canonical_cookie_unittest.cc 254 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141214221432144214521462147214821492150215121522153215421552156215721582159216021612162216321642165216621672168216921702171217221732174217521762177217821792180218121822183218421852186218721882189219021912192219321942195219621972198219922002201220222032204220522062207220822092210221122122213221422152216221722182219222022212222222322242225222622272228222922302231223222332234223522362237223822392240224122422243224422452246224722482249225022512252225322542255225622572258225922602261226222632264226522662267226822692270227122722273227422752276227722782279228022812282228322842285228622872288228922902291229222932294229522962297229822992300230123022303230423052306230723082309231023112312231323142315231623172318231923202321232223232324232523262327232823292330233123322333233423352336233723382339234023412342234323442345234623472348234923502351235223532354235523562357235823592360236123622363236423652366236723682369237023712372237323742375237623772378237923802381238223832384238523862387238823892390239123922393239423952396239723982399240024012402240324042405240624072408240924102411241224132414241524162417241824192420242124222423242424252426242724282429243024312432243324342435243624372438243924402441244224432444244524462447244824492450245124522453245424552456245724582459246024612462246324642465246624672468246924702471247224732474247524762477247824792480248124822483248424852486248724882489249024912492249324942495249624972498249925002501250225032504250525062507250825092510251125122513251425152516251725182519252025212522252325242525252625272528252925302531253225332534253525362537253825392540254125422543254425452546254725482549255025512552255325542555255625572558255925602561256225632564256525662567256825692570257125722573257425752576257725782579258025812582258325842585258625872588258925902591259225932594259525962597259825992600260126022603260426052606260726082609261026112612261326142615261626172618261926202621262226232624262526262627262826292630263126322633263426352636263726382639264026412642264326442645264626472648264926502651265226532654265526562657265826592660266126622663266426652666266726682669267026712672267326742675267626772678267926802681268226832684268526862687268826892690269126922693269426952696269726982699270027012702270327042705270627072708270927102711271227132714271527162717271827192720272127222723272427252726272727282729273027312732273327342735273627372738273927402741274227432744274527462747274827492750275127522753275427552756275727582759276027612762276327642765276627672768276927702771277227732774277527762777277827792780278127822783278427852786278727882789279027912792279327942795279627972798279928002801280228032804280528062807280828092810281128122813281428152816281728182819282028212822282328242825282628272828282928302831283228332834283528362837283828392840284128422843284428452846284728482849285028512852285328542855285628572858285928602861286228632864286528662867286828692870287128722873287428752876287728782879288028812882288328842885288628872888288928902891289228932894289528962897289828992900290129022903290429052906290729082909291029112912291329142915291629172918291929202921292229232924292529262927292829292930293129322933293429352936293729382939294029412942294329442945294629472948294929502951295229532954295529562957295829592960296129622963296429652966296729682969297029712972297329742975297629772978297929802981298229832984298529862987298829892990299129922993299429952996299729982999300030013002300330043005300630073008300930103011301230133014301530163017301830193020302130223023302430253026302730283029303030313032303330343035303630373038303930403041304230433044304530463047304830493050305130523053305430553056305730583059306030613062306330643065306630673068306930703071307230733074307530763077307830793080308130823083308430853086308730883089309030913092309330943095309630973098309931003101310231033104310531063107310831093110311131123113311431153116311731183119312031213122312331243125312631273128312931303131313231333134313531363137313831393140314131423143314431453146314731483149315031513152315331543155315631573158315931603161316231633164316531663167316831693170317131723173317431753176317731783179318031813182318331843185318631873188318931903191319231933194319531963197319831993200320132023203320432053206320732083209321032113212321332143215321632173218321932203221322232233224322532263227322832293230323132323233323432353236323732383239324032413242324332443245324632473248324932503251325232533254325532563257325832593260326132623263326432653266326732683269327032713272327332743275327632773278327932803281328232833284328532863287328832893290329132923293329432953296329732983299330033013302330333043305330633073308330933103311331233133314331533163317331833193320332133223323332433253326332733283329333033313332333333343335333633373338333933403341334233433344334533463347334833493350335133523353335433553356335733583359336033613362336333643365336633673368336933703371337233733374337533763377337833793380338133823383338433853386338733883389339033913392339333943395339633973398339934003401340234033404340534063407340834093410341134123413341434153416341734183419342034213422342334243425342634273428342934303431343234333434343534363437343834393440344134423443344434453446344734483449345034513452345334543455345634573458345934603461346234633464346534663467346834693470347134723473347434753476347734783479348034813482348334843485348634873488348934903491349234933494349534963497349834993500350135023503350435053506350735083509351035113512351335143515351635173518351935203521352235233524352535263527352835293530353135323533353435353536353735383539354035413542354335443545354635473548354935503551355235533554355535563557355835593560356135623563356435653566356735683569357035713572357335743575357635773578357935803581358235833584358535863587358835893590359135923593359435953596359735983599360036013602360336043605360636073608360936103611361236133614361536163617361836193620362136223623362436253626362736283629363036313632363336343635363636373638363936403641364236433644364536463647364836493650365136523653365436553656365736583659366036613662366336643665366636673668366936703671367236733674367536763677367836793680368136823683368436853686368736883689369036913692369336943695369636973698369937003701370237033704370537063707370837093710371137123713371437153716371737183719372037213722372337243725372637273728372937303731373237333734373537363737373837393740374137423743374437453746374737483749375037513752375337543755375637573758375937603761376237633764376537663767376837693770377137723773377437753776377737783779378037813782378337843785378637873788378937903791379237933794379537963797379837993800380138023803380438053806380738083809381038113812381338143815381638173818381938203821382238233824382538263827382838293830383138323833383438353836383738383839384038413842384338443845384638473848384938503851385238533854385538563857385838593860386138623863386438653866386738683869387038713872387338743875387638773878387938803881388238833884388538863887388838893890389138923893389438953896389738983899390039013902390339043905390639073908390939103911391239133914391539163917391839193920392139223923392439253926392739283929393039313932393339343935393639373938393939403941394239433944394539463947394839493950395139523953395439553956395739583959396039613962396339643965396639673968396939703971397239733974397539763977397839793980398139823983398439853986398739883989399039913992399339943995399639973998399940004001400240034004400540064007400840094010401140124013401440154016401740184019402040214022402340244025402640274028402940304031403240334034403540364037403840394040404140424043404440454046404740484049405040514052405340544055405640574058405940604061406240634064406540664067406840694070407140724073407440754076407740784079408040814082408340844085408640874088408940904091409240934094409540964097409840994100410141024103410441054106410741084109411041114112411341144115411641174118411941204121412241234124412541264127412841294130413141324133413441354136413741384139414041414142414341444145414641474148414941504151415241534154415541564157415841594160416141624163416441654166416741684169417041714172417341744175417641774178417941804181418241834184418541864187418841894190419141924193419441954196419741984199420042014202420342044205420642074208420942104211421242134214421542164217421842194220422142224223422442254226422742284229423042314232423342344235423642374238423942404241424242434244424542464247424842494250425142524253425442554256425742584259426042614262426342644265426642674268426942704271427242734274427542764277427842794280428142824283428442854286428742884289429042914292429342944295429642974298429943004301430243034304430543064307430843094310431143124313431443154316431743184319432043214322432343244325432643274328432943304331433243334334433543364337433843394340434143424343434443454346434743484349435043514352435343544355435643574358435943604361436243634364436543664367436843694370437143724373437443754376437743784379438043814382438343844385438643874388438943904391439243934394439543964397439843994400440144024403440444054406440744084409441044114412441344144415441644174418441944204421442244234424442544264427442844294430443144324433443444354436443744384439444044414442444344444445444644474448444944504451445244534454445544564457445844594460446144624463446444654466446744684469447044714472447344744475447644774478447944804481448244834484448544864487448844894490449144924493449444954496449744984499450045014502450345044505450645074508450945104511451245134514451545164517451845194520452145224523452445254526452745284529453045314532453345344535453645374538453945404541454245434544454545464547454845494550455145524553455445554556455745584559456045614562456345644565456645674568456945704571457245734574457545764577457845794580458145824583458445854586458745884589459045914592459345944595459645974598459946004601460246034604460546064607460846094610461146124613461446154616461746184619462046214622462346244625462646274628462946304631463246334634463546364637463846394640464146424643464446454646464746484649465046514652465346544655465646574658465946604661466246634664466546664667466846694670467146724673467446754676467746784679468046814682468346844685468646874688468946904691469246934694469546964697469846994700470147024703470447054706470747084709471047114712471347144715471647174718471947204721472247234724472547264727472847294730473147324733473447354736473747384739474047414742474347444745474647474748474947504751475247534754475547564757475847594760476147624763476447654766476747684769477047714772477347744775477647774778477947804781478247834784478547864787478847894790479147924793479447954796479747984799480048014802480348044805480648074808480948104811481248134814481548164817481848194820482148224823482448254826482748284829483048314832483348344835483648374838483948404841484248434844484548464847484848494850485148524853485448554856485748584859486048614862486348644865486648674868486948704871487248734874487548764877487848794880488148824883488448854886488748884889489048914892489348944895489648974898489949004901490249034904490549064907490849094910491149124913491449154916491749184919492049214922492349244925492649274928492949304931493249334934493549364937493849394940494149424943494449454946494749484949495049514952495349544955495649574958495949604961496249634964496549664967496849694970497149724973497449754976497749784979498049814982498349844985498649874988498949904991499249934994499549964997499849995000500150025003500450055006500750085009501050115012501350145015501650175018501950205021502250235024502550265027502850295030503150325033503450355036503750385039504050415042504350445045504650475048504950505051505250535054505550565057505850595060506150625063506450655066506750685069507050715072507350745075507650775078507950805081508250835084508550865087508850895090509150925093509450955096509750985099510051015102510351045105510651075108510951105111511251135114511551165117511851195120512151225123512451255126512751285129513051315132513351345135513651375138513951405141514251435144514551465147514851495150515151525153515451555156515751585159516051615162516351645165516651675168516951705171517251735174517551765177517851795180518151825183518451855186518751885189519051915192519351945195519651975198519952005201520252035204520552065207520852095210521152125213521452155216521752185219522052215222522352245225522652275228522952305231523252335234523552365237523852395240524152425243524452455246524752485249525052515252525352545255525652575258525952605261526252635264526552665267526852695270527152725273527452755276527752785279528052815282528352845285528652875288528952905291529252935294529552965297529852995300530153025303530453055306530753085309531053115312531353145315531653175318531953205321532253235324532553265327532853295330533153325333533453355336533753385339534053415342
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/cookies/canonical_cookie.h"
  5. #include <memory>
  6. #include <string>
  7. #include <vector>
  8. #include "base/test/metrics/histogram_tester.h"
  9. #include "base/test/scoped_feature_list.h"
  10. #include "base/time/time.h"
  11. #include "build/build_config.h"
  12. #include "net/base/features.h"
  13. #include "net/cookies/canonical_cookie_test_helpers.h"
  14. #include "net/cookies/cookie_constants.h"
  15. #include "net/cookies/cookie_inclusion_status.h"
  16. #include "net/cookies/cookie_options.h"
  17. #include "net/cookies/parsed_cookie.h"
  18. #include "testing/gmock/include/gmock/gmock-matchers.h"
  19. #include "testing/gmock/include/gmock/gmock.h"
  20. #include "testing/gtest/include/gtest/gtest.h"
  21. #include "third_party/abseil-cpp/absl/types/optional.h"
  22. #include "url/gurl.h"
  23. #include "url/third_party/mozilla/url_parse.h"
  24. namespace net {
  25. namespace {
  26. const std::vector<std::string> kCookieableSchemes = {"http", "https", "ws",
  27. "wss"};
  28. // Helper for testing BuildCookieLine
  29. void MatchCookieLineToVector(
  30. const std::string& line,
  31. const std::vector<std::unique_ptr<CanonicalCookie>>& cookies) {
  32. std::vector<CanonicalCookie> list;
  33. for (const auto& cookie : cookies)
  34. list.push_back(*cookie);
  35. EXPECT_EQ(line, CanonicalCookie::BuildCookieLine(list));
  36. }
  37. } // namespace
  38. using testing::_;
  39. using testing::AllOf;
  40. using testing::Eq;
  41. using testing::Not;
  42. using testing::Property;
  43. // Tests which use this class verify the expiry date clamping behavior when
  44. // kClampCookieExpiryTo400Days is enabled. This caps expiry dates on new/updated
  45. // cookies to max of 400 days, but does not affect previously stored cookies.
  46. class CanonicalCookieWithClampingTest
  47. : public testing::Test,
  48. public testing::WithParamInterface<bool> {
  49. public:
  50. CanonicalCookieWithClampingTest() {
  51. scoped_feature_list_.InitWithFeatureState(
  52. features::kClampCookieExpiryTo400Days,
  53. IsClampCookieExpiryTo400DaysEnabled());
  54. }
  55. bool IsClampCookieExpiryTo400DaysEnabled() { return GetParam(); }
  56. private:
  57. base::test::ScopedFeatureList scoped_feature_list_;
  58. };
  59. INSTANTIATE_TEST_SUITE_P(/* no label */,
  60. CanonicalCookieWithClampingTest,
  61. testing::Bool());
  62. TEST(CanonicalCookieTest, Constructor) {
  63. base::Time current_time = base::Time::Now();
  64. // CreateUnsafeCookieForTesting just forwards to the constructor.
  65. auto cookie1 = CanonicalCookie::CreateUnsafeCookieForTesting(
  66. "A", "2", "www.example.com", "/test", current_time, base::Time(),
  67. base::Time(), base::Time(), false, false, CookieSameSite::NO_RESTRICTION,
  68. COOKIE_PRIORITY_DEFAULT, false, absl::nullopt,
  69. CookieSourceScheme::kSecure, 443);
  70. EXPECT_EQ("A", cookie1->Name());
  71. EXPECT_EQ("2", cookie1->Value());
  72. EXPECT_EQ("www.example.com", cookie1->Domain());
  73. EXPECT_EQ("/test", cookie1->Path());
  74. EXPECT_FALSE(cookie1->IsSecure());
  75. EXPECT_FALSE(cookie1->IsHttpOnly());
  76. EXPECT_EQ(CookieSameSite::NO_RESTRICTION, cookie1->SameSite());
  77. EXPECT_EQ(CookiePriority::COOKIE_PRIORITY_DEFAULT, cookie1->Priority());
  78. EXPECT_FALSE(cookie1->IsSameParty());
  79. EXPECT_FALSE(cookie1->IsPartitioned());
  80. EXPECT_EQ(cookie1->SourceScheme(), CookieSourceScheme::kSecure);
  81. EXPECT_EQ(cookie1->SourcePort(), 443);
  82. auto cookie2 = CanonicalCookie::CreateUnsafeCookieForTesting(
  83. "A", "2", ".www.example.com", "/", current_time, base::Time(),
  84. base::Time(), base::Time(), false, false, CookieSameSite::NO_RESTRICTION,
  85. COOKIE_PRIORITY_DEFAULT, true,
  86. CookiePartitionKey::FromURLForTesting(GURL("https://foo.com")),
  87. CookieSourceScheme::kNonSecure, 65536);
  88. EXPECT_EQ("A", cookie2->Name());
  89. EXPECT_EQ("2", cookie2->Value());
  90. EXPECT_EQ(".www.example.com", cookie2->Domain());
  91. EXPECT_EQ("/", cookie2->Path());
  92. EXPECT_FALSE(cookie2->IsSecure());
  93. EXPECT_FALSE(cookie2->IsHttpOnly());
  94. EXPECT_EQ(CookieSameSite::NO_RESTRICTION, cookie2->SameSite());
  95. EXPECT_EQ(CookiePriority::COOKIE_PRIORITY_DEFAULT, cookie2->Priority());
  96. EXPECT_TRUE(cookie2->IsSameParty());
  97. EXPECT_TRUE(cookie2->IsPartitioned());
  98. EXPECT_EQ(cookie2->SourceScheme(), CookieSourceScheme::kNonSecure);
  99. // Because the port can be set explicitly in the constructor its value can be
  100. // independent of the other parameters. In this case, test that an out of
  101. // range port is kept out of range.
  102. EXPECT_EQ(cookie2->SourcePort(), 65536);
  103. // Set Secure to true but don't specify source_scheme or port.
  104. auto cookie3 = CanonicalCookie::CreateUnsafeCookieForTesting(
  105. "A", "2", ".www.example.com", "/", current_time, base::Time(),
  106. base::Time(), base::Time(), true /* secure */, false,
  107. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT, false);
  108. EXPECT_TRUE(cookie3->IsSecure());
  109. EXPECT_EQ(cookie3->SourceScheme(), CookieSourceScheme::kUnset);
  110. EXPECT_EQ(cookie3->SourcePort(), url::PORT_UNSPECIFIED);
  111. auto cookie4 = CanonicalCookie::CreateUnsafeCookieForTesting(
  112. "A", "2", ".www.example.com", "/test", current_time, base::Time(),
  113. base::Time(), base::Time(), false, false, CookieSameSite::NO_RESTRICTION,
  114. COOKIE_PRIORITY_DEFAULT, false);
  115. EXPECT_EQ("A", cookie4->Name());
  116. EXPECT_EQ("2", cookie4->Value());
  117. EXPECT_EQ(".www.example.com", cookie4->Domain());
  118. EXPECT_EQ("/test", cookie4->Path());
  119. EXPECT_FALSE(cookie4->IsSecure());
  120. EXPECT_FALSE(cookie4->IsHttpOnly());
  121. EXPECT_EQ(CookieSameSite::NO_RESTRICTION, cookie4->SameSite());
  122. EXPECT_FALSE(cookie4->IsSameParty());
  123. EXPECT_FALSE(cookie4->IsPartitioned());
  124. EXPECT_EQ(cookie4->SourceScheme(), CookieSourceScheme::kUnset);
  125. EXPECT_EQ(cookie4->SourcePort(), url::PORT_UNSPECIFIED);
  126. // Test some port edge cases: unspecified.
  127. auto cookie5 = CanonicalCookie::CreateUnsafeCookieForTesting(
  128. "A", "2", ".www.example.com", "/", current_time, base::Time(),
  129. base::Time(), base::Time(), true /* secure */, false,
  130. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT, false,
  131. absl::nullopt, CookieSourceScheme::kUnset, url::PORT_UNSPECIFIED);
  132. EXPECT_EQ(cookie5->SourcePort(), url::PORT_UNSPECIFIED);
  133. // Test some port edge cases: invalid.
  134. auto cookie6 = CanonicalCookie::CreateUnsafeCookieForTesting(
  135. "A", "2", ".www.example.com", "/", current_time, base::Time(),
  136. base::Time(), base::Time(), true /* secure */, false,
  137. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT, false,
  138. absl::nullopt, CookieSourceScheme::kUnset, url::PORT_INVALID);
  139. EXPECT_EQ(cookie6->SourcePort(), url::PORT_INVALID);
  140. }
  141. TEST(CanonicalCookieTest, CreationCornerCases) {
  142. base::Time creation_time = base::Time::Now();
  143. std::unique_ptr<CanonicalCookie> cookie;
  144. absl::optional<base::Time> server_time = absl::nullopt;
  145. // Space in name.
  146. cookie = CanonicalCookie::Create(GURL("http://www.example.com/test/foo.html"),
  147. "A C=2", creation_time, server_time,
  148. absl::nullopt /* cookie_partition_key */);
  149. EXPECT_TRUE(cookie.get());
  150. EXPECT_EQ("A C", cookie->Name());
  151. // Semicolon in path.
  152. cookie = CanonicalCookie::Create(GURL("http://fool/;/"), "*", creation_time,
  153. server_time,
  154. absl::nullopt /* cookie_partition_key */);
  155. EXPECT_TRUE(cookie.get());
  156. // Control characters in name or value.
  157. CookieInclusionStatus status;
  158. cookie = CanonicalCookie::Create(
  159. GURL("http://www.example.com/test/foo.html"), "\b=foo", creation_time,
  160. server_time, absl::nullopt /* cookie_partition_key */, &status);
  161. EXPECT_FALSE(cookie.get());
  162. EXPECT_TRUE(status.HasExclusionReason(
  163. CookieInclusionStatus::ExclusionReason::EXCLUDE_FAILURE_TO_STORE));
  164. cookie = CanonicalCookie::Create(
  165. GURL("http://www.example.com/test/foo.html"), "bar=\b", creation_time,
  166. server_time, absl::nullopt /* cookie_partition_key */, &status);
  167. EXPECT_FALSE(cookie.get());
  168. EXPECT_TRUE(status.HasExclusionReason(
  169. CookieInclusionStatus::ExclusionReason::EXCLUDE_FAILURE_TO_STORE));
  170. // The ParsedCookie constructor unit tests cover many edge cases related to
  171. // invalid sizes when parsing a cookie line, and since CanonicalCookie::Create
  172. // creates a ParsedCookie immediately, there's no point in replicating all
  173. // of those tests here. We should test that the corresponding ExclusionReason
  174. // gets passed back correctly, though.
  175. std::string too_long_value(ParsedCookie::kMaxCookieNamePlusValueSize + 1,
  176. 'a');
  177. cookie = CanonicalCookie::Create(GURL("http://www.example.com/test/foo.html"),
  178. too_long_value, creation_time, server_time,
  179. absl::nullopt /* cookie_partition_key */,
  180. &status);
  181. EXPECT_FALSE(cookie.get());
  182. EXPECT_TRUE(
  183. status.HasExclusionReason(CookieInclusionStatus::ExclusionReason::
  184. EXCLUDE_NAME_VALUE_PAIR_EXCEEDS_MAX_SIZE));
  185. }
  186. TEST(CanonicalCookieTest, Create) {
  187. // Test creating cookies from a cookie string.
  188. GURL url("http://www.example.com/test/foo.html");
  189. GURL https_url("https://www.example.com/test/foo.html");
  190. base::Time creation_time = base::Time::Now();
  191. absl::optional<base::Time> server_time = absl::nullopt;
  192. std::unique_ptr<CanonicalCookie> cookie(
  193. CanonicalCookie::Create(url, "A=2", creation_time, server_time,
  194. absl::nullopt /* cookie_partition_key */));
  195. EXPECT_EQ("A", cookie->Name());
  196. EXPECT_EQ("2", cookie->Value());
  197. EXPECT_EQ("www.example.com", cookie->Domain());
  198. EXPECT_EQ("/test", cookie->Path());
  199. EXPECT_FALSE(cookie->IsSecure());
  200. EXPECT_EQ(cookie->SourceScheme(), CookieSourceScheme::kNonSecure);
  201. EXPECT_EQ(cookie->SourcePort(), 80);
  202. GURL url2("http://www.foo.com");
  203. cookie = CanonicalCookie::Create(url2, "B=1", creation_time, server_time,
  204. absl::nullopt /* cookie_partition_key */);
  205. EXPECT_EQ("B", cookie->Name());
  206. EXPECT_EQ("1", cookie->Value());
  207. EXPECT_EQ("www.foo.com", cookie->Domain());
  208. EXPECT_EQ("/", cookie->Path());
  209. EXPECT_FALSE(cookie->IsSecure());
  210. EXPECT_EQ(cookie->SourceScheme(), CookieSourceScheme::kNonSecure);
  211. EXPECT_EQ(cookie->SourcePort(), 80);
  212. // Test creating secure cookies. Secure scheme is not checked upon creation,
  213. // so a URL of any scheme can create a Secure cookie.
  214. cookie =
  215. CanonicalCookie::Create(url, "A=2; Secure", creation_time, server_time,
  216. absl::nullopt /* cookie_partition_key */);
  217. EXPECT_TRUE(cookie->IsSecure());
  218. cookie = CanonicalCookie::Create(https_url, "A=2; Secure", creation_time,
  219. server_time,
  220. absl::nullopt /* cookie_partition_key */);
  221. EXPECT_TRUE(cookie->IsSecure());
  222. GURL url3("https://www.foo.com");
  223. cookie =
  224. CanonicalCookie::Create(url3, "A=2; Secure", creation_time, server_time,
  225. absl::nullopt /* cookie_partition_key */);
  226. EXPECT_TRUE(cookie->IsSecure());
  227. EXPECT_EQ(cookie->SourceScheme(), CookieSourceScheme::kSecure);
  228. cookie = CanonicalCookie::Create(url3, "A=2", creation_time, server_time,
  229. absl::nullopt /* cookie_partition_key */);
  230. EXPECT_FALSE(cookie->IsSecure());
  231. EXPECT_EQ(cookie->SourceScheme(), CookieSourceScheme::kSecure);
  232. // Test creating cookie from localhost URL.
  233. cookie = CanonicalCookie::Create(GURL("http://localhost/path"), "A=2",
  234. creation_time, server_time,
  235. absl::nullopt /* cookie_partition_key */);
  236. EXPECT_EQ(cookie->SourceScheme(), CookieSourceScheme::kNonSecure);
  237. cookie = CanonicalCookie::Create(GURL("http://127.0.0.1/path"), "A=2",
  238. creation_time, server_time,
  239. absl::nullopt /* cookie_partition_key */);
  240. EXPECT_EQ(cookie->SourceScheme(), CookieSourceScheme::kNonSecure);
  241. cookie = CanonicalCookie::Create(GURL("http://[::1]/path"), "A=2",
  242. creation_time, server_time,
  243. absl::nullopt /* cookie_partition_key */);
  244. EXPECT_EQ(cookie->SourceScheme(), CookieSourceScheme::kNonSecure);
  245. cookie = CanonicalCookie::Create(GURL("https://localhost/path"), "A=2",
  246. creation_time, server_time,
  247. absl::nullopt /* cookie_partition_key */);
  248. EXPECT_EQ(cookie->SourceScheme(), CookieSourceScheme::kSecure);
  249. cookie = CanonicalCookie::Create(GURL("https://127.0.0.1/path"), "A=2",
  250. creation_time, server_time,
  251. absl::nullopt /* cookie_partition_key */);
  252. EXPECT_EQ(cookie->SourceScheme(), CookieSourceScheme::kSecure);
  253. cookie = CanonicalCookie::Create(GURL("https://[::1]/path"), "A=2",
  254. creation_time, server_time,
  255. absl::nullopt /* cookie_partition_key */);
  256. EXPECT_EQ(cookie->SourceScheme(), CookieSourceScheme::kSecure);
  257. // Test creating http only cookies. HttpOnly is not checked upon creation.
  258. cookie =
  259. CanonicalCookie::Create(url, "A=2; HttpOnly", creation_time, server_time,
  260. absl::nullopt /* cookie_partition_key */);
  261. EXPECT_TRUE(cookie->IsHttpOnly());
  262. cookie =
  263. CanonicalCookie::Create(url, "A=2; HttpOnly", creation_time, server_time,
  264. absl::nullopt /* cookie_partition_key */);
  265. EXPECT_TRUE(cookie->IsHttpOnly());
  266. // Test creating SameSite cookies. SameSite is not checked upon creation.
  267. cookie = CanonicalCookie::Create(url, "A=2; SameSite=Strict", creation_time,
  268. server_time,
  269. absl::nullopt /* cookie_partition_key */);
  270. ASSERT_TRUE(cookie.get());
  271. EXPECT_EQ(CookieSameSite::STRICT_MODE, cookie->SameSite());
  272. cookie = CanonicalCookie::Create(url, "A=2; SameSite=Lax", creation_time,
  273. server_time,
  274. absl::nullopt /* cookie_partition_key */);
  275. ASSERT_TRUE(cookie.get());
  276. EXPECT_EQ(CookieSameSite::LAX_MODE, cookie->SameSite());
  277. cookie = CanonicalCookie::Create(url, "A=2; SameSite=Extended", creation_time,
  278. server_time,
  279. absl::nullopt /* cookie_partition_key */);
  280. ASSERT_TRUE(cookie.get());
  281. EXPECT_EQ(CookieSameSite::UNSPECIFIED, cookie->SameSite());
  282. cookie = CanonicalCookie::Create(url, "A=2; SameSite=None", creation_time,
  283. server_time,
  284. absl::nullopt /* cookie_partition_key */);
  285. ASSERT_TRUE(cookie.get());
  286. EXPECT_EQ(CookieSameSite::NO_RESTRICTION, cookie->SameSite());
  287. cookie = CanonicalCookie::Create(url, "A=2", creation_time, server_time,
  288. absl::nullopt /* cookie_partition_key */);
  289. ASSERT_TRUE(cookie.get());
  290. EXPECT_EQ(CookieSameSite::UNSPECIFIED, cookie->SameSite());
  291. // Test creating cookies with different ports.
  292. cookie = CanonicalCookie::Create(GURL("http://www.foo.com"), "B=1",
  293. creation_time, server_time,
  294. absl::nullopt /* cookie_partition_key */);
  295. EXPECT_EQ(cookie->SourcePort(), 80);
  296. cookie = CanonicalCookie::Create(GURL("http://www.foo.com:81"), "B=1",
  297. creation_time, server_time,
  298. absl::nullopt /* cookie_partition_key */);
  299. EXPECT_EQ(cookie->SourcePort(), 81);
  300. cookie = CanonicalCookie::Create(GURL("https://www.foo.com"), "B=1",
  301. creation_time, server_time,
  302. absl::nullopt /* cookie_partition_key */);
  303. EXPECT_EQ(cookie->SourcePort(), 443);
  304. cookie = CanonicalCookie::Create(GURL("https://www.foo.com:1234"), "B=1",
  305. creation_time, server_time,
  306. absl::nullopt /* cookie_partition_key */);
  307. EXPECT_EQ(cookie->SourcePort(), 1234);
  308. cookie = CanonicalCookie::Create(GURL("http://www.foo.com:443"), "B=1",
  309. creation_time, server_time,
  310. absl::nullopt /* cookie_partition_key */);
  311. EXPECT_EQ(cookie->SourcePort(), 443);
  312. // GURL's port parsing will handle any invalid ports, but let's still make
  313. // sure we get the expected result anyway.
  314. cookie = CanonicalCookie::Create(GURL("http://www.foo.com:70000"), "B=1",
  315. creation_time, server_time,
  316. absl::nullopt /* cookie_partition_key */);
  317. EXPECT_EQ(cookie->SourcePort(), url::PORT_INVALID);
  318. }
  319. // Test that a cookie string with an empty domain attribute generates a
  320. // canonical host cookie.
  321. TEST(CanonicalCookieTest, CreateHostCookieFromString) {
  322. // Create a new canonical host cookie via empty string domain in the
  323. // cookie_line.
  324. GURL url("http://www.example.com/test/foo.html");
  325. base::Time creation_time = base::Time::Now();
  326. absl::optional<base::Time> server_time = absl::nullopt;
  327. std::unique_ptr<CanonicalCookie> cookie(CanonicalCookie::Create(
  328. url, "A=2; domain=; Secure", creation_time, server_time,
  329. absl::nullopt /*cookie_partition_key*/));
  330. EXPECT_EQ("www.example.com", cookie->Domain());
  331. EXPECT_TRUE(cookie->IsHostCookie());
  332. }
  333. TEST(CanonicalCookieTest, CreateNonStandardSameSite) {
  334. GURL url("http://www.example.com/test/foo.html");
  335. base::Time now = base::Time::Now();
  336. std::unique_ptr<CanonicalCookie> cookie;
  337. absl::optional<base::Time> server_time = absl::nullopt;
  338. // Non-standard value for the SameSite attribute.
  339. cookie = CanonicalCookie::Create(url, "A=2; SameSite=NonStandard", now,
  340. server_time,
  341. absl::nullopt /* cookie_partition_key */);
  342. EXPECT_TRUE(cookie.get());
  343. EXPECT_EQ(CookieSameSite::UNSPECIFIED, cookie->SameSite());
  344. // Omit value for the SameSite attribute.
  345. cookie = CanonicalCookie::Create(url, "A=2; SameSite", now, server_time,
  346. absl::nullopt /* cookie_partition_key */);
  347. EXPECT_TRUE(cookie.get());
  348. EXPECT_EQ(CookieSameSite::UNSPECIFIED, cookie->SameSite());
  349. }
  350. TEST(CanonicalCookieTest, CreateSameSiteInCrossSiteContexts) {
  351. GURL url("http://www.example.com/test/foo.html");
  352. base::Time now = base::Time::Now();
  353. std::unique_ptr<CanonicalCookie> cookie;
  354. absl::optional<base::Time> server_time = absl::nullopt;
  355. // A cookie can be created from any SameSiteContext regardless of SameSite
  356. // value (it is upon setting the cookie that the SameSiteContext comes into
  357. // effect).
  358. cookie =
  359. CanonicalCookie::Create(url, "A=2; SameSite=Strict", now, server_time,
  360. absl::nullopt /* cookie_partition_key */);
  361. EXPECT_TRUE(cookie.get());
  362. cookie = CanonicalCookie::Create(url, "A=2; SameSite=Lax", now, server_time,
  363. absl::nullopt /* cookie_partition_key */);
  364. EXPECT_TRUE(cookie.get());
  365. cookie = CanonicalCookie::Create(url, "A=2; SameSite=None", now, server_time,
  366. absl::nullopt /* cookie_partition_key */);
  367. EXPECT_TRUE(cookie.get());
  368. cookie = CanonicalCookie::Create(url, "A=2;", now, server_time,
  369. absl::nullopt /* cookie_partition_key */);
  370. EXPECT_TRUE(cookie.get());
  371. }
  372. TEST(CanonicalCookieTest, CreateHttpOnly) {
  373. GURL url("http://www.example.com/test/foo.html");
  374. base::Time now = base::Time::Now();
  375. absl::optional<base::Time> server_time = absl::nullopt;
  376. CookieInclusionStatus status;
  377. // An HttpOnly cookie can be created.
