5E_%60abcdefghijklmnopqrstuvwxyz"
  89. "%7B%7C%7D~%7F%80%FF");
  90. }
  91. TEST(EscapeTest, EscapeUrlEncodedData) {
  92. ASSERT_EQ(
  93. // Most of the character space we care about, un-escaped
  94. EscapeUrlEncodedData("\x02\n\x1d !\"#$%&'()*+,-./0123456789:;"
  95. "<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ"
  96. "[\\]^_`abcdefghijklmnopqrstuvwxyz"
  97. "{|}~\x7f\x80\xff",
  98. true),
  99. // Escaped
  100. "%02%0A%1D+!%22%23%24%25%26%27()*%2B,-./0123456789:%3B"
  101. "%3C%3D%3E%3F%40ABCDEFGHIJKLMNOPQRSTUVWXYZ"
  102. "%5B%5C%5D%5E_%60abcdefghijklmnopqrstuvwxyz"
  103. "%7B%7C%7D~%7F%80%FF");
  104. }
  105. TEST(EscapeTest, EscapeUrlEncodedDataSpace) {
  106. ASSERT_EQ(EscapeUrlEncodedData("a b", true), "a+b");
  107. ASSERT_EQ(EscapeUrlEncodedData("a b", false), "a%20b");
  108. }
  109. TEST(EscapeTest, EscapeForHTML) {
  110. const EscapeForHTMLCase tests[] = {
  111. {"hello", "hello"},
  112. {"<hello>", "&lt;hello&gt;"},
  113. {"don\'t mess with me", "don&#39;t mess with me"},
  114. };
  115. for (const auto& test : tests) {
  116. std::string result = EscapeForHTML(std::string(test.input));
  117. EXPECT_EQ(std::string(test.expected_output), result);
  118. }
  119. }
  120. TEST(EscapeTest, UnescapeForHTML) {
  121. const EscapeForHTMLCase tests[] = {
  122. {"", ""},
  123. {"&lt;hello&gt;", "<hello>"},
  124. {"don&#39;t mess with me", "don\'t mess with me"},
  125. {"&lt;&gt;&amp;&quot;&#39;", "<>&\"'"},
  126. {"& lt; &amp ; &; '", "& lt; &amp ; &; '"},
  127. {"&amp;", "&"},
  128. {"&quot;", "\""},
  129. {"&#39;", "'"},
  130. {"&lt;", "<"},
  131. {"&gt;", ">"},
  132. {"&amp; &", "& &"},
  133. };
  134. for (const auto& test : tests) {
  135. std::u16string result = UnescapeForHTML(ASCIIToUTF16(test.input));
  136. EXPECT_EQ(ASCIIToUTF16(test.expected_output), result);
  137. }
  138. }
  139. TEST(EscapeTest, EscapeExternalHandlerValue) {
  140. ASSERT_EQ(
  141. // Escaped
  142. "%02%0A%1D%20!%22#$%25&'()*+,-./0123456789:;"
  143. "%3C=%3E?@ABCDEFGHIJKLMNOPQRSTUVWXYZ"
  144. "[%5C]%5E_%60abcdefghijklmnopqrstuvwxyz"
  145. "%7B%7C%7D~%7F%80%FF",
  146. // Most of the character space we care about, un-escaped
  147. EscapeExternalHandlerValue("\x02\n\x1d !\"#$%&'()*+,-./0123456789:;"
  148. "<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ"
  149. "[\\]^_`abcdefghijklmnopqrstuvwxyz"
  150. "{|}~\x7f\x80\xff"));
  151. ASSERT_EQ(
  152. "!#$&'()*+,-./0123456789:;=?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]_"
  153. "abcdefghijklmnopqrstuvwxyz~",
