oauth_request_signer_unittest.cc 15 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330
  1. // Copyright (c) 2011 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "google_apis/gaia/oauth_request_signer.h"
  5. #include "build/build_config.h"
  6. #include "testing/gtest/include/gtest/gtest.h"
  7. #include "url/gurl.h"
  8. // This value is used to seed the PRNG at the beginning of a sequence of
  9. // operations to produce a repeatable sequence.
  10. #define RANDOM_SEED (0x69E3C47D)
  11. TEST(OAuthRequestSignerTest, Encode) {
  12. ASSERT_EQ(OAuthRequestSigner::Encode("ABCDEFGHIJKLMNOPQRSTUVWXYZ"
  13. "abcdefghijklmnopqrstuvwxyz"
  14. "0123456789"
  15. "-._~"),
  16. "ABCDEFGHIJKLMNOPQRSTUVWXYZ"
  17. "abcdefghijklmnopqrstuvwxyz"
  18. "0123456789"
  19. "-._~");
  20. ASSERT_EQ(OAuthRequestSigner::Encode(
  21. "https://accounts.google.com/OAuthLogin"),
  22. "https%3A%2F%2Faccounts.google.com%2FOAuthLogin");
  23. ASSERT_EQ(OAuthRequestSigner::Encode("%"), "%25");
  24. ASSERT_EQ(OAuthRequestSigner::Encode("%25"), "%2525");
  25. ASSERT_EQ(OAuthRequestSigner::Encode(
  26. "Lorem ipsum dolor sit amet, consectetur adipisicing elit, sed "
  27. "do eiusmod tempor incididunt ut labore et dolore magna "
  28. "aliqua. Ut enim ad minim veniam, quis nostrud exercitation "
  29. "ullamco laboris nisi ut aliquip ex ea commodo consequat. Duis "
  30. "aute irure dolor in reprehenderit in voluptate velit esse "
  31. "cillum dolore eu fugiat nulla pariatur. Excepteur sint "
  32. "occaecat cupidatat non proident, sunt in culpa qui officia "
  33. "deserunt mollit anim id est laborum."),
  34. "Lorem%20ipsum%20dolor%20sit%20amet%2C%20consectetur%20"
  35. "adipisicing%20elit%2C%20sed%20do%20eiusmod%20tempor%20"
  36. "incididunt%20ut%20labore%20et%20dolore%20magna%20aliqua.%20Ut%20"
  37. "enim%20ad%20minim%20veniam%2C%20quis%20nostrud%20exercitation%20"
  38. "ullamco%20laboris%20nisi%20ut%20aliquip%20ex%20ea%20commodo%20"
  39. "consequat.%20Duis%20aute%20irure%20dolor%20in%20reprehenderit%20"
  40. "in%20voluptate%20velit%20esse%20cillum%20dolore%20eu%20fugiat%20"
  41. "nulla%20pariatur.%20Excepteur%20sint%20occaecat%20cupidatat%20"
  42. "non%20proident%2C%20sunt%20in%20culpa%20qui%20officia%20"
  43. "deserunt%20mollit%20anim%20id%20est%20laborum.");
  44. ASSERT_EQ(OAuthRequestSigner::Encode("!5}&QF~0R-Ecy[?2Cig>6g=;hH!\\Ju4K%UK;"),
  45. "%215%7D%26QF~0R-Ecy%5B%3F2Cig%3E6g%3D%3BhH%21%5CJu4K%25UK%3B");
  46. ASSERT_EQ(OAuthRequestSigner::Encode("1UgHf(r)SkMRS`fRZ/8PsTcXT0:\\<9I=6{|:"),
  47. "1UgHf%28r%29SkMRS%60fRZ%2F8PsTcXT0%3A%5C%3C9I%3D6%7B%7C%3A");
  48. ASSERT_EQ(OAuthRequestSigner::Encode("|<XIy1?o`r\"RuGSX#!:MeP&RLZQM@:\\';2X"),
  49. "%7C%3CXIy1%3Fo%60r%22RuGSX%23%21%3AMeP%26RLZQM%40%3A%5C%27%3B2X");
  50. ASSERT_EQ(OAuthRequestSigner::Encode("#a@A>ZtcQ/yb.~^Q_]daRT?ffK>@A:afWuZL"),