  378. std::unique_ptr<CanonicalCookie> cookie = CanonicalCookie::Create(
  379. url, "A=2; HttpOnly", now, server_time,
  380. absl::nullopt /* cookie_partition_key */, &status);
  381. EXPECT_TRUE(cookie->IsHttpOnly());
  382. EXPECT_TRUE(status.IsInclude());
  383. }
  384. TEST(CanonicalCookieTest, CreateWithInvalidDomain) {
  385. GURL url("http://www.example.com/test/foo.html");
  386. base::Time now = base::Time::Now();
  387. absl::optional<base::Time> server_time = absl::nullopt;
  388. CookieInclusionStatus status;
  389. std::unique_ptr<CanonicalCookie> cookie = CanonicalCookie::Create(
  390. url, "A=2; Domain=wrongdomain.com", now, server_time,
  391. absl::nullopt /* cookie_partition_key */, &status);
  392. EXPECT_EQ(nullptr, cookie.get());
  393. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  394. {CookieInclusionStatus::EXCLUDE_INVALID_DOMAIN}));
  395. }
  396. TEST(CanonicalCookieTest, CreateWithNonASCIIDomain) {
  397. GURL url("http://www.xn--xample-9ua.com/test/foo.html");
  398. base::Time now = base::Time::Now();
  399. absl::optional<base::Time> server_time = absl::nullopt;
  400. // Test with feature flag enabled.
  401. {
  402. base::test::ScopedFeatureList feature_list;
  403. feature_list.InitAndEnableFeature(features::kCookieDomainRejectNonASCII);
  404. CookieInclusionStatus status;
  405. // Test that non-ascii characters are rejected.
  406. std::unique_ptr<CanonicalCookie> cookie = CanonicalCookie::Create(
  407. url, "A=1; Domain=\xC3\xA9xample.com", now, server_time,
  408. absl::nullopt /* cookie_partition_key */, &status);
  409. EXPECT_EQ(nullptr, cookie.get());
  410. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  411. {CookieInclusionStatus::EXCLUDE_INVALID_DOMAIN,
  412. CookieInclusionStatus::EXCLUDE_DOMAIN_NON_ASCII}));
  413. EXPECT_FALSE(
  414. status.HasWarningReason(CookieInclusionStatus::WARN_DOMAIN_NON_ASCII));
  415. }
  416. // Test with feature flag disabled.
  417. {
  418. base::test::ScopedFeatureList feature_list;
  419. feature_list.InitAndDisableFeature(features::kCookieDomainRejectNonASCII);
  420. CookieInclusionStatus status2;
  421. std::unique_ptr<CanonicalCookie> cookie2 = CanonicalCookie::Create(
  422. url, "A=2; Domain=\xC3\xA9xample.com", now, server_time,
  423. absl::nullopt /* cookie_partition_key */, &status2);
  424. EXPECT_TRUE(cookie2.get());
  425. EXPECT_TRUE(status2.IsInclude());
  426. EXPECT_TRUE(
  427. status2.HasWarningReason(CookieInclusionStatus::WARN_DOMAIN_NON_ASCII));
  428. }
  429. // Test that regular ascii punycode still works.
  430. CookieInclusionStatus status3;
  431. std::unique_ptr<CanonicalCookie> cookie3 = CanonicalCookie::Create(
  432. url, "A=3; Domain=xn--xample-9ua.com", now, server_time,
  433. absl::nullopt /* cookie_partition_key */, &status3);
  434. EXPECT_TRUE(cookie3.get());
  435. EXPECT_TRUE(status3.IsInclude());
  436. EXPECT_FALSE(
  437. status3.HasWarningReason(CookieInclusionStatus::WARN_DOMAIN_NON_ASCII));
  438. }
  439. TEST(CanonicalCookieTest, CreateWithDomainAsIP) {
  440. GURL url("http://1.1.1.1");
  441. GURL url6("http://[2606:2800:220:1:248:1893:25c8:1946]");
  442. base::Time now = base::Time::Now();
  443. absl::optional<base::Time> server_time = absl::nullopt;
  444. CookieInclusionStatus status;
  445. const struct {
  446. const GURL url;
  447. const std::string cookie_line;
  448. const bool expectedResult;
  449. } kTests[] = {
  450. {url, "d=1;Domain=1.1.1.1;", true},
  451. {url, "dd=1;Domain=.1.1.1.1;", true},
  452. {url, "ds=1;Domain=1.1.1;", false},
  453. {url, "dsd=1;Domain=.1.1.1;", false},
  454. {url, "dx=1;Domain=0x01.0x1.0x1.0x1;", false},
  455. {url, "dxd=1;Domain=.0x01.0x1.0x1.0x1;", false},
  456. {url, "do=1;Domain=0001.0001.0001.0001;", false},
  457. {url, "d10=1;Domain=16843009;", false},
  458. {url, "d16=value;Domain=0x1010101;", false},
  459. {url, "d8=1;Domain=0100200401;", false},
  460. {url, "dm=1;Domain=00001.0x01.1.001;", false},
  461. {url6, "d1ipv6=1;Domain=[2606:2800:220:1:248:1893:25c8:1946];", true},
  462. {url6, "dd1ipv6=1;Domain=.[2606:2800:220:1:248:1893:25c8:1946];", true},
  463. {url6, "dc1ipv6=1;Domain=[2606:2800:220:1:248:1893:25C8:1946];", true},
  464. {url6, "d2ipv6=1;Domain=2606:2800:220:1:248:1893:25c8:1946;", false},
  465. {url6, "dd2ipv6=1;Domain=.2606:2800:220:1:248:1893:25c8:1946;", false},
  466. {url6, "dc2ipv6=1;Domain=2606:2800:220:1:248:1893:25C8:1946;", false},
  467. };
  468. for (const auto& test : kTests) {
  469. std::unique_ptr<CanonicalCookie> cookie = CanonicalCookie::Create(
  470. test.url, test.cookie_line, now, server_time,
  471. absl::nullopt /* cookie_partition_key */, &status);
  472. if (test.expectedResult) {
  473. ASSERT_TRUE(cookie.get());
  474. EXPECT_EQ(test.url.host(), cookie->Domain());
  475. } else {
  476. EXPECT_EQ(nullptr, cookie.get());
  477. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  478. {CookieInclusionStatus::EXCLUDE_INVALID_DOMAIN}));
  479. }
  480. }
  481. }
  482. TEST(CanonicalCookieTest, CreateSameParty) {
  483. GURL url("http://www.example.com/test/foo.html");
  484. GURL https_url("https://www.example.com/test/foo.html");
  485. base::Time creation_time = base::Time::Now();
  486. absl::optional<base::Time> server_time = absl::nullopt;
  487. CookieInclusionStatus status;
  488. std::unique_ptr<CanonicalCookie> cookie = CanonicalCookie::Create(
  489. url, "A=2; SameParty; Secure", creation_time, server_time,
  490. absl::nullopt /* cookie_partition_key */, &status);
  491. ASSERT_TRUE(cookie.get());
  492. EXPECT_TRUE(status.IsInclude());
  493. EXPECT_TRUE(cookie->IsSecure());
  494. EXPECT_TRUE(cookie->IsSameParty());
  495. EXPECT_EQ(CookieSameSite::UNSPECIFIED, cookie->SameSite());
  496. cookie = CanonicalCookie::Create(
  497. url, "A=2; SameParty; SameSite=None; Secure", creation_time, server_time,
  498. absl::nullopt /* cookie_partition_key */, &status);
  499. ASSERT_TRUE(cookie.get());
  500. EXPECT_TRUE(status.IsInclude());
  501. EXPECT_TRUE(cookie->IsSecure());
  502. EXPECT_TRUE(cookie->IsSameParty());
  503. EXPECT_EQ(CookieSameSite::NO_RESTRICTION, cookie->SameSite());
  504. cookie = CanonicalCookie::Create(
  505. url, "A=2; SameParty; SameSite=Lax; Secure", creation_time, server_time,
  506. absl::nullopt /* cookie_partition_key */, &status);
  507. ASSERT_TRUE(cookie.get());
  508. EXPECT_TRUE(status.IsInclude());
  509. EXPECT_TRUE(cookie->IsSecure());
  510. EXPECT_TRUE(cookie->IsSameParty());
  511. EXPECT_EQ(CookieSameSite::LAX_MODE, cookie->SameSite());
  512. // SameParty cookie with SameSite=Strict is invalid.
  513. cookie = CanonicalCookie::Create(
  514. url, "A=2; SameParty; SameSite=Strict; Secure", creation_time,
  515. server_time, absl::nullopt /* cookie_partition_key */, &status);
  516. EXPECT_FALSE(cookie.get());
  517. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  518. {CookieInclusionStatus::EXCLUDE_INVALID_SAMEPARTY}));
  519. // SameParty cookie without Secure is invalid.
  520. cookie = CanonicalCookie::Create(
  521. url, "A=2; SameParty; SameSite=Lax", creation_time, server_time,
  522. absl::nullopt /* cookie_partition_key */, &status);
  523. EXPECT_FALSE(cookie.get());
  524. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  525. {CookieInclusionStatus::EXCLUDE_INVALID_SAMEPARTY}));
  526. }
  527. TEST(CanonicalCookieTest, CreateWithPartitioned) {
  528. GURL url("https://www.example.com/test/foo.html");
  529. base::Time creation_time = base::Time::Now();
  530. absl::optional<base::Time> server_time = absl::nullopt;
  531. auto partition_key = absl::make_optional(
  532. CookiePartitionKey::FromURLForTesting(GURL("https://toplevelsite.com")));
  533. CookieInclusionStatus status;
  534. // Valid Partitioned attribute
  535. std::unique_ptr<CanonicalCookie> cookie = CanonicalCookie::Create(
  536. url, "__Host-A=2; Partitioned; Path=/; Secure", creation_time,
  537. server_time, partition_key, &status);
  538. ASSERT_TRUE(cookie.get());
  539. EXPECT_TRUE(status.IsInclude());
  540. EXPECT_TRUE(cookie->IsSecure());
  541. EXPECT_TRUE(cookie->IsPartitioned());
  542. EXPECT_EQ(partition_key, cookie->PartitionKey());
  543. EXPECT_EQ(CookieSameSite::UNSPECIFIED, cookie->SameSite());
  544. // Create() without Partitioned in the cookie line should not result in a
  545. // partitioned cookie.
  546. status = CookieInclusionStatus();
  547. cookie =
  548. CanonicalCookie::Create(url, "__Host-A=2; Path=/; Secure", creation_time,
  549. server_time, partition_key, &status);
  550. ASSERT_TRUE(cookie.get());
  551. EXPECT_TRUE(status.IsInclude());
  552. EXPECT_FALSE(cookie->IsPartitioned());
  553. EXPECT_FALSE(cookie->PartitionKey());
  554. // Partitioned cookies with no __Host- prefix are still valid if they still
  555. // have Secure, Path=/, and no Domain.
  556. status = CookieInclusionStatus();
  557. cookie = CanonicalCookie::Create(url, "A=2; Partitioned; Path=/; Secure",
  558. creation_time, server_time, partition_key,
  559. &status);
  560. EXPECT_TRUE(cookie.get());
  561. EXPECT_TRUE(status.IsInclude());
  562. EXPECT_TRUE(cookie->IsPartitioned());
  563. EXPECT_EQ(partition_key, cookie->PartitionKey());
  564. // Invalid Partitioned attribute: No Secure attribute.
  565. status = CookieInclusionStatus();
  566. cookie =
  567. CanonicalCookie::Create(url, "A=2; Partitioned; Path=/", creation_time,
  568. server_time, partition_key, &status);
  569. EXPECT_FALSE(cookie.get());
  570. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  571. {CookieInclusionStatus::EXCLUDE_INVALID_PARTITIONED}));
  572. // Partitioned attribute: No Path attribute.
  573. status = CookieInclusionStatus();
  574. cookie =
  575. CanonicalCookie::Create(url, "A=2; Partitioned; Secure", creation_time,
  576. server_time, partition_key, &status);
  577. EXPECT_TRUE(cookie.get());
  578. EXPECT_TRUE(status.IsInclude());
  579. EXPECT_TRUE(cookie->IsPartitioned());
  580. EXPECT_EQ(partition_key, cookie->PartitionKey());
  581. // Partitioned attribute: Path attribute not equal to "/".
  582. status = CookieInclusionStatus();
  583. cookie = CanonicalCookie::Create(
  584. url, "A=2; Partitioned; Path=/foobar; Secure", creation_time, server_time,
  585. partition_key, &status);
  586. EXPECT_TRUE(cookie.get());
  587. EXPECT_TRUE(status.IsInclude());
  588. EXPECT_TRUE(cookie->IsPartitioned());
  589. EXPECT_EQ(partition_key, cookie->PartitionKey());
  590. // Partitioned attribute: Domain cookie.
  591. status = CookieInclusionStatus();
  592. cookie = CanonicalCookie::Create(
  593. url, "A=2; Partitioned; Path=/; Secure; Domain=example.com",
  594. creation_time, server_time, partition_key, &status);
  595. EXPECT_TRUE(cookie.get());
  596. LOG(ERROR) << status;
  597. EXPECT_TRUE(status.IsInclude());
  598. EXPECT_TRUE(cookie->IsPartitioned());
  599. EXPECT_EQ(partition_key, cookie->PartitionKey());
  600. // No Partitioned attribute but with a nonce.
  601. status = CookieInclusionStatus();
  602. auto partition_key_with_nonce =
  603. absl::make_optional(CookiePartitionKey::FromURLForTesting(
  604. GURL("https://toplevelsite.com"), base::UnguessableToken::Create()));
  605. cookie =
  606. CanonicalCookie::Create(url, "__Host-A=2; Path=/; Secure", creation_time,
  607. server_time, partition_key_with_nonce, &status);
  608. EXPECT_TRUE(cookie.get());
  609. EXPECT_TRUE(status.IsInclude());
  610. EXPECT_TRUE(cookie->IsPartitioned());
  611. EXPECT_EQ(partition_key_with_nonce, cookie->PartitionKey());
  612. }
  613. TEST_P(CanonicalCookieWithClampingTest, CreateWithMaxAge) {
  614. GURL url("http://www.example.com/test/foo.html");
  615. base::Time creation_time = base::Time::Now();
  616. absl::optional<base::Time> server_time = absl::nullopt;
  617. // Max-age with positive integer.
  618. std::unique_ptr<CanonicalCookie> cookie = CanonicalCookie::Create(
  619. url, "A=1; max-age=60", creation_time, server_time,
  620. absl::nullopt /* cookie_partition_key */);
  621. EXPECT_TRUE(cookie.get());
  622. EXPECT_TRUE(cookie->IsPersistent());
  623. EXPECT_FALSE(cookie->IsExpired(creation_time));
  624. EXPECT_EQ(base::Seconds(60) + creation_time, cookie->ExpiryDate());
  625. EXPECT_TRUE(cookie->IsCanonical());
  626. // Max-age with expires (max-age should take precedence).
  627. cookie = CanonicalCookie::Create(
  628. url, "A=1; expires=01-Jan-1970, 00:00:00 GMT; max-age=60", creation_time,
  629. server_time, absl::nullopt /* cookie_partition_key */);
  630. EXPECT_TRUE(cookie.get());
  631. EXPECT_TRUE(cookie->IsPersistent());
  632. EXPECT_FALSE(cookie->IsExpired(creation_time));
  633. EXPECT_EQ(base::Seconds(60) + creation_time, cookie->ExpiryDate());
  634. EXPECT_TRUE(cookie->IsCanonical());
  635. // Max-age=0 should create an expired cookie with expiry equal to the earliest
  636. // representable time.
  637. cookie =
  638. CanonicalCookie::Create(url, "A=1; max-age=0", creation_time, server_time,
  639. absl::nullopt /* cookie_partition_key */);
  640. EXPECT_TRUE(cookie.get());
  641. EXPECT_TRUE(cookie->IsPersistent());
  642. EXPECT_TRUE(cookie->IsExpired(creation_time));
  643. EXPECT_EQ(base::Time::Min(), cookie->ExpiryDate());
  644. EXPECT_TRUE(cookie->IsCanonical());
  645. // Negative max-age should create an expired cookie with expiry equal to the
  646. // earliest representable time.
  647. cookie = CanonicalCookie::Create(url, "A=1; max-age=-1", creation_time,
  648. server_time,
  649. absl::nullopt /* cookie_partition_key */);
  650. EXPECT_TRUE(cookie.get());
  651. EXPECT_TRUE(cookie->IsPersistent());
  652. EXPECT_TRUE(cookie->IsExpired(creation_time));
  653. EXPECT_EQ(base::Time::Min(), cookie->ExpiryDate());
  654. EXPECT_TRUE(cookie->IsCanonical());
  655. // Max-age with whitespace (should be trimmed out).
  656. cookie = CanonicalCookie::Create(url, "A=1; max-age = 60 ; Secure",
  657. creation_time, server_time,
  658. absl::nullopt /* cookie_partition_key */);
  659. EXPECT_TRUE(cookie.get());
  660. EXPECT_TRUE(cookie->IsPersistent());
  661. EXPECT_FALSE(cookie->IsExpired(creation_time));
  662. EXPECT_EQ(base::Seconds(60) + creation_time, cookie->ExpiryDate());
  663. EXPECT_TRUE(cookie->IsCanonical());
  664. // Max-age with non-integer should be ignored.
  665. cookie = CanonicalCookie::Create(url, "A=1; max-age=abcd", creation_time,
  666. server_time,
  667. absl::nullopt /* cookie_partition_key */);
  668. EXPECT_TRUE(cookie.get());
  669. EXPECT_FALSE(cookie->IsPersistent());
  670. EXPECT_FALSE(cookie->IsExpired(creation_time));
  671. EXPECT_TRUE(cookie->IsCanonical());
  672. // Overflow max-age should be clipped.
  673. cookie = CanonicalCookie::Create(url,
  674. "A=1; "
  675. "max-age="
  676. "9999999999999999999999999999999999999999999"
  677. "999999999999999999999999999999999999999999",
  678. creation_time, server_time,
  679. absl::nullopt /* cookie_partition_key */);
  680. EXPECT_TRUE(cookie.get());
  681. EXPECT_TRUE(cookie->IsPersistent());
  682. EXPECT_FALSE(cookie->IsExpired(creation_time));
  683. if (IsClampCookieExpiryTo400DaysEnabled()) {
  684. EXPECT_EQ(creation_time + base::Days(400), cookie->ExpiryDate());
  685. } else {
  686. EXPECT_EQ(base::Time::Max(), cookie->ExpiryDate());
  687. }
  688. EXPECT_TRUE(cookie->IsCanonical());
  689. // Underflow max-age should be clipped.
  690. cookie = CanonicalCookie::Create(url,
  691. "A=1; "
  692. "max-age=-"
  693. "9999999999999999999999999999999999999999999"
  694. "999999999999999999999999999999999999999999",
  695. creation_time, server_time,
  696. absl::nullopt /* cookie_partition_key */);
  697. EXPECT_TRUE(cookie.get());
  698. EXPECT_TRUE(cookie->IsPersistent());
  699. EXPECT_TRUE(cookie->IsExpired(creation_time));
  700. EXPECT_EQ(base::Time::Min(), cookie->ExpiryDate());
  701. EXPECT_TRUE(cookie->IsCanonical());
  702. }
  703. TEST_P(CanonicalCookieWithClampingTest, CreateWithExpires) {
  704. GURL url("http://www.example.com/test/foo.html");
  705. base::Time creation_time = base::Time::Now();
  706. absl::optional<base::Time> server_time = absl::nullopt;
  707. // Expires in the past
  708. base::Time past_date = base::Time::Now() - base::Days(10);
  709. std::unique_ptr<CanonicalCookie> cookie = CanonicalCookie::Create(
  710. url, "A=1; expires=" + base::TimeFormatHTTP(past_date), creation_time,
  711. server_time, absl::nullopt /* cookie_partition_key */);
  712. EXPECT_TRUE(cookie.get());
  713. EXPECT_TRUE(cookie->IsPersistent());
  714. EXPECT_TRUE(cookie->IsExpired(creation_time));
  715. EXPECT_TRUE((past_date - cookie->ExpiryDate()).magnitude() <
  716. base::Seconds(1));
  717. EXPECT_TRUE(cookie->IsCanonical());
  718. // Expires in the future
  719. base::Time future_date = base::Time::Now() + base::Days(10);
  720. cookie = CanonicalCookie::Create(
  721. url, "A=1; expires=" + base::TimeFormatHTTP(future_date), creation_time,
  722. server_time, absl::nullopt /* cookie_partition_key */);
  723. EXPECT_TRUE(cookie.get());
  724. EXPECT_TRUE(cookie->IsPersistent());
  725. EXPECT_FALSE(cookie->IsExpired(creation_time));
  726. EXPECT_TRUE((future_date - cookie->ExpiryDate()).magnitude() <
  727. base::Seconds(1));
  728. EXPECT_TRUE(cookie->IsCanonical());
  729. // Expires in the far future
  730. future_date = base::Time::Now() + base::Days(800);
  731. cookie = CanonicalCookie::Create(
  732. url, "A=1; expires=" + base::TimeFormatHTTP(future_date), creation_time,
  733. server_time, absl::nullopt /* cookie_partition_key */);
  734. EXPECT_TRUE(cookie.get());
  735. EXPECT_TRUE(cookie->IsPersistent());
  736. EXPECT_FALSE(cookie->IsExpired(creation_time));
  737. if (IsClampCookieExpiryTo400DaysEnabled()) {
  738. EXPECT_TRUE(
  739. (cookie->ExpiryDate() - creation_time - base::Days(400)).magnitude() <
  740. base::Seconds(1));
  741. } else {
  742. EXPECT_TRUE((future_date - cookie->ExpiryDate()).magnitude() <
  743. base::Seconds(1));
  744. }
  745. EXPECT_TRUE(cookie->IsCanonical());
  746. // Expires in the far future using CreateUnsafeCookieForTesting.
  747. cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  748. "A", "1", url.host(), url.path(), creation_time, base::Time::Max(),
  749. base::Time(), base::Time(), true, false, CookieSameSite::UNSPECIFIED,
  750. COOKIE_PRIORITY_HIGH, false, absl::nullopt /* cookie_partition_key */,
  751. CookieSourceScheme::kSecure, 443);
  752. EXPECT_TRUE(cookie.get());
  753. EXPECT_TRUE(cookie->IsPersistent());
  754. EXPECT_FALSE(cookie->IsExpired(creation_time));
  755. EXPECT_EQ(base::Time::Max(), cookie->ExpiryDate());
  756. EXPECT_EQ(base::Time(), cookie->LastUpdateDate());
  757. if (IsClampCookieExpiryTo400DaysEnabled()) {
  758. EXPECT_FALSE(cookie->IsCanonical());
  759. } else {
  760. EXPECT_TRUE(cookie->IsCanonical());
  761. }
  762. // Expires in the far future using FromStorage.
  763. cookie = CanonicalCookie::FromStorage(
  764. "A", "B", "www.foo.com", "/bar", creation_time, base::Time::Max(),
  765. base::Time(), base::Time(), false /*secure*/, false /*httponly*/,
  766. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  767. false /*same_party*/, absl::nullopt /*partition_key*/,
  768. CookieSourceScheme::kSecure, 443);
  769. EXPECT_TRUE(cookie.get());
  770. EXPECT_TRUE(cookie->IsPersistent());
  771. EXPECT_FALSE(cookie->IsExpired(creation_time));
  772. EXPECT_EQ(base::Time::Max(), cookie->ExpiryDate());
  773. EXPECT_EQ(base::Time(), cookie->LastUpdateDate());
  774. if (IsClampCookieExpiryTo400DaysEnabled()) {
  775. EXPECT_FALSE(cookie->IsCanonical());
  776. } else {
  777. EXPECT_TRUE(cookie->IsCanonical());
  778. }
  779. }
  780. TEST(CanonicalCookieTest, EmptyExpiry) {
  781. GURL url("http://www7.ipdl.inpit.go.jp/Tokujitu/tjkta.ipdl?N0000=108");
  782. base::Time creation_time = base::Time::Now();
  783. absl::optional<base::Time> server_time = absl::nullopt;
  784. std::string cookie_line =
  785. "ACSTM=20130308043820420042; path=/; domain=ipdl.inpit.go.jp; Expires=";
  786. std::unique_ptr<CanonicalCookie> cookie(
  787. CanonicalCookie::Create(url, cookie_line, creation_time, server_time,
  788. absl::nullopt /* cookie_partition_key */));
  789. EXPECT_TRUE(cookie.get());
  790. EXPECT_FALSE(cookie->IsPersistent());
  791. EXPECT_FALSE(cookie->IsExpired(creation_time));
  792. EXPECT_EQ(base::Time(), cookie->ExpiryDate());
  793. // With a stale server time
  794. server_time = creation_time - base::Hours(1);
  795. cookie = CanonicalCookie::Create(url, cookie_line, creation_time, server_time,
  796. absl::nullopt /* cookie_partition_key */);
  797. EXPECT_TRUE(cookie.get());
  798. EXPECT_FALSE(cookie->IsPersistent());
  799. EXPECT_FALSE(cookie->IsExpired(creation_time));
  800. EXPECT_EQ(base::Time(), cookie->ExpiryDate());
  801. // With a future server time
  802. server_time = creation_time + base::Hours(1);
  803. cookie = CanonicalCookie::Create(url, cookie_line, creation_time, server_time,
  804. absl::nullopt /* cookie_partition_key */);
  805. EXPECT_TRUE(cookie.get());
  806. EXPECT_FALSE(cookie->IsPersistent());
  807. EXPECT_FALSE(cookie->IsExpired(creation_time));
  808. EXPECT_EQ(base::Time(), cookie->ExpiryDate());
  809. }
  810. TEST_P(CanonicalCookieWithClampingTest, CreateWithLastUpdate) {
  811. GURL url("http://www.example.com/test/foo.html");
  812. base::Time creation_time = base::Time::Now() - base::Days(1);
  813. base::Time last_update_time = base::Time::Now() - base::Hours(1);
  814. absl::optional<base::Time> server_time = absl::nullopt;
  815. // Creating a cookie sets the last update date as now.
  816. std::unique_ptr<CanonicalCookie> cookie =
  817. CanonicalCookie::Create(url, "A=1", creation_time, server_time,
  818. /*cookie_partition_key=*/absl::nullopt);
  819. ASSERT_TRUE(cookie.get());
  820. EXPECT_TRUE((base::Time::Now() - cookie->LastUpdateDate()).magnitude() <
  821. base::Seconds(1));
  822. // Creating a sanitized cookie sets the last update date as now.
  823. cookie = CanonicalCookie::CreateSanitizedCookie(
  824. url, "A", "1", url.host(), url.path(), creation_time, base::Time(),
  825. creation_time, /*secure=*/true,
  826. /*http_only=*/false, CookieSameSite::NO_RESTRICTION,
  827. COOKIE_PRIORITY_DEFAULT, /*same_party=*/false,
  828. /*partition_key=*/absl::nullopt);
  829. ASSERT_TRUE(cookie.get());
  830. EXPECT_TRUE((base::Time::Now() - cookie->LastUpdateDate()).magnitude() <
  831. base::Seconds(1));
  832. // Creating an unsafe cookie allows us to set the last update date.
  833. cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  834. "A", "1", url.host(), url.path(), creation_time, base::Time(),
  835. base::Time(), last_update_time, /*secure=*/true,
  836. /*httponly=*/false, CookieSameSite::NO_RESTRICTION,
  837. COOKIE_PRIORITY_DEFAULT, /*same_party=*/false,
  838. /*partition_key=*/absl::nullopt, CookieSourceScheme::kSecure,
  839. /*source_port=*/443);
  840. ASSERT_TRUE(cookie.get());
  841. EXPECT_EQ(last_update_time, cookie->LastUpdateDate());
  842. // Loading a cookie from storage allows us to set the last update date.
  843. cookie = CanonicalCookie::FromStorage(
  844. "A", "1", url.host(), url.path(), creation_time, base::Time(),
  845. base::Time(), last_update_time, /*secure=*/true,
  846. /*httponly=*/false, CookieSameSite::NO_RESTRICTION,
  847. COOKIE_PRIORITY_DEFAULT, /*same_party=*/false,
  848. /*partition_key=*/absl::nullopt, CookieSourceScheme::kSecure,
  849. /*source_port=*/443);
  850. ASSERT_TRUE(cookie.get());
  851. EXPECT_EQ(last_update_time, cookie->LastUpdateDate());
  852. }
  853. TEST(CanonicalCookieTest, IsEquivalent) {
  854. GURL url("https://www.example.com/");
  855. std::string cookie_name = "A";
  856. std::string cookie_value = "2EDA-EF";
  857. std::string cookie_domain = ".www.example.com";
  858. std::string cookie_path = "/path";
  859. base::Time creation_time = base::Time::Now();
  860. base::Time expiration_time = creation_time + base::Days(2);
  861. base::Time update_time = creation_time + base::Days(1);
  862. bool secure = false;
  863. bool httponly = false;
  864. CookieSameSite same_site = CookieSameSite::NO_RESTRICTION;
  865. bool same_party = false;
  866. // Test that a cookie is equivalent to itself.
  867. auto cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  868. cookie_name, cookie_value, cookie_domain, cookie_path, creation_time,
  869. expiration_time, base::Time(), update_time, secure, httponly, same_site,
  870. COOKIE_PRIORITY_MEDIUM, same_party);
  871. EXPECT_TRUE(cookie->IsEquivalent(*cookie));
  872. EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*cookie));
  873. // Test that two identical cookies are equivalent.
  874. auto other_cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  875. cookie_name, cookie_value, cookie_domain, cookie_path, creation_time,
  876. expiration_time, base::Time(), update_time, secure, httponly, same_site,
  877. COOKIE_PRIORITY_MEDIUM, same_party);
  878. EXPECT_TRUE(cookie->IsEquivalent(*other_cookie));
  879. EXPECT_TRUE(other_cookie->IsEquivalentForSecureCookieMatching(*cookie));
  880. // Tests that use different variations of attribute values that
  881. // DON'T affect cookie equivalence.
  882. other_cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  883. cookie_name, "2", cookie_domain, cookie_path, creation_time,
  884. expiration_time, base::Time(), update_time, secure, httponly, same_site,
  885. COOKIE_PRIORITY_HIGH, same_party);
  886. EXPECT_TRUE(cookie->IsEquivalent(*other_cookie));
  887. EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
  888. EXPECT_TRUE(other_cookie->IsEquivalentForSecureCookieMatching(*cookie));
  889. base::Time other_creation_time = creation_time + base::Minutes(2);
  890. other_cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  891. cookie_name, "2", cookie_domain, cookie_path, other_creation_time,
  892. expiration_time, base::Time(), update_time, secure, httponly, same_site,
  893. COOKIE_PRIORITY_MEDIUM, same_party);
  894. EXPECT_TRUE(cookie->IsEquivalent(*other_cookie));
  895. EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
  896. EXPECT_TRUE(other_cookie->IsEquivalentForSecureCookieMatching(*cookie));
  897. other_cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  898. cookie_name, cookie_name, cookie_domain, cookie_path, creation_time,
  899. expiration_time, base::Time(), update_time, true, httponly, same_site,
  900. COOKIE_PRIORITY_LOW, same_party);
  901. EXPECT_TRUE(cookie->IsEquivalent(*other_cookie));
  902. EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
  903. EXPECT_TRUE(other_cookie->IsEquivalentForSecureCookieMatching(*cookie));
  904. other_cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  905. cookie_name, cookie_name, cookie_domain, cookie_path, creation_time,
  906. expiration_time, base::Time(), update_time, secure, true, same_site,
  907. COOKIE_PRIORITY_LOW, same_party);
  908. EXPECT_TRUE(cookie->IsEquivalent(*other_cookie));
  909. EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
  910. EXPECT_TRUE(other_cookie->IsEquivalentForSecureCookieMatching(*cookie));
  911. other_cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  912. cookie_name, cookie_name, cookie_domain, cookie_path, creation_time,
  913. expiration_time, base::Time(), update_time, secure, httponly,
  914. CookieSameSite::STRICT_MODE, COOKIE_PRIORITY_LOW, same_party);
  915. EXPECT_TRUE(cookie->IsEquivalent(*other_cookie));
  916. EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
  917. EXPECT_TRUE(other_cookie->IsEquivalentForSecureCookieMatching(*cookie));
  918. // Test the effect of a differing last_update_time on equivalency.
  919. other_cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  920. cookie_name, cookie_name, cookie_domain, cookie_path, creation_time,
  921. expiration_time, base::Time(), base::Time(), secure, httponly, same_site,
  922. COOKIE_PRIORITY_LOW, same_party);
  923. EXPECT_TRUE(cookie->IsEquivalent(*other_cookie));
  924. EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
  925. EXPECT_TRUE(other_cookie->IsEquivalentForSecureCookieMatching(*cookie));
  926. EXPECT_FALSE(cookie->HasEquivalentDataMembers(*other_cookie));
  927. // Cookies whose names mismatch are not equivalent.