  154. EscapeExternalHandlerValue(
  155. "!#$&'()*+,-./0123456789:;=?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[]_"
  156. "abcdefghijklmnopqrstuvwxyz~"));
  157. ASSERT_EQ("%258k", EscapeExternalHandlerValue("%8k"));
  158. ASSERT_EQ("a%25", EscapeExternalHandlerValue("a%"));
  159. ASSERT_EQ("%25a", EscapeExternalHandlerValue("%a"));
  160. ASSERT_EQ("a%258", EscapeExternalHandlerValue("a%8"));
  161. ASSERT_EQ("%ab", EscapeExternalHandlerValue("%ab"));
  162. ASSERT_EQ("%AB", EscapeExternalHandlerValue("%AB"));
  163. ASSERT_EQ("http://example.com/path/sub?q=a%7Cb%7Cc&q=1%7C2%7C3#ref%7C",
  164. EscapeExternalHandlerValue(
  165. "http://example.com/path/sub?q=a|b|c&q=1|2|3#ref|"));
  166. ASSERT_EQ("http://example.com/path/sub?q=a%7Cb%7Cc&q=1%7C2%7C3#ref%7C",
  167. EscapeExternalHandlerValue(
  168. "http://example.com/path/sub?q=a%7Cb%7Cc&q=1%7C2%7C3#ref%7C"));
  169. ASSERT_EQ("http://[2001:db8:0:1]:80",
  170. EscapeExternalHandlerValue("http://[2001:db8:0:1]:80"));
  171. }
  172. TEST(EscapeTest, EscapeNonASCII) {
  173. EXPECT_EQ("abc\n%2580%80", EscapeNonASCIIAndPercent("abc\n%80\x80"));
  174. EXPECT_EQ("abc\n%80%80", EscapeNonASCII("abc\n%80\x80"));
  175. }
  176. TEST(EscapeTest, DataURLWithAccentedCharacters) {
  177. const std::string url =
  178. "text/html;charset=utf-8,%3Chtml%3E%3Cbody%3ETonton,%20ton%20th%C3"
  179. "%A9%20t'a-t-il%20%C3%B4t%C3%A9%20ta%20toux%20";
  180. OffsetAdjuster::Adjustments adjustments;
  181. UnescapeAndDecodeUTF8URLComponentWithAdjustments(url, UnescapeRule::SPACES,
  182. &adjustments);
  183. }
  184. TEST(EscapeTest, UnescapeURLComponent) {
  185. const UnescapeURLCase kUnescapeCases[] = {
  186. {"", UnescapeRule::NORMAL, ""},
  187. {"%2", UnescapeRule::NORMAL, "%2"},
  188. {"%%%%%%", UnescapeRule::NORMAL, "%%%%%%"},
  189. {"Don't escape anything", UnescapeRule::NORMAL, "Don't escape anything"},
  190. {"Invalid %escape %2", UnescapeRule::NORMAL, "Invalid %escape %2"},
  191. {"Some%20random text %25%2dOK", UnescapeRule::NONE,
  192. "Some%20random text %25%2dOK"},
  193. {"Some%20random text %25%2dOK", UnescapeRule::NORMAL,
  194. "Some%20random text %25-OK"},
  195. {"Some%20random text %25%E1%A6", UnescapeRule::NORMAL,
  196. "Some%20random text %25\xE1\xA6"},
  197. {"Some%20random text %25%E1%A6OK", UnescapeRule::NORMAL,
  198. "Some%20random text %25\xE1\xA6OK"},
  199. {"Some%20random text %25%E1%A6%99OK", UnescapeRule::NORMAL,
  200. "Some%20random text %25\xE1\xA6\x99OK"},
  201. // BiDi Control characters should not be unescaped.