  51. "%23a%40A%3EZtcQ%2Fyb.~%5EQ_%5DdaRT%3FffK%3E%40A%3AafWuZL");
  52. }
  53. // http://crbug.com/685352
  54. #if BUILDFLAG(IS_WIN)
  55. #define MAYBE_DecodeEncoded DISABLED_DecodeEncoded
  56. #else
  57. #define MAYBE_DecodeEncoded DecodeEncoded
  58. #endif
  59. TEST(OAuthRequestSignerTest, MAYBE_DecodeEncoded) {
  60. srand(RANDOM_SEED);
  61. static const int kIterations = 500;
  62. static const int kLengthLimit = 500;
  63. for (int iteration = 0; iteration < kIterations; ++iteration) {
  64. std::string text;
  65. int length = rand() % kLengthLimit;
  66. for (int position = 0; position < length; ++position) {
  67. text += static_cast<char>(rand() % 256);
  68. }
  69. std::string encoded = OAuthRequestSigner::Encode(text);
  70. std::string decoded;
  71. ASSERT_TRUE(OAuthRequestSigner::Decode(encoded, &decoded));
  72. ASSERT_EQ(decoded, text);
  73. }
  74. }
  75. TEST(OAuthRequestSignerTest, SignGet1) {
  76. GURL request_url("https://www.google.com/accounts/o8/GetOAuthToken");
  77. OAuthRequestSigner::Parameters parameters;
  78. parameters["scope"] = "https://accounts.google.com/OAuthLogin";
  79. parameters["oauth_nonce"] = "2oiE_aHdk5qRTz0L9C8Lq0g";
  80. parameters["xaouth_display_name"] = "Chromium";
  81. parameters["oauth_timestamp"] = "1308152953";
  82. std::string signed_text;
  83. ASSERT_TRUE(OAuthRequestSigner::SignURL(
  84. request_url,
  85. parameters,
  86. OAuthRequestSigner::HMAC_SHA1_SIGNATURE,
  87. OAuthRequestSigner::GET_METHOD,
  88. "johndoe", // oauth_consumer_key
  89. "53cR3t", // consumer secret
  90. "4/VGY0MsQadcmO8VnCv9gnhoEooq1v", // oauth_token
  91. "c5e0531ff55dfbb4054e", // token secret
  92. &signed_text));
  93. ASSERT_EQ("https://www.google.com/accounts/o8/GetOAuthToken"
  94. "?oauth_consumer_key=johndoe"
  95. "&oauth_nonce=2oiE_aHdk5qRTz0L9C8Lq0g"
  96. "&oauth_signature=PFqDTaiyey1UObcvOyI4Ng2HXW0%3D"
  97. "&oauth_signature_method=HMAC-SHA1"
  98. "&oauth_timestamp=1308152953"
  99. "&oauth_token=4%2FVGY0MsQadcmO8VnCv9gnhoEooq1v"
  100. "&oauth_version=1.0"
  101. "&scope=https%3A%2F%2Faccounts.google.com%2FOAuthLogin"
  102. "&xaouth_display_name=Chromium",
  103. signed_text);
  104. }
  105. TEST(OAuthRequestSignerTest, SignGet2) {
  106. GURL request_url("https://accounts.google.com/OAuthGetAccessToken");
  107. OAuthRequestSigner::Parameters parameters;
  108. parameters["oauth_timestamp"] = "1308147831";
  109. parameters["oauth_nonce"] = "4d4hZW9DygWQujP2tz06UN";
  110. std::string signed_text;
  111. ASSERT_TRUE(OAuthRequestSigner::SignURL(
  112. request_url,
  113. parameters,
  114. OAuthRequestSigner::HMAC_SHA1_SIGNATURE,
  115. OAuthRequestSigner::GET_METHOD,
  116. "anonymous", // oauth_consumer_key
  117. "anonymous", // consumer secret