  928. other_cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  929. "B", cookie_value, cookie_domain, cookie_path, creation_time,
  930. expiration_time, base::Time(), update_time, secure, httponly, same_site,
  931. COOKIE_PRIORITY_MEDIUM, same_party);
  932. EXPECT_FALSE(cookie->IsEquivalent(*other_cookie));
  933. EXPECT_FALSE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
  934. EXPECT_FALSE(other_cookie->IsEquivalentForSecureCookieMatching(*cookie));
  935. // A domain cookie at 'www.example.com' is not equivalent to a host cookie
  936. // at the same domain. These are, however, equivalent according to the laxer
  937. // rules of 'IsEquivalentForSecureCookieMatching'.
  938. other_cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  939. cookie_name, cookie_value, "www.example.com", cookie_path, creation_time,
  940. expiration_time, base::Time(), update_time, secure, httponly, same_site,
  941. COOKIE_PRIORITY_MEDIUM, same_party);
  942. EXPECT_TRUE(cookie->IsDomainCookie());
  943. EXPECT_FALSE(other_cookie->IsDomainCookie());
  944. EXPECT_FALSE(cookie->IsEquivalent(*other_cookie));
  945. EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
  946. EXPECT_TRUE(other_cookie->IsEquivalentForSecureCookieMatching(*cookie));
  947. // Likewise, a cookie on 'example.com' is not equivalent to a cookie on
  948. // 'www.example.com', but they are equivalent for secure cookie matching.
  949. other_cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  950. cookie_name, cookie_value, ".example.com", cookie_path, creation_time,
  951. expiration_time, base::Time(), update_time, secure, httponly, same_site,
  952. COOKIE_PRIORITY_MEDIUM, same_party);
  953. EXPECT_FALSE(cookie->IsEquivalent(*other_cookie));
  954. EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
  955. EXPECT_TRUE(other_cookie->IsEquivalentForSecureCookieMatching(*cookie));
  956. // Paths are a bit more complicated. 'IsEquivalent' requires an exact path
  957. // match, while secure cookie matching uses a more relaxed 'IsOnPath' check.
  958. // That is, |cookie| set on '/path' is not equivalent in either way to
  959. // |other_cookie| set on '/test' or '/path/subpath'. It is, however,
  960. // equivalent for secure cookie matching to |other_cookie| set on '/'.
  961. other_cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  962. cookie_name, cookie_value, cookie_domain, "/test", creation_time,
  963. expiration_time, base::Time(), update_time, secure, httponly, same_site,
  964. COOKIE_PRIORITY_MEDIUM, same_party);
  965. EXPECT_FALSE(cookie->IsEquivalent(*other_cookie));
  966. EXPECT_FALSE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
  967. EXPECT_FALSE(other_cookie->IsEquivalentForSecureCookieMatching(*cookie));
  968. other_cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  969. cookie_name, cookie_value, cookie_domain, cookie_path + "/subpath",
  970. creation_time, expiration_time, base::Time(), update_time, secure,
  971. httponly, same_site, COOKIE_PRIORITY_MEDIUM, same_party);
  972. EXPECT_FALSE(cookie->IsEquivalent(*other_cookie));
  973. // The path comparison is asymmetric
  974. EXPECT_FALSE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
  975. EXPECT_TRUE(other_cookie->IsEquivalentForSecureCookieMatching(*cookie));
  976. other_cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  977. cookie_name, cookie_value, cookie_domain, "/", creation_time,
  978. expiration_time, base::Time(), update_time, secure, httponly, same_site,
  979. COOKIE_PRIORITY_MEDIUM, same_party);
  980. EXPECT_FALSE(cookie->IsEquivalent(*other_cookie));
  981. EXPECT_TRUE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
  982. EXPECT_FALSE(other_cookie->IsEquivalentForSecureCookieMatching(*cookie));
  983. // Partitioned cookies are not equivalent to unpartitioned cookies.
  984. other_cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  985. cookie_name, cookie_value, cookie_domain, cookie_path, creation_time,
  986. expiration_time, base::Time(), update_time, secure, httponly, same_site,
  987. COOKIE_PRIORITY_MEDIUM, same_party,
  988. CookiePartitionKey::FromURLForTesting(GURL("https://foo.com")));
  989. EXPECT_FALSE(cookie->IsEquivalent(*other_cookie));
  990. EXPECT_FALSE(cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
  991. // Partitioned cookies are equal if they have the same partition key.
  992. auto paritioned_cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  993. cookie_name, cookie_value, cookie_domain, cookie_path, creation_time,
  994. expiration_time, base::Time(), update_time, secure, httponly, same_site,
  995. COOKIE_PRIORITY_MEDIUM, same_party,
  996. CookiePartitionKey::FromURLForTesting(GURL("https://foo.com")));
  997. EXPECT_TRUE(paritioned_cookie->IsEquivalent(*other_cookie));
  998. EXPECT_TRUE(
  999. paritioned_cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
  1000. // Partitioned cookies with different partition keys are not equal
  1001. other_cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  1002. cookie_name, cookie_value, cookie_domain, cookie_path, creation_time,
  1003. expiration_time, base::Time(), update_time, secure, httponly, same_site,
  1004. COOKIE_PRIORITY_MEDIUM, same_party,
  1005. CookiePartitionKey::FromURLForTesting(GURL("https://bar.com")));
  1006. EXPECT_FALSE(paritioned_cookie->IsEquivalent(*other_cookie));
  1007. EXPECT_FALSE(
  1008. paritioned_cookie->IsEquivalentForSecureCookieMatching(*other_cookie));
  1009. }
  1010. TEST(CanonicalCookieTest, IsEquivalentForSecureCookieMatching) {
  1011. struct {
  1012. struct {
  1013. const char* name;
  1014. const char* domain;
  1015. const char* path;
  1016. absl::optional<CookiePartitionKey> cookie_partition_key = absl::nullopt;
  1017. } cookie, secure_cookie;
  1018. bool equivalent;
  1019. bool is_symmetric; // Whether the reverse comparison has the same result.
  1020. } kTests[] = {
  1021. // Equivalent to itself
  1022. {{"A", "a.foo.com", "/"}, {"A", "a.foo.com", "/"}, true, true},
  1023. {{"A", ".a.foo.com", "/"}, {"A", ".a.foo.com", "/"}, true, true},
  1024. // Names are different
  1025. {{"A", "a.foo.com", "/"}, {"B", "a.foo.com", "/"}, false, true},
  1026. // Host cookie and domain cookie with same hostname match
  1027. {{"A", "a.foo.com", "/"}, {"A", ".a.foo.com", "/"}, true, true},
  1028. // Subdomains and superdomains match
  1029. {{"A", "a.foo.com", "/"}, {"A", ".foo.com", "/"}, true, true},
  1030. {{"A", ".a.foo.com", "/"}, {"A", ".foo.com", "/"}, true, true},
  1031. {{"A", "a.foo.com", "/"}, {"A", "foo.com", "/"}, true, true},
  1032. {{"A", ".a.foo.com", "/"}, {"A", "foo.com", "/"}, true, true},
  1033. // Different domains don't match
  1034. {{"A", "a.foo.com", "/"}, {"A", "b.foo.com", "/"}, false, true},
  1035. {{"A", "a.foo.com", "/"}, {"A", "ba.foo.com", "/"}, false, true},
  1036. // Path attribute matches if it is a subdomain, but not vice versa.
  1037. {{"A", "a.foo.com", "/sub"}, {"A", "a.foo.com", "/"}, true, false},
  1038. // Different paths don't match
  1039. {{"A", "a.foo.com", "/sub"}, {"A", "a.foo.com", "/other"}, false, true},
  1040. {{"A", "a.foo.com", "/a/b"}, {"A", "a.foo.com", "/a/c"}, false, true},
  1041. // Partitioned cookies are not equivalent to unpartitioned cookies.
  1042. {{"A", ".a.foo.com", "/"},
  1043. {"A", ".a.foo.com", "/",
  1044. CookiePartitionKey::FromURLForTesting(GURL("https://bar.com"))},
  1045. false,
  1046. true},
  1047. // Partitioned cookies are equivalent if they have the same partition key.
  1048. {{"A", "a.foo.com", "/",
  1049. CookiePartitionKey::FromURLForTesting(GURL("https://bar.com"))},
  1050. {"A", "a.foo.com", "/",
  1051. CookiePartitionKey::FromURLForTesting(GURL("https://bar.com"))},
  1052. true,
  1053. true},
  1054. // Partitioned cookies are *not* equivalent if they have the different
  1055. // partition keys.
  1056. {{"A", "a.foo.com", "/",
  1057. CookiePartitionKey::FromURLForTesting(GURL("https://bar.com"))},
  1058. {"A", "a.foo.com", "/",
  1059. CookiePartitionKey::FromURLForTesting(GURL("https://baz.com"))},
  1060. false,
  1061. true},
  1062. };
  1063. for (auto test : kTests) {
  1064. auto cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  1065. test.cookie.name, "value1", test.cookie.domain, test.cookie.path,
  1066. base::Time(), base::Time(), base::Time(), base::Time(),
  1067. false /* secure */, false /* httponly */, CookieSameSite::LAX_MODE,
  1068. COOKIE_PRIORITY_MEDIUM, false /* sameparty */,
  1069. test.cookie.cookie_partition_key);
  1070. auto secure_cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  1071. test.secure_cookie.name, "value2", test.secure_cookie.domain,
  1072. test.secure_cookie.path, base::Time(), base::Time(), base::Time(),
  1073. base::Time(), true /* secure */, false /* httponly */,
  1074. CookieSameSite::LAX_MODE, COOKIE_PRIORITY_MEDIUM, false /* sameparty */,
  1075. test.secure_cookie.cookie_partition_key);
  1076. EXPECT_EQ(test.equivalent,
  1077. cookie->IsEquivalentForSecureCookieMatching(*secure_cookie));
  1078. EXPECT_EQ(test.equivalent == test.is_symmetric,
  1079. secure_cookie->IsEquivalentForSecureCookieMatching(*cookie));
  1080. }
  1081. }
  1082. TEST(CanonicalCookieTest, IsDomainMatch) {
  1083. GURL url("http://www.example.com/test/foo.html");
  1084. base::Time creation_time = base::Time::Now();
  1085. absl::optional<base::Time> server_time = absl::nullopt;
  1086. std::unique_ptr<CanonicalCookie> cookie(
  1087. CanonicalCookie::Create(url, "A=2", creation_time, server_time,
  1088. absl::nullopt /* cookie_partition_key */));
  1089. EXPECT_TRUE(cookie->IsHostCookie());
  1090. EXPECT_TRUE(cookie->IsDomainMatch("www.example.com"));
  1091. EXPECT_TRUE(cookie->IsDomainMatch("www.example.com"));
  1092. EXPECT_FALSE(cookie->IsDomainMatch("foo.www.example.com"));
  1093. EXPECT_FALSE(cookie->IsDomainMatch("www0.example.com"));
  1094. EXPECT_FALSE(cookie->IsDomainMatch("example.com"));
  1095. cookie = CanonicalCookie::Create(url, "A=2; Domain=www.example.com",
  1096. creation_time, server_time,
  1097. absl::nullopt /* cookie_partition_key */);
  1098. EXPECT_TRUE(cookie->IsDomainCookie());
  1099. EXPECT_TRUE(cookie->IsDomainMatch("www.example.com"));
  1100. EXPECT_TRUE(cookie->IsDomainMatch("www.example.com"));
  1101. EXPECT_TRUE(cookie->IsDomainMatch("foo.www.example.com"));
  1102. EXPECT_FALSE(cookie->IsDomainMatch("www0.example.com"));
  1103. EXPECT_FALSE(cookie->IsDomainMatch("example.com"));
  1104. cookie = CanonicalCookie::Create(url, "A=2; Domain=.www.example.com",
  1105. creation_time, server_time,
  1106. absl::nullopt /* cookie_partition_key */);
  1107. EXPECT_TRUE(cookie->IsDomainMatch("www.example.com"));
  1108. EXPECT_TRUE(cookie->IsDomainMatch("www.example.com"));
  1109. EXPECT_TRUE(cookie->IsDomainMatch("foo.www.example.com"));
  1110. EXPECT_FALSE(cookie->IsDomainMatch("www0.example.com"));
  1111. EXPECT_FALSE(cookie->IsDomainMatch("example.com"));
  1112. }
  1113. TEST(CanonicalCookieTest, IsOnPath) {
  1114. base::Time creation_time = base::Time::Now();
  1115. absl::optional<base::Time> server_time = absl::nullopt;
  1116. std::unique_ptr<CanonicalCookie> cookie(CanonicalCookie::Create(
  1117. GURL("http://www.example.com"), "A=2", creation_time, server_time,
  1118. absl::nullopt /* cookie_partition_key */));
  1119. EXPECT_TRUE(cookie->IsOnPath("/"));
  1120. EXPECT_TRUE(cookie->IsOnPath("/test"));
  1121. EXPECT_TRUE(cookie->IsOnPath("/test/bar.html"));
  1122. // Test the empty string edge case.
  1123. EXPECT_FALSE(cookie->IsOnPath(std::string()));
  1124. cookie = CanonicalCookie::Create(GURL("http://www.example.com/test/foo.html"),
  1125. "A=2", creation_time, server_time,
  1126. absl::nullopt /* cookie_partition_key */);
  1127. EXPECT_FALSE(cookie->IsOnPath("/"));
  1128. EXPECT_TRUE(cookie->IsOnPath("/test"));
  1129. EXPECT_TRUE(cookie->IsOnPath("/test/bar.html"));
  1130. EXPECT_TRUE(cookie->IsOnPath("/test/sample/bar.html"));
  1131. }
  1132. TEST(CanonicalCookieTest, GetEffectiveSameSite) {
  1133. struct {
  1134. CookieSameSite same_site;
  1135. CookieEffectiveSameSite expected_effective_same_site;
  1136. // nullopt for following members indicates same effective SameSite result
  1137. // for all possible values.
  1138. absl::optional<CookieAccessSemantics> access_semantics = absl::nullopt;
  1139. absl::optional<bool> is_cookie_recent = absl::nullopt;
  1140. } kTestCases[] = {
  1141. // Explicitly specified SameSite always has the same effective SameSite
  1142. // regardless of the access semantics.
  1143. {CookieSameSite::NO_RESTRICTION, CookieEffectiveSameSite::NO_RESTRICTION},
  1144. {CookieSameSite::LAX_MODE, CookieEffectiveSameSite::LAX_MODE},
  1145. {CookieSameSite::STRICT_MODE, CookieEffectiveSameSite::STRICT_MODE},
  1146. {CookieSameSite::NO_RESTRICTION, CookieEffectiveSameSite::NO_RESTRICTION},
  1147. // UNSPECIFIED always maps to NO_RESTRICTION if LEGACY access semantics.
  1148. {CookieSameSite::UNSPECIFIED, CookieEffectiveSameSite::NO_RESTRICTION,
  1149. CookieAccessSemantics::LEGACY},
  1150. // UNSPECIFIED with non-LEGACY access semantics depends on whether cookie
  1151. // is recently created.
  1152. {CookieSameSite::UNSPECIFIED,
  1153. CookieEffectiveSameSite::LAX_MODE_ALLOW_UNSAFE,
  1154. CookieAccessSemantics::NONLEGACY, true},
  1155. {CookieSameSite::UNSPECIFIED,
  1156. CookieEffectiveSameSite::LAX_MODE_ALLOW_UNSAFE,
  1157. CookieAccessSemantics::UNKNOWN, true},
  1158. {CookieSameSite::UNSPECIFIED, CookieEffectiveSameSite::LAX_MODE,
  1159. CookieAccessSemantics::NONLEGACY, false},
  1160. {CookieSameSite::UNSPECIFIED, CookieEffectiveSameSite::LAX_MODE,
  1161. CookieAccessSemantics::UNKNOWN, false},
  1162. };
  1163. for (const auto& test : kTestCases) {
  1164. std::vector<std::unique_ptr<CanonicalCookie>> cookies;
  1165. base::Time now = base::Time::Now();
  1166. base::Time recent_creation_time = now - (kLaxAllowUnsafeMaxAge / 4);
  1167. base::Time not_recent_creation_time = now - (kLaxAllowUnsafeMaxAge * 4);
  1168. base::Time expiry_time = now + (kLaxAllowUnsafeMaxAge / 4);
  1169. if (!test.is_cookie_recent.has_value() || *test.is_cookie_recent) {
  1170. // Recent session cookie.
  1171. cookies.push_back(CanonicalCookie::CreateUnsafeCookieForTesting(
  1172. "A", "2", "example.test", "/", recent_creation_time, base::Time(),
  1173. base::Time(), base::Time(), true /* secure */, false /* httponly */,
  1174. test.same_site, COOKIE_PRIORITY_DEFAULT, false));
  1175. // Recent persistent cookie.
  1176. cookies.push_back(CanonicalCookie::CreateUnsafeCookieForTesting(
  1177. "A", "2", "example.test", "/", recent_creation_time, expiry_time,
  1178. base::Time(), base::Time(), true /* secure */, false /* httponly */,
  1179. test.same_site, COOKIE_PRIORITY_DEFAULT, false));
  1180. }
  1181. if (!test.is_cookie_recent.has_value() || !(*test.is_cookie_recent)) {
  1182. // Not-recent session cookie.
  1183. cookies.push_back(CanonicalCookie::CreateUnsafeCookieForTesting(
  1184. "A", "2", "example.test", "/", not_recent_creation_time, base::Time(),
  1185. base::Time(), base::Time(), true /* secure */, false /* httponly */,
  1186. test.same_site, COOKIE_PRIORITY_DEFAULT, false));
  1187. // Not-recent persistent cookie.
  1188. cookies.push_back(CanonicalCookie::CreateUnsafeCookieForTesting(
  1189. "A", "2", "example.test", "/", not_recent_creation_time, expiry_time,
  1190. base::Time(), base::Time(), true /* secure */, false /* httponly */,
  1191. test.same_site, COOKIE_PRIORITY_DEFAULT, false));
  1192. }
  1193. std::vector<CookieAccessSemantics> access_semantics = {
  1194. CookieAccessSemantics::UNKNOWN, CookieAccessSemantics::LEGACY,
  1195. CookieAccessSemantics::NONLEGACY};
  1196. if (test.access_semantics.has_value())
  1197. access_semantics = {*test.access_semantics};
  1198. for (const auto& cookie : cookies) {
  1199. for (const auto semantics : access_semantics) {
  1200. EXPECT_EQ(test.expected_effective_same_site,
  1201. cookie->GetEffectiveSameSiteForTesting(semantics));
  1202. }
  1203. }
  1204. }
  1205. }
  1206. TEST(CanonicalCookieTest, IncludeForRequestURL) {
  1207. GURL url("http://www.example.com");
  1208. base::Time creation_time = base::Time::Now();
  1209. CookieOptions options = CookieOptions::MakeAllInclusive();
  1210. absl::optional<base::Time> server_time = absl::nullopt;
  1211. std::unique_ptr<CanonicalCookie> cookie(
  1212. CanonicalCookie::Create(url, "A=2", creation_time, server_time,
  1213. absl::nullopt /* cookie_partition_key */));
  1214. EXPECT_TRUE(cookie
  1215. ->IncludeForRequestURL(
  1216. url, options,
  1217. CookieAccessParams{
  1218. net::CookieAccessSemantics::UNKNOWN,
  1219. /*delegate_treats_url_as_trustworthy=*/false,
  1220. CookieSamePartyStatus::kNoSamePartyEnforcement})
  1221. .status.IsInclude());
  1222. EXPECT_TRUE(cookie
  1223. ->IncludeForRequestURL(
  1224. GURL("http://www.example.com/foo/bar"), options,
  1225. CookieAccessParams{
  1226. net::CookieAccessSemantics::UNKNOWN,
  1227. /*delegate_treats_url_as_trustworthy=*/false,
  1228. CookieSamePartyStatus::kNoSamePartyEnforcement})
  1229. .status.IsInclude());
  1230. EXPECT_TRUE(cookie
  1231. ->IncludeForRequestURL(
  1232. GURL("https://www.example.com/foo/bar"), options,
  1233. CookieAccessParams{
  1234. net::CookieAccessSemantics::UNKNOWN,
  1235. /*delegate_treats_url_as_trustworthy=*/false,
  1236. CookieSamePartyStatus::kNoSamePartyEnforcement})
  1237. .status.IsInclude());
  1238. EXPECT_TRUE(cookie
  1239. ->IncludeForRequestURL(
  1240. GURL("https://sub.example.com"), options,
  1241. CookieAccessParams{
  1242. net::CookieAccessSemantics::UNKNOWN,
  1243. /*delegate_treats_url_as_trustworthy=*/false,
  1244. CookieSamePartyStatus::kNoSamePartyEnforcement})
  1245. .status.HasExactlyExclusionReasonsForTesting(
  1246. {CookieInclusionStatus::EXCLUDE_DOMAIN_MISMATCH}));
  1247. EXPECT_TRUE(cookie
  1248. ->IncludeForRequestURL(
  1249. GURL("https://sub.www.example.com"), options,
  1250. CookieAccessParams{
  1251. net::CookieAccessSemantics::UNKNOWN,
  1252. /*delegate_treats_url_as_trustworthy=*/false,
  1253. CookieSamePartyStatus::kNoSamePartyEnforcement})
  1254. .status.HasExactlyExclusionReasonsForTesting(
  1255. {CookieInclusionStatus::EXCLUDE_DOMAIN_MISMATCH}));
  1256. // Test that cookie with a cookie path that does not match the url path are
  1257. // not included.
  1258. cookie = CanonicalCookie::Create(url, "A=2; Path=/foo/bar", creation_time,
  1259. server_time,
  1260. absl::nullopt /* cookie_partition_key */);
  1261. EXPECT_TRUE(cookie
  1262. ->IncludeForRequestURL(
  1263. url, options,
  1264. CookieAccessParams{
  1265. net::CookieAccessSemantics::UNKNOWN,
  1266. /*delegate_treats_url_as_trustworthy=*/false,
  1267. CookieSamePartyStatus::kNoSamePartyEnforcement})
  1268. .status.HasExactlyExclusionReasonsForTesting(
  1269. {CookieInclusionStatus::EXCLUDE_NOT_ON_PATH}));
  1270. EXPECT_TRUE(cookie
  1271. ->IncludeForRequestURL(
  1272. GURL("http://www.example.com/foo/bar/index.html"),
  1273. options,
  1274. CookieAccessParams{
  1275. net::CookieAccessSemantics::UNKNOWN,
  1276. /*delegate_treats_url_as_trustworthy=*/false,
  1277. CookieSamePartyStatus::kNoSamePartyEnforcement})
  1278. .status.IsInclude());
  1279. // Test that a secure cookie is not included for a non secure URL.
  1280. GURL secure_url("https://www.example.com");
  1281. cookie = CanonicalCookie::Create(secure_url, "A=2; Secure", creation_time,
  1282. server_time,
  1283. absl::nullopt /* cookie_partition_key */);
  1284. EXPECT_TRUE(cookie->IsSecure());
  1285. EXPECT_TRUE(cookie
  1286. ->IncludeForRequestURL(
  1287. secure_url, options,
  1288. CookieAccessParams{
  1289. net::CookieAccessSemantics::UNKNOWN,
  1290. /*delegate_treats_url_as_trustworthy=*/false,
  1291. CookieSamePartyStatus::kNoSamePartyEnforcement})
  1292. .status.IsInclude());
  1293. EXPECT_TRUE(cookie
  1294. ->IncludeForRequestURL(
  1295. url, options,
  1296. CookieAccessParams{
  1297. net::CookieAccessSemantics::UNKNOWN,
  1298. /*delegate_treats_url_as_trustworthy=*/false,
  1299. CookieSamePartyStatus::kNoSamePartyEnforcement})
  1300. .status.HasExactlyExclusionReasonsForTesting(
  1301. {CookieInclusionStatus::EXCLUDE_SECURE_ONLY}));
  1302. // Test that a delegate can make an exception, however, and ask for a
  1303. // non-secure URL to be treated as trustworthy... with a warning.
  1304. cookie =
  1305. CanonicalCookie::Create(url, "A=2; Secure", creation_time, server_time,
  1306. absl::nullopt /* cookie_partition_key */);
  1307. ASSERT_TRUE(cookie);
  1308. EXPECT_TRUE(cookie->IsSecure());
  1309. CookieAccessResult result = cookie->IncludeForRequestURL(
  1310. url, options,
  1311. CookieAccessParams{net::CookieAccessSemantics::UNKNOWN,
  1312. /*delegate_treats_url_as_trustworthy=*/true,
  1313. CookieSamePartyStatus::kNoSamePartyEnforcement});
  1314. EXPECT_TRUE(result.status.IsInclude());
  1315. EXPECT_TRUE(result.status.HasWarningReason(
  1316. CookieInclusionStatus::WARN_SECURE_ACCESS_GRANTED_NON_CRYPTOGRAPHIC));
  1317. // The same happens for localhost even w/o delegate intervention.
  1318. GURL localhost_url("http://localhost/");
  1319. cookie = CanonicalCookie::Create(localhost_url, "A=2; Secure", creation_time,
  1320. server_time,
  1321. absl::nullopt /* cookie_partition_key */);
  1322. ASSERT_TRUE(cookie);
  1323. EXPECT_TRUE(cookie->IsSecure());
  1324. result = cookie->IncludeForRequestURL(
  1325. localhost_url, options,
  1326. CookieAccessParams{net::CookieAccessSemantics::UNKNOWN,
  1327. /*delegate_treats_url_as_trustworthy=*/false,
  1328. CookieSamePartyStatus::kNoSamePartyEnforcement});
  1329. EXPECT_TRUE(result.status.IsInclude());
  1330. EXPECT_TRUE(result.status.HasWarningReason(
  1331. CookieInclusionStatus::WARN_SECURE_ACCESS_GRANTED_NON_CRYPTOGRAPHIC));
  1332. // An unneeded exception doesn't add a warning, however.
  1333. cookie = CanonicalCookie::Create(secure_url, "A=2; Secure", creation_time,
  1334. server_time,
  1335. absl::nullopt /* cookie_partition_key */);
  1336. ASSERT_TRUE(cookie);
  1337. EXPECT_TRUE(cookie->IsSecure());
  1338. result = cookie->IncludeForRequestURL(
  1339. secure_url, options,
  1340. CookieAccessParams{net::CookieAccessSemantics::UNKNOWN,
  1341. /*delegate_treats_url_as_trustworthy=*/true,
  1342. CookieSamePartyStatus::kNoSamePartyEnforcement});
  1343. EXPECT_TRUE(result.status.IsInclude());
  1344. EXPECT_FALSE(result.status.ShouldWarn());
  1345. //
  1346. // Test that http only cookies are only included if the include httponly flag
  1347. // is set on the cookie options.
  1348. options.set_include_httponly();
  1349. cookie =
  1350. CanonicalCookie::Create(url, "A=2; HttpOnly", creation_time, server_time,
  1351. absl::nullopt /* cookie_partition_key */);
  1352. EXPECT_TRUE(cookie->IsHttpOnly());
  1353. EXPECT_TRUE(cookie
  1354. ->IncludeForRequestURL(
  1355. url, options,
  1356. CookieAccessParams{
  1357. net::CookieAccessSemantics::UNKNOWN,
  1358. /*delegate_treats_url_as_trustworthy=*/false,
  1359. CookieSamePartyStatus::kNoSamePartyEnforcement})
  1360. .status.IsInclude());
  1361. options.set_exclude_httponly();
  1362. EXPECT_TRUE(cookie
  1363. ->IncludeForRequestURL(
  1364. url, options,
  1365. CookieAccessParams{
  1366. net::CookieAccessSemantics::UNKNOWN,
  1367. /*delegate_treats_url_as_trustworthy=*/false,
  1368. CookieSamePartyStatus::kNoSamePartyEnforcement})
  1369. .status.HasExactlyExclusionReasonsForTesting(
  1370. {CookieInclusionStatus::EXCLUDE_HTTP_ONLY}));
  1371. }
  1372. struct IncludeForRequestURLTestCase {
  1373. std::string cookie_line;
  1374. CookieSameSite expected_samesite;
  1375. CookieEffectiveSameSite expected_effective_samesite;
  1376. CookieOptions::SameSiteCookieContext request_options_samesite_context;
  1377. CookieInclusionStatus expected_inclusion_status;
  1378. base::TimeDelta creation_time_delta = base::TimeDelta();
  1379. };
  1380. void VerifyIncludeForRequestURLTestCases(
  1381. CookieAccessSemantics access_semantics,
  1382. std::vector<IncludeForRequestURLTestCase> test_cases) {
  1383. GURL url("https://example.test");
  1384. for (const auto& test : test_cases) {
  1385. base::Time creation_time = base::Time::Now() - test.creation_time_delta;
  1386. std::unique_ptr<CanonicalCookie> cookie = CanonicalCookie::Create(
  1387. url, test.cookie_line, creation_time, absl::nullopt /* server_time */,
  1388. absl::nullopt /* cookie_partition_key */);
  1389. EXPECT_EQ(test.expected_samesite, cookie->SameSite());
  1390. CookieOptions request_options;
  1391. request_options.set_same_site_cookie_context(
  1392. test.request_options_samesite_context);
  1393. EXPECT_THAT(
  1394. cookie->IncludeForRequestURL(
  1395. url, request_options,
  1396. CookieAccessParams{access_semantics,
  1397. /*delegate_treats_url_as_trustworthy=*/false,
  1398. CookieSamePartyStatus::kNoSamePartyEnforcement}),
  1399. MatchesCookieAccessResult(test.expected_inclusion_status,
  1400. test.expected_effective_samesite,
  1401. access_semantics, true))
  1402. << cookie->Name() << "=" << cookie->Value();
  1403. }
  1404. }
  1405. TEST(CanonicalCookieTest, IncludeForRequestURLSameSite) {
  1406. const base::TimeDelta kLongAge = kLaxAllowUnsafeMaxAge * 4;
  1407. const base::TimeDelta kShortAge = kLaxAllowUnsafeMaxAge / 4;
  1408. using SameSiteCookieContext = CookieOptions::SameSiteCookieContext;
  1409. // Test cases that are the same regardless of feature status or access
  1410. // semantics. For Schemeful Same-Site this means that the context downgrade is
  1411. // a no-op (such as for NO_RESTRICTION cookies) or that there is no downgrade:
  1412. std::vector<IncludeForRequestURLTestCase> common_test_cases = {
  1413. // Strict cookies:
  1414. {"Common=1;SameSite=Strict", CookieSameSite::STRICT_MODE,
  1415. CookieEffectiveSameSite::STRICT_MODE,
  1416. SameSiteCookieContext(SameSiteCookieContext::ContextType::CROSS_SITE),
  1417. CookieInclusionStatus(CookieInclusionStatus::EXCLUDE_SAMESITE_STRICT)},
  1418. {"Common=2;SameSite=Strict", CookieSameSite::STRICT_MODE,
  1419. CookieEffectiveSameSite::STRICT_MODE,
  1420. SameSiteCookieContext(
  1421. SameSiteCookieContext::ContextType::SAME_SITE_LAX_METHOD_UNSAFE),
  1422. CookieInclusionStatus(CookieInclusionStatus::EXCLUDE_SAMESITE_STRICT)},
  1423. {"Common=3;SameSite=Strict", CookieSameSite::STRICT_MODE,
  1424. CookieEffectiveSameSite::STRICT_MODE,
  1425. SameSiteCookieContext(SameSiteCookieContext::ContextType::SAME_SITE_LAX),
  1426. CookieInclusionStatus(CookieInclusionStatus::EXCLUDE_SAMESITE_STRICT)},
  1427. {"Common=4;SameSite=Strict", CookieSameSite::STRICT_MODE,
  1428. CookieEffectiveSameSite::STRICT_MODE,
  1429. SameSiteCookieContext(
  1430. SameSiteCookieContext::ContextType::SAME_SITE_STRICT),
  1431. CookieInclusionStatus()},
  1432. // Lax cookies:
  1433. {"Common=5;SameSite=Lax", CookieSameSite::LAX_MODE,
  1434. CookieEffectiveSameSite::LAX_MODE,
  1435. SameSiteCookieContext(SameSiteCookieContext::ContextType::CROSS_SITE),
  1436. CookieInclusionStatus(CookieInclusionStatus::EXCLUDE_SAMESITE_LAX)},
  1437. {"Common=6;SameSite=Lax", CookieSameSite::LAX_MODE,
  1438. CookieEffectiveSameSite::LAX_MODE,
  1439. SameSiteCookieContext(
  1440. SameSiteCookieContext::ContextType::SAME_SITE_LAX_METHOD_UNSAFE),
  1441. CookieInclusionStatus(CookieInclusionStatus::EXCLUDE_SAMESITE_LAX)},
  1442. {"Common=7;SameSite=Lax", CookieSameSite::LAX_MODE,
  1443. CookieEffectiveSameSite::LAX_MODE,
  1444. SameSiteCookieContext(SameSiteCookieContext::ContextType::SAME_SITE_LAX),
  1445. CookieInclusionStatus()},
  1446. {"Common=8;SameSite=Lax", CookieSameSite::LAX_MODE,
  1447. CookieEffectiveSameSite::LAX_MODE,
  1448. SameSiteCookieContext(
  1449. SameSiteCookieContext::ContextType::SAME_SITE_STRICT),
  1450. CookieInclusionStatus()},
  1451. // Lax cookies with downgrade:
  1452. {"Common=9;SameSite=Lax", CookieSameSite::LAX_MODE,
  1453. CookieEffectiveSameSite::LAX_MODE,
  1454. SameSiteCookieContext(
  1455. SameSiteCookieContext::ContextType::SAME_SITE_STRICT,
  1456. SameSiteCookieContext::ContextType::SAME_SITE_LAX),
  1457. CookieInclusionStatus()},
  1458. // None and Secure cookies:
  1459. {"Common=10;SameSite=None;Secure", CookieSameSite::NO_RESTRICTION,
  1460. CookieEffectiveSameSite::NO_RESTRICTION,
  1461. SameSiteCookieContext(SameSiteCookieContext::ContextType::CROSS_SITE),
  1462. CookieInclusionStatus()},
  1463. {"Common=11;SameSite=None;Secure", CookieSameSite::NO_RESTRICTION,
  1464. CookieEffectiveSameSite::NO_RESTRICTION,
  1465. SameSiteCookieContext(
  1466. SameSiteCookieContext::ContextType::SAME_SITE_LAX_METHOD_UNSAFE),
  1467. CookieInclusionStatus()},
  1468. {"Common=12;SameSite=None;Secure", CookieSameSite::NO_RESTRICTION,
  1469. CookieEffectiveSameSite::NO_RESTRICTION,
  1470. SameSiteCookieContext(SameSiteCookieContext::ContextType::SAME_SITE_LAX),
  1471. CookieInclusionStatus()},
  1472. {"Common=13;SameSite=None;Secure", CookieSameSite::NO_RESTRICTION,
  1473. CookieEffectiveSameSite::NO_RESTRICTION,
  1474. SameSiteCookieContext(
  1475. SameSiteCookieContext::ContextType::SAME_SITE_STRICT),
  1476. CookieInclusionStatus()},
  1477. // Because NO_RESTRICTION cookies are always sent, the schemeful context
  1478. // downgrades shouldn't matter.