  202. {"Some%20random text %25%D8%9COK", UnescapeRule::NORMAL,
  203. "Some%20random text %25%D8%9COK"},
  204. {"Some%20random text %25%E2%80%8EOK", UnescapeRule::NORMAL,
  205. "Some%20random text %25%E2%80%8EOK"},
  206. {"Some%20random text %25%E2%80%8FOK", UnescapeRule::NORMAL,
  207. "Some%20random text %25%E2%80%8FOK"},
  208. {"Some%20random text %25%E2%80%AAOK", UnescapeRule::NORMAL,
  209. "Some%20random text %25%E2%80%AAOK"},
  210. {"Some%20random text %25%E2%80%ABOK", UnescapeRule::NORMAL,
  211. "Some%20random text %25%E2%80%ABOK"},
  212. {"Some%20random text %25%E2%80%AEOK", UnescapeRule::NORMAL,
  213. "Some%20random text %25%E2%80%AEOK"},
  214. {"Some%20random text %25%E2%81%A6OK", UnescapeRule::NORMAL,
  215. "Some%20random text %25%E2%81%A6OK"},
  216. {"Some%20random text %25%E2%81%A9OK", UnescapeRule::NORMAL,
  217. "Some%20random text %25%E2%81%A9OK"},
  218. // Certain banned characters should not be unescaped.
  219. // U+1F50F LOCK WITH INK PEN
  220. {"Some%20random text %25%F0%9F%94%8FOK", UnescapeRule::NORMAL,
  221. "Some%20random text %25%F0%9F%94%8FOK"},
  222. // U+1F510 CLOSED LOCK WITH KEY
  223. {"Some%20random text %25%F0%9F%94%90OK", UnescapeRule::NORMAL,
  224. "Some%20random text %25%F0%9F%94%90OK"},
  225. // U+1F512 LOCK
  226. {"Some%20random text %25%F0%9F%94%92OK", UnescapeRule::NORMAL,
  227. "Some%20random text %25%F0%9F%94%92OK"},
  228. // U+1F513 OPEN LOCK
  229. {"Some%20random text %25%F0%9F%94%93OK", UnescapeRule::NORMAL,
  230. "Some%20random text %25%F0%9F%94%93OK"},
  231. // Spaces
  232. {"(%C2%85)(%C2%A0)(%E1%9A%80)(%E2%80%80)", UnescapeRule::NORMAL,
  233. "(%C2%85)(%C2%A0)(%E1%9A%80)(%E2%80%80)"},
  234. {"(%E2%80%81)(%E2%80%82)(%E2%80%83)(%E2%80%84)", UnescapeRule::NORMAL,
  235. "(%E2%80%81)(%E2%80%82)(%E2%80%83)(%E2%80%84)"},
  236. {"(%E2%80%85)(%E2%80%86)(%E2%80%87)(%E2%80%88)", UnescapeRule::NORMAL,
  237. "(%E2%80%85)(%E2%80%86)(%E2%80%87)(%E2%80%88)"},
  238. {"(%E2%80%89)(%E2%80%8A)(%E2%80%A8)(%E2%80%A9)", UnescapeRule::NORMAL,
  239. "(%E2%80%89)(%E2%80%8A)(%E2%80%A8)(%E2%80%A9)"},
  240. {"(%E2%80%AF)(%E2%81%9F)(%E3%80%80)", UnescapeRule::NORMAL,
  241. "(%E2%80%AF)(%E2%81%9F)(%E3%80%80)"},
  242. {"(%E2%A0%80)", UnescapeRule::NORMAL, "(%E2%A0%80)"},
  243. // Default Ignorable and Formatting characters should not be unescaped.