  118. "4/CcC-hgdj1TNnWaX8NTQ76YDXCBEK", // oauth_token
  119. std::string(), // token secret
  120. &signed_text));
  121. ASSERT_EQ(signed_text,
  122. "https://accounts.google.com/OAuthGetAccessToken"
  123. "?oauth_consumer_key=anonymous"
  124. "&oauth_nonce=4d4hZW9DygWQujP2tz06UN"
  125. "&oauth_signature=YiJv%2BEOWsvCDCi13%2FhQBFrr0J7c%3D"
  126. "&oauth_signature_method=HMAC-SHA1"
  127. "&oauth_timestamp=1308147831"
  128. "&oauth_token=4%2FCcC-hgdj1TNnWaX8NTQ76YDXCBEK"
  129. "&oauth_version=1.0");
  130. }
  131. TEST(OAuthRequestSignerTest, ParseAndSignGet1) {
  132. GURL request_url("https://www.google.com/accounts/o8/GetOAuthToken"
  133. "?scope=https://accounts.google.com/OAuthLogin"
  134. "&oauth_nonce=2oiE_aHdk5qRTz0L9C8Lq0g"
  135. "&xaouth_display_name=Chromium"
  136. "&oauth_timestamp=1308152953");
  137. std::string signed_text;
  138. ASSERT_TRUE(OAuthRequestSigner::ParseAndSign(
  139. request_url,
  140. OAuthRequestSigner::HMAC_SHA1_SIGNATURE,
  141. OAuthRequestSigner::GET_METHOD,
  142. "anonymous", // oauth_consumer_key
  143. "anonymous", // consumer secret
  144. "4/CcC-hgdj1TNnWaX8NTQ76YDXCBEK", // oauth_token
  145. std::string(), // token secret
  146. &signed_text));
  147. ASSERT_EQ("https://www.google.com/accounts/o8/GetOAuthToken"
  148. "?oauth_consumer_key=anonymous"
  149. "&oauth_nonce=2oiE_aHdk5qRTz0L9C8Lq0g"
  150. "&oauth_signature=PH7KP6cP%2BzZ1SJ6WGqBgXwQP9Mc%3D"
  151. "&oauth_signature_method=HMAC-SHA1"
  152. "&oauth_timestamp=1308152953"
  153. "&oauth_token=4%2FCcC-hgdj1TNnWaX8NTQ76YDXCBEK"
  154. "&oauth_version=1.0"
  155. "&scope=https%3A%2F%2Faccounts.google.com%2FOAuthLogin"
  156. "&xaouth_display_name=Chromium",
  157. signed_text);
  158. }
  159. TEST(OAuthRequestSignerTest, ParseAndSignGet2) {
  160. GURL request_url("https://accounts.google.com/OAuthGetAccessToken"
  161. "?oauth_timestamp=1308147831"
  162. "&oauth_nonce=4d4hZW9DygWQujP2tz06UN");
  163. std::string signed_text;
  164. ASSERT_TRUE(OAuthRequestSigner::ParseAndSign(
  165. request_url,
  166. OAuthRequestSigner::HMAC_SHA1_SIGNATURE,
  167. OAuthRequestSigner::GET_METHOD,
  168. "anonymous", // oauth_consumer_key
  169. "anonymous", // consumer secret
  170. "4/CcC-hgdj1TNnWaX8NTQ76YDXCBEK", // oauth_token
  171. std::string(), // token secret
  172. &signed_text));
  173. ASSERT_EQ(signed_text,
  174. "https://accounts.google.com/OAuthGetAccessToken"
  175. "?oauth_consumer_key=anonymous"
  176. "&oauth_nonce=4d4hZW9DygWQujP2tz06UN"
  177. "&oauth_signature=YiJv%2BEOWsvCDCi13%2FhQBFrr0J7c%3D"
  178. "&oauth_signature_method=HMAC-SHA1"
  179. "&oauth_timestamp=1308147831"
  180. "&oauth_token=4%2FCcC-hgdj1TNnWaX8NTQ76YDXCBEK"
  181. "&oauth_version=1.0");
  182. }
  183. TEST(OAuthRequestSignerTest, SignPost1) {
  184. GURL request_url("https://www.google.com/accounts/o8/GetOAuthToken");