  1479. {"Common=14;SameSite=None;Secure", CookieSameSite::NO_RESTRICTION,
  1480. CookieEffectiveSameSite::NO_RESTRICTION,
  1481. SameSiteCookieContext(
  1482. SameSiteCookieContext::ContextType::SAME_SITE_STRICT,
  1483. SameSiteCookieContext::ContextType::SAME_SITE_LAX),
  1484. CookieInclusionStatus()},
  1485. {"Common=15;SameSite=None;Secure", CookieSameSite::NO_RESTRICTION,
  1486. CookieEffectiveSameSite::NO_RESTRICTION,
  1487. SameSiteCookieContext(
  1488. SameSiteCookieContext::ContextType::SAME_SITE_STRICT,
  1489. SameSiteCookieContext::ContextType::SAME_SITE_LAX_METHOD_UNSAFE),
  1490. CookieInclusionStatus()},
  1491. {"Common=16;SameSite=None;Secure", CookieSameSite::NO_RESTRICTION,
  1492. CookieEffectiveSameSite::NO_RESTRICTION,
  1493. SameSiteCookieContext(
  1494. SameSiteCookieContext::ContextType::SAME_SITE_STRICT,
  1495. SameSiteCookieContext::ContextType::CROSS_SITE),
  1496. CookieInclusionStatus()},
  1497. {"Common=17;SameSite=None;Secure", CookieSameSite::NO_RESTRICTION,
  1498. CookieEffectiveSameSite::NO_RESTRICTION,
  1499. SameSiteCookieContext(SameSiteCookieContext::ContextType::SAME_SITE_LAX,
  1500. SameSiteCookieContext::ContextType::CROSS_SITE),
  1501. CookieInclusionStatus()},
  1502. {"Common=18;SameSite=None;Secure", CookieSameSite::NO_RESTRICTION,
  1503. CookieEffectiveSameSite::NO_RESTRICTION,
  1504. SameSiteCookieContext(
  1505. SameSiteCookieContext::ContextType::SAME_SITE_LAX_METHOD_UNSAFE,
  1506. SameSiteCookieContext::ContextType::CROSS_SITE),
  1507. CookieInclusionStatus()},
  1508. };
  1509. // Test cases where the unspecified-SameSite cookie defaults to SameSite=None
  1510. // due to LEGACY access semantics):
  1511. std::vector<IncludeForRequestURLTestCase> default_none_test_cases = {
  1512. {"DefaultNone=1", CookieSameSite::UNSPECIFIED,
  1513. CookieEffectiveSameSite::NO_RESTRICTION,
  1514. SameSiteCookieContext(SameSiteCookieContext::ContextType::CROSS_SITE),
  1515. CookieInclusionStatus::MakeFromReasonsForTesting(
  1516. std::vector<CookieInclusionStatus::ExclusionReason>(),
  1517. {CookieInclusionStatus::
  1518. WARN_SAMESITE_UNSPECIFIED_CROSS_SITE_CONTEXT})},
  1519. {"DefaultNone=2", CookieSameSite::UNSPECIFIED,
  1520. CookieEffectiveSameSite::NO_RESTRICTION,
  1521. SameSiteCookieContext(
  1522. SameSiteCookieContext::ContextType::SAME_SITE_LAX_METHOD_UNSAFE),
  1523. CookieInclusionStatus::MakeFromReasonsForTesting(
  1524. std::vector<CookieInclusionStatus::ExclusionReason>(),
  1525. {CookieInclusionStatus::
  1526. WARN_SAMESITE_UNSPECIFIED_CROSS_SITE_CONTEXT})},
  1527. {"DefaultNone=3", CookieSameSite::UNSPECIFIED,
  1528. CookieEffectiveSameSite::NO_RESTRICTION,
  1529. SameSiteCookieContext(SameSiteCookieContext::ContextType::SAME_SITE_LAX),
  1530. CookieInclusionStatus()},
  1531. {"DefaultNone=4", CookieSameSite::UNSPECIFIED,
  1532. CookieEffectiveSameSite::NO_RESTRICTION,
  1533. SameSiteCookieContext(
  1534. SameSiteCookieContext::ContextType::SAME_SITE_STRICT),
  1535. CookieInclusionStatus()}};
  1536. // Test cases where the unspecified-SameSite cookie defaults to SameSite=Lax:
  1537. std::vector<IncludeForRequestURLTestCase> default_lax_test_cases = {
  1538. // Unspecified recently-created cookies (with SameSite-by-default):
  1539. {"DefaultLax=1", CookieSameSite::UNSPECIFIED,
  1540. CookieEffectiveSameSite::LAX_MODE_ALLOW_UNSAFE,
  1541. SameSiteCookieContext(SameSiteCookieContext::ContextType::CROSS_SITE),
  1542. CookieInclusionStatus(
  1543. CookieInclusionStatus::EXCLUDE_SAMESITE_UNSPECIFIED_TREATED_AS_LAX,
  1544. CookieInclusionStatus::WARN_SAMESITE_UNSPECIFIED_CROSS_SITE_CONTEXT),
  1545. kShortAge},
  1546. {"DefaultLax=2", CookieSameSite::UNSPECIFIED,
  1547. CookieEffectiveSameSite::LAX_MODE_ALLOW_UNSAFE,
  1548. SameSiteCookieContext(
  1549. SameSiteCookieContext::ContextType::SAME_SITE_LAX_METHOD_UNSAFE),
  1550. CookieInclusionStatus::MakeFromReasonsForTesting(
  1551. std::vector<CookieInclusionStatus::ExclusionReason>(),
  1552. {CookieInclusionStatus::WARN_SAMESITE_UNSPECIFIED_LAX_ALLOW_UNSAFE}),
  1553. kShortAge},
  1554. {"DefaultLax=3", CookieSameSite::UNSPECIFIED,
  1555. CookieEffectiveSameSite::LAX_MODE_ALLOW_UNSAFE,
  1556. SameSiteCookieContext(SameSiteCookieContext::ContextType::SAME_SITE_LAX),
  1557. CookieInclusionStatus(), kShortAge},
  1558. {"DefaultLax=4", CookieSameSite::UNSPECIFIED,
  1559. CookieEffectiveSameSite::LAX_MODE_ALLOW_UNSAFE,
  1560. SameSiteCookieContext(
  1561. SameSiteCookieContext::ContextType::SAME_SITE_STRICT),
  1562. CookieInclusionStatus(), kShortAge},
  1563. // Unspecified not-recently-created cookies (with SameSite-by-default):
  1564. {"DefaultLax=5", CookieSameSite::UNSPECIFIED,
  1565. CookieEffectiveSameSite::LAX_MODE,
  1566. SameSiteCookieContext(SameSiteCookieContext::ContextType::CROSS_SITE),
  1567. CookieInclusionStatus(
  1568. CookieInclusionStatus::EXCLUDE_SAMESITE_UNSPECIFIED_TREATED_AS_LAX,
  1569. CookieInclusionStatus::WARN_SAMESITE_UNSPECIFIED_CROSS_SITE_CONTEXT),
  1570. kLongAge},
  1571. {"DefaultLax=6", CookieSameSite::UNSPECIFIED,
  1572. CookieEffectiveSameSite::LAX_MODE,
  1573. SameSiteCookieContext(
  1574. SameSiteCookieContext::ContextType::SAME_SITE_LAX_METHOD_UNSAFE),
  1575. CookieInclusionStatus(
  1576. CookieInclusionStatus::EXCLUDE_SAMESITE_UNSPECIFIED_TREATED_AS_LAX,
  1577. CookieInclusionStatus::WARN_SAMESITE_UNSPECIFIED_CROSS_SITE_CONTEXT),
  1578. kLongAge},
  1579. {"DefaultLax=7", CookieSameSite::UNSPECIFIED,
  1580. CookieEffectiveSameSite::LAX_MODE,
  1581. SameSiteCookieContext(SameSiteCookieContext::ContextType::SAME_SITE_LAX),
  1582. CookieInclusionStatus(), kLongAge},
  1583. {"DefaultLax=8", CookieSameSite::UNSPECIFIED,
  1584. CookieEffectiveSameSite::LAX_MODE,
  1585. SameSiteCookieContext(
  1586. SameSiteCookieContext::ContextType::SAME_SITE_STRICT),
  1587. CookieInclusionStatus(), kLongAge},
  1588. };
  1589. // Test cases that require LEGACY semantics or Schemeful Same-Site to be
  1590. // disabled.
  1591. std::vector<IncludeForRequestURLTestCase> schemeful_disabled_test_cases = {
  1592. {"LEGACY_Schemeful=1;SameSite=Strict", CookieSameSite::STRICT_MODE,
  1593. CookieEffectiveSameSite::STRICT_MODE,
  1594. SameSiteCookieContext(
  1595. SameSiteCookieContext::ContextType::SAME_SITE_STRICT,
  1596. SameSiteCookieContext::ContextType::SAME_SITE_LAX),
  1597. CookieInclusionStatus::MakeFromReasonsForTesting(
  1598. std::vector<CookieInclusionStatus::ExclusionReason>(),
  1599. {CookieInclusionStatus::WARN_STRICT_LAX_DOWNGRADE_STRICT_SAMESITE})},
  1600. {"LEGACY_Schemeful=2;SameSite=Strict", CookieSameSite::STRICT_MODE,
  1601. CookieEffectiveSameSite::STRICT_MODE,
  1602. SameSiteCookieContext(
  1603. SameSiteCookieContext::ContextType::SAME_SITE_STRICT,
  1604. SameSiteCookieContext::ContextType::SAME_SITE_LAX_METHOD_UNSAFE),
  1605. CookieInclusionStatus::MakeFromReasonsForTesting(
  1606. std::vector<CookieInclusionStatus::ExclusionReason>(),
  1607. {CookieInclusionStatus::
  1608. WARN_STRICT_CROSS_DOWNGRADE_STRICT_SAMESITE})},
  1609. {"LEGACY_Schemeful=3;SameSite=Strict", CookieSameSite::STRICT_MODE,
  1610. CookieEffectiveSameSite::STRICT_MODE,
  1611. SameSiteCookieContext(
  1612. SameSiteCookieContext::ContextType::SAME_SITE_STRICT,
  1613. SameSiteCookieContext::ContextType::CROSS_SITE),
  1614. CookieInclusionStatus::MakeFromReasonsForTesting(
  1615. std::vector<CookieInclusionStatus::ExclusionReason>(),
  1616. {CookieInclusionStatus::
  1617. WARN_STRICT_CROSS_DOWNGRADE_STRICT_SAMESITE})},
  1618. {"LEGACY_Schemeful=4;SameSite=Lax", CookieSameSite::LAX_MODE,
  1619. CookieEffectiveSameSite::LAX_MODE,
  1620. SameSiteCookieContext(
  1621. SameSiteCookieContext::ContextType::SAME_SITE_STRICT,
  1622. SameSiteCookieContext::ContextType::SAME_SITE_LAX_METHOD_UNSAFE),
  1623. CookieInclusionStatus::MakeFromReasonsForTesting(
  1624. std::vector<CookieInclusionStatus::ExclusionReason>(),
  1625. {CookieInclusionStatus::WARN_STRICT_CROSS_DOWNGRADE_LAX_SAMESITE})},
  1626. {"LEGACY_Schemeful=5;SameSite=Lax", CookieSameSite::LAX_MODE,
  1627. CookieEffectiveSameSite::LAX_MODE,
  1628. SameSiteCookieContext(
  1629. SameSiteCookieContext::ContextType::SAME_SITE_STRICT,
  1630. SameSiteCookieContext::ContextType::CROSS_SITE),
  1631. CookieInclusionStatus::MakeFromReasonsForTesting(
  1632. std::vector<CookieInclusionStatus::ExclusionReason>(),
  1633. {CookieInclusionStatus::WARN_STRICT_CROSS_DOWNGRADE_LAX_SAMESITE})},
  1634. {"LEGACY_Schemeful=6;SameSite=Lax", CookieSameSite::LAX_MODE,
  1635. CookieEffectiveSameSite::LAX_MODE,
  1636. SameSiteCookieContext(SameSiteCookieContext::ContextType::SAME_SITE_LAX,
  1637. SameSiteCookieContext::ContextType::CROSS_SITE),
  1638. CookieInclusionStatus::MakeFromReasonsForTesting(
  1639. std::vector<CookieInclusionStatus::ExclusionReason>(),
  1640. {CookieInclusionStatus::WARN_LAX_CROSS_DOWNGRADE_LAX_SAMESITE})},
  1641. };
  1642. // Test cases that require NONLEGACY or UNKNOWN semantics with Schemeful
  1643. // Same-Site enabled
  1644. std::vector<IncludeForRequestURLTestCase> schemeful_enabled_test_cases = {
  1645. {"NONLEGACY_Schemeful=1;SameSite=Strict", CookieSameSite::STRICT_MODE,
  1646. CookieEffectiveSameSite::STRICT_MODE,
  1647. SameSiteCookieContext(
  1648. SameSiteCookieContext::ContextType::SAME_SITE_STRICT,
  1649. SameSiteCookieContext::ContextType::SAME_SITE_LAX),
  1650. CookieInclusionStatus::MakeFromReasonsForTesting(
  1651. {CookieInclusionStatus::EXCLUDE_SAMESITE_STRICT},
  1652. {CookieInclusionStatus::WARN_STRICT_LAX_DOWNGRADE_STRICT_SAMESITE})},
  1653. {"NONLEGACY_Schemeful=2;SameSite=Strict", CookieSameSite::STRICT_MODE,
  1654. CookieEffectiveSameSite::STRICT_MODE,
  1655. SameSiteCookieContext(
  1656. SameSiteCookieContext::ContextType::SAME_SITE_STRICT,
  1657. SameSiteCookieContext::ContextType::SAME_SITE_LAX_METHOD_UNSAFE),
  1658. CookieInclusionStatus::MakeFromReasonsForTesting(
  1659. {CookieInclusionStatus::EXCLUDE_SAMESITE_STRICT},
  1660. {CookieInclusionStatus::
  1661. WARN_STRICT_CROSS_DOWNGRADE_STRICT_SAMESITE})},
  1662. {"NONLEGACY_Schemeful=3;SameSite=Strict", CookieSameSite::STRICT_MODE,
  1663. CookieEffectiveSameSite::STRICT_MODE,
  1664. SameSiteCookieContext(
  1665. SameSiteCookieContext::ContextType::SAME_SITE_STRICT,
  1666. SameSiteCookieContext::ContextType::CROSS_SITE),
  1667. CookieInclusionStatus::MakeFromReasonsForTesting(
  1668. {CookieInclusionStatus::EXCLUDE_SAMESITE_STRICT},
  1669. {CookieInclusionStatus::
  1670. WARN_STRICT_CROSS_DOWNGRADE_STRICT_SAMESITE})},
  1671. {"NONLEGACY_Schemeful=4;SameSite=Lax", CookieSameSite::LAX_MODE,
  1672. CookieEffectiveSameSite::LAX_MODE,
  1673. SameSiteCookieContext(
  1674. SameSiteCookieContext::ContextType::SAME_SITE_STRICT,
  1675. SameSiteCookieContext::ContextType::SAME_SITE_LAX_METHOD_UNSAFE),
  1676. CookieInclusionStatus::MakeFromReasonsForTesting(
  1677. {CookieInclusionStatus::EXCLUDE_SAMESITE_LAX},
  1678. {CookieInclusionStatus::WARN_STRICT_CROSS_DOWNGRADE_LAX_SAMESITE})},
  1679. {"NONLEGACY_Schemeful=5;SameSite=Lax", CookieSameSite::LAX_MODE,
  1680. CookieEffectiveSameSite::LAX_MODE,
  1681. SameSiteCookieContext(
  1682. SameSiteCookieContext::ContextType::SAME_SITE_STRICT,
  1683. SameSiteCookieContext::ContextType::CROSS_SITE),
  1684. CookieInclusionStatus::MakeFromReasonsForTesting(
  1685. {CookieInclusionStatus::EXCLUDE_SAMESITE_LAX},
  1686. {CookieInclusionStatus::WARN_STRICT_CROSS_DOWNGRADE_LAX_SAMESITE})},
  1687. {"NONLEGACY_Schemeful=6;SameSite=Lax", CookieSameSite::LAX_MODE,
  1688. CookieEffectiveSameSite::LAX_MODE,
  1689. SameSiteCookieContext(SameSiteCookieContext::ContextType::SAME_SITE_LAX,
  1690. SameSiteCookieContext::ContextType::CROSS_SITE),
  1691. CookieInclusionStatus::MakeFromReasonsForTesting(
  1692. {CookieInclusionStatus::EXCLUDE_SAMESITE_LAX},
  1693. {CookieInclusionStatus::WARN_LAX_CROSS_DOWNGRADE_LAX_SAMESITE})},
  1694. };
  1695. auto SchemefulIndependentCases = [&]() {
  1696. // Run the test cases that are independent of Schemeful Same-Site.
  1697. VerifyIncludeForRequestURLTestCases(CookieAccessSemantics::UNKNOWN,
  1698. common_test_cases);
  1699. VerifyIncludeForRequestURLTestCases(CookieAccessSemantics::UNKNOWN,
  1700. default_lax_test_cases);
  1701. VerifyIncludeForRequestURLTestCases(CookieAccessSemantics::LEGACY,
  1702. common_test_cases);
  1703. VerifyIncludeForRequestURLTestCases(CookieAccessSemantics::LEGACY,
  1704. default_none_test_cases);
  1705. VerifyIncludeForRequestURLTestCases(CookieAccessSemantics::NONLEGACY,
  1706. common_test_cases);
  1707. VerifyIncludeForRequestURLTestCases(CookieAccessSemantics::NONLEGACY,
  1708. default_lax_test_cases);
  1709. };
  1710. {
  1711. // Schemeful Same-Site disabled.
  1712. base::test::ScopedFeatureList feature_list;
  1713. feature_list.InitAndDisableFeature(features::kSchemefulSameSite);
  1714. SchemefulIndependentCases();
  1715. VerifyIncludeForRequestURLTestCases(CookieAccessSemantics::LEGACY,
  1716. schemeful_disabled_test_cases);
  1717. VerifyIncludeForRequestURLTestCases(CookieAccessSemantics::NONLEGACY,
  1718. schemeful_disabled_test_cases);
  1719. VerifyIncludeForRequestURLTestCases(CookieAccessSemantics::UNKNOWN,
  1720. schemeful_disabled_test_cases);
  1721. }
  1722. {
  1723. // Schemeful Same-Site enabled.
  1724. base::test::ScopedFeatureList feature_list;
  1725. feature_list.InitAndEnableFeature(features::kSchemefulSameSite);
  1726. SchemefulIndependentCases();
  1727. // With LEGACY access the cases should act as if schemeful is disabled, even
  1728. // when it's not.
  1729. VerifyIncludeForRequestURLTestCases(CookieAccessSemantics::LEGACY,
  1730. schemeful_disabled_test_cases);
  1731. VerifyIncludeForRequestURLTestCases(CookieAccessSemantics::NONLEGACY,
  1732. schemeful_enabled_test_cases);
  1733. VerifyIncludeForRequestURLTestCases(CookieAccessSemantics::UNKNOWN,
  1734. schemeful_enabled_test_cases);
  1735. }
  1736. }
  1737. // Test that SameSite=None requires Secure.
  1738. TEST(CanonicalCookieTest, IncludeCookiesWithoutSameSiteMustBeSecure) {
  1739. GURL url("https://www.example.com");
  1740. base::Time creation_time = base::Time::Now();
  1741. absl::optional<base::Time> server_time = absl::nullopt;
  1742. CookieOptions options;
  1743. // Make a SameSite=None, *not* Secure cookie.
  1744. std::unique_ptr<CanonicalCookie> cookie = CanonicalCookie::Create(
  1745. url, "A=2; SameSite=None", creation_time, server_time,
  1746. absl::nullopt /* cookie_partition_key */);
  1747. ASSERT_TRUE(cookie.get());
  1748. EXPECT_FALSE(cookie->IsSecure());
  1749. EXPECT_EQ(CookieSameSite::NO_RESTRICTION, cookie->SameSite());
  1750. EXPECT_EQ(CookieEffectiveSameSite::NO_RESTRICTION,
  1751. cookie->GetEffectiveSameSiteForTesting());
  1752. // UKNOWN semantics results in modern behavior (requiring Secure).
  1753. EXPECT_TRUE(cookie
  1754. ->IncludeForRequestURL(
  1755. url, options,
  1756. CookieAccessParams{
  1757. CookieAccessSemantics::UNKNOWN,
  1758. /*delegate_treats_url_as_trustworthy=*/false,
  1759. CookieSamePartyStatus::kNoSamePartyEnforcement})
  1760. .status.HasExactlyExclusionReasonsForTesting(
  1761. {CookieInclusionStatus::EXCLUDE_SAMESITE_NONE_INSECURE}));
  1762. // LEGACY semantics does not require Secure for SameSite=None cookies.
  1763. EXPECT_TRUE(cookie
  1764. ->IncludeForRequestURL(
  1765. url, options,
  1766. CookieAccessParams{
  1767. CookieAccessSemantics::LEGACY,
  1768. /*delegate_treats_url_as_trustworthy=*/false,
  1769. CookieSamePartyStatus::kNoSamePartyEnforcement})
  1770. .status.IsInclude());
  1771. // NONLEGACY semantics results in modern behavior (requiring Secure).
  1772. EXPECT_TRUE(cookie
  1773. ->IncludeForRequestURL(
  1774. url, options,
  1775. CookieAccessParams{
  1776. CookieAccessSemantics::NONLEGACY,
  1777. /*delegate_treats_url_as_trustworthy=*/false,
  1778. CookieSamePartyStatus::kNoSamePartyEnforcement})
  1779. .status.HasExactlyExclusionReasonsForTesting(
  1780. {CookieInclusionStatus::EXCLUDE_SAMESITE_NONE_INSECURE}));
  1781. }
  1782. TEST(CanonicalCookieTest, IncludeForRequestURLSameParty) {
  1783. GURL url("https://www.example.com");
  1784. base::Time creation_time = base::Time::Now();
  1785. absl::optional<base::Time> server_time = absl::nullopt;
  1786. CookieOptions options;
  1787. // SameSite is not specified.
  1788. std::unique_ptr<CanonicalCookie> cookie_samesite_unspecified =
  1789. CanonicalCookie::Create(url, "A=2; SameParty; Secure", creation_time,
  1790. server_time,
  1791. absl::nullopt /* cookie_partition_key */);
  1792. ASSERT_TRUE(cookie_samesite_unspecified.get());
  1793. EXPECT_TRUE(cookie_samesite_unspecified->IsSecure());
  1794. EXPECT_EQ(CookieSameSite::UNSPECIFIED,
  1795. cookie_samesite_unspecified->SameSite());
  1796. EXPECT_EQ(CookieEffectiveSameSite::LAX_MODE_ALLOW_UNSAFE,
  1797. cookie_samesite_unspecified->GetEffectiveSameSiteForTesting());
  1798. EXPECT_TRUE(cookie_samesite_unspecified->IsSameParty());
  1799. // SameSite=None.
  1800. std::unique_ptr<CanonicalCookie> cookie_samesite_none =
  1801. CanonicalCookie::Create(url, "A=2; SameSite=None; SameParty; Secure",
  1802. creation_time, server_time,
  1803. absl::nullopt /* cookie_partition_key */);
  1804. ASSERT_TRUE(cookie_samesite_none.get());
  1805. EXPECT_TRUE(cookie_samesite_none->IsSecure());
  1806. EXPECT_EQ(CookieSameSite::NO_RESTRICTION, cookie_samesite_none->SameSite());
  1807. EXPECT_EQ(CookieEffectiveSameSite::NO_RESTRICTION,
  1808. cookie_samesite_none->GetEffectiveSameSiteForTesting());
  1809. EXPECT_TRUE(cookie_samesite_none->IsSameParty());
  1810. // SameSite=Lax.
  1811. std::unique_ptr<CanonicalCookie> cookie_samesite_lax =
  1812. CanonicalCookie::Create(url, "A=2; SameSite=Lax; SameParty; Secure",
  1813. creation_time, server_time,
  1814. absl::nullopt /* cookie_partition_key */);
  1815. ASSERT_TRUE(cookie_samesite_lax.get());
  1816. EXPECT_TRUE(cookie_samesite_lax->IsSecure());
  1817. EXPECT_EQ(CookieSameSite::LAX_MODE, cookie_samesite_lax->SameSite());
  1818. EXPECT_EQ(CookieEffectiveSameSite::LAX_MODE,
  1819. cookie_samesite_lax->GetEffectiveSameSiteForTesting());
  1820. EXPECT_TRUE(cookie_samesite_lax->IsSameParty());
  1821. for (const CanonicalCookie* cookie : {
  1822. cookie_samesite_unspecified.get(),
  1823. cookie_samesite_none.get(),
  1824. cookie_samesite_lax.get(),
  1825. }) {
  1826. // SameParty cookies that should be excluded result in the appropriate
  1827. // exclusion reason, and removes SAMESITE exclusion reasons.
  1828. for (CookieAccessSemantics access_semantics : {
  1829. CookieAccessSemantics::UNKNOWN,
  1830. CookieAccessSemantics::LEGACY,
  1831. CookieAccessSemantics::NONLEGACY,
  1832. }) {
  1833. EXPECT_THAT(cookie->IncludeForRequestURL(
  1834. url, options,
  1835. CookieAccessParams{
  1836. access_semantics,
  1837. /*delegate_treats_url_as_trustworthy=*/false,
  1838. CookieSamePartyStatus::kEnforceSamePartyExclude}),
  1839. MatchesCookieAccessResult(
  1840. HasExactlyExclusionReasonsForTesting(
  1841. std::vector<CookieInclusionStatus::ExclusionReason>(
  1842. {CookieInclusionStatus::
  1843. EXCLUDE_SAMEPARTY_CROSS_PARTY_CONTEXT})),
  1844. _, _, true))
  1845. << "SameSite = " << static_cast<int>(cookie->SameSite())
  1846. << ", access_semantics = " << static_cast<int>(access_semantics);
  1847. }
  1848. }
  1849. }
  1850. TEST(CanonicalCookieTest, IncludeForRequestURL_SameSiteNone_Metrics) {
  1851. using SamePartyContextType = SamePartyContext::Type;
  1852. constexpr bool delegate_treats_url_as_trustworthy = false;
  1853. const base::Time now = base::Time::Now();
  1854. const auto make_cookie = [now](CookieSameSite same_site, bool same_party) {
  1855. return CanonicalCookie::CreateUnsafeCookieForTesting(
  1856. "A", "1", "www.example.com", "/test", now, base::Time(), base::Time(),
  1857. base::Time(), true /* secure */, false /*httponly*/, same_site,
  1858. COOKIE_PRIORITY_DEFAULT, same_party);
  1859. };
  1860. GURL url("https://www.example.com/test");
  1861. const std::unique_ptr<CanonicalCookie> same_site_none_cookie =
  1862. make_cookie(CookieSameSite::NO_RESTRICTION, false /* same_party */);
  1863. const std::unique_ptr<CanonicalCookie> same_party_cookie =
  1864. make_cookie(CookieSameSite::NO_RESTRICTION, true /* same_party */);
  1865. const std::unique_ptr<CanonicalCookie> same_site_lax_cookie =
  1866. make_cookie(CookieSameSite::LAX_MODE, false /* same_party */);
  1867. const std::unique_ptr<CanonicalCookie> same_site_strict_cookie =
  1868. make_cookie(CookieSameSite::STRICT_MODE, false /* same_party */);
  1869. CookieOptions options;
  1870. options.set_same_site_cookie_context(CookieOptions::SameSiteCookieContext(
  1871. CookieOptions::SameSiteCookieContext::ContextType::CROSS_SITE));
  1872. // Same as default, but just to be explicit:
  1873. options.set_same_party_context(
  1874. SamePartyContext(SamePartyContext::Type::kCrossParty));
  1875. // Check that the most restrictive context is recognized and enforced.
  1876. EXPECT_THAT(
  1877. same_site_none_cookie->IncludeForRequestURL(
  1878. url, options,
  1879. CookieAccessParams(CookieAccessSemantics::LEGACY,
  1880. delegate_treats_url_as_trustworthy,
  1881. CookieSamePartyStatus::kNoSamePartyEnforcement)),
  1882. MatchesCookieAccessResult(CookieInclusionStatus(), _, _, true));
  1883. EXPECT_THAT(
  1884. same_party_cookie->IncludeForRequestURL(
  1885. url, options,
  1886. CookieAccessParams(CookieAccessSemantics::LEGACY,
  1887. delegate_treats_url_as_trustworthy,
  1888. CookieSamePartyStatus::kEnforceSamePartyExclude)),
  1889. MatchesCookieAccessResult(Not(net::IsInclude()), _, _, true));
  1890. // Now tweak the context to allow a SameParty cookie (using the top&resource
  1891. // definition) and make sure we get the right warning. (Note: we make the
  1892. // "real" same-partyness value match the value computed for the metric, even
  1893. // though they would differ unless we changed the real definition.) Then
  1894. // check that if we modify the cookie as indicated, the set would be allowed,
  1895. // but the next-most-restrictive variation would still be blocked.
  1896. options.set_same_party_context(
  1897. SamePartyContext(SamePartyContextType::kSameParty));
  1898. EXPECT_THAT(
  1899. same_site_none_cookie->IncludeForRequestURL(
  1900. url, options,
  1901. CookieAccessParams(CookieAccessSemantics::LEGACY,
  1902. delegate_treats_url_as_trustworthy,
  1903. CookieSamePartyStatus::kNoSamePartyEnforcement)),
  1904. MatchesCookieAccessResult(CookieInclusionStatus(), _, _, true));
  1905. EXPECT_THAT(
  1906. same_party_cookie->IncludeForRequestURL(
  1907. url, options,
  1908. CookieAccessParams(CookieAccessSemantics::LEGACY,
  1909. delegate_treats_url_as_trustworthy,
  1910. CookieSamePartyStatus::kEnforceSamePartyInclude)),
  1911. MatchesCookieAccessResult(net::IsInclude(), _, _, true));
  1912. EXPECT_THAT(
  1913. same_site_lax_cookie->IncludeForRequestURL(
  1914. url, options,
  1915. CookieAccessParams(CookieAccessSemantics::LEGACY,
  1916. delegate_treats_url_as_trustworthy,
  1917. CookieSamePartyStatus::kNoSamePartyEnforcement)),
  1918. MatchesCookieAccessResult(Not(net::IsInclude()), _, _, true));
  1919. // Next: allow a SameParty cookie (using both definitions).
  1920. options.set_same_party_context(SamePartyContext::MakeInclusive());
  1921. EXPECT_THAT(
  1922. same_site_none_cookie->IncludeForRequestURL(
  1923. url, options,
  1924. CookieAccessParams(CookieAccessSemantics::LEGACY,
  1925. delegate_treats_url_as_trustworthy,
  1926. CookieSamePartyStatus::kNoSamePartyEnforcement)),
  1927. MatchesCookieAccessResult(CookieInclusionStatus(), _, _, true));
  1928. EXPECT_THAT(
  1929. same_party_cookie->IncludeForRequestURL(
  1930. url, options,
  1931. CookieAccessParams(CookieAccessSemantics::LEGACY,
  1932. delegate_treats_url_as_trustworthy,
  1933. CookieSamePartyStatus::kNoSamePartyEnforcement)),
  1934. MatchesCookieAccessResult(net::IsInclude(), _, _, true));
  1935. EXPECT_THAT(
  1936. same_site_lax_cookie->IncludeForRequestURL(
  1937. url, options,
  1938. CookieAccessParams(CookieAccessSemantics::LEGACY,
  1939. delegate_treats_url_as_trustworthy,
  1940. CookieSamePartyStatus::kNoSamePartyEnforcement)),
  1941. MatchesCookieAccessResult(Not(net::IsInclude()), _, _, true));
  1942. // Next: allow a SameSite=Lax cookie.