  244. {"(%E2%81%A5)(%EF%BF%B0)(%EF%BF%B8)", UnescapeRule::NORMAL,
  245. "(%E2%81%A5)(%EF%BF%B0)(%EF%BF%B8)"},
  246. {"(%F3%A0%82%80)(%F3%A0%83%BF)(%F3%A0%87%B0)", UnescapeRule::NORMAL,
  247. "(%F3%A0%82%80)(%F3%A0%83%BF)(%F3%A0%87%B0)"},
  248. {"(%F3%A0%BF%BF)(%C2%AD)(%CD%8F)", UnescapeRule::NORMAL,
  249. "(%F3%A0%BF%BF)(%C2%AD)(%CD%8F)"},
  250. {"(%D8%80%20)(%D8%85)(%DB%9D)(%DC%8F)(%E0%A3%A2)", UnescapeRule::NORMAL,
  251. "(%D8%80%20)(%D8%85)(%DB%9D)(%DC%8F)(%E0%A3%A2)"},
  252. {"(%E1%85%9F)(%E1%85%A0)(%E1%9E%B4)(%E1%9E%B5)", UnescapeRule::NORMAL,
  253. "(%E1%85%9F)(%E1%85%A0)(%E1%9E%B4)(%E1%9E%B5)"},
  254. {"(%E1%A0%8B)(%E1%A0%8C)(%E1%A0%8D)(%E1%A0%8E)", UnescapeRule::NORMAL,
  255. "(%E1%A0%8B)(%E1%A0%8C)(%E1%A0%8D)(%E1%A0%8E)"},
  256. {"(%E2%80%8B)(%E2%80%8C)(%E2%80%8D)(%E2%81%A0)", UnescapeRule::NORMAL,
  257. "(%E2%80%8B)(%E2%80%8C)(%E2%80%8D)(%E2%81%A0)"},
  258. {"(%E2%81%A1)(%E2%81%A2)(%E2%81%A3)(%E2%81%A4)", UnescapeRule::NORMAL,
  259. "(%E2%81%A1)(%E2%81%A2)(%E2%81%A3)(%E2%81%A4)"},
  260. {"(%E3%85%A4)(%EF%BB%BF)(%EF%BE%A0)(%EF%BF%B9)", UnescapeRule::NORMAL,
  261. "(%E3%85%A4)(%EF%BB%BF)(%EF%BE%A0)(%EF%BF%B9)"},
  262. {"(%EF%BF%BB)(%F0%91%82%BD)(%F0%91%83%8D)", UnescapeRule::NORMAL,
  263. "(%EF%BF%BB)(%F0%91%82%BD)(%F0%91%83%8D)"},
  264. {"(%F0%93%90%B0)(%F0%93%90%B8)", UnescapeRule::NORMAL,
  265. "(%F0%93%90%B0)(%F0%93%90%B8)"},
  266. // General Punctuation - Deprecated (U+206A--206F)
  267. {"(%E2%81%AA)(%E2%81%AD)(%E2%81%AF)", UnescapeRule::NORMAL,
  268. "(%E2%81%AA)(%E2%81%AD)(%E2%81%AF)"},
  269. // Variation selectors (U+FE00--FE0F)
  270. {"(%EF%B8%80)(%EF%B8%8C)(%EF%B8%8D)", UnescapeRule::NORMAL,
  271. "(%EF%B8%80)(%EF%B8%8C)(%EF%B8%8D)"},
  272. // Shorthand format controls (U+1BCA0--1BCA3)
  273. {"(%F0%9B%B2%A0)(%F0%9B%B2%A1)(%F0%9B%B2%A3)", UnescapeRule::NORMAL,
  274. "(%F0%9B%B2%A0)(%F0%9B%B2%A1)(%F0%9B%B2%A3)"},
  275. // Musical symbols beams and slurs (U+1D173--1D17A)
  276. {"(%F0%9D%85%B3)(%F0%9D%85%B9)(%F0%9D%85%BA)", UnescapeRule::NORMAL,
  277. "(%F0%9D%85%B3)(%F0%9D%85%B9)(%F0%9D%85%BA)"},
  278. // Tags block (U+E0000--E007F), includes unassigned points
  279. {"(%F3%A0%80%80)(%F3%A0%80%81)(%F3%A0%81%8F)", UnescapeRule::NORMAL,
  280. "(%F3%A0%80%80)(%F3%A0%80%81)(%F3%A0%81%8F)"},
  281. // Ideographic-specific variation selectors (U+E0100--E01EF)
  282. {"(%F3%A0%84%80)(%F3%A0%84%90)(%F3%A0%87%AF)", UnescapeRule::NORMAL,
  283. "(%F3%A0%84%80)(%F3%A0%84%90)(%F3%A0%87%AF)"},
  284. // Two spoofing characters in a row should not be unescaped.