  185. OAuthRequestSigner::Parameters parameters;
  186. parameters["scope"] = "https://accounts.google.com/OAuthLogin";
  187. parameters["oauth_nonce"] = "2oiE_aHdk5qRTz0L9C8Lq0g";
  188. parameters["xaouth_display_name"] = "Chromium";
  189. parameters["oauth_timestamp"] = "1308152953";
  190. std::string signed_text;
  191. ASSERT_TRUE(OAuthRequestSigner::SignURL(
  192. request_url,
  193. parameters,
  194. OAuthRequestSigner::HMAC_SHA1_SIGNATURE,
  195. OAuthRequestSigner::POST_METHOD,
  196. "anonymous", // oauth_consumer_key
  197. "anonymous", // consumer secret
  198. "4/X8x0r7bHif_VNCLjUMutxGkzo13d", // oauth_token
  199. "b7120598d47594bd3522", // token secret
  200. &signed_text));
  201. ASSERT_EQ("oauth_consumer_key=anonymous"
  202. "&oauth_nonce=2oiE_aHdk5qRTz0L9C8Lq0g"
  203. "&oauth_signature=vVlfv6dnV2%2Fx7TozS0Gf83zS2%2BQ%3D"
  204. "&oauth_signature_method=HMAC-SHA1"
  205. "&oauth_timestamp=1308152953"
  206. "&oauth_token=4%2FX8x0r7bHif_VNCLjUMutxGkzo13d"
  207. "&oauth_version=1.0"
  208. "&scope=https%3A%2F%2Faccounts.google.com%2FOAuthLogin"
  209. "&xaouth_display_name=Chromium",
  210. signed_text);
  211. }
  212. TEST(OAuthRequestSignerTest, SignPost2) {
  213. GURL request_url("https://accounts.google.com/OAuthGetAccessToken");
  214. OAuthRequestSigner::Parameters parameters;
  215. parameters["oauth_timestamp"] = "1234567890";
  216. parameters["oauth_nonce"] = "17171717171717171";
  217. std::string signed_text;
  218. ASSERT_TRUE(OAuthRequestSigner::SignURL(
  219. request_url,
  220. parameters,
  221. OAuthRequestSigner::HMAC_SHA1_SIGNATURE,
  222. OAuthRequestSigner::POST_METHOD,
  223. "anonymous", // oauth_consumer_key
  224. "anonymous", // consumer secret
  225. "4/CcC-hgdj1TNnWaX8NTQ76YDXCBEK", // oauth_token
  226. std::string(), // token secret
  227. &signed_text));
  228. ASSERT_EQ(signed_text,
  229. "oauth_consumer_key=anonymous"
  230. "&oauth_nonce=17171717171717171"
  231. "&oauth_signature=tPX2XqKQICWzopZ80CFGX%2F53DLo%3D"
  232. "&oauth_signature_method=HMAC-SHA1"
  233. "&oauth_timestamp=1234567890"
  234. "&oauth_token=4%2FCcC-hgdj1TNnWaX8NTQ76YDXCBEK"
  235. "&oauth_version=1.0");
  236. }
  237. TEST(OAuthRequestSignerTest, ParseAndSignPost1) {
  238. GURL request_url("https://www.google.com/accounts/o8/GetOAuthToken"
  239. "?scope=https://accounts.google.com/OAuthLogin"
  240. "&oauth_nonce=2oiE_aHdk5qRTz0L9C8Lq0g"
  241. "&xaouth_display_name=Chromium"
  242. "&oauth_timestamp=1308152953");
  243. std::string signed_text;
  244. ASSERT_TRUE(OAuthRequestSigner::ParseAndSign(
  245. request_url,
  246. OAuthRequestSigner::HMAC_SHA1_SIGNATURE,
  247. OAuthRequestSigner::POST_METHOD,
  248. "anonymous", // oauth_consumer_key
  249. "anonymous", // consumer secret
  250. "4/X8x0r7bHif_VNCLjUMutxGkzo13d", // oauth_token