  1943. options.set_same_site_cookie_context(CookieOptions::SameSiteCookieContext(
  1944. CookieOptions::SameSiteCookieContext::ContextType::SAME_SITE_LAX));
  1945. EXPECT_THAT(
  1946. same_site_none_cookie->IncludeForRequestURL(
  1947. url, options,
  1948. CookieAccessParams(CookieAccessSemantics::LEGACY,
  1949. delegate_treats_url_as_trustworthy,
  1950. CookieSamePartyStatus::kNoSamePartyEnforcement)),
  1951. MatchesCookieAccessResult(CookieInclusionStatus(), _, _, true));
  1952. EXPECT_THAT(
  1953. same_site_lax_cookie->IncludeForRequestURL(
  1954. url, options,
  1955. CookieAccessParams(CookieAccessSemantics::LEGACY,
  1956. delegate_treats_url_as_trustworthy,
  1957. CookieSamePartyStatus::kNoSamePartyEnforcement)),
  1958. MatchesCookieAccessResult(net::IsInclude(), _, _, true));
  1959. EXPECT_THAT(
  1960. same_site_strict_cookie->IncludeForRequestURL(
  1961. url, options,
  1962. CookieAccessParams(CookieAccessSemantics::LEGACY,
  1963. delegate_treats_url_as_trustworthy,
  1964. CookieSamePartyStatus::kNoSamePartyEnforcement)),
  1965. MatchesCookieAccessResult(Not(net::IsInclude()), _, _, true));
  1966. // Next: allow a SameSite=Strict cookie.
  1967. options.set_same_site_cookie_context(CookieOptions::SameSiteCookieContext(
  1968. CookieOptions::SameSiteCookieContext::ContextType::SAME_SITE_STRICT));
  1969. EXPECT_THAT(
  1970. same_site_none_cookie->IncludeForRequestURL(
  1971. url, options,
  1972. CookieAccessParams(CookieAccessSemantics::LEGACY,
  1973. delegate_treats_url_as_trustworthy,
  1974. CookieSamePartyStatus::kNoSamePartyEnforcement)),
  1975. MatchesCookieAccessResult(CookieInclusionStatus(), _, _, true));
  1976. EXPECT_THAT(
  1977. same_site_strict_cookie->IncludeForRequestURL(
  1978. url, options,
  1979. CookieAccessParams(CookieAccessSemantics::LEGACY,
  1980. delegate_treats_url_as_trustworthy,
  1981. CookieSamePartyStatus::kNoSamePartyEnforcement)),
  1982. MatchesCookieAccessResult(net::IsInclude(), _, _, true));
  1983. }
  1984. // Test that the CookieInclusionStatus warning for inclusion changed by
  1985. // cross-site redirect context downgrade is applied correctly.
  1986. TEST(CanonicalCookieTest, IncludeForRequestURL_RedirectDowngradeWarning) {
  1987. using Context = CookieOptions::SameSiteCookieContext;
  1988. using ContextType = Context::ContextType;
  1989. Context::ContextMetadata strict_lax_downgrade_metadata,
  1990. strict_cross_downgrade_metadata;
  1991. strict_lax_downgrade_metadata.cross_site_redirect_downgrade =
  1992. Context::ContextMetadata::ContextDowngradeType::kStrictToLax;
  1993. strict_cross_downgrade_metadata.cross_site_redirect_downgrade =
  1994. Context::ContextMetadata::ContextDowngradeType::kStrictToCross;
  1995. GURL url("https://www.example.test/test");
  1996. GURL insecure_url("http://www.example.test/test");
  1997. const struct {
  1998. ContextType context_type;
  1999. Context::ContextMetadata metadata;
  2000. CookieSameSite samesite;
  2001. bool expect_cross_site_redirect_warning;
  2002. } kTestCases[] = {
  2003. // Strict-to-lax downgrade.
  2004. {ContextType::SAME_SITE_STRICT, strict_lax_downgrade_metadata,
  2005. CookieSameSite::STRICT_MODE, true},
  2006. {ContextType::SAME_SITE_LAX, strict_lax_downgrade_metadata,
  2007. CookieSameSite::STRICT_MODE, true},
  2008. {ContextType::SAME_SITE_STRICT, strict_lax_downgrade_metadata,
  2009. CookieSameSite::LAX_MODE, false},
  2010. {ContextType::SAME_SITE_LAX, strict_lax_downgrade_metadata,
  2011. CookieSameSite::LAX_MODE, false},
  2012. {ContextType::SAME_SITE_STRICT, strict_lax_downgrade_metadata,
  2013. CookieSameSite::NO_RESTRICTION, false},
  2014. {ContextType::SAME_SITE_LAX, strict_lax_downgrade_metadata,
  2015. CookieSameSite::NO_RESTRICTION, false},
  2016. // Strict-to-cross downgrade.
  2017. {ContextType::SAME_SITE_STRICT, strict_cross_downgrade_metadata,
  2018. CookieSameSite::STRICT_MODE, true},
  2019. {ContextType::CROSS_SITE, strict_cross_downgrade_metadata,
  2020. CookieSameSite::STRICT_MODE, true},
  2021. {ContextType::SAME_SITE_STRICT, strict_cross_downgrade_metadata,
  2022. CookieSameSite::LAX_MODE, true},
  2023. {ContextType::CROSS_SITE, strict_cross_downgrade_metadata,
  2024. CookieSameSite::LAX_MODE, true},
  2025. {ContextType::SAME_SITE_STRICT, strict_cross_downgrade_metadata,
  2026. CookieSameSite::NO_RESTRICTION, false},
  2027. {ContextType::CROSS_SITE, strict_cross_downgrade_metadata,
  2028. CookieSameSite::NO_RESTRICTION, false},
  2029. };
  2030. for (bool consider_redirects : {true, false}) {
  2031. base::test::ScopedFeatureList feature_list;
  2032. feature_list.InitWithFeatureState(
  2033. features::kCookieSameSiteConsidersRedirectChain, consider_redirects);
  2034. for (CookieAccessSemantics semantics :
  2035. {CookieAccessSemantics::LEGACY, CookieAccessSemantics::NONLEGACY}) {
  2036. // There are no downgrade warnings for undowngraded contexts.
  2037. for (ContextType context_type :
  2038. {ContextType::SAME_SITE_STRICT, ContextType::SAME_SITE_LAX,
  2039. ContextType::SAME_SITE_LAX_METHOD_UNSAFE,
  2040. ContextType::CROSS_SITE}) {
  2041. for (CookieSameSite samesite :
  2042. {CookieSameSite::UNSPECIFIED, CookieSameSite::NO_RESTRICTION,
  2043. CookieSameSite::LAX_MODE, CookieSameSite::STRICT_MODE}) {
  2044. std::unique_ptr<CanonicalCookie> cookie =
  2045. CanonicalCookie::CreateUnsafeCookieForTesting(
  2046. "A", "1", "www.example.test", "/test", base::Time::Now(),
  2047. base::Time(), base::Time(), base::Time(), /*secure=*/true,
  2048. /*httponly=*/false, samesite, COOKIE_PRIORITY_DEFAULT,
  2049. /*same_party=*/false);
  2050. CookieOptions options;
  2051. options.set_same_site_cookie_context(Context(context_type));
  2052. EXPECT_FALSE(
  2053. cookie
  2054. ->IncludeForRequestURL(
  2055. url, options,
  2056. CookieAccessParams(
  2057. semantics,
  2058. /*delegate_treats_url_as_trustworthy=*/false,
  2059. CookieSamePartyStatus::kNoSamePartyEnforcement))
  2060. .status.HasWarningReason(
  2061. CookieInclusionStatus::
  2062. WARN_CROSS_SITE_REDIRECT_DOWNGRADE_CHANGES_INCLUSION));
  2063. }
  2064. }
  2065. for (const auto& test : kTestCases) {
  2066. std::unique_ptr<CanonicalCookie> cookie =
  2067. CanonicalCookie::CreateUnsafeCookieForTesting(
  2068. "A", "1", "www.example.test", "/test", base::Time::Now(),
  2069. base::Time(), base::Time(), base::Time(), /*secure=*/true,
  2070. /*httponly=*/false, test.samesite, COOKIE_PRIORITY_DEFAULT,
  2071. /*same_party=*/false);
  2072. CookieOptions options;
  2073. options.set_same_site_cookie_context(
  2074. Context(test.context_type, test.context_type, test.metadata,
  2075. test.metadata));
  2076. EXPECT_EQ(
  2077. cookie
  2078. ->IncludeForRequestURL(
  2079. url, options,
  2080. CookieAccessParams(
  2081. semantics,
  2082. /*delegate_treats_url_as_trustworthy=*/false,
  2083. CookieSamePartyStatus::kNoSamePartyEnforcement))
  2084. .status.HasWarningReason(
  2085. CookieInclusionStatus::
  2086. WARN_CROSS_SITE_REDIRECT_DOWNGRADE_CHANGES_INCLUSION),
  2087. test.expect_cross_site_redirect_warning);
  2088. // SameSite warnings not applied if other exclusion reasons apply (e.g.
  2089. // non-https with Secure attribute).
  2090. EXPECT_FALSE(
  2091. cookie
  2092. ->IncludeForRequestURL(
  2093. insecure_url, options,
  2094. CookieAccessParams(
  2095. semantics,
  2096. /*delegate_treats_url_as_trustworthy=*/false,
  2097. CookieSamePartyStatus::kNoSamePartyEnforcement))
  2098. .status.HasWarningReason(
  2099. CookieInclusionStatus::
  2100. WARN_CROSS_SITE_REDIRECT_DOWNGRADE_CHANGES_INCLUSION));
  2101. }
  2102. }
  2103. }
  2104. }
  2105. TEST(CanonicalCookieTest, MultipleExclusionReasons) {
  2106. GURL url("http://www.not-secure.com/foo");
  2107. base::Time creation_time = base::Time::Now();
  2108. absl::optional<base::Time> server_time = absl::nullopt;
  2109. CookieOptions options;
  2110. options.set_exclude_httponly();
  2111. options.set_same_site_cookie_context(CookieOptions::SameSiteCookieContext(
  2112. CookieOptions::SameSiteCookieContext::ContextType::CROSS_SITE));
  2113. // Test IncludeForRequestURL()
  2114. // Note: This is a cookie that should never exist normally, because Create()
  2115. // would weed it out.
  2116. auto cookie1 = CanonicalCookie::CreateUnsafeCookieForTesting(
  2117. "name", "value", "other-domain.com", "/bar", creation_time, base::Time(),
  2118. base::Time(), base::Time(), true /* secure */, true /* httponly */,
  2119. CookieSameSite::STRICT_MODE, COOKIE_PRIORITY_DEFAULT, false);
  2120. EXPECT_THAT(
  2121. cookie1->IncludeForRequestURL(
  2122. url, options,
  2123. CookieAccessParams{CookieAccessSemantics::UNKNOWN,
  2124. /*delegate_treats_url_as_trustworthy=*/false,
  2125. CookieSamePartyStatus::kNoSamePartyEnforcement}),
  2126. MatchesCookieAccessResult(
  2127. CookieInclusionStatus::MakeFromReasonsForTesting({
  2128. CookieInclusionStatus::EXCLUDE_HTTP_ONLY,
  2129. CookieInclusionStatus::EXCLUDE_SECURE_ONLY,
  2130. CookieInclusionStatus::EXCLUDE_DOMAIN_MISMATCH,
  2131. CookieInclusionStatus::EXCLUDE_NOT_ON_PATH,
  2132. CookieInclusionStatus::EXCLUDE_SAMESITE_STRICT,
  2133. }),
  2134. _, _, false));
  2135. // Test Create()
  2136. CookieInclusionStatus create_status;
  2137. auto cookie2 = CanonicalCookie::Create(
  2138. url, "__Secure-notactuallysecure=value;Domain=some-other-domain.com",
  2139. creation_time, server_time, absl::nullopt /* cookie_partition_key */,
  2140. &create_status);
  2141. ASSERT_FALSE(cookie2);
  2142. EXPECT_TRUE(create_status.HasExactlyExclusionReasonsForTesting(
  2143. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX,
  2144. CookieInclusionStatus::EXCLUDE_INVALID_DOMAIN}));
  2145. // Test IsSetPermittedInContext()
  2146. auto cookie3 = CanonicalCookie::Create(
  2147. url, "name=value;HttpOnly;SameSite=Lax", creation_time, server_time,
  2148. absl::nullopt /* cookie_partition_key */);
  2149. ASSERT_TRUE(cookie3);
  2150. EXPECT_THAT(
  2151. cookie3->IsSetPermittedInContext(
  2152. url, options,
  2153. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  2154. false /* delegate_treats_url_as_trustworthy */,
  2155. CookieSamePartyStatus::kNoSamePartyEnforcement),
  2156. kCookieableSchemes),
  2157. MatchesCookieAccessResult(
  2158. CookieInclusionStatus::MakeFromReasonsForTesting(
  2159. {CookieInclusionStatus::EXCLUDE_HTTP_ONLY,
  2160. CookieInclusionStatus::EXCLUDE_SAMESITE_LAX}),
  2161. _, _, false));
  2162. }
  2163. TEST(CanonicalCookieTest, PartialCompare) {
  2164. GURL url("http://www.example.com");
  2165. base::Time creation_time = base::Time::Now();
  2166. absl::optional<base::Time> server_time = absl::nullopt;
  2167. std::unique_ptr<CanonicalCookie> cookie(
  2168. CanonicalCookie::Create(url, "a=b", creation_time, server_time,
  2169. absl::nullopt /* cookie_partition_key */));
  2170. std::unique_ptr<CanonicalCookie> cookie_different_path(
  2171. CanonicalCookie::Create(url, "a=b; path=/foo", creation_time, server_time,
  2172. absl::nullopt /* cookie_partition_key */));
  2173. std::unique_ptr<CanonicalCookie> cookie_different_value(
  2174. CanonicalCookie::Create(url, "a=c", creation_time, server_time,
  2175. absl::nullopt /* cookie_partition_key */));
  2176. // Cookie is equivalent to itself.
  2177. EXPECT_FALSE(cookie->PartialCompare(*cookie));
  2178. // Changing the path affects the ordering.
  2179. EXPECT_TRUE(cookie->PartialCompare(*cookie_different_path));
  2180. EXPECT_FALSE(cookie_different_path->PartialCompare(*cookie));
  2181. // Changing the value does not affect the ordering.
  2182. EXPECT_FALSE(cookie->PartialCompare(*cookie_different_value));
  2183. EXPECT_FALSE(cookie_different_value->PartialCompare(*cookie));
  2184. // Cookies identical for PartialCompare() are equivalent.
  2185. EXPECT_TRUE(cookie->IsEquivalent(*cookie_different_value));
  2186. EXPECT_TRUE(cookie->IsEquivalent(*cookie));
  2187. }
  2188. TEST(CanonicalCookieTest, SecureCookiePrefix) {
  2189. GURL https_url("https://www.example.test");
  2190. GURL http_url("http://www.example.test");
  2191. base::Time creation_time = base::Time::Now();
  2192. absl::optional<base::Time> server_time = absl::nullopt;
  2193. CookieInclusionStatus status;
  2194. // A __Secure- cookie must be Secure.
  2195. EXPECT_FALSE(CanonicalCookie::Create(
  2196. https_url, "__Secure-A=B", creation_time, server_time,
  2197. absl::nullopt /* cookie_partition_key */, &status));
  2198. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  2199. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  2200. EXPECT_FALSE(CanonicalCookie::Create(
  2201. https_url, "__Secure-A=B; httponly", creation_time, server_time,
  2202. absl::nullopt /* cookie_partition_key */, &status));
  2203. // (EXCLUDE_HTTP_ONLY would be fine, too)
  2204. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  2205. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  2206. // A typoed prefix does not have to be Secure.
  2207. EXPECT_TRUE(CanonicalCookie::Create(
  2208. https_url, "__secure-A=B; Secure", creation_time, server_time,
  2209. absl::nullopt /* cookie_partition_key */));
  2210. EXPECT_TRUE(CanonicalCookie::Create(
  2211. https_url, "__secure-A=C;", creation_time, server_time,
  2212. absl::nullopt /* cookie_partition_key */));
  2213. EXPECT_TRUE(CanonicalCookie::Create(
  2214. https_url, "__SecureA=B; Secure", creation_time, server_time,
  2215. absl::nullopt /* cookie_partition_key */));
  2216. EXPECT_TRUE(CanonicalCookie::Create(
  2217. https_url, "__SecureA=C;", creation_time, server_time,
  2218. absl::nullopt /* cookie_partition_key */));
  2219. // A __Secure- cookie can't be set on a non-secure origin.
  2220. EXPECT_FALSE(CanonicalCookie::Create(
  2221. http_url, "__Secure-A=B; Secure", creation_time, server_time,
  2222. absl::nullopt /* cookie_partition_key */, &status));
  2223. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  2224. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  2225. // Hidden __Secure- prefixes should be rejected.
  2226. EXPECT_FALSE(CanonicalCookie::Create(
  2227. https_url, "=__Secure-A=B; Secure", creation_time, server_time,
  2228. absl::nullopt /* cookie_partition_key */, &status));
  2229. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  2230. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  2231. // While tricky, this isn't considered hidden and is fine.
  2232. EXPECT_TRUE(CanonicalCookie::Create(
  2233. https_url, "A=__Secure-A=B; Secure", creation_time, server_time,
  2234. absl::nullopt /* cookie_partition_key */));
  2235. }
  2236. TEST(CanonicalCookieTest, HostCookiePrefix) {
  2237. GURL https_url("https://www.example.test");
  2238. GURL http_url("http://www.example.test");
  2239. base::Time creation_time = base::Time::Now();
  2240. absl::optional<base::Time> server_time = absl::nullopt;
  2241. std::string domain = https_url.host();
  2242. CookieInclusionStatus status;
  2243. // A __Host- cookie must be Secure.
  2244. EXPECT_FALSE(CanonicalCookie::Create(
  2245. https_url, "__Host-A=B;", creation_time, server_time,
  2246. absl::nullopt /* cookie_partition_key */, &status));
  2247. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  2248. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  2249. EXPECT_FALSE(CanonicalCookie::Create(
  2250. https_url, "__Host-A=B; Domain=" + domain + "; Path=/;", creation_time,
  2251. server_time, absl::nullopt /* cookie_partition_key */, &status));
  2252. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  2253. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  2254. EXPECT_TRUE(CanonicalCookie::Create(
  2255. https_url, "__Host-A=B; Path=/; Secure;", creation_time, server_time,
  2256. absl::nullopt /* cookie_partition_key */));
  2257. // A __Host- cookie must be set from a secure scheme.
  2258. EXPECT_FALSE(CanonicalCookie::Create(
  2259. http_url, "__Host-A=B; Domain=" + domain + "; Path=/; Secure;",
  2260. creation_time, server_time, absl::nullopt /* cookie_partition_key */,
  2261. &status));
  2262. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  2263. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  2264. EXPECT_TRUE(CanonicalCookie::Create(
  2265. https_url, "__Host-A=B; Path=/; Secure;", creation_time, server_time,
  2266. absl::nullopt /* cookie_partition_key */));
  2267. // A __Host- cookie can't have a Domain.
  2268. EXPECT_FALSE(CanonicalCookie::Create(
  2269. https_url, "__Host-A=B; Domain=" + domain + "; Path=/; Secure;",
  2270. creation_time, server_time, absl::nullopt /* cookie_partition_key */,
  2271. &status));
  2272. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  2273. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  2274. EXPECT_FALSE(CanonicalCookie::Create(
  2275. https_url, "__Host-A=B; Domain=" + domain + "; Secure;", creation_time,
  2276. server_time, absl::nullopt /* cookie_partition_key */, &status));
  2277. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  2278. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  2279. // A __Host- cookie may have a domain if it's an IP address that matches the
  2280. // URL.
  2281. EXPECT_TRUE(CanonicalCookie::Create(
  2282. GURL("https://127.0.0.1"),
  2283. "__Host-A=B; Domain=127.0.0.1; Path=/; Secure;", creation_time,
  2284. server_time, absl::nullopt /* cookie_partition_key */, &status));
  2285. // A __Host- cookie with an IP address domain does not need the domain
  2286. // attribute specified explicitly (just like a normal domain).
  2287. EXPECT_TRUE(CanonicalCookie::Create(
  2288. GURL("https://127.0.0.1"), "__Host-A=B; Domain=; Path=/; Secure;",
  2289. creation_time, server_time, absl::nullopt /* cookie_partition_key */,
  2290. &status));
  2291. // A __Host- cookie must have a Path of "/".
  2292. EXPECT_FALSE(CanonicalCookie::Create(
  2293. https_url, "__Host-A=B; Path=/foo; Secure;", creation_time, server_time,
  2294. absl::nullopt /* cookie_partition_key */, &status));
  2295. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  2296. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  2297. EXPECT_FALSE(CanonicalCookie::Create(
  2298. https_url, "__Host-A=B; Secure;", creation_time, server_time,
  2299. absl::nullopt /* cookie_partition_key */, &status));
  2300. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  2301. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  2302. EXPECT_TRUE(CanonicalCookie::Create(
  2303. https_url, "__Host-A=B; Secure; Path=/;", creation_time, server_time,
  2304. absl::nullopt /* cookie_partition_key */));
  2305. // Rules don't apply for a typoed prefix.
  2306. EXPECT_TRUE(CanonicalCookie::Create(
  2307. http_url, "__host-A=B; Domain=" + domain + "; Path=/;", creation_time,
  2308. server_time, absl::nullopt /* cookie_partition_key */));
  2309. EXPECT_TRUE(CanonicalCookie::Create(
  2310. https_url, "__HostA=B; Domain=" + domain + "; Secure;", creation_time,
  2311. server_time, absl::nullopt /* cookie_partition_key */));
  2312. // Hidden __Host- prefixes should be rejected.
  2313. EXPECT_FALSE(CanonicalCookie::Create(
  2314. https_url, "=__Host-A=B; Path=/; Secure;", creation_time, server_time,
  2315. absl::nullopt /* cookie_partition_key */, &status));
  2316. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  2317. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  2318. // While tricky, this isn't considered hidden and is fine.
  2319. EXPECT_TRUE(CanonicalCookie::Create(
  2320. https_url, "A=__Host-A=B; Path=/; Secure;", creation_time, server_time,
  2321. absl::nullopt /* cookie_partition_key */));
  2322. }
  2323. TEST(CanonicalCookieTest, CanCreateSecureCookiesFromAnyScheme) {
  2324. GURL http_url("http://www.example.com");
  2325. GURL https_url("https://www.example.com");
  2326. base::Time creation_time = base::Time::Now();
  2327. absl::optional<base::Time> server_time = absl::nullopt;
  2328. std::unique_ptr<CanonicalCookie> http_cookie_no_secure(
  2329. CanonicalCookie::Create(http_url, "a=b", creation_time, server_time,
  2330. absl::nullopt /* cookie_partition_key */));
  2331. std::unique_ptr<CanonicalCookie> http_cookie_secure(CanonicalCookie::Create(
  2332. http_url, "a=b; Secure", creation_time, server_time,
  2333. absl::nullopt /* cookie_partition_key */));
  2334. std::unique_ptr<CanonicalCookie> https_cookie_no_secure(
  2335. CanonicalCookie::Create(https_url, "a=b", creation_time, server_time,
  2336. absl::nullopt /* cookie_partition_key */));
  2337. std::unique_ptr<CanonicalCookie> https_cookie_secure(CanonicalCookie::Create(
  2338. https_url, "a=b; Secure", creation_time, server_time,
  2339. absl::nullopt /* cookie_partition_key */));
  2340. EXPECT_TRUE(http_cookie_no_secure.get());
  2341. EXPECT_TRUE(http_cookie_secure.get());
  2342. EXPECT_TRUE(https_cookie_no_secure.get());
  2343. EXPECT_TRUE(https_cookie_secure.get());
  2344. }
  2345. TEST(CanonicalCookieTest, IsCanonical) {
  2346. // Base correct template.
  2347. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2348. "A", "B", "x.y", "/path", base::Time(), base::Time(),
  2349. base::Time(), base::Time(), false, false,
  2350. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2351. ->IsCanonical());
  2352. // Newline in name.
  2353. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2354. "A\n", "B", "x.y", "/path", base::Time(), base::Time(),
  2355. base::Time(), base::Time(), false, false,
  2356. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2357. ->IsCanonical());
  2358. // Carriage return in name.
  2359. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2360. "A\r", "B", "x.y", "/path", base::Time(), base::Time(),
  2361. base::Time(), base::Time(), false, false,
  2362. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2363. ->IsCanonical());
  2364. // Null character in name.
  2365. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2366. std::string("A\0Z", 3), "B", "x.y", "/path", base::Time(),
  2367. base::Time(), base::Time(), base::Time(), false, false,
  2368. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2369. ->IsCanonical());
  2370. // Name begins with whitespace.
  2371. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2372. " A", "B", "x.y", "/path", base::Time(), base::Time(),
  2373. base::Time(), base::Time(), false, false,
  2374. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2375. ->IsCanonical());
  2376. // Name ends with whitespace.
  2377. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2378. "A ", "B", "x.y", "/path", base::Time(), base::Time(),
  2379. base::Time(), base::Time(), false, false,
  2380. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2381. ->IsCanonical());
  2382. // Empty name. (Note this is against the spec but compatible with other
  2383. // browsers.)
  2384. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2385. "", "B", "x.y", "/path", base::Time(), base::Time(),
  2386. base::Time(), base::Time(), false, false,
  2387. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2388. ->IsCanonical());
  2389. // Space in name
  2390. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2391. "A C", "B", "x.y", "/path", base::Time(), base::Time(),
  2392. base::Time(), base::Time(), false, false,
  2393. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2394. ->IsCanonical());
  2395. // Extra space suffixing name.
  2396. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2397. "A ", "B", "x.y", "/path", base::Time(), base::Time(),
  2398. base::Time(), base::Time(), false, false,
  2399. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2400. ->IsCanonical());
  2401. // '=' character in name.
  2402. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2403. "A=", "B", "x.y", "/path", base::Time(), base::Time(),
  2404. base::Time(), base::Time(), false, false,
  2405. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2406. ->IsCanonical());
  2407. // Separator in name.
  2408. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2409. "A;", "B", "x.y", "/path", base::Time(), base::Time(),
  2410. base::Time(), base::Time(), false, false,
  2411. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2412. ->IsCanonical());
  2413. // '=' character in value.
  2414. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2415. "A", "B=", "x.y", "/path", base::Time(), base::Time(),
  2416. base::Time(), base::Time(), false, false,
  2417. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2418. ->IsCanonical());
  2419. // Separator in value.
  2420. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2421. "A", "B;", "x.y", "/path", base::Time(), base::Time(),
  2422. base::Time(), base::Time(), false, false,
  2423. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2424. ->IsCanonical());
  2425. // Separator in domain.
  2426. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2427. "A", "B", ";x.y", "/path", base::Time(), base::Time(),
  2428. base::Time(), base::Time(), false, false,
  2429. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2430. ->IsCanonical());
  2431. // Garbage in domain.
  2432. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2433. "A", "B", "@:&", "/path", base::Time(), base::Time(),
  2434. base::Time(), base::Time(), false, false,
  2435. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2436. ->IsCanonical());
  2437. // Space in domain.
  2438. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2439. "A", "B", "x.y ", "/path", base::Time(), base::Time(),
  2440. base::Time(), base::Time(), false, false,
  2441. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2442. ->IsCanonical());
  2443. // Empty domain. (This is against cookie spec, but needed for Chrome's
  2444. // out-of-spec use of cookies for extensions; see http://crbug.com/730633.
  2445. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2446. "A", "B", "", "/path", base::Time(), base::Time(),
  2447. base::Time(), base::Time(), false, false,
  2448. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2449. ->IsCanonical());
  2450. // Path does not start with a "/".
  2451. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2452. "A", "B", "x.y", "path", base::Time(), base::Time(),
  2453. base::Time(), base::Time(), false, false,
  2454. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2455. ->IsCanonical());
  2456. // Empty path.
  2457. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2458. "A", "B", "x.y", "", base::Time(), base::Time(),
  2459. base::Time(), base::Time(), false, false,
  2460. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2461. ->IsCanonical());
  2462. // "localhost" as domain.
  2463. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2464. "A", "B", "localhost", "/path", base::Time(), base::Time(),
  2465. base::Time(), base::Time(), false, false,
  2466. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2467. ->IsCanonical());
  2468. // non-ASCII domain.
  2469. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2470. "A", "B", "\xC3\xA9xample.com", "/path", base::Time(),
  2471. base::Time(), base::Time(), base::Time(), false, false,
  2472. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2473. ->IsCanonical());
  2474. // punycode domain.
  2475. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2476. "A", "B", "xn--xample-9ua.com", "/path", base::Time(),
  2477. base::Time(), base::Time(), base::Time(), false, false,
  2478. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2479. ->IsCanonical());
  2480. // Localhost IPv4 address as domain.
  2481. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2482. "A", "B", "127.0.0.1", "/path", base::Time(), base::Time(),
  2483. base::Time(), base::Time(), false, false,
  2484. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2485. ->IsCanonical());
  2486. // Simple IPv4 address as domain.
  2487. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2488. "A", "B", "1.2.3.4", "/path", base::Time(), base::Time(),
  2489. base::Time(), base::Time(), false, false,
  2490. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2491. ->IsCanonical());
  2492. // period-prefixed IPv4 address as domain.
  2493. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2494. "A", "B", ".1.3.2.4", "/path", base::Time(), base::Time(),
  2495. base::Time(), base::Time(), false, false,
  2496. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2497. ->IsCanonical());
  2498. // period-prefixed truncated IPv4 address as domain.
  2499. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2500. "A", "B", ".3.2.4", "/path", base::Time(), base::Time(),
  2501. base::Time(), base::Time(), true, false,
  2502. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2503. ->IsCanonical());
  2504. // truncated IPv4 address as domain.
  2505. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2506. "A", "B", "3.2.4", "/path", base::Time(), base::Time(),
  2507. base::Time(), base::Time(), true, false,
  2508. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2509. ->IsCanonical());
  2510. // Non-canonical IPv4 address as domain.
  2511. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2512. "A", "B", "01.2.03.4", "/path", base::Time(), base::Time(),
  2513. base::Time(), base::Time(), false, false,
  2514. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2515. ->IsCanonical());
  2516. // Non-canonical IPv4 address as domain.
  2517. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2518. "A", "B", "16843009", "/path", base::Time(), base::Time(),
  2519. base::Time(), base::Time(), false, false,
  2520. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2521. ->IsCanonical());
  2522. // Non-canonical IPv4 address as domain.
  2523. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2524. "A", "B", "0x1010101", "/path", base::Time(), base::Time(),
  2525. base::Time(), base::Time(), false, false,
  2526. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2527. ->IsCanonical());
  2528. // Null IPv6 address as domain.
  2529. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2530. "A", "B", "[::]", "/path", base::Time(), base::Time(),
  2531. base::Time(), base::Time(), false, false,
  2532. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2533. ->IsCanonical());
  2534. // Localhost IPv6 address as domain.
  2535. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2536. "A", "B", "[::1]", "/path", base::Time(), base::Time(),
  2537. base::Time(), base::Time(), false, false,
  2538. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2539. ->IsCanonical());
  2540. // Fully speced IPv6 address as domain.
  2541. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2542. "A", "B", "[2001:0DB8:AC10:FE01:0000:0000:0000:0000]",
  2543. "/path", base::Time(), base::Time(), base::Time(),
  2544. base::Time(), false, false, CookieSameSite::NO_RESTRICTION,
  2545. COOKIE_PRIORITY_LOW, false)
  2546. ->IsCanonical());
  2547. // Zero abbreviated IPv6 address as domain. Not canonical because of leading
  2548. // zeros & uppercase hex letters.
  2549. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2550. "A", "B", "[2001:0DB8:AC10:FE01::]", "/path", base::Time(),
  2551. base::Time(), base::Time(), base::Time(), false, false,
  2552. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2553. ->IsCanonical());
  2554. // Zero prefixes removed IPv6 address as domain. Not canoncial because of
  2555. // uppercase hex letters.
  2556. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2557. "A", "B", "[2001:DB8:AC10:FE01::]", "/path", base::Time(),
  2558. base::Time(), base::Time(), base::Time(), false, false,
  2559. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2560. ->IsCanonical());
  2561. // Lowercased hex IPv6 address as domain.
  2562. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2563. "A", "B", "[2001:db8:ac10:fe01::]", "/path", base::Time(),
  2564. base::Time(), base::Time(), base::Time(), false, false,
  2565. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2566. ->IsCanonical());
  2567. // Lowercased hex IPv6 address as domain for domain cookie.
  2568. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2569. "A", "B", ".[2001:db8:ac10:fe01::]", "/path", base::Time(),
  2570. base::Time(), base::Time(), base::Time(), false, false,
  2571. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2572. ->IsCanonical());
  2573. // Incomplete lowercased hex IPv6 address as domain.
  2574. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2575. "A", "B", "[2001:db8:ac10:fe01:]", "/path", base::Time(),
  2576. base::Time(), base::Time(), base::Time(), false, false,
  2577. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2578. ->IsCanonical());
  2579. // Missing square brackets in IPv6 address as domain.
  2580. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2581. "A", "B", "2606:2800:220:1:248:1893:25c8:1946", "/path",
  2582. base::Time(), base::Time(), base::Time(), base::Time(),
  2583. false, false, CookieSameSite::NO_RESTRICTION,
  2584. COOKIE_PRIORITY_LOW, false)
  2585. ->IsCanonical());
  2586. // Properly formatted host cookie.