  285. {"%D8%9C%D8%9C", UnescapeRule::NORMAL, "%D8%9C%D8%9C"},
  286. // Non-spoofing characters surrounded by spoofing characters should be
  287. // unescaped.
  288. {"%D8%9C%C2%A1%D8%9C%C2%A1", UnescapeRule::NORMAL,
  289. "%D8%9C\xC2\xA1%D8%9C\xC2\xA1"},
  290. // Invalid UTF-8 characters surrounded by spoofing characters should be
  291. // unescaped.
  292. {"%D8%9C%85%D8%9C%85", UnescapeRule::NORMAL, "%D8%9C\x85%D8%9C\x85"},
  293. // Test with enough trail bytes to overflow the CBU8_MAX_LENGTH-byte
  294. // buffer. The first two bytes are a spoofing character as well.
  295. {"%D8%9C%9C%9C%9C%9C%9C%9C%9C%9C%9C", UnescapeRule::NORMAL,
  296. "%D8%9C\x9C\x9C\x9C\x9C\x9C\x9C\x9C\x9C\x9C"},
  297. {"Some%20random text %25%2dOK", UnescapeRule::SPACES,
  298. "Some random text %25-OK"},
  299. {"Some%20random text %25%2dOK", UnescapeRule::PATH_SEPARATORS,
  300. "Some%20random text %25-OK"},
  301. {"Some%20random text %25%2dOK",
  302. UnescapeRule::URL_SPECIAL_CHARS_EXCEPT_PATH_SEPARATORS,
  303. "Some%20random text %-OK"},
  304. {"Some%20random text %25%2dOK",
  305. UnescapeRule::SPACES |
  306. UnescapeRule::URL_SPECIAL_CHARS_EXCEPT_PATH_SEPARATORS,
  307. "Some random text %-OK"},
  308. {"%A0%B1%C2%D3%E4%F5", UnescapeRule::NORMAL, "\xA0\xB1\xC2\xD3\xE4\xF5"},
  309. {"%Aa%Bb%Cc%Dd%Ee%Ff", UnescapeRule::NORMAL, "\xAa\xBb\xCc\xDd\xEe\xFf"},
  310. // Certain URL-sensitive characters should not be unescaped unless asked.
  311. {"Hello%20%13%10world %23# %3F? %3D= %26& %25% %2B+",
  312. UnescapeRule::SPACES, "Hello %13%10world %23# %3F? %3D= %26& %25% %2B+"},
  313. {"Hello%20%13%10world %23# %3F? %3D= %26& %25% %2B+",
  314. UnescapeRule::URL_SPECIAL_CHARS_EXCEPT_PATH_SEPARATORS,
  315. "Hello%20%13%10world ## ?? == && %% ++"},
  316. // We can neither escape nor unescape '@' since some websites expect it to
  317. // be preserved as either '@' or "%40".
  318. // See http://b/996720 and http://crbug.com/23933 .
  319. {"me@my%40example", UnescapeRule::NORMAL, "me@my%40example"},
  320. // Control characters.
  321. {"%01%02%03%04%05%06%07%08%09 %25",
  322. UnescapeRule::URL_SPECIAL_CHARS_EXCEPT_PATH_SEPARATORS,
  323. "%01%02%03%04%05%06%07%08%09 %"},
  324. {"Hello%20%13%10%02", UnescapeRule::SPACES, "Hello %13%10%02"},
  325. // '/' and '\\' should only be unescaped by PATH_SEPARATORS.
  326. {"%2F%5C", UnescapeRule::PATH_SEPARATORS, "/\\"},
  327. };
  328. for (const auto unescape_case : kUnescapeCases) {
  329. EXPECT_EQ(unescape_case.output,
  330. UnescapeURLComponent(unescape_case.input, unescape_case.rules));
  331. }
  332. // Test NULL character unescaping, which can't be tested above since those are
  333. // just char pointers.
  334. std::string input("Null");
  335. input.push_back(0); // Also have a NULL in the input.