  251. "b7120598d47594bd3522", // token secret
  252. &signed_text));
  253. ASSERT_EQ("oauth_consumer_key=anonymous"
  254. "&oauth_nonce=2oiE_aHdk5qRTz0L9C8Lq0g"
  255. "&oauth_signature=vVlfv6dnV2%2Fx7TozS0Gf83zS2%2BQ%3D"
  256. "&oauth_signature_method=HMAC-SHA1"
  257. "&oauth_timestamp=1308152953"
  258. "&oauth_token=4%2FX8x0r7bHif_VNCLjUMutxGkzo13d"
  259. "&oauth_version=1.0"
  260. "&scope=https%3A%2F%2Faccounts.google.com%2FOAuthLogin"
  261. "&xaouth_display_name=Chromium",
  262. signed_text);
  263. }
  264. TEST(OAuthRequestSignerTest, ParseAndSignPost2) {
  265. GURL request_url("https://accounts.google.com/OAuthGetAccessToken"
  266. "?oauth_timestamp=1234567890"
  267. "&oauth_nonce=17171717171717171");
  268. std::string signed_text;
  269. ASSERT_TRUE(OAuthRequestSigner::ParseAndSign(
  270. request_url,
  271. OAuthRequestSigner::HMAC_SHA1_SIGNATURE,
  272. OAuthRequestSigner::POST_METHOD,
  273. "anonymous", // oauth_consumer_key
  274. "anonymous", // consumer secret
  275. "4/CcC-hgdj1TNnWaX8NTQ76YDXCBEK", // oauth_token
  276. std::string(), // token secret
  277. &signed_text));
  278. ASSERT_EQ(signed_text,
  279. "oauth_consumer_key=anonymous"
  280. "&oauth_nonce=17171717171717171"
  281. "&oauth_signature=tPX2XqKQICWzopZ80CFGX%2F53DLo%3D"
  282. "&oauth_signature_method=HMAC-SHA1"
  283. "&oauth_timestamp=1234567890"
  284. "&oauth_token=4%2FCcC-hgdj1TNnWaX8NTQ76YDXCBEK"
  285. "&oauth_version=1.0");
  286. }
  287. TEST(OAuthRequestSignerTest, SignAuthHeader) {
  288. GURL request_url("https://www.google.com/accounts/o8/GetOAuthToken");
  289. OAuthRequestSigner::Parameters parameters;
  290. parameters["scope"] = "https://accounts.google.com/OAuthLogin";
  291. parameters["oauth_nonce"] = "2oiE_aHdk5qRTz0L9C8Lq0g";
  292. parameters["xaouth_display_name"] = "Chromium";
  293. parameters["oauth_timestamp"] = "1308152953";
  294. std::string signed_text;
  295. ASSERT_TRUE(OAuthRequestSigner::SignAuthHeader(
  296. request_url,
  297. parameters,
  298. OAuthRequestSigner::HMAC_SHA1_SIGNATURE,
  299. OAuthRequestSigner::GET_METHOD,
  300. "johndoe", // oauth_consumer_key
  301. "53cR3t", // consumer secret
  302. "4/VGY0MsQadcmO8VnCv9gnhoEooq1v", // oauth_token
  303. "c5e0531ff55dfbb4054e", // token secret
  304. &signed_text));
  305. ASSERT_EQ("OAuth "
  306. "oauth_consumer_key=\"johndoe\", "
  307. "oauth_nonce=\"2oiE_aHdk5qRTz0L9C8Lq0g\", "
  308. "oauth_signature=\"PFqDTaiyey1UObcvOyI4Ng2HXW0%3D\", "
  309. "oauth_signature_method=\"HMAC-SHA1\", "
  310. "oauth_timestamp=\"1308152953\", "
  311. "oauth_token=\"4%2FVGY0MsQadcmO8VnCv9gnhoEooq1v\", "
  312. "oauth_version=\"1.0\", "
  313. "scope=\"https%3A%2F%2Faccounts.google.com%2FOAuthLogin\", "
  314. "xaouth_display_name=\"Chromium\"",
  315. signed_text);
  316. }