  2587. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2588. "__Host-A", "B", "x.y", "/", base::Time(), base::Time(),
  2589. base::Time(), base::Time(), true, false,
  2590. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2591. ->IsCanonical());
  2592. // Insecure host cookie.
  2593. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2594. "__Host-A", "B", "x.y", "/", base::Time(), base::Time(),
  2595. base::Time(), base::Time(), false, false,
  2596. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2597. ->IsCanonical());
  2598. // Host cookie with non-null path.
  2599. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2600. "__Host-A", "B", "x.y", "/path", base::Time(), base::Time(),
  2601. base::Time(), base::Time(), true, false,
  2602. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2603. ->IsCanonical());
  2604. // Host cookie with empty domain.
  2605. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2606. "__Host-A", "B", "", "/", base::Time(), base::Time(),
  2607. base::Time(), base::Time(), true, false,
  2608. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2609. ->IsCanonical());
  2610. // Host cookie with period prefixed domain.
  2611. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2612. "__Host-A", "B", ".x.y", "/", base::Time(), base::Time(),
  2613. base::Time(), base::Time(), true, false,
  2614. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2615. ->IsCanonical());
  2616. // Properly formatted secure cookie.
  2617. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2618. "__Secure-A", "B", "x.y", "/", base::Time(), base::Time(),
  2619. base::Time(), base::Time(), true, false,
  2620. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2621. ->IsCanonical());
  2622. // Insecure secure cookie.
  2623. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2624. "__Secure-A", "B", "x.y", "/", base::Time(), base::Time(),
  2625. base::Time(), base::Time(), false, false,
  2626. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2627. ->IsCanonical());
  2628. // SameParty attribute used correctly (with Secure and non-Strict SameSite).
  2629. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2630. "A", "B", "x.y", "/", base::Time(), base::Time(),
  2631. base::Time(), base::Time(), true, false,
  2632. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, true)
  2633. ->IsCanonical());
  2634. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2635. "A", "B", "x.y", "/", base::Time(), base::Time(),
  2636. base::Time(), base::Time(), true, false,
  2637. CookieSameSite::UNSPECIFIED, COOKIE_PRIORITY_LOW, true)
  2638. ->IsCanonical());
  2639. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2640. "A", "B", "x.y", "/", base::Time(), base::Time(),
  2641. base::Time(), base::Time(), true, false,
  2642. CookieSameSite::LAX_MODE, COOKIE_PRIORITY_LOW, true)
  2643. ->IsCanonical());
  2644. // SameParty without Secure is not canonical.
  2645. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2646. "A", "B", "x.y", "/", base::Time(), base::Time(),
  2647. base::Time(), base::Time(), false, false,
  2648. CookieSameSite::LAX_MODE, COOKIE_PRIORITY_LOW, true)
  2649. ->IsCanonical());
  2650. // SameParty with SameSite=Strict is not canonical.
  2651. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2652. "A", "B", "x.y", "/", base::Time(), base::Time(),
  2653. base::Time(), base::Time(), true, false,
  2654. CookieSameSite::STRICT_MODE, COOKIE_PRIORITY_LOW, true)
  2655. ->IsCanonical());
  2656. // Partitioned attribute used correctly (__Host- prefix, no SameParty).
  2657. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2658. "__Host-A", "B", "x.y", "/", base::Time(), base::Time(),
  2659. base::Time(), base::Time(), /*secure=*/true,
  2660. /*httponly=*/false, CookieSameSite::UNSPECIFIED,
  2661. COOKIE_PRIORITY_LOW,
  2662. /*same_party=*/false,
  2663. CookiePartitionKey::FromURLForTesting(
  2664. GURL("https://toplevelsite.com")))
  2665. ->IsCanonical());
  2666. // Partitioned attribute with no __Host- prefix is still valid if it has
  2667. // Secure, Path=/, and no Domain.
  2668. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2669. "A", "B", "x.y", "/", base::Time(), base::Time(),
  2670. base::Time(), base::Time(), /*secure=*/true,
  2671. /*httponly=*/false, CookieSameSite::UNSPECIFIED,
  2672. COOKIE_PRIORITY_LOW,
  2673. /*same_party=*/false,
  2674. CookiePartitionKey::FromURLForTesting(
  2675. GURL("https://toplevelsite.com")))
  2676. ->IsCanonical());
  2677. // Partitioned attribute invalid, not Secure.
  2678. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2679. "A", "B", "x.y", "/", base::Time(), base::Time(),
  2680. base::Time(), base::Time(), /*secure=*/false,
  2681. /*httponly=*/false, CookieSameSite::UNSPECIFIED,
  2682. COOKIE_PRIORITY_LOW,
  2683. /*same_party=*/false,
  2684. CookiePartitionKey::FromURLForTesting(
  2685. GURL("https://toplevelsite.com")))
  2686. ->IsCanonical());
  2687. // Partitioned attribute is valid when Path != "/".
  2688. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2689. "A", "B", "x.y", "/foo/bar", base::Time(), base::Time(),
  2690. base::Time(), base::Time(), /*secure=*/true,
  2691. /*httponly=*/false, CookieSameSite::UNSPECIFIED,
  2692. COOKIE_PRIORITY_LOW,
  2693. /*same_party=*/false,
  2694. CookiePartitionKey::FromURLForTesting(
  2695. GURL("https://toplevelsite.com")))
  2696. ->IsCanonical());
  2697. // Partitioned attribute is valid when Domain attribute also included.
  2698. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2699. "A", "B", ".x.y", "/", base::Time(), base::Time(),
  2700. base::Time(), base::Time(), /*secure=*/true,
  2701. /*httponly=*/false, CookieSameSite::UNSPECIFIED,
  2702. COOKIE_PRIORITY_LOW,
  2703. /*same_party=*/false,
  2704. CookiePartitionKey::FromURLForTesting(
  2705. GURL("https://toplevelsite.com")))
  2706. ->IsCanonical());
  2707. // Hidden cookie prefixes.
  2708. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2709. "", "__Secure-a=b", "x.y", "/", base::Time(), base::Time(),
  2710. base::Time(), base::Time(), true, false,
  2711. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2712. ->IsCanonical());
  2713. EXPECT_FALSE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2714. "", "__Host-a=b", "x.y", "/", base::Time(), base::Time(),
  2715. base::Time(), base::Time(), true, false,
  2716. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2717. ->IsCanonical());
  2718. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2719. "a", "__Secure-a=b", "x.y", "/", base::Time(), base::Time(),
  2720. base::Time(), base::Time(), true, false,
  2721. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2722. ->IsCanonical());
  2723. EXPECT_TRUE(CanonicalCookie::CreateUnsafeCookieForTesting(
  2724. "a", "__Host-a=b", "x.y", "/", base::Time(), base::Time(),
  2725. base::Time(), base::Time(), true, false,
  2726. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW, false)
  2727. ->IsCanonical());
  2728. }
  2729. TEST(CanonicalCookieTest, TestSetCreationDate) {
  2730. auto cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  2731. "A", "B", "x.y", "/path", base::Time(), base::Time(), base::Time(),
  2732. base::Time(), false, false, CookieSameSite::NO_RESTRICTION,
  2733. COOKIE_PRIORITY_LOW, false);
  2734. EXPECT_TRUE(cookie->CreationDate().is_null());
  2735. base::Time now(base::Time::Now());
  2736. cookie->SetCreationDate(now);
  2737. EXPECT_EQ(now, cookie->CreationDate());
  2738. }
  2739. TEST(CanonicalCookieTest, TestPrefixHistograms) {
  2740. base::HistogramTester histograms;
  2741. const char kCookiePrefixHistogram[] = "Cookie.CookiePrefix";
  2742. GURL https_url("https://www.example.test");
  2743. base::Time creation_time = base::Time::Now();
  2744. absl::optional<base::Time> server_time = absl::nullopt;
  2745. EXPECT_FALSE(CanonicalCookie::Create(
  2746. https_url, "__Host-A=B;", creation_time, server_time,
  2747. absl::nullopt /* cookie_partition_key */));
  2748. histograms.ExpectBucketCount(kCookiePrefixHistogram,
  2749. CanonicalCookie::COOKIE_PREFIX_HOST, 1);
  2750. EXPECT_TRUE(CanonicalCookie::Create(
  2751. https_url, "__Host-A=B; Path=/; Secure", creation_time, server_time,
  2752. absl::nullopt /* cookie_partition_key */));
  2753. histograms.ExpectBucketCount(kCookiePrefixHistogram,
  2754. CanonicalCookie::COOKIE_PREFIX_HOST, 2);
  2755. EXPECT_TRUE(CanonicalCookie::Create(
  2756. https_url, "__HostA=B; Path=/; Secure", creation_time, server_time,
  2757. absl::nullopt /* cookie_partition_key */));
  2758. histograms.ExpectBucketCount(kCookiePrefixHistogram,
  2759. CanonicalCookie::COOKIE_PREFIX_HOST, 2);
  2760. EXPECT_FALSE(CanonicalCookie::Create(
  2761. https_url, "__Secure-A=B;", creation_time, server_time,
  2762. absl::nullopt /* cookie_partition_key */));
  2763. histograms.ExpectBucketCount(kCookiePrefixHistogram,
  2764. CanonicalCookie::COOKIE_PREFIX_SECURE, 1);
  2765. EXPECT_TRUE(CanonicalCookie::Create(
  2766. https_url, "__Secure-A=B; Path=/; Secure", creation_time, server_time,
  2767. absl::nullopt /* cookie_partition_key */));
  2768. histograms.ExpectBucketCount(kCookiePrefixHistogram,
  2769. CanonicalCookie::COOKIE_PREFIX_SECURE, 2);
  2770. EXPECT_TRUE(CanonicalCookie::Create(
  2771. https_url, "__SecureA=B; Path=/; Secure", creation_time, server_time,
  2772. absl::nullopt /* cookie_partition_key */));
  2773. histograms.ExpectBucketCount(kCookiePrefixHistogram,
  2774. CanonicalCookie::COOKIE_PREFIX_SECURE, 2);
  2775. }
  2776. TEST(CanonicalCookieTest, BuildCookieLine) {
  2777. std::vector<std::unique_ptr<CanonicalCookie>> cookies;
  2778. GURL url("https://example.com/");
  2779. base::Time now = base::Time::Now();
  2780. absl::optional<base::Time> server_time = absl::nullopt;
  2781. MatchCookieLineToVector("", cookies);
  2782. cookies.push_back(CanonicalCookie::Create(
  2783. url, "A=B", now, server_time, absl::nullopt /* cookie_partition_key */));
  2784. MatchCookieLineToVector("A=B", cookies);
  2785. // Nameless cookies are sent back without a prefixed '='.
  2786. cookies.push_back(CanonicalCookie::Create(
  2787. url, "C", now, server_time, absl::nullopt /* cookie_partition_key */));
  2788. MatchCookieLineToVector("A=B; C", cookies);
  2789. // Cookies separated by ';'.
  2790. cookies.push_back(CanonicalCookie::Create(
  2791. url, "D=E", now, server_time, absl::nullopt /* cookie_partition_key */));
  2792. MatchCookieLineToVector("A=B; C; D=E", cookies);
  2793. // BuildCookieLine doesn't reorder the list, it relies on the caller to do so.
  2794. cookies.push_back(
  2795. CanonicalCookie::Create(url, "F=G", now - base::Seconds(1), server_time,
  2796. absl::nullopt /* cookie_partition_key */));
  2797. MatchCookieLineToVector("A=B; C; D=E; F=G", cookies);
  2798. // BuildCookieLine doesn't deduplicate.
  2799. cookies.push_back(
  2800. CanonicalCookie::Create(url, "D=E", now - base::Seconds(2), server_time,
  2801. absl::nullopt /* cookie_partition_key */));
  2802. MatchCookieLineToVector("A=B; C; D=E; F=G; D=E", cookies);
  2803. // BuildCookieLine should match the spec in the case of an empty name with a
  2804. // value containing an equal sign (even if it currently produces "invalid"
  2805. // cookie lines).
  2806. cookies.push_back(CanonicalCookie::Create(
  2807. url, "=H=I", now, server_time, absl::nullopt /* cookie_partition_key */));
  2808. MatchCookieLineToVector("A=B; C; D=E; F=G; D=E; H=I", cookies);
  2809. }
  2810. TEST(CanonicalCookieTest, BuildCookieAttributesLine) {
  2811. std::unique_ptr<CanonicalCookie> cookie;
  2812. GURL url("https://example.com/");
  2813. base::Time now = base::Time::Now();
  2814. absl::optional<base::Time> server_time = absl::nullopt;
  2815. cookie = CanonicalCookie::Create(url, "A=B", now, server_time,
  2816. absl::nullopt /* cookie_partition_key */);
  2817. EXPECT_EQ("A=B; domain=example.com; path=/",
  2818. CanonicalCookie::BuildCookieAttributesLine(*cookie));
  2819. // Nameless cookies are sent back without a prefixed '='.
  2820. cookie = CanonicalCookie::Create(url, "C", now, server_time,
  2821. absl::nullopt /* cookie_partition_key */);
  2822. EXPECT_EQ("C; domain=example.com; path=/",
  2823. CanonicalCookie::BuildCookieAttributesLine(*cookie));
  2824. // BuildCookieAttributesLine should match the spec in the case of an empty
  2825. // name with a value containing an equal sign (even if it currently produces
  2826. // "invalid" cookie lines).
  2827. cookie = CanonicalCookie::Create(url, "=H=I", now, server_time,
  2828. absl::nullopt /* cookie_partition_key */);
  2829. EXPECT_EQ("H=I; domain=example.com; path=/",
  2830. CanonicalCookie::BuildCookieAttributesLine(*cookie));
  2831. // BuildCookieAttributesLine should include all attributes.
  2832. cookie = CanonicalCookie::Create(
  2833. url, "A=B; domain=.example.com; path=/; secure; httponly; samesite=lax",
  2834. now, server_time, absl::nullopt /* cookie_partition_key */);
  2835. EXPECT_EQ("A=B; domain=.example.com; path=/; secure; httponly; samesite=lax",
  2836. CanonicalCookie::BuildCookieAttributesLine(*cookie));
  2837. }
  2838. // Confirm that input arguments are reflected in the output cookie.
  2839. TEST(CanonicalCookieTest, CreateSanitizedCookie_Inputs) {
  2840. base::Time two_hours_ago = base::Time::Now() - base::Hours(2);
  2841. base::Time one_hour_ago = base::Time::Now() - base::Hours(1);
  2842. base::Time one_hour_from_now = base::Time::Now() + base::Hours(1);
  2843. CookieInclusionStatus status;
  2844. std::unique_ptr<CanonicalCookie> cc;
  2845. cc = CanonicalCookie::CreateSanitizedCookie(
  2846. GURL("https://www.foo.com"), "A", "B", std::string(), "/foo",
  2847. base::Time(), base::Time(), base::Time(), false /*secure*/,
  2848. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  2849. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  2850. absl::nullopt /*partition_key*/, &status);
  2851. EXPECT_TRUE(cc);
  2852. EXPECT_EQ("A", cc->Name());
  2853. EXPECT_EQ("B", cc->Value());
  2854. EXPECT_EQ("www.foo.com", cc->Domain());
  2855. EXPECT_EQ("/foo", cc->Path());
  2856. EXPECT_EQ(base::Time(), cc->CreationDate());
  2857. EXPECT_EQ(base::Time(), cc->LastAccessDate());
  2858. EXPECT_EQ(base::Time(), cc->ExpiryDate());
  2859. EXPECT_FALSE(cc->IsSecure());
  2860. EXPECT_FALSE(cc->IsHttpOnly());
  2861. EXPECT_EQ(CookieSameSite::NO_RESTRICTION, cc->SameSite());
  2862. EXPECT_EQ(COOKIE_PRIORITY_MEDIUM, cc->Priority());
  2863. EXPECT_FALSE(cc->IsSameParty());
  2864. EXPECT_FALSE(cc->IsPartitioned());
  2865. EXPECT_FALSE(cc->IsDomainCookie());
  2866. EXPECT_TRUE(status.IsInclude());
  2867. // Creation date
  2868. cc = CanonicalCookie::CreateSanitizedCookie(
  2869. GURL("https://www.foo.com"), "A", "B", std::string(), "/foo",
  2870. two_hours_ago, base::Time(), base::Time(), false /*secure*/,
  2871. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  2872. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  2873. absl::nullopt /*partition_key*/, &status);
  2874. EXPECT_TRUE(cc);
  2875. EXPECT_EQ(two_hours_ago, cc->CreationDate());
  2876. EXPECT_TRUE(status.IsInclude());
  2877. // Last access date
  2878. cc = CanonicalCookie::CreateSanitizedCookie(
  2879. GURL("https://www.foo.com"), "A", "B", std::string(), "/foo",
  2880. two_hours_ago, base::Time(), one_hour_ago, false /*secure*/,
  2881. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  2882. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  2883. absl::nullopt /*partition_key*/, &status);
  2884. EXPECT_TRUE(cc);
  2885. EXPECT_EQ(one_hour_ago, cc->LastAccessDate());
  2886. EXPECT_TRUE(status.IsInclude());
  2887. // Expiry
  2888. cc = CanonicalCookie::CreateSanitizedCookie(
  2889. GURL("https://www.foo.com"), "A", "B", std::string(), "/foo",
  2890. base::Time(), one_hour_from_now, base::Time(), false /*secure*/,
  2891. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  2892. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  2893. absl::nullopt /*partition_key*/, &status);
  2894. EXPECT_TRUE(cc);
  2895. EXPECT_EQ(one_hour_from_now, cc->ExpiryDate());
  2896. EXPECT_TRUE(status.IsInclude());
  2897. // Secure
  2898. cc = CanonicalCookie::CreateSanitizedCookie(
  2899. GURL("https://www.foo.com"), "A", "B", std::string(), "/foo",
  2900. base::Time(), base::Time(), base::Time(), true /*secure*/,
  2901. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  2902. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  2903. absl::nullopt /*partition_key*/, &status);
  2904. EXPECT_TRUE(cc);
  2905. EXPECT_TRUE(cc->IsSecure());
  2906. EXPECT_TRUE(status.IsInclude());
  2907. // Httponly
  2908. cc = CanonicalCookie::CreateSanitizedCookie(
  2909. GURL("https://www.foo.com"), "A", "B", std::string(), "/foo",
  2910. base::Time(), base::Time(), base::Time(), false /*secure*/,
  2911. true /*httponly*/, CookieSameSite::NO_RESTRICTION,
  2912. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  2913. absl::nullopt /*partition_key*/, &status);
  2914. EXPECT_TRUE(cc);
  2915. EXPECT_TRUE(cc->IsHttpOnly());
  2916. EXPECT_TRUE(status.IsInclude());
  2917. // Same site
  2918. cc = CanonicalCookie::CreateSanitizedCookie(
  2919. GURL("https://www.foo.com"), "A", "B", std::string(), "/foo",
  2920. base::Time(), base::Time(), base::Time(), false /*secure*/,
  2921. false /*httponly*/, CookieSameSite::LAX_MODE, COOKIE_PRIORITY_DEFAULT,
  2922. false /*same_party*/, absl::nullopt /*partition_key*/, &status);
  2923. EXPECT_TRUE(cc);
  2924. EXPECT_EQ(CookieSameSite::LAX_MODE, cc->SameSite());
  2925. EXPECT_TRUE(status.IsInclude());
  2926. // Priority
  2927. cc = CanonicalCookie::CreateSanitizedCookie(
  2928. GURL("https://www.foo.com"), "A", "B", std::string(), "/foo",
  2929. base::Time(), base::Time(), base::Time(), false /*secure*/,
  2930. false /*httponly*/, CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW,
  2931. false /*same_party*/, absl::nullopt /*partition_key*/, &status);
  2932. EXPECT_TRUE(cc);
  2933. EXPECT_EQ(COOKIE_PRIORITY_LOW, cc->Priority());
  2934. EXPECT_TRUE(status.IsInclude());
  2935. // Domain cookie
  2936. cc = CanonicalCookie::CreateSanitizedCookie(
  2937. GURL("https://www.foo.com"), "A", "B", "www.foo.com", "/foo",
  2938. base::Time(), base::Time(), base::Time(), false /*secure*/,
  2939. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  2940. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  2941. absl::nullopt /*partition_key*/, &status);
  2942. EXPECT_TRUE(cc);
  2943. EXPECT_TRUE(cc->IsDomainCookie());
  2944. EXPECT_TRUE(status.IsInclude());
  2945. // SameParty
  2946. cc = CanonicalCookie::CreateSanitizedCookie(
  2947. GURL("https://www.foo.com"), "A", "B", std::string(), "/foo",
  2948. base::Time(), base::Time(), base::Time(), true /*secure*/,
  2949. false /*httponly*/, CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW,
  2950. true /*same_party*/, absl::nullopt /*partition_key*/, &status);
  2951. EXPECT_TRUE(cc);
  2952. EXPECT_TRUE(cc->IsSameParty());
  2953. EXPECT_TRUE(status.IsInclude());
  2954. // Partitioned
  2955. cc = CanonicalCookie::CreateSanitizedCookie(
  2956. GURL("https://www.foo.com"), "__Host-A", "B", std::string(), "/",
  2957. base::Time(), base::Time(), base::Time(), true /*secure*/,
  2958. false /*httponly*/, CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_LOW,
  2959. false /*same_party*/,
  2960. CookiePartitionKey::FromURLForTesting(GURL("https://toplevelsite.com")),
  2961. &status);
  2962. EXPECT_TRUE(cc);
  2963. EXPECT_TRUE(cc->IsPartitioned());
  2964. EXPECT_TRUE(status.IsInclude());
  2965. }
  2966. // Make sure sanitization and blocking of cookies works correctly.
  2967. TEST(CanonicalCookieTest, CreateSanitizedCookie_Logic) {
  2968. base::Time two_hours_ago = base::Time::Now() - base::Hours(2);
  2969. base::Time one_hour_ago = base::Time::Now() - base::Hours(1);
  2970. base::Time one_hour_from_now = base::Time::Now() + base::Hours(1);
  2971. CookieInclusionStatus status;
  2972. // Simple path and domain variations.
  2973. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  2974. GURL("http://www.foo.com/foo"), "A", "B", std::string(), "/foo",
  2975. one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  2976. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  2977. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  2978. absl::nullopt /*partition_key*/, &status));
  2979. EXPECT_TRUE(status.IsInclude());
  2980. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  2981. GURL("http://www.foo.com/bar"), "C", "D", "www.foo.com", "/",
  2982. two_hours_ago, base::Time(), one_hour_ago, false /*secure*/,
  2983. true /*httponly*/, CookieSameSite::NO_RESTRICTION,
  2984. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  2985. absl::nullopt /*partition_key*/, &status));
  2986. EXPECT_TRUE(status.IsInclude());
  2987. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  2988. GURL("https://www.foo.com"), "E", "F", std::string(), std::string(),
  2989. base::Time(), base::Time(), base::Time(), true /*secure*/,
  2990. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  2991. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  2992. absl::nullopt /*partition_key*/, &status));
  2993. EXPECT_TRUE(status.IsInclude());
  2994. // Test the file:// protocol.
  2995. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  2996. GURL("file:///"), "A", "B", std::string(), "/foo", one_hour_ago,
  2997. one_hour_from_now, base::Time(), false /*secure*/, false /*httponly*/,
  2998. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  2999. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3000. EXPECT_TRUE(status.IsInclude());
  3001. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3002. GURL("file:///home/user/foo.txt"), "A", "B", std::string(), "/foo",
  3003. one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  3004. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3005. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3006. absl::nullopt /*partition_key*/, &status));
  3007. EXPECT_TRUE(status.IsInclude());
  3008. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3009. GURL("file:///home/user/foo.txt"), "A", "B", "home", "/foo", one_hour_ago,
  3010. one_hour_from_now, base::Time(), false /*secure*/, false /*httponly*/,
  3011. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  3012. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3013. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3014. {CookieInclusionStatus::EXCLUDE_INVALID_DOMAIN}));
  3015. // Test that malformed attributes fail to set the cookie.
  3016. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3017. GURL("http://www.foo.com/foo"), " A", "B", std::string(), "/foo",
  3018. base::Time(), base::Time(), base::Time(), false /*secure*/,
  3019. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3020. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3021. absl::nullopt /*partition_key*/, &status));
  3022. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3023. {CookieInclusionStatus::EXCLUDE_FAILURE_TO_STORE}));
  3024. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3025. GURL("http://www.foo.com/foo"), "A;", "B", std::string(), "/foo",
  3026. base::Time(), base::Time(), base::Time(), false /*secure*/,
  3027. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3028. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3029. absl::nullopt /*partition_key*/, &status));
  3030. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3031. {CookieInclusionStatus::EXCLUDE_FAILURE_TO_STORE}));
  3032. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3033. GURL("http://www.foo.com/foo"), "A=", "B", std::string(), "/foo",
  3034. base::Time(), base::Time(), base::Time(), false /*secure*/,
  3035. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3036. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3037. absl::nullopt /*partition_key*/, &status));
  3038. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3039. {CookieInclusionStatus::EXCLUDE_FAILURE_TO_STORE}));
  3040. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3041. GURL("http://www.foo.com/foo"), "A\x07", "B", std::string(), "/foo",
  3042. one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  3043. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3044. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3045. absl::nullopt /*partition_key*/, &status));
  3046. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3047. {CookieInclusionStatus::EXCLUDE_FAILURE_TO_STORE}));
  3048. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3049. GURL("http://www.foo.com"), "A", " B", std::string(), "/foo",
  3050. base::Time(), base::Time(), base::Time(), false /*secure*/,
  3051. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3052. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3053. absl::nullopt /*partition_key*/, &status));
  3054. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3055. {CookieInclusionStatus::EXCLUDE_FAILURE_TO_STORE}));
  3056. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3057. GURL("http://www.foo.com"), "A", "\x0fZ", std::string(), "/foo",
  3058. base::Time(), base::Time(), base::Time(), false /*secure*/,
  3059. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3060. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3061. absl::nullopt /*partition_key*/, &status));
  3062. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3063. {CookieInclusionStatus::EXCLUDE_FAILURE_TO_STORE}));
  3064. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3065. GURL("http://www.foo.com"), "A", "B", "www.foo.com ", "/foo",
  3066. base::Time(), base::Time(), base::Time(), false /*secure*/,
  3067. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3068. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3069. absl::nullopt /*partition_key*/, &status));
  3070. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3071. {CookieInclusionStatus::EXCLUDE_INVALID_DOMAIN}));
  3072. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3073. GURL("http://www.foo.com/foo"), "A", "B", "foo.ozzzzzzle", "/foo",
  3074. base::Time(), base::Time(), base::Time(), false /*secure*/,
  3075. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3076. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3077. absl::nullopt /*partition_key*/, &status));
  3078. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3079. {CookieInclusionStatus::EXCLUDE_INVALID_DOMAIN}));
  3080. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3081. GURL("http://www.foo.com/foo"), "A", "B", std::string(), "foo",
  3082. base::Time(), base::Time(), base::Time(), false /*secure*/,
  3083. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3084. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3085. absl::nullopt /*partition_key*/, &status));
  3086. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3087. {CookieInclusionStatus::EXCLUDE_FAILURE_TO_STORE}));
  3088. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3089. GURL("http://www.foo.com"), "A", "B", std::string(), "/foo ",
  3090. base::Time(), base::Time(), base::Time(), false /*secure*/,
  3091. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3092. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3093. absl::nullopt /*partition_key*/, &status));
  3094. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3095. {CookieInclusionStatus::EXCLUDE_FAILURE_TO_STORE}));
  3096. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3097. GURL("http://www.foo.com/foo"), "A", "B", "%2Efoo.com", "/foo",
  3098. one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  3099. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3100. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3101. absl::nullopt /*partition_key*/, &status));
  3102. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3103. {CookieInclusionStatus::EXCLUDE_INVALID_DOMAIN}));
  3104. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3105. GURL("http://domaintest.%E3%81%BF%E3%82%93%E3%81%AA"), "A", "B",
  3106. "domaintest.%E3%81%BF%E3%82%93%E3%81%AA", "/foo", base::Time(),
  3107. base::Time(), base::Time(), false /*secure*/, false /*httponly*/,
  3108. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  3109. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3110. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3111. {CookieInclusionStatus::EXCLUDE_INVALID_DOMAIN}));
  3112. std::unique_ptr<CanonicalCookie> cc;
  3113. // Confirm that setting domain cookies with or without leading periods,
  3114. // or on domains different from the URL's, functions correctly.
  3115. cc = CanonicalCookie::CreateSanitizedCookie(
  3116. GURL("http://www.foo.com/foo"), "A", "B", "www.foo.com", "/foo",
  3117. one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  3118. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3119. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3120. absl::nullopt /*partition_key*/, &status);
  3121. ASSERT_TRUE(cc);
  3122. EXPECT_TRUE(cc->IsDomainCookie());
  3123. EXPECT_EQ(".www.foo.com", cc->Domain());
  3124. EXPECT_TRUE(status.IsInclude());
  3125. cc = CanonicalCookie::CreateSanitizedCookie(
  3126. GURL("http://www.foo.com/foo"), "A", "B", ".www.foo.com", "/foo",
  3127. one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  3128. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3129. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3130. absl::nullopt /*partition_key*/, &status);
  3131. ASSERT_TRUE(cc);
  3132. EXPECT_TRUE(cc->IsDomainCookie());
  3133. EXPECT_EQ(".www.foo.com", cc->Domain());
  3134. EXPECT_TRUE(status.IsInclude());
  3135. cc = CanonicalCookie::CreateSanitizedCookie(
  3136. GURL("http://www.foo.com/foo"), "A", "B", ".foo.com", "/foo",
  3137. one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  3138. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3139. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3140. absl::nullopt /*partition_key*/, &status);
  3141. ASSERT_TRUE(cc);
  3142. EXPECT_TRUE(cc->IsDomainCookie());
  3143. EXPECT_EQ(".foo.com", cc->Domain());
  3144. EXPECT_TRUE(status.IsInclude());
  3145. cc = CanonicalCookie::CreateSanitizedCookie(
  3146. GURL("http://www.foo.com/foo"), "A", "B", ".www2.www.foo.com", "/foo",
  3147. one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  3148. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3149. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3150. absl::nullopt /*partition_key*/, &status);
  3151. EXPECT_FALSE(cc);
  3152. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3153. {CookieInclusionStatus::EXCLUDE_INVALID_DOMAIN}));
  3154. // Secure/URL Scheme mismatch.
  3155. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3156. GURL("http://www.foo.com"), "A", "B", std::string(), "/foo ",
  3157. base::Time(), base::Time(), base::Time(), true /*secure*/,
  3158. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3159. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3160. absl::nullopt /*partition_key*/, &status));
  3161. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3162. {CookieInclusionStatus::EXCLUDE_FAILURE_TO_STORE}));
  3163. // Null creation date/non-null last access date conflict.
  3164. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3165. GURL("http://www.foo.com"), "A", "B", std::string(), "/foo", base::Time(),
  3166. base::Time(), base::Time::Now(), false /*secure*/, false /*httponly*/,
  3167. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  3168. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3169. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3170. {CookieInclusionStatus::EXCLUDE_FAILURE_TO_STORE}));
  3171. // Domain doesn't match URL
  3172. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3173. GURL("http://www.foo.com"), "A", "B", "www.bar.com", "/", base::Time(),
  3174. base::Time(), base::Time(), false /*secure*/, false /*httponly*/,
  3175. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  3176. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3177. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3178. {CookieInclusionStatus::EXCLUDE_INVALID_DOMAIN}));
  3179. // Path with unusual characters escaped.
  3180. cc = CanonicalCookie::CreateSanitizedCookie(
  3181. GURL("http://www.foo.com"), "A", "B", std::string(), "/foo\x7F",
  3182. base::Time(), base::Time(), base::Time(), false /*secure*/,
  3183. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3184. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3185. absl::nullopt /*partition_key*/, &status);
  3186. ASSERT_TRUE(cc);
  3187. EXPECT_EQ("/foo%7F", cc->Path());
  3188. EXPECT_TRUE(status.IsInclude());
  3189. // Ensure that all characters get escaped the same on all platforms. This is
  3190. // also useful for visualizing which characters will actually be escaped.
  3191. std::stringstream ss;
  3192. ss << "/";
  3193. for (uint8_t character = 0; character < 0xFF; character++) {
  3194. // Skip any "terminating characters" that CreateSanitizedCookie does not
  3195. // allow to be in `path`.