  336. input.append("%00%39Test");
  337. std::string expected = "Null";
  338. expected.push_back(0);
  339. expected.append("%009Test");
  340. EXPECT_EQ(expected, UnescapeURLComponent(input, UnescapeRule::NORMAL));
  341. }
  342. TEST(EscapeTest, UnescapeAndDecodeUTF8URLComponentWithAdjustments) {
  343. const UnescapeAndDecodeCase unescape_cases[] = {
  344. {"%", "%", "%", L"%"},
  345. {"+", "+", " ", L"+"},
  346. {"%2+", "%2+", "%2 ", L"%2+"},
  347. {"+%%%+%%%", "+%%%+%%%", " %%% %%%", L"+%%%+%%%"},
  348. {"Don't escape anything", "Don't escape anything",
  349. "Don't escape anything", L"Don't escape anything"},
  350. {"+Invalid %escape %2+", "+Invalid %escape %2+", " Invalid %escape %2 ",
  351. L"+Invalid %escape %2+"},
  352. {"Some random text %25%2dOK", "Some random text %25-OK",
  353. "Some random text %25-OK", L"Some random text %25-OK"},
  354. {"%01%02%03%04%05%06%07%08%09", "%01%02%03%04%05%06%07%08%09",
  355. "%01%02%03%04%05%06%07%08%09", L"%01%02%03%04%05%06%07%08%09"},
  356. {"%E4%BD%A0+%E5%A5%BD", "\xE4\xBD\xA0+\xE5\xA5\xBD",
  357. "\xE4\xBD\xA0 \xE5\xA5\xBD", L"\x4f60+\x597d"},
  358. {"%ED%ED", // Invalid UTF-8.
  359. "\xED\xED", "\xED\xED", L"%ED%ED"}, // Invalid UTF-8 -> kept unescaped.
  360. };
  361. for (const auto& unescape_case : unescape_cases) {
  362. std::string unescaped =
  363. UnescapeURLComponent(unescape_case.input, UnescapeRule::NORMAL);
  364. EXPECT_EQ(std::string(unescape_case.url_unescaped), unescaped);
  365. unescaped = UnescapeURLComponent(unescape_case.input,
  366. UnescapeRule::REPLACE_PLUS_WITH_SPACE);
  367. EXPECT_EQ(std::string(unescape_case.query_unescaped), unescaped);
  368. // The adjustments argument is covered by the next test.
  369. //
  370. // TODO: Need to test unescape_spaces and unescape_percent.
  371. std::u16string decoded = UnescapeAndDecodeUTF8URLComponentWithAdjustments(
  372. unescape_case.input, UnescapeRule::NORMAL, nullptr);
  373. EXPECT_EQ(WideToUTF16(unescape_case.decoded), decoded);
  374. }
  375. }
  376. TEST(EscapeTest, AdjustOffset) {
  377. const AdjustOffsetCase adjust_cases[] = {
  378. {"", 0, 0},
  379. {"test", 0, 0},
  380. {"test", 2, 2},
  381. {"test", 4, 4},
  382. {"test", std::string::npos, std::string::npos},
  383. {"%2dtest", 6, 4},
  384. {"%2dtest", 3, 1},
  385. {"%2dtest", 2, std::string::npos},
  386. {"%2dtest", 1, std::string::npos},
  387. {"%2dtest", 0, 0},
  388. {"test%2d", 2, 2},
  389. {"test%2e", 2, 2},
  390. {"%E4%BD%A0+%E5%A5%BD", 9, 1},
  391. {"%E4%BD%A0+%E5%A5%BD", 6, std::string::npos},
  392. {"%E4%BD%A0+%E5%A5%BD", 0, 0},
  393. {"%E4%BD%A0+%E5%A5%BD", 10, 2},
  394. {"%E4%BD%A0+%E5%A5%BD", 19, 3},
  395. {"hi%41test%E4%BD%A0+%E5%A5%BD", 18, 8},
  396. {"hi%41test%E4%BD%A0+%E5%A5%BD", 15, std::string::npos},