  3196. if (character == '\0' || character == '\n' || character == '\r' ||
  3197. character == ';') {
  3198. continue;
  3199. }
  3200. ss << character;
  3201. }
  3202. ss << "\xFF";
  3203. std::string initial(ss.str());
  3204. std::string expected =
  3205. "/%01%02%03%04%05%06%07%08%09%0B%0C%0E%0F%10%11%12%13%14%15%16%17%18%19%"
  3206. "1A%1B%1C%1D%1E%1F%20!%22%23$%&'()*+,-./"
  3207. "0123456789:%3C=%3E%3F@ABCDEFGHIJKLMNOPQRSTUVWXYZ[/"
  3208. "]%5E_%60abcdefghijklmnopqrstuvwxyz%7B%7C%7D~%7F%80%81%82%83%84%85%86%87%"
  3209. "88%89%8A%8B%8C%8D%8E%8F%90%91%92%93%94%95%96%97%98%99%9A%9B%9C%9D%9E%9F%"
  3210. "A0%A1%A2%A3%A4%A5%A6%A7%A8%A9%AA%AB%AC%AD%AE%AF%B0%B1%B2%B3%B4%B5%B6%B7%"
  3211. "B8%B9%BA%BB%BC%BD%BE%BF%C0%C1%C2%C3%C4%C5%C6%C7%C8%C9%CA%CB%CC%CD%CE%CF%"
  3212. "D0%D1%D2%D3%D4%D5%D6%D7%D8%D9%DA%DB%DC%DD%DE%DF%E0%E1%E2%E3%E4%E5%E6%E7%"
  3213. "E8%E9%EA%EB%EC%ED%EE%EF%F0%F1%F2%F3%F4%F5%F6%F7%F8%F9%FA%FB%FC%FD%FE%FF";
  3214. cc = CanonicalCookie::CreateSanitizedCookie(
  3215. GURL("http://www.foo.com"), "A", "B", std::string(), initial,
  3216. base::Time(), base::Time(), base::Time(), false /*secure*/,
  3217. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3218. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3219. absl::nullopt /*partition_key*/, &status);
  3220. ASSERT_TRUE(cc);
  3221. EXPECT_EQ(expected, cc->Path());
  3222. EXPECT_TRUE(status.IsInclude());
  3223. // Empty name and value.
  3224. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3225. GURL("http://www.foo.com"), "", "", std::string(), "/", base::Time(),
  3226. base::Time(), base::Time(), false /*secure*/, false /*httponly*/,
  3227. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  3228. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3229. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3230. {CookieInclusionStatus::EXCLUDE_FAILURE_TO_STORE}));
  3231. // Check that value can contain an equal sign, even when no name is present.
  3232. // Note that in newer drafts of RFC6265bis, it is specified that a cookie with
  3233. // an empty name and a value containing an equal sign should result in a
  3234. // corresponding cookie line that omits the preceding equal sign. This means
  3235. // that the cookie line won't be deserialized into the original cookie in this
  3236. // case. For now, we'll test for compliance with the spec here, but we aim to
  3237. // collect metrics and hopefully fix this in the spec (and then in
  3238. // CanonicalCookie) at some point.
  3239. // For reference, see: https://github.com/httpwg/http-extensions/pull/1592
  3240. cc = CanonicalCookie::CreateSanitizedCookie(
  3241. GURL("http://www.foo.com"), "", "ambiguous=value", std::string(),
  3242. std::string(), base::Time(), base::Time(), base::Time(), false /*secure*/,
  3243. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3244. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3245. absl::nullopt /*partition_key*/, &status);
  3246. EXPECT_TRUE(cc);
  3247. std::vector<std::unique_ptr<CanonicalCookie>> cookies;
  3248. cookies.push_back(std::move(cc));
  3249. MatchCookieLineToVector("ambiguous=value", cookies);
  3250. // Check that name can't contain an equal sign ("ambiguous=name=value" should
  3251. // correctly be parsed as name: "ambiguous" and value "name=value", so
  3252. // allowing this case would result in cookies that can't serialize correctly).
  3253. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3254. GURL("http://www.foo.com"), "ambiguous=name", "value", std::string(),
  3255. std::string(), base::Time(), base::Time(), base::Time(), false /*secure*/,
  3256. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3257. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3258. absl::nullopt /*partition_key*/, &status));
  3259. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3260. {CookieInclusionStatus::EXCLUDE_FAILURE_TO_STORE}));
  3261. // A __Secure- cookie must be Secure.
  3262. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3263. GURL("https://www.foo.com"), "__Secure-A", "B", ".www.foo.com", "/",
  3264. two_hours_ago, one_hour_from_now, one_hour_ago, true, false,
  3265. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3266. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3267. EXPECT_TRUE(status.IsInclude());
  3268. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3269. GURL("https://www.foo.com"), "__Secure-A", "B", ".www.foo.com", "/",
  3270. two_hours_ago, one_hour_from_now, one_hour_ago, false, false,
  3271. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3272. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3273. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3274. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  3275. // A __Host- cookie must be Secure.
  3276. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3277. GURL("https://www.foo.com"), "__Host-A", "B", std::string(), "/",
  3278. two_hours_ago, one_hour_from_now, one_hour_ago, true, false,
  3279. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3280. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3281. EXPECT_TRUE(status.IsInclude());
  3282. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3283. GURL("https://www.foo.com"), "__Host-A", "B", std::string(), "/",
  3284. two_hours_ago, one_hour_from_now, one_hour_ago, false, false,
  3285. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3286. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3287. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3288. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  3289. // A __Host- cookie must have path "/".
  3290. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3291. GURL("https://www.foo.com"), "__Host-A", "B", std::string(), "/",
  3292. two_hours_ago, one_hour_from_now, one_hour_ago, true, false,
  3293. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3294. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3295. EXPECT_TRUE(status.IsInclude());
  3296. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3297. GURL("https://www.foo.com"), "__Host-A", "B", std::string(), "/foo",
  3298. two_hours_ago, one_hour_from_now, one_hour_ago, true, false,
  3299. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3300. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3301. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3302. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  3303. // A __Host- cookie must not specify a domain.
  3304. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3305. GURL("https://www.foo.com"), "__Host-A", "B", std::string(), "/",
  3306. two_hours_ago, one_hour_from_now, one_hour_ago, true, false,
  3307. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3308. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3309. EXPECT_TRUE(status.IsInclude());
  3310. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3311. GURL("https://www.foo.com"), "__Host-A", "B", ".www.foo.com", "/",
  3312. two_hours_ago, one_hour_from_now, one_hour_ago, true, false,
  3313. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3314. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3315. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3316. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  3317. // Without __Host- prefix, this is a valid host cookie because it does not
  3318. // specify a domain.
  3319. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3320. GURL("https://www.foo.com"), "A", "B", std::string(), "/", two_hours_ago,
  3321. one_hour_from_now, one_hour_ago, true, false,
  3322. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3323. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3324. EXPECT_TRUE(status.IsInclude());
  3325. // Without __Host- prefix, this is a valid domain (not host) cookie.
  3326. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3327. GURL("https://www.foo.com"), "A", "B", ".www.foo.com", "/", two_hours_ago,
  3328. one_hour_from_now, one_hour_ago, true, false,
  3329. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3330. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3331. EXPECT_TRUE(status.IsInclude());
  3332. // The __Host- prefix should not prevent otherwise-valid host cookies from
  3333. // being accepted.
  3334. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3335. GURL("https://127.0.0.1"), "A", "B", std::string(), "/", two_hours_ago,
  3336. one_hour_from_now, one_hour_ago, true, false,
  3337. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3338. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3339. EXPECT_TRUE(status.IsInclude());
  3340. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3341. GURL("https://127.0.0.1"), "__Host-A", "B", std::string(), "/",
  3342. two_hours_ago, one_hour_from_now, one_hour_ago, true, false,
  3343. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3344. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3345. EXPECT_TRUE(status.IsInclude());
  3346. // Host cookies should not specify domain unless it is an IP address that
  3347. // matches the URL.
  3348. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3349. GURL("https://127.0.0.1"), "A", "B", "127.0.0.1", "/", two_hours_ago,
  3350. one_hour_from_now, one_hour_ago, true, false,
  3351. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3352. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3353. EXPECT_TRUE(status.IsInclude());
  3354. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3355. GURL("https://127.0.0.1"), "__Host-A", "B", "127.0.0.1", "/",
  3356. two_hours_ago, one_hour_from_now, one_hour_ago, true, false,
  3357. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3358. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3359. EXPECT_TRUE(status.IsInclude());
  3360. // Cookies with hidden prefixes should be rejected.
  3361. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3362. GURL("https://www.foo.com"), "", "__Host-A=B", "", "/", two_hours_ago,
  3363. one_hour_from_now, one_hour_ago, true, false,
  3364. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3365. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3366. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3367. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  3368. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3369. GURL("https://www.foo.com"), "", "__Secure-A=B", "", "/", two_hours_ago,
  3370. one_hour_from_now, one_hour_ago, true, false,
  3371. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3372. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3373. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3374. {CookieInclusionStatus::EXCLUDE_INVALID_PREFIX}));
  3375. // While tricky, this aren't considered hidden prefixes and should succeed.
  3376. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3377. GURL("https://www.foo.com"), "A", "__Host-A=B", "", "/", two_hours_ago,
  3378. one_hour_from_now, one_hour_ago, true, false,
  3379. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3380. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3381. EXPECT_TRUE(status.IsInclude());
  3382. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3383. GURL("https://www.foo.com"), "A", "__Secure-A=B", "", "/", two_hours_ago,
  3384. one_hour_from_now, one_hour_ago, true, false,
  3385. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3386. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3387. EXPECT_TRUE(status.IsInclude());
  3388. // SameParty attribute requires Secure and forbids SameSite=Strict.
  3389. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3390. GURL("https://www.foo.com"), "A", "B", ".www.foo.com", "/", two_hours_ago,
  3391. one_hour_from_now, one_hour_ago, true /*secure*/, false,
  3392. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3393. true /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3394. EXPECT_TRUE(status.IsInclude());
  3395. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3396. GURL("https://www.foo.com"), "A", "B", ".www.foo.com", "/", two_hours_ago,
  3397. one_hour_from_now, one_hour_ago, false /*secure*/, false,
  3398. CookieSameSite::LAX_MODE, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3399. true /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3400. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3401. {CookieInclusionStatus::EXCLUDE_INVALID_SAMEPARTY}));
  3402. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3403. GURL("https://www.foo.com"), "A", "B", ".www.foo.com", "/", two_hours_ago,
  3404. one_hour_from_now, one_hour_ago, true /*secure*/, false,
  3405. CookieSameSite::STRICT_MODE, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3406. true /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3407. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3408. {CookieInclusionStatus::EXCLUDE_INVALID_SAMEPARTY}));
  3409. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3410. GURL("https://www.foo.com"), "A", "B", ".www.foo.com", "/", two_hours_ago,
  3411. one_hour_from_now, one_hour_ago, false /*secure*/, false,
  3412. CookieSameSite::STRICT_MODE, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3413. true /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3414. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3415. {CookieInclusionStatus::EXCLUDE_INVALID_SAMEPARTY}));
  3416. // Partitioned attribute requires __Host- and forbids SameParty.
  3417. status = CookieInclusionStatus();
  3418. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3419. GURL("https://www.foo.com"), "__Host-A", "B", std::string(), "/",
  3420. two_hours_ago, one_hour_from_now, one_hour_ago, true /*secure*/, false,
  3421. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3422. false /*same_party*/,
  3423. absl::optional<CookiePartitionKey>(CookiePartitionKey::FromURLForTesting(
  3424. GURL("https://toplevelsite.com"))),
  3425. &status));
  3426. EXPECT_TRUE(status.IsInclude());
  3427. // No __Host- prefix is still valid if the cookie still has Secure, Path=/,
  3428. // and no Domain.
  3429. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3430. GURL("https://www.foo.com"), "A", "B", std::string(), "/", two_hours_ago,
  3431. one_hour_from_now, one_hour_ago, true /*secure*/, false,
  3432. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3433. false /*same_party*/,
  3434. absl::optional<CookiePartitionKey>(CookiePartitionKey::FromURLForTesting(
  3435. GURL("https://toplevelsite.com"))),
  3436. &status));
  3437. EXPECT_TRUE(status.IsInclude());
  3438. status = CookieInclusionStatus();
  3439. // Invalid: Not Secure.
  3440. status = CookieInclusionStatus();
  3441. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3442. GURL("https://www.foo.com"), "A", "B", std::string(), "/", two_hours_ago,
  3443. one_hour_from_now, one_hour_ago, /*secure=*/false, /*http_only=*/false,
  3444. CookieSameSite::LAX_MODE, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3445. /*same_party=*/false,
  3446. absl::optional<CookiePartitionKey>(CookiePartitionKey::FromURLForTesting(
  3447. GURL("https://toplevelsite.com"))),
  3448. &status));
  3449. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3450. {CookieInclusionStatus::EXCLUDE_INVALID_PARTITIONED}));
  3451. // Invalid: invalid Path.
  3452. status = CookieInclusionStatus();
  3453. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3454. GURL("https://www.foo.com"), "A", "B", std::string(), "/foobar",
  3455. two_hours_ago, one_hour_from_now, one_hour_ago, /*secure=*/true,
  3456. /*http_only=*/false, CookieSameSite::NO_RESTRICTION,
  3457. CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3458. /*same_party=*/false,
  3459. absl::optional<CookiePartitionKey>(CookiePartitionKey::FromURLForTesting(
  3460. GURL("https://toplevelsite.com"))),
  3461. &status));
  3462. EXPECT_TRUE(status.IsInclude());
  3463. // Domain attribute present is still valid.
  3464. status = CookieInclusionStatus();
  3465. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3466. GURL("https://www.foo.com"), "A", "B", ".foo.com", "/", two_hours_ago,
  3467. one_hour_from_now, one_hour_ago, /*secure=*/true, /*http_only=*/false,
  3468. CookieSameSite::NO_RESTRICTION, CookiePriority::COOKIE_PRIORITY_DEFAULT,
  3469. /*same_party=*/false,
  3470. absl::optional<CookiePartitionKey>(CookiePartitionKey::FromURLForTesting(
  3471. GURL("https://toplevelsite.com"))),
  3472. &status));
  3473. EXPECT_TRUE(status.IsInclude());
  3474. status = CookieInclusionStatus();
  3475. // Check that CreateSanitizedCookie can gracefully fail on inputs that would
  3476. // crash cookie_util::GetCookieDomainWithString due to failing
  3477. // DCHECKs. Specifically, GetCookieDomainWithString requires that if the
  3478. // domain is empty or the URL's host matches the domain, then the URL's host
  3479. // must pass DomainIsHostOnly; it must not begin with a period.
  3480. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3481. GURL("http://..."), "A", "B", "...", "/", base::Time(), base::Time(),
  3482. base::Time(), false /*secure*/, false /*httponly*/,
  3483. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  3484. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3485. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3486. {CookieInclusionStatus::EXCLUDE_INVALID_DOMAIN}));
  3487. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3488. GURL("http://."), "A", "B", std::string(), "/", base::Time(),
  3489. base::Time(), base::Time(), false /*secure*/, false /*httponly*/,
  3490. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  3491. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3492. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3493. {CookieInclusionStatus::EXCLUDE_INVALID_DOMAIN}));
  3494. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3495. GURL("http://.chromium.org"), "A", "B", ".chromium.org", "/",
  3496. base::Time(), base::Time(), base::Time(), false /*secure*/,
  3497. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3498. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3499. absl::nullopt /*partition_key*/, &status));
  3500. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3501. {CookieInclusionStatus::EXCLUDE_INVALID_DOMAIN}));
  3502. // Check that a file URL with an IPv6 host, and matching IPv6 domain, are
  3503. // valid.
  3504. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3505. GURL("file://[A::]"), "A", "B", "[A::]", "", base::Time(), base::Time(),
  3506. base::Time(), false /*secure*/, false /*httponly*/,
  3507. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  3508. false /*same_party*/, absl::nullopt /*partition_key*/, &status));
  3509. EXPECT_TRUE(status.IsInclude());
  3510. // On Windows, URLs beginning with two backslashes are considered file
  3511. // URLs. On other platforms, they are invalid.
  3512. auto double_backslash_ipv6_cookie = CanonicalCookie::CreateSanitizedCookie(
  3513. GURL("\\\\[A::]"), "A", "B", "[A::]", "", base::Time(), base::Time(),
  3514. base::Time(), false /*secure*/, false /*httponly*/,
  3515. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  3516. false /*same_party*/, absl::nullopt /*partition_key*/, &status);
  3517. #if BUILDFLAG(IS_WIN)
  3518. EXPECT_TRUE(double_backslash_ipv6_cookie);
  3519. EXPECT_TRUE(double_backslash_ipv6_cookie->IsCanonical());
  3520. EXPECT_TRUE(status.IsInclude());
  3521. #else
  3522. EXPECT_FALSE(double_backslash_ipv6_cookie);
  3523. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3524. {CookieInclusionStatus::EXCLUDE_INVALID_DOMAIN}));
  3525. #endif
  3526. // Confirm multiple error types can be set.
  3527. EXPECT_FALSE(CanonicalCookie::CreateSanitizedCookie(
  3528. GURL(""), "", "", "", "", base::Time(), base::Time(), base::Time::Now(),
  3529. true /*secure*/, true /*httponly*/, CookieSameSite::STRICT_MODE,
  3530. COOKIE_PRIORITY_DEFAULT, true /*same_party*/,
  3531. absl::nullopt /*partition_key*/, &status));
  3532. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3533. {CookieInclusionStatus::EXCLUDE_FAILURE_TO_STORE,
  3534. CookieInclusionStatus::EXCLUDE_INVALID_DOMAIN,
  3535. CookieInclusionStatus::EXCLUDE_INVALID_SAMEPARTY}));
  3536. // Check that RFC6265bis name + value string length limits are enforced.
  3537. std::string max_name(ParsedCookie::kMaxCookieNamePlusValueSize, 'a');
  3538. std::string max_value(ParsedCookie::kMaxCookieNamePlusValueSize, 'b');
  3539. std::string almost_max_name = max_name.substr(1, std::string::npos);
  3540. std::string almost_max_value = max_value.substr(1, std::string::npos);
  3541. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3542. GURL("http://www.foo.com/foo"), max_name, "", std::string(), "/foo",
  3543. one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  3544. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3545. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3546. absl::nullopt /*partition_key*/, &status));
  3547. EXPECT_TRUE(status.IsInclude());
  3548. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3549. GURL("http://www.foo.com/foo"), "", max_value, std::string(), "/foo",
  3550. one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  3551. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3552. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3553. absl::nullopt /*partition_key*/, &status));
  3554. EXPECT_TRUE(status.IsInclude());
  3555. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3556. GURL("http://www.foo.com/foo"), almost_max_name, "b", std::string(),
  3557. "/foo", one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  3558. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3559. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3560. absl::nullopt /*partition_key*/, &status));
  3561. EXPECT_TRUE(status.IsInclude());
  3562. EXPECT_TRUE(CanonicalCookie::CreateSanitizedCookie(
  3563. GURL("http://www.foo.com/foo"), "a", almost_max_value, std::string(),
  3564. "/foo", one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  3565. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3566. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3567. absl::nullopt /*partition_key*/, &status));
  3568. EXPECT_TRUE(status.IsInclude());
  3569. for (const bool toggle : {false, true}) {
  3570. base::test::ScopedFeatureList scope_feature_list;
  3571. scope_feature_list.InitWithFeatureState(
  3572. features::kExtraCookieValidityChecks, toggle);
  3573. cc = CanonicalCookie::CreateSanitizedCookie(
  3574. GURL("http://www.foo.com/foo"), max_name, "X", std::string(), "/foo",
  3575. one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  3576. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3577. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3578. absl::nullopt /*partition_key*/, &status);
  3579. if (base::FeatureList::IsEnabled(features::kExtraCookieValidityChecks)) {
  3580. EXPECT_FALSE(cc);
  3581. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3582. {CookieInclusionStatus::EXCLUDE_NAME_VALUE_PAIR_EXCEEDS_MAX_SIZE}));
  3583. } else {
  3584. EXPECT_TRUE(cc);
  3585. EXPECT_TRUE(status.IsInclude());
  3586. }
  3587. cc = CanonicalCookie::CreateSanitizedCookie(
  3588. GURL("http://www.foo.com/foo"), "X", max_value, std::string(), "/foo",
  3589. one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  3590. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3591. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3592. absl::nullopt /*partition_key*/, &status);
  3593. if (base::FeatureList::IsEnabled(features::kExtraCookieValidityChecks)) {
  3594. EXPECT_FALSE(cc);
  3595. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3596. {CookieInclusionStatus::EXCLUDE_NAME_VALUE_PAIR_EXCEEDS_MAX_SIZE}));
  3597. } else {
  3598. EXPECT_TRUE(cc);
  3599. EXPECT_TRUE(status.IsInclude());
  3600. }
  3601. }
  3602. // Check that the RFC6265bis attribute value size limits apply to the Path
  3603. // attribute value.
  3604. std::string almost_max_path(ParsedCookie::kMaxCookieAttributeValueSize - 1,
  3605. 'c');
  3606. std::string max_path = "/" + almost_max_path;
  3607. std::string too_long_path = "/X" + almost_max_path;
  3608. cc = CanonicalCookie::CreateSanitizedCookie(
  3609. GURL("http://www.foo.com" + max_path), "name", "value", std::string(),
  3610. max_path, one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  3611. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3612. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3613. absl::nullopt /*partition_key*/, &status);
  3614. EXPECT_TRUE(cc);
  3615. EXPECT_EQ(max_path, cc->Path());
  3616. EXPECT_TRUE(status.IsInclude());
  3617. for (const bool toggle : {false, true}) {
  3618. base::test::ScopedFeatureList scope_feature_list;
  3619. scope_feature_list.InitWithFeatureState(
  3620. features::kExtraCookieValidityChecks, toggle);
  3621. cc = CanonicalCookie::CreateSanitizedCookie(
  3622. GURL("http://www.foo.com/path-attr-from-url/"), "name", "value",
  3623. std::string(), too_long_path, one_hour_ago, one_hour_from_now,
  3624. base::Time(), false /*secure*/, false /*httponly*/,
  3625. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  3626. false /*same_party*/, absl::nullopt /*partition_key*/, &status);
  3627. if (base::FeatureList::IsEnabled(features::kExtraCookieValidityChecks)) {
  3628. EXPECT_FALSE(cc);
  3629. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3630. {CookieInclusionStatus::EXCLUDE_ATTRIBUTE_VALUE_EXCEEDS_MAX_SIZE}));
  3631. } else {
  3632. EXPECT_TRUE(cc);
  3633. EXPECT_EQ(too_long_path, cc->Path());
  3634. EXPECT_TRUE(status.IsInclude());
  3635. }
  3636. }
  3637. // Check that length limits on the Path attribute value are not enforced in
  3638. // the case where no Path attribute is specified and the path value is
  3639. // implicitly set from the URL.
  3640. cc = CanonicalCookie::CreateSanitizedCookie(
  3641. GURL("http://www.foo.com" + too_long_path + "/"), "name", "value",
  3642. std::string(), std::string(), one_hour_ago, one_hour_from_now,
  3643. base::Time(), false /*secure*/, false /*httponly*/,
  3644. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  3645. false /*same_party*/, absl::nullopt /*partition_key*/, &status);
  3646. EXPECT_TRUE(cc);
  3647. EXPECT_EQ(too_long_path, cc->Path());
  3648. EXPECT_TRUE(status.IsInclude());
  3649. // The Path attribute value gets URL-encoded, so ensure that the size limit is
  3650. // enforced after this (to avoid setting cookies where the Path attribute
  3651. // value would otherwise exceed the lengths specified in the RFC).
  3652. for (const bool toggle : {false, true}) {
  3653. base::test::ScopedFeatureList scope_feature_list;
  3654. scope_feature_list.InitWithFeatureState(
  3655. features::kExtraCookieValidityChecks, toggle);
  3656. std::string expanding_path(ParsedCookie::kMaxCookieAttributeValueSize / 2,
  3657. '#');
  3658. expanding_path = "/" + expanding_path;
  3659. cc = CanonicalCookie::CreateSanitizedCookie(
  3660. GURL("http://www.foo.com/path-attr-from-url/"), "name", "value",
  3661. std::string(), expanding_path, one_hour_ago, one_hour_from_now,
  3662. base::Time(), false /*secure*/, false /*httponly*/,
  3663. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  3664. false /*same_party*/, absl::nullopt /*partition_key*/, &status);
  3665. if (base::FeatureList::IsEnabled(features::kExtraCookieValidityChecks)) {
  3666. EXPECT_FALSE(cc);
  3667. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3668. {CookieInclusionStatus::EXCLUDE_ATTRIBUTE_VALUE_EXCEEDS_MAX_SIZE}));
  3669. } else {
  3670. EXPECT_TRUE(cc);
  3671. // "#" expands into "%23"; -2 because '/' doesn't expand
  3672. EXPECT_EQ((expanding_path.size() * 3) - 2, cc->Path().size());
  3673. EXPECT_TRUE(status.IsInclude());
  3674. }
  3675. }
  3676. // Check that the RFC6265bis attribute value size limits apply to the Domain
  3677. // attribute value.
  3678. std::string max_domain(ParsedCookie::kMaxCookieAttributeValueSize, 'd');
  3679. max_domain.replace(ParsedCookie::kMaxCookieAttributeValueSize - 4, 4, ".com");
  3680. std::string too_long_domain = "x" + max_domain;
  3681. cc = CanonicalCookie::CreateSanitizedCookie(
  3682. GURL("http://" + max_domain + "/"), "name", "value", max_domain, "/",
  3683. one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  3684. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3685. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3686. absl::nullopt /*partition_key*/, &status);
  3687. EXPECT_TRUE(cc);
  3688. EXPECT_EQ(max_domain, cc->DomainWithoutDot());
  3689. EXPECT_TRUE(status.IsInclude());
  3690. cc = CanonicalCookie::CreateSanitizedCookie(
  3691. GURL("http://www.domain-from-url.com/"), "name", "value", too_long_domain,
  3692. "/", one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  3693. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3694. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3695. absl::nullopt /*partition_key*/, &status);
  3696. EXPECT_FALSE(cc);
  3697. EXPECT_TRUE(status.HasExactlyExclusionReasonsForTesting(
  3698. {CookieInclusionStatus::EXCLUDE_ATTRIBUTE_VALUE_EXCEEDS_MAX_SIZE}));
  3699. // Check that length limits on the Domain attribute value are not enforced in
  3700. // the case where no Domain attribute is specified and the domain value is
  3701. // implicitly set from the URL.
  3702. cc = CanonicalCookie::CreateSanitizedCookie(
  3703. GURL("http://" + too_long_domain + "/"), "name", "value", std::string(),
  3704. "/", one_hour_ago, one_hour_from_now, base::Time(), false /*secure*/,
  3705. false /*httponly*/, CookieSameSite::NO_RESTRICTION,
  3706. COOKIE_PRIORITY_DEFAULT, false /*same_party*/,
  3707. absl::nullopt /*partition_key*/, &status);
  3708. EXPECT_TRUE(cc);
  3709. EXPECT_EQ(too_long_domain, cc->DomainWithoutDot());
  3710. EXPECT_TRUE(status.IsInclude());
  3711. }
  3712. TEST(CanonicalCookieTest, FromStorage) {
  3713. base::Time two_hours_ago = base::Time::Now() - base::Hours(2);
  3714. base::Time one_hour_ago = base::Time::Now() - base::Hours(1);
  3715. base::Time one_hour_from_now = base::Time::Now() + base::Hours(1);
  3716. std::unique_ptr<CanonicalCookie> cc = CanonicalCookie::FromStorage(
  3717. "A", "B", "www.foo.com", "/bar", two_hours_ago, one_hour_from_now,
  3718. one_hour_ago, one_hour_ago, false /*secure*/, false /*httponly*/,
  3719. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  3720. false /*same_party*/, absl::nullopt /*partition_key*/,
  3721. CookieSourceScheme::kSecure, 87);
  3722. EXPECT_TRUE(cc);
  3723. EXPECT_EQ("A", cc->Name());
  3724. EXPECT_EQ("B", cc->Value());
  3725. EXPECT_EQ("www.foo.com", cc->Domain());
  3726. EXPECT_EQ("/bar", cc->Path());
  3727. EXPECT_EQ(two_hours_ago, cc->CreationDate());
  3728. EXPECT_EQ(one_hour_ago, cc->LastAccessDate());
  3729. EXPECT_EQ(one_hour_from_now, cc->ExpiryDate());
  3730. EXPECT_EQ(one_hour_ago, cc->LastUpdateDate());
  3731. EXPECT_FALSE(cc->IsSecure());
  3732. EXPECT_FALSE(cc->IsHttpOnly());
  3733. EXPECT_EQ(CookieSameSite::NO_RESTRICTION, cc->SameSite());
  3734. EXPECT_EQ(COOKIE_PRIORITY_MEDIUM, cc->Priority());
  3735. EXPECT_EQ(CookieSourceScheme::kSecure, cc->SourceScheme());
  3736. EXPECT_FALSE(cc->IsDomainCookie());
  3737. EXPECT_EQ(cc->SourcePort(), 87);
  3738. // Should return nullptr when the cookie is not canonical.
  3739. // In this case the cookie is not canonical because its name attribute
  3740. // contains a newline character.
  3741. EXPECT_FALSE(CanonicalCookie::FromStorage(
  3742. "A\n", "B", "www.foo.com", "/bar", two_hours_ago, one_hour_from_now,
  3743. one_hour_ago, one_hour_ago, false /*secure*/, false /*httponly*/,
  3744. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  3745. false /*same_party*/, absl::nullopt /*partition_key*/,
  3746. CookieSourceScheme::kSecure, 80));
  3747. // If the port information gets corrupted out of the valid range
  3748. // FromStorage() should result in a PORT_INVALID.
  3749. std::unique_ptr<CanonicalCookie> cc2 = CanonicalCookie::FromStorage(
  3750. "A", "B", "www.foo.com", "/bar", two_hours_ago, one_hour_from_now,
  3751. one_hour_ago, one_hour_ago, false /*secure*/, false /*httponly*/,
  3752. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  3753. false /*same_party*/, absl::nullopt /*partition_key*/,
  3754. CookieSourceScheme::kSecure, 80000);
  3755. EXPECT_EQ(cc2->SourcePort(), url::PORT_INVALID);
  3756. // Test port edge cases: unspecified.
  3757. std::unique_ptr<CanonicalCookie> cc3 = CanonicalCookie::FromStorage(
  3758. "A", "B", "www.foo.com", "/bar", two_hours_ago, one_hour_from_now,
  3759. one_hour_ago, one_hour_ago, false /*secure*/, false /*httponly*/,
  3760. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  3761. false /*same_party*/, absl::nullopt /*partition_key*/,
  3762. CookieSourceScheme::kSecure, url::PORT_UNSPECIFIED);
  3763. EXPECT_EQ(cc3->SourcePort(), url::PORT_UNSPECIFIED);
  3764. // Test port edge cases: invalid.