  397. {"hi%41test%E4%BD%A0+%E5%A5%BD", 9, 7},
  398. {"hi%41test%E4%BD%A0+%E5%A5%BD", 19, 9},
  399. {"hi%41test%E4%BD%A0+%E5%A5%BD", 28, 10},
  400. {"hi%41test%E4%BD%A0+%E5%A5%BD", 0, 0},
  401. {"hi%41test%E4%BD%A0+%E5%A5%BD", 2, 2},
  402. {"hi%41test%E4%BD%A0+%E5%A5%BD", 3, std::string::npos},
  403. {"hi%41test%E4%BD%A0+%E5%A5%BD", 5, 3},
  404. {"%E4%BD%A0+%E5%A5%BDhi%41test", 9, 1},
  405. {"%E4%BD%A0+%E5%A5%BDhi%41test", 6, std::string::npos},
  406. {"%E4%BD%A0+%E5%A5%BDhi%41test", 0, 0},
  407. {"%E4%BD%A0+%E5%A5%BDhi%41test", 10, 2},
  408. {"%E4%BD%A0+%E5%A5%BDhi%41test", 19, 3},
  409. {"%E4%BD%A0+%E5%A5%BDhi%41test", 21, 5},
  410. {"%E4%BD%A0+%E5%A5%BDhi%41test", 22, std::string::npos},
  411. {"%E4%BD%A0+%E5%A5%BDhi%41test", 24, 6},
  412. {"%E4%BD%A0+%E5%A5%BDhi%41test", 28, 10},
  413. {"%ED%B0%80+%E5%A5%BD", 6, 6}, // not convertible to UTF-8
  414. };
  415. for (const auto& adjust_case : adjust_cases) {
  416. size_t offset = adjust_case.input_offset;
  417. OffsetAdjuster::Adjustments adjustments;
  418. UnescapeAndDecodeUTF8URLComponentWithAdjustments(
  419. adjust_case.input, UnescapeRule::NORMAL, &adjustments);
  420. OffsetAdjuster::AdjustOffset(adjustments, &offset);
  421. EXPECT_EQ(adjust_case.output_offset, offset)
  422. << "input=" << adjust_case.input
  423. << " offset=" << adjust_case.input_offset;
  424. }
  425. }
  426. TEST(EscapeTest, UnescapeBinaryURLComponent) {
  427. const UnescapeURLCase kTestCases[] = {
  428. // Check that ASCII characters with special handling in
  429. // UnescapeURLComponent() are still unescaped.
  430. {"%09%20%25foo%2F", UnescapeRule::NORMAL, "\x09 %foo/"},
  431. // UTF-8 Characters banned by UnescapeURLComponent() should also be
  432. // unescaped.
  433. {"Some random text %D8%9COK", UnescapeRule::NORMAL,
  434. "Some random text \xD8\x9COK"},
  435. {"Some random text %F0%9F%94%8FOK", UnescapeRule::NORMAL,
  436. "Some random text \xF0\x9F\x94\x8FOK"},
  437. // As should invalid UTF-8 characters.
  438. {"%A0%A0%E9%E9%A0%A0%A0%A0", UnescapeRule::NORMAL,
  439. "\xA0\xA0\xE9\xE9\xA0\xA0\xA0\xA0"},
  440. // And valid UTF-8 characters that are not banned by
  441. // UnescapeURLComponent() should be unescaped, too!
  442. {"%C2%A1%C2%A1", UnescapeRule::NORMAL, "\xC2\xA1\xC2\xA1"},
  443. // '+' should be left alone by default
  444. {"++%2B++", UnescapeRule::NORMAL, "+++++"},
  445. // But should magically be turned into a space if requested.
  446. {"++%2B++", UnescapeRule::REPLACE_PLUS_WITH_SPACE, " + "},
  447. };
  448. for (const auto& test_case : kTestCases) {
  449. EXPECT_EQ(test_case.output,
  450. UnescapeBinaryURLComponent(test_case.input, test_case.rules));
  451. }
  452. // Test NULL character unescaping, which can't be tested above since those are
  453. // just char pointers.
  454. std::string input("Null");
  455. input.push_back(0); // Also have a NULL in the input.
  456. input.append("%00%39Test");
  457. std::string expected("Null");
  458. expected.push_back(0);
  459. expected.push_back(0);
  460. expected.append("9Test");
  461. EXPECT_EQ(expected, UnescapeBinaryURLComponent(input));
  462. }
  463. TEST(EscapeTest, UnescapeBinaryURLComponentSafe) {
  464. const struct TestCase {
  465. const char* input;
  466. // Expected output. Null if call is expected to fail when
  467. // |fail_on_path_separators| is false.
  468. const char* expected_output;
  469. // Whether |input| has any escaped path separators.
  470. bool has_path_separators;
  471. } kTestCases[] = {
  472. // Spaces, percents, and invalid UTF-8 characters are all successfully
  473. // unescaped.
  474. {"%20%25foo%81", " %foo\x81", false},
  475. // Characters disallowed unconditionally.
  476. {"foo%00", nullptr, false},
  477. {"foo%01", nullptr, false},
  478. {"foo%0A", nullptr, false},
  479. {"foo%0D", nullptr, false},
  480. // Path separators.
  481. {"foo%2F", "foo/", true},
  482. {"foo%5C", "foo\\", true},
  483. // Characters that are considered invalid to escape are ignored if passed
  484. // in unescaped.
  485. {"foo\x01\r/\\", "foo\x01\r/\\", false},
  486. };
  487. for (const auto& test_case : kTestCases) {
  488. SCOPED_TRACE(test_case.input);
  489. std::string output = "foo";
  490. if (!test_case.expected_output) {
  491. EXPECT_FALSE(UnescapeBinaryURLComponentSafe(
  492. test_case.input, false /* fail_on_path_separators */, &output));
  493. EXPECT_TRUE(output.empty());
  494. EXPECT_FALSE(UnescapeBinaryURLComponentSafe(
  495. test_case.input, true /* fail_on_path_separators */, &output));
  496. EXPECT_TRUE(output.empty());
  497. continue;
  498. }
  499. EXPECT_TRUE(UnescapeBinaryURLComponentSafe(
  500. test_case.input, false /* fail_on_path_separators */, &output));
  501. EXPECT_EQ(test_case.expected_output, output);
  502. if (test_case.has_path_separators) {
  503. EXPECT_FALSE(UnescapeBinaryURLComponentSafe(
  504. test_case.input, true /* fail_on_path_separators */, &output));
  505. EXPECT_TRUE(output.empty());
  506. } else {
  507. output = "foo";
  508. EXPECT_TRUE(UnescapeBinaryURLComponentSafe(
  509. test_case.input, true /* fail_on_path_separators */, &output));
  510. EXPECT_EQ(test_case.expected_output, output);
  511. }
  512. }
  513. }
  514. TEST(EscapeTest, ContainsEncodedBytes) {
  515. EXPECT_FALSE(ContainsEncodedBytes("abc/def", {'/', '\\'}));
  516. EXPECT_FALSE(ContainsEncodedBytes("abc%2Fdef", {'%'}));
  517. EXPECT_TRUE(ContainsEncodedBytes("abc%252Fdef", {'%'}));
  518. EXPECT_TRUE(ContainsEncodedBytes("abc%2Fdef", {'/', '\\'}));
  519. EXPECT_TRUE(ContainsEncodedBytes("abc%5Cdef", {'/', '\\'}));
  520. EXPECT_TRUE(ContainsEncodedBytes("abc%2fdef", {'/', '\\'}));
  521. // Should be looking for byte values, not UTF-8 character values.
  522. EXPECT_TRUE(
  523. ContainsEncodedBytes("caf%C3%A9", {static_cast<uint8_t>('\xc3')}));
  524. EXPECT_FALSE(
  525. ContainsEncodedBytes("caf%C3%A9", {static_cast<uint8_t>('\xe9')}));
  526. }
  527. } // namespace
  528. } // namespace base