  3765. std::unique_ptr<CanonicalCookie> cc4 = CanonicalCookie::FromStorage(
  3766. "A", "B", "www.foo.com", "/bar", two_hours_ago, one_hour_from_now,
  3767. one_hour_ago, one_hour_ago, false /*secure*/, false /*httponly*/,
  3768. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  3769. false /*same_party*/, absl::nullopt /*partition_key*/,
  3770. CookieSourceScheme::kSecure, url::PORT_INVALID);
  3771. EXPECT_EQ(cc4->SourcePort(), url::PORT_INVALID);
  3772. }
  3773. TEST(CanonicalCookieTest, IsSetPermittedInContext) {
  3774. GURL url("https://www.example.com/test");
  3775. GURL insecure_url("http://www.example.com/test");
  3776. base::Time current_time = base::Time::Now();
  3777. auto cookie_scriptable = CanonicalCookie::CreateUnsafeCookieForTesting(
  3778. "A", "2", "www.example.com", "/test", current_time, base::Time(),
  3779. base::Time(), base::Time(), true /*secure*/, false /*httponly*/,
  3780. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT, false);
  3781. auto cookie_httponly = CanonicalCookie::CreateUnsafeCookieForTesting(
  3782. "A", "2", "www.example.com", "/test", current_time, base::Time(),
  3783. base::Time(), base::Time(), true /*secure*/, true /*httponly*/,
  3784. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT, false);
  3785. CookieOptions context_script;
  3786. CookieOptions context_network;
  3787. context_network.set_include_httponly();
  3788. EXPECT_THAT(
  3789. cookie_scriptable->IsSetPermittedInContext(
  3790. GURL("file://foo/bar.txt"), context_network,
  3791. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  3792. false /* delegate_treats_url_as_trustworthy */,
  3793. CookieSamePartyStatus::kNoSamePartyEnforcement),
  3794. kCookieableSchemes),
  3795. MatchesCookieAccessResult(
  3796. CookieInclusionStatus::MakeFromReasonsForTesting({
  3797. CookieInclusionStatus::EXCLUDE_NONCOOKIEABLE_SCHEME,
  3798. CookieInclusionStatus::EXCLUDE_SECURE_ONLY,
  3799. }),
  3800. _, _, false));
  3801. EXPECT_THAT(
  3802. cookie_scriptable->IsSetPermittedInContext(
  3803. insecure_url, context_network,
  3804. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  3805. false /* delegate_treats_url_as_trustworthy */,
  3806. CookieSamePartyStatus::kNoSamePartyEnforcement),
  3807. kCookieableSchemes),
  3808. MatchesCookieAccessResult(
  3809. CookieInclusionStatus::MakeFromReasonsForTesting(
  3810. {CookieInclusionStatus::EXCLUDE_SECURE_ONLY}),
  3811. _, _, false));
  3812. EXPECT_THAT(
  3813. cookie_scriptable->IsSetPermittedInContext(
  3814. url, context_network,
  3815. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  3816. false /* delegate_treats_url_as_trustworthy */,
  3817. CookieSamePartyStatus::kNoSamePartyEnforcement),
  3818. kCookieableSchemes),
  3819. MatchesCookieAccessResult(IsInclude(), _, _, true));
  3820. EXPECT_THAT(
  3821. cookie_scriptable->IsSetPermittedInContext(
  3822. url, context_script,
  3823. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  3824. false /* delegate_treats_url_as_trustworthy */,
  3825. CookieSamePartyStatus::kNoSamePartyEnforcement),
  3826. kCookieableSchemes),
  3827. MatchesCookieAccessResult(IsInclude(), _, _, true));
  3828. EXPECT_THAT(
  3829. cookie_httponly->IsSetPermittedInContext(
  3830. url, context_network,
  3831. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  3832. false /* delegate_treats_url_as_trustworthy */,
  3833. CookieSamePartyStatus::kNoSamePartyEnforcement),
  3834. kCookieableSchemes),
  3835. MatchesCookieAccessResult(IsInclude(), _, _, true));
  3836. EXPECT_THAT(
  3837. cookie_httponly->IsSetPermittedInContext(
  3838. url, context_script,
  3839. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  3840. false /* delegate_treats_url_as_trustworthy */,
  3841. CookieSamePartyStatus::kNoSamePartyEnforcement),
  3842. kCookieableSchemes),
  3843. MatchesCookieAccessResult(
  3844. CookieInclusionStatus::MakeFromReasonsForTesting(
  3845. {CookieInclusionStatus::EXCLUDE_HTTP_ONLY}),
  3846. _, _, true));
  3847. CookieOptions context_cross_site;
  3848. CookieOptions context_same_site_lax;
  3849. context_same_site_lax.set_same_site_cookie_context(
  3850. CookieOptions::SameSiteCookieContext(
  3851. CookieOptions::SameSiteCookieContext::ContextType::SAME_SITE_LAX));
  3852. CookieOptions context_same_site_strict;
  3853. context_same_site_strict.set_same_site_cookie_context(
  3854. CookieOptions::SameSiteCookieContext(
  3855. CookieOptions::SameSiteCookieContext::ContextType::SAME_SITE_STRICT));
  3856. CookieOptions context_same_site_strict_to_lax;
  3857. context_same_site_strict_to_lax.set_same_site_cookie_context(
  3858. CookieOptions::SameSiteCookieContext(
  3859. CookieOptions::SameSiteCookieContext::ContextType::SAME_SITE_STRICT,
  3860. CookieOptions::SameSiteCookieContext::ContextType::SAME_SITE_LAX));
  3861. CookieOptions context_same_site_strict_to_cross;
  3862. context_same_site_strict_to_cross.set_same_site_cookie_context(
  3863. CookieOptions::SameSiteCookieContext(
  3864. CookieOptions::SameSiteCookieContext::ContextType::SAME_SITE_STRICT,
  3865. CookieOptions::SameSiteCookieContext::ContextType::CROSS_SITE));
  3866. CookieOptions context_same_site_lax_to_cross;
  3867. context_same_site_lax_to_cross.set_same_site_cookie_context(
  3868. CookieOptions::SameSiteCookieContext(
  3869. CookieOptions::SameSiteCookieContext::ContextType::SAME_SITE_LAX,
  3870. CookieOptions::SameSiteCookieContext::ContextType::CROSS_SITE));
  3871. {
  3872. auto cookie_same_site_unrestricted =
  3873. CanonicalCookie::CreateUnsafeCookieForTesting(
  3874. "A", "2", "www.example.com", "/test", current_time, base::Time(),
  3875. base::Time(), base::Time(), true /*secure*/, false /*httponly*/,
  3876. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT, false);
  3877. EXPECT_THAT(
  3878. cookie_same_site_unrestricted->IsSetPermittedInContext(
  3879. url, context_cross_site,
  3880. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  3881. false /* delegate_treats_url_as_trustworthy */,
  3882. CookieSamePartyStatus::kNoSamePartyEnforcement),
  3883. kCookieableSchemes),
  3884. MatchesCookieAccessResult(IsInclude(), _, _, true));
  3885. EXPECT_THAT(
  3886. cookie_same_site_unrestricted->IsSetPermittedInContext(
  3887. url, context_same_site_lax,
  3888. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  3889. false /* delegate_treats_url_as_trustworthy */,
  3890. CookieSamePartyStatus::kNoSamePartyEnforcement),
  3891. kCookieableSchemes),
  3892. MatchesCookieAccessResult(IsInclude(), _, _, true));
  3893. EXPECT_THAT(
  3894. cookie_same_site_unrestricted->IsSetPermittedInContext(
  3895. url, context_same_site_strict,
  3896. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  3897. false /* delegate_treats_url_as_trustworthy */,
  3898. CookieSamePartyStatus::kNoSamePartyEnforcement),
  3899. kCookieableSchemes),
  3900. MatchesCookieAccessResult(IsInclude(), _, _, true));
  3901. {
  3902. // Schemeful Same-Site disabled.
  3903. base::test::ScopedFeatureList feature_list;
  3904. feature_list.InitAndDisableFeature(features::kSchemefulSameSite);
  3905. EXPECT_THAT(
  3906. cookie_same_site_unrestricted->IsSetPermittedInContext(
  3907. url, context_same_site_strict_to_lax,
  3908. CookieAccessParams(
  3909. CookieAccessSemantics::UNKNOWN,
  3910. false /* delegate_treats_url_as_trustworthy */,
  3911. CookieSamePartyStatus::kNoSamePartyEnforcement),
  3912. kCookieableSchemes),
  3913. MatchesCookieAccessResult(
  3914. AllOf(IsInclude(), Not(HasDowngradeWarning())), _, _, true));
  3915. EXPECT_THAT(
  3916. cookie_same_site_unrestricted->IsSetPermittedInContext(
  3917. url, context_same_site_strict_to_cross,
  3918. CookieAccessParams(
  3919. CookieAccessSemantics::UNKNOWN,
  3920. false /* delegate_treats_url_as_trustworthy */,
  3921. CookieSamePartyStatus::kNoSamePartyEnforcement),
  3922. kCookieableSchemes),
  3923. MatchesCookieAccessResult(
  3924. AllOf(IsInclude(), Not(HasDowngradeWarning())), _, _, true));
  3925. EXPECT_THAT(
  3926. cookie_same_site_unrestricted->IsSetPermittedInContext(
  3927. url, context_same_site_lax_to_cross,
  3928. CookieAccessParams(
  3929. CookieAccessSemantics::UNKNOWN,
  3930. false /* delegate_treats_url_as_trustworthy */,
  3931. CookieSamePartyStatus::kNoSamePartyEnforcement),
  3932. kCookieableSchemes),
  3933. MatchesCookieAccessResult(
  3934. AllOf(IsInclude(), Not(HasDowngradeWarning())), _, _, true));
  3935. }
  3936. {
  3937. // Schemeful Same-Site enabled.
  3938. base::test::ScopedFeatureList feature_list;
  3939. feature_list.InitAndEnableFeature(features::kSchemefulSameSite);
  3940. EXPECT_THAT(
  3941. cookie_same_site_unrestricted->IsSetPermittedInContext(
  3942. url, context_same_site_strict_to_lax,
  3943. CookieAccessParams(
  3944. CookieAccessSemantics::UNKNOWN,
  3945. false /* delegate_treats_url_as_trustworthy */,
  3946. CookieSamePartyStatus::kNoSamePartyEnforcement),
  3947. kCookieableSchemes),
  3948. MatchesCookieAccessResult(
  3949. AllOf(IsInclude(), Not(HasDowngradeWarning())), _, _, true));
  3950. EXPECT_THAT(
  3951. cookie_same_site_unrestricted->IsSetPermittedInContext(
  3952. url, context_same_site_strict_to_cross,
  3953. CookieAccessParams(
  3954. CookieAccessSemantics::UNKNOWN,
  3955. false /* delegate_treats_url_as_trustworthy */,
  3956. CookieSamePartyStatus::kNoSamePartyEnforcement),
  3957. kCookieableSchemes),
  3958. MatchesCookieAccessResult(
  3959. AllOf(IsInclude(), Not(HasDowngradeWarning())), _, _, true));
  3960. EXPECT_THAT(
  3961. cookie_same_site_unrestricted->IsSetPermittedInContext(
  3962. url, context_same_site_lax_to_cross,
  3963. CookieAccessParams(
  3964. CookieAccessSemantics::UNKNOWN,
  3965. false /* delegate_treats_url_as_trustworthy */,
  3966. CookieSamePartyStatus::kNoSamePartyEnforcement),
  3967. kCookieableSchemes),
  3968. MatchesCookieAccessResult(
  3969. AllOf(IsInclude(), Not(HasDowngradeWarning())), _, _, true));
  3970. }
  3971. }
  3972. {
  3973. auto cookie_same_site_lax = CanonicalCookie::CreateUnsafeCookieForTesting(
  3974. "A", "2", "www.example.com", "/test", current_time, base::Time(),
  3975. base::Time(), base::Time(), true /*secure*/, false /*httponly*/,
  3976. CookieSameSite::LAX_MODE, COOKIE_PRIORITY_DEFAULT, false);
  3977. EXPECT_THAT(
  3978. cookie_same_site_lax->IsSetPermittedInContext(
  3979. url, context_cross_site,
  3980. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  3981. false /* delegate_treats_url_as_trustworthy */,
  3982. CookieSamePartyStatus::kNoSamePartyEnforcement),
  3983. kCookieableSchemes),
  3984. MatchesCookieAccessResult(
  3985. CookieInclusionStatus::MakeFromReasonsForTesting(
  3986. {CookieInclusionStatus::EXCLUDE_SAMESITE_LAX}),
  3987. _, _, true));
  3988. EXPECT_THAT(
  3989. cookie_same_site_lax->IsSetPermittedInContext(
  3990. url, context_same_site_lax,
  3991. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  3992. false /* delegate_treats_url_as_trustworthy */,
  3993. CookieSamePartyStatus::kNoSamePartyEnforcement),
  3994. kCookieableSchemes),
  3995. MatchesCookieAccessResult(IsInclude(), _, _, true));
  3996. EXPECT_THAT(
  3997. cookie_same_site_lax->IsSetPermittedInContext(
  3998. url, context_same_site_strict,
  3999. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  4000. false /* delegate_treats_url_as_trustworthy */,
  4001. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4002. kCookieableSchemes),
  4003. MatchesCookieAccessResult(IsInclude(), _, _, true));
  4004. {
  4005. // Schemeful Same-Site disabled.
  4006. base::test::ScopedFeatureList feature_list;
  4007. feature_list.InitAndDisableFeature(features::kSchemefulSameSite);
  4008. EXPECT_THAT(
  4009. cookie_same_site_lax->IsSetPermittedInContext(
  4010. url, context_same_site_strict_to_lax,
  4011. CookieAccessParams(
  4012. CookieAccessSemantics::UNKNOWN,
  4013. false /* delegate_treats_url_as_trustworthy */,
  4014. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4015. kCookieableSchemes),
  4016. MatchesCookieAccessResult(
  4017. AllOf(IsInclude(), Not(HasDowngradeWarning())), _, _, true));
  4018. EXPECT_THAT(cookie_same_site_lax->IsSetPermittedInContext(
  4019. url, context_same_site_strict_to_cross,
  4020. CookieAccessParams(
  4021. CookieAccessSemantics::UNKNOWN,
  4022. false /* delegate_treats_url_as_trustworthy */,
  4023. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4024. kCookieableSchemes),
  4025. MatchesCookieAccessResult(
  4026. AllOf(IsInclude(),
  4027. HasWarningReason(
  4028. CookieInclusionStatus::
  4029. WARN_STRICT_CROSS_DOWNGRADE_LAX_SAMESITE)),
  4030. _, _, true));
  4031. EXPECT_THAT(cookie_same_site_lax->IsSetPermittedInContext(
  4032. url, context_same_site_lax_to_cross,
  4033. CookieAccessParams(
  4034. CookieAccessSemantics::UNKNOWN,
  4035. false /* delegate_treats_url_as_trustworthy */,
  4036. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4037. kCookieableSchemes),
  4038. MatchesCookieAccessResult(
  4039. AllOf(IsInclude(),
  4040. HasWarningReason(
  4041. CookieInclusionStatus::
  4042. WARN_LAX_CROSS_DOWNGRADE_LAX_SAMESITE)),
  4043. _, _, true));
  4044. }
  4045. {
  4046. // Schemeful Same-Site enabled.
  4047. base::test::ScopedFeatureList feature_list;
  4048. feature_list.InitAndEnableFeature(features::kSchemefulSameSite);
  4049. EXPECT_THAT(
  4050. cookie_same_site_lax->IsSetPermittedInContext(
  4051. url, context_same_site_strict_to_lax,
  4052. CookieAccessParams(
  4053. CookieAccessSemantics::UNKNOWN,
  4054. false /* delegate_treats_url_as_trustworthy */,
  4055. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4056. kCookieableSchemes),
  4057. MatchesCookieAccessResult(
  4058. AllOf(IsInclude(), Not(HasDowngradeWarning())), _, _, true));
  4059. EXPECT_THAT(cookie_same_site_lax->IsSetPermittedInContext(
  4060. url, context_same_site_strict_to_cross,
  4061. CookieAccessParams(
  4062. CookieAccessSemantics::UNKNOWN,
  4063. false /* delegate_treats_url_as_trustworthy */,
  4064. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4065. kCookieableSchemes),
  4066. MatchesCookieAccessResult(
  4067. AllOf(Not(IsInclude()),
  4068. HasWarningReason(
  4069. CookieInclusionStatus::
  4070. WARN_STRICT_CROSS_DOWNGRADE_LAX_SAMESITE),
  4071. HasExclusionReason(
  4072. CookieInclusionStatus::EXCLUDE_SAMESITE_LAX)),
  4073. _, _, true));
  4074. EXPECT_THAT(
  4075. cookie_same_site_lax->IsSetPermittedInContext(
  4076. url, context_same_site_lax_to_cross,
  4077. CookieAccessParams(
  4078. CookieAccessSemantics::UNKNOWN,
  4079. false /* delegate_treats_url_as_trustworthy */,
  4080. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4081. kCookieableSchemes),
  4082. MatchesCookieAccessResult(
  4083. AllOf(Not(IsInclude()),
  4084. HasWarningReason(CookieInclusionStatus::
  4085. WARN_LAX_CROSS_DOWNGRADE_LAX_SAMESITE),
  4086. HasExclusionReason(
  4087. CookieInclusionStatus::EXCLUDE_SAMESITE_LAX)),
  4088. _, _, true));
  4089. }
  4090. }
  4091. {
  4092. auto cookie_same_site_strict =
  4093. CanonicalCookie::CreateUnsafeCookieForTesting(
  4094. "A", "2", "www.example.com", "/test", current_time, base::Time(),
  4095. base::Time(), base::Time(), true /*secure*/, false /*httponly*/,
  4096. CookieSameSite::STRICT_MODE, COOKIE_PRIORITY_DEFAULT, false);
  4097. // TODO(morlovich): Do compatibility testing on whether set of strict in lax
  4098. // context really should be accepted.
  4099. EXPECT_THAT(
  4100. cookie_same_site_strict->IsSetPermittedInContext(
  4101. url, context_cross_site,
  4102. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  4103. false /* delegate_treats_url_as_trustworthy */,
  4104. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4105. kCookieableSchemes),
  4106. MatchesCookieAccessResult(
  4107. CookieInclusionStatus::MakeFromReasonsForTesting(
  4108. {CookieInclusionStatus::EXCLUDE_SAMESITE_STRICT}),
  4109. _, _, true));
  4110. EXPECT_THAT(
  4111. cookie_same_site_strict->IsSetPermittedInContext(
  4112. url, context_same_site_lax,
  4113. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  4114. false /* delegate_treats_url_as_trustworthy */,
  4115. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4116. kCookieableSchemes),
  4117. MatchesCookieAccessResult(IsInclude(), _, _, true));
  4118. EXPECT_THAT(
  4119. cookie_same_site_strict->IsSetPermittedInContext(
  4120. url, context_same_site_strict,
  4121. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  4122. false /* delegate_treats_url_as_trustworthy */,
  4123. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4124. kCookieableSchemes),
  4125. MatchesCookieAccessResult(IsInclude(), _, _, true));
  4126. {
  4127. // Schemeful Same-Site disabled.
  4128. base::test::ScopedFeatureList feature_list;
  4129. feature_list.InitAndDisableFeature(features::kSchemefulSameSite);
  4130. EXPECT_THAT(
  4131. cookie_same_site_strict->IsSetPermittedInContext(
  4132. url, context_same_site_strict_to_lax,
  4133. CookieAccessParams(
  4134. CookieAccessSemantics::UNKNOWN,
  4135. false /* delegate_treats_url_as_trustworthy */,
  4136. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4137. kCookieableSchemes),
  4138. MatchesCookieAccessResult(
  4139. AllOf(IsInclude(), Not(HasDowngradeWarning())), _, _, true));
  4140. EXPECT_THAT(
  4141. cookie_same_site_strict->IsSetPermittedInContext(
  4142. url, context_same_site_strict_to_cross,
  4143. CookieAccessParams(
  4144. CookieAccessSemantics::UNKNOWN,
  4145. false /* delegate_treats_url_as_trustworthy */,
  4146. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4147. kCookieableSchemes),
  4148. MatchesCookieAccessResult(
  4149. AllOf(IsInclude(),
  4150. HasWarningReason(
  4151. CookieInclusionStatus::
  4152. WARN_STRICT_CROSS_DOWNGRADE_STRICT_SAMESITE)),
  4153. _, _, true));
  4154. EXPECT_THAT(cookie_same_site_strict->IsSetPermittedInContext(
  4155. url, context_same_site_lax_to_cross,
  4156. CookieAccessParams(
  4157. CookieAccessSemantics::UNKNOWN,
  4158. false /* delegate_treats_url_as_trustworthy */,
  4159. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4160. kCookieableSchemes),
  4161. MatchesCookieAccessResult(
  4162. AllOf(IsInclude(),
  4163. HasWarningReason(
  4164. CookieInclusionStatus::
  4165. WARN_LAX_CROSS_DOWNGRADE_STRICT_SAMESITE)),
  4166. _, _, true));
  4167. }
  4168. {
  4169. // Schemeful Same-Site enabled.
  4170. base::test::ScopedFeatureList feature_list;
  4171. feature_list.InitAndEnableFeature(features::kSchemefulSameSite);
  4172. EXPECT_THAT(
  4173. cookie_same_site_strict->IsSetPermittedInContext(
  4174. url, context_same_site_strict_to_lax,
  4175. CookieAccessParams(
  4176. CookieAccessSemantics::UNKNOWN,
  4177. false /* delegate_treats_url_as_trustworthy */,
  4178. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4179. kCookieableSchemes),
  4180. MatchesCookieAccessResult(
  4181. AllOf(IsInclude(), Not(HasDowngradeWarning())), _, _, true));
  4182. EXPECT_THAT(
  4183. cookie_same_site_strict->IsSetPermittedInContext(
  4184. url, context_same_site_strict_to_cross,
  4185. CookieAccessParams(
  4186. CookieAccessSemantics::UNKNOWN,
  4187. false /* delegate_treats_url_as_trustworthy */,
  4188. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4189. kCookieableSchemes),
  4190. MatchesCookieAccessResult(
  4191. AllOf(Not(IsInclude()),
  4192. HasWarningReason(
  4193. CookieInclusionStatus::
  4194. WARN_STRICT_CROSS_DOWNGRADE_STRICT_SAMESITE),
  4195. HasExclusionReason(
  4196. CookieInclusionStatus::EXCLUDE_SAMESITE_STRICT)),
  4197. _, _, true));
  4198. EXPECT_THAT(
  4199. cookie_same_site_strict->IsSetPermittedInContext(
  4200. url, context_same_site_lax_to_cross,
  4201. CookieAccessParams(
  4202. CookieAccessSemantics::UNKNOWN,
  4203. false /* delegate_treats_url_as_trustworthy */,
  4204. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4205. kCookieableSchemes),
  4206. MatchesCookieAccessResult(
  4207. AllOf(Not(IsInclude()),
  4208. HasWarningReason(
  4209. CookieInclusionStatus::
  4210. WARN_LAX_CROSS_DOWNGRADE_STRICT_SAMESITE),
  4211. HasExclusionReason(
  4212. CookieInclusionStatus::EXCLUDE_SAMESITE_STRICT)),
  4213. _, _, true));
  4214. }
  4215. // Even with Schemeful Same-Site enabled, cookies semantics could change the
  4216. // inclusion.
  4217. {
  4218. base::test::ScopedFeatureList feature_list;
  4219. feature_list.InitAndEnableFeature(features::kSchemefulSameSite);
  4220. EXPECT_THAT(cookie_same_site_strict->IsSetPermittedInContext(
  4221. url, context_same_site_strict_to_cross,
  4222. CookieAccessParams(
  4223. CookieAccessSemantics::UNKNOWN,
  4224. false /* delegate_treats_url_as_trustworthy */,
  4225. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4226. kCookieableSchemes),
  4227. MatchesCookieAccessResult(Not(IsInclude()), _, _, true));
  4228. EXPECT_THAT(cookie_same_site_strict->IsSetPermittedInContext(
  4229. url, context_same_site_strict_to_cross,
  4230. CookieAccessParams(
  4231. CookieAccessSemantics::NONLEGACY,
  4232. false /* delegate_treats_url_as_trustworthy */,
  4233. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4234. kCookieableSchemes),
  4235. MatchesCookieAccessResult(Not(IsInclude()), _, _, true));
  4236. // LEGACY semantics should allow cookies which Schemeful Same-Site would
  4237. // normally block.
  4238. EXPECT_THAT(cookie_same_site_strict->IsSetPermittedInContext(
  4239. url, context_same_site_strict_to_cross,
  4240. CookieAccessParams(
  4241. CookieAccessSemantics::LEGACY,
  4242. false /* delegate_treats_url_as_trustworthy */,
  4243. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4244. kCookieableSchemes),
  4245. MatchesCookieAccessResult(IsInclude(), _, _, true));
  4246. }
  4247. }
  4248. // Behavior of UNSPECIFIED depends on CookieAccessSemantics.
  4249. auto cookie_same_site_unspecified =
  4250. CanonicalCookie::CreateUnsafeCookieForTesting(
  4251. "A", "2", "www.example.com", "/test", current_time, base::Time(),
  4252. base::Time(), base::Time(), true /*secure*/, false /*httponly*/,
  4253. CookieSameSite::UNSPECIFIED, COOKIE_PRIORITY_DEFAULT, false);
  4254. EXPECT_THAT(
  4255. cookie_same_site_unspecified->IsSetPermittedInContext(
  4256. url, context_cross_site,
  4257. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  4258. false /* delegate_treats_url_as_trustworthy */,
  4259. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4260. kCookieableSchemes),
  4261. MatchesCookieAccessResult(
  4262. HasExactlyExclusionReasonsForTesting(
  4263. std::vector<CookieInclusionStatus::ExclusionReason>(
  4264. {CookieInclusionStatus::
  4265. EXCLUDE_SAMESITE_UNSPECIFIED_TREATED_AS_LAX})),
  4266. _, _, true));
  4267. EXPECT_THAT(
  4268. cookie_same_site_unspecified->IsSetPermittedInContext(
  4269. url, context_same_site_lax,
  4270. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  4271. false /* delegate_treats_url_as_trustworthy */,
  4272. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4273. kCookieableSchemes),
  4274. MatchesCookieAccessResult(IsInclude(), _, _, true));
  4275. EXPECT_THAT(
  4276. cookie_same_site_unspecified->IsSetPermittedInContext(
  4277. url, context_same_site_strict,
  4278. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  4279. false /* delegate_treats_url_as_trustworthy */,
  4280. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4281. kCookieableSchemes),
  4282. MatchesCookieAccessResult(IsInclude(), _, _, true));
  4283. EXPECT_THAT(
  4284. cookie_same_site_unspecified->IsSetPermittedInContext(
  4285. url, context_cross_site,
  4286. CookieAccessParams(CookieAccessSemantics::LEGACY,
  4287. false /* delegate_treats_url_as_trustworthy */,
  4288. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4289. kCookieableSchemes),
  4290. MatchesCookieAccessResult(IsInclude(), _, _, true));
  4291. EXPECT_THAT(
  4292. cookie_same_site_unspecified->IsSetPermittedInContext(
  4293. url, context_same_site_lax,
  4294. CookieAccessParams(CookieAccessSemantics::LEGACY,
  4295. false /* delegate_treats_url_as_trustworthy */,
  4296. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4297. kCookieableSchemes),
  4298. MatchesCookieAccessResult(IsInclude(), _, _, true));
  4299. EXPECT_THAT(
  4300. cookie_same_site_unspecified->IsSetPermittedInContext(
  4301. url, context_same_site_strict,
  4302. CookieAccessParams(CookieAccessSemantics::LEGACY,
  4303. false /* delegate_treats_url_as_trustworthy */,
  4304. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4305. kCookieableSchemes),
  4306. MatchesCookieAccessResult(IsInclude(), _, _, true));
  4307. EXPECT_THAT(
  4308. cookie_same_site_unspecified->IsSetPermittedInContext(
  4309. url, context_cross_site,
  4310. CookieAccessParams(CookieAccessSemantics::NONLEGACY,
  4311. false /* delegate_treats_url_as_trustworthy */,
  4312. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4313. kCookieableSchemes),
  4314. MatchesCookieAccessResult(
  4315. HasExactlyExclusionReasonsForTesting(
  4316. std::vector<CookieInclusionStatus::ExclusionReason>(
  4317. {CookieInclusionStatus::
  4318. EXCLUDE_SAMESITE_UNSPECIFIED_TREATED_AS_LAX})),
  4319. _, _, true));
  4320. EXPECT_THAT(
  4321. cookie_same_site_unspecified->IsSetPermittedInContext(
  4322. url, context_same_site_lax,
  4323. CookieAccessParams(CookieAccessSemantics::NONLEGACY,
  4324. false /* delegate_treats_url_as_trustworthy */,
  4325. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4326. kCookieableSchemes),
  4327. MatchesCookieAccessResult(IsInclude(), _, _, true));
  4328. EXPECT_THAT(
  4329. cookie_same_site_unspecified->IsSetPermittedInContext(
  4330. url, context_same_site_strict,
  4331. CookieAccessParams(CookieAccessSemantics::NONLEGACY,
  4332. false /* delegate_treats_url_as_trustworthy */,
  4333. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4334. kCookieableSchemes),
  4335. MatchesCookieAccessResult(IsInclude(), _, _, true));
  4336. // Test IsSetPermittedInContext successfully chains warnings by passing
  4337. // in a CookieAccessResult and expecting the result to have a
  4338. // WARN_ATTRIBUTE_VALUE_EXCEEDS_MAX_SIZE
  4339. CookieInclusionStatus status;
  4340. std::string long_path(ParsedCookie::kMaxCookieAttributeValueSize, 'a');
  4341. std::unique_ptr<CanonicalCookie> cookie_with_long_path =
  4342. CanonicalCookie::Create(url, "A=B; Path=/" + long_path, current_time,
  4343. absl::nullopt, absl::nullopt, &status);
  4344. CookieAccessResult cookie_access_result(status);
  4345. CookieOptions cookie_with_long_path_options;
  4346. EXPECT_THAT(
  4347. cookie_with_long_path->IsSetPermittedInContext(
  4348. url, cookie_with_long_path_options,
  4349. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  4350. false /* delegate_treats_url_as_trustworthy */,
  4351. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4352. kCookieableSchemes, cookie_access_result),
  4353. MatchesCookieAccessResult(
  4354. HasWarningReason(
  4355. CookieInclusionStatus::WARN_ATTRIBUTE_VALUE_EXCEEDS_MAX_SIZE),
  4356. _, _, _));
  4357. }
  4358. TEST(CanonicalCookieTest, IsSetPermittedEffectiveSameSite) {
  4359. GURL url("http://www.example.com/test");
  4360. base::Time current_time = base::Time::Now();
  4361. CookieOptions options;
  4362. // Test IsSetPermitted CookieEffectiveSameSite for
  4363. // CanonicalCookie with CookieSameSite::NO_RESTRICTION.
  4364. auto cookie_no_restriction = CanonicalCookie::CreateUnsafeCookieForTesting(
  4365. "A", "2", "www.example.com", "/test", current_time, base::Time(),
  4366. base::Time(), base::Time(), true /*secure*/, false /*httponly*/,
  4367. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT, false);
  4368. EXPECT_THAT(
  4369. cookie_no_restriction->IsSetPermittedInContext(
  4370. url, options,
  4371. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  4372. false /* delegate_treats_url_as_trustworthy */,
  4373. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4374. kCookieableSchemes),
  4375. MatchesCookieAccessResult(_, CookieEffectiveSameSite::NO_RESTRICTION, _,
  4376. false));
  4377. // Test IsSetPermitted CookieEffectiveSameSite for
  4378. // CanonicalCookie with CookieSameSite::LAX_MODE.
  4379. auto cookie_lax = CanonicalCookie::CreateUnsafeCookieForTesting(
  4380. "A", "2", "www.example.com", "/test", current_time, base::Time(),
  4381. base::Time(), base::Time(), true /*secure*/, false /*httponly*/,
  4382. CookieSameSite::LAX_MODE, COOKIE_PRIORITY_DEFAULT, false);
  4383. EXPECT_THAT(
  4384. cookie_lax->IsSetPermittedInContext(
  4385. url, options,
  4386. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  4387. false /* delegate_treats_url_as_trustworthy */,
  4388. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4389. kCookieableSchemes),
  4390. MatchesCookieAccessResult(_, CookieEffectiveSameSite::LAX_MODE, _,
  4391. false));
  4392. // Test IsSetPermitted CookieEffectiveSameSite for
  4393. // CanonicalCookie with CookieSameSite::STRICT_MODE.
  4394. auto cookie_strict = CanonicalCookie::CreateUnsafeCookieForTesting(
  4395. "A", "2", "www.example.com", "/test", current_time, base::Time(),
  4396. base::Time(), base::Time(), true /*secure*/, false /*httponly*/,
  4397. CookieSameSite::STRICT_MODE, COOKIE_PRIORITY_DEFAULT, false);
  4398. EXPECT_THAT(
  4399. cookie_strict->IsSetPermittedInContext(
  4400. url, options,
  4401. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  4402. false /* delegate_treats_url_as_trustworthy */,
  4403. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4404. kCookieableSchemes),
  4405. MatchesCookieAccessResult(_, CookieEffectiveSameSite::STRICT_MODE, _,
  4406. false));
  4407. // Test IsSetPermitted CookieEffectiveSameSite for
  4408. // CanonicalCookie with CookieSameSite::UNSPECIFIED.
  4409. base::Time creation_time = base::Time::Now() - (kLaxAllowUnsafeMaxAge * 4);
  4410. auto cookie_old_unspecified = CanonicalCookie::CreateUnsafeCookieForTesting(
  4411. "A", "2", "www.example.com", "/test", creation_time, base::Time(),
  4412. base::Time(), base::Time(), true /*secure*/, false /*httponly*/,
  4413. CookieSameSite::UNSPECIFIED, COOKIE_PRIORITY_DEFAULT, false);
  4414. auto cookie_unspecified = CanonicalCookie::CreateUnsafeCookieForTesting(
  4415. "A", "2", "www.example.com", "/test", current_time, base::Time(),
  4416. base::Time(), base::Time(), true /*secure*/, false /*httponly*/,
  4417. CookieSameSite::UNSPECIFIED, COOKIE_PRIORITY_DEFAULT, false);
  4418. EXPECT_THAT(
  4419. cookie_old_unspecified->IsSetPermittedInContext(
  4420. url, options,
  4421. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  4422. false /* delegate_treats_url_as_trustworthy */,
  4423. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4424. kCookieableSchemes),
  4425. MatchesCookieAccessResult(_, CookieEffectiveSameSite::LAX_MODE, _,
  4426. false));
  4427. EXPECT_THAT(
  4428. cookie_unspecified->IsSetPermittedInContext(
  4429. url, options,
  4430. CookieAccessParams(CookieAccessSemantics::UNKNOWN,
  4431. false /* delegate_treats_url_as_trustworthy */,
  4432. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4433. kCookieableSchemes),
  4434. MatchesCookieAccessResult(
  4435. _, CookieEffectiveSameSite::LAX_MODE_ALLOW_UNSAFE, _, false));
  4436. EXPECT_THAT(
  4437. cookie_unspecified->IsSetPermittedInContext(
  4438. url, options,
  4439. CookieAccessParams(CookieAccessSemantics::NONLEGACY,
  4440. false /* delegate_treats_url_as_trustworthy */,
  4441. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4442. kCookieableSchemes),
  4443. MatchesCookieAccessResult(
  4444. _, CookieEffectiveSameSite::LAX_MODE_ALLOW_UNSAFE, _, false));
  4445. EXPECT_THAT(
  4446. cookie_unspecified->IsSetPermittedInContext(
  4447. url, options,
  4448. CookieAccessParams(CookieAccessSemantics::LEGACY,
  4449. false /* delegate_treats_url_as_trustworthy */,
  4450. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4451. kCookieableSchemes),
  4452. MatchesCookieAccessResult(_, CookieEffectiveSameSite::NO_RESTRICTION, _,
  4453. false));
  4454. }
  4455. TEST(CanonicalCookieTest, IsSetPermitted_AllowedToAccessSecureCookies) {
  4456. GURL url("https://www.example.com/test");
  4457. GURL insecure_url("http://www.example.com/test");
  4458. GURL localhost_url("http://localhost/test");
  4459. base::Time current_time = base::Time::Now();
  4460. CookieOptions options;
  4461. for (bool secure : {false, true}) {
  4462. for (CookieSameSite same_site : {
  4463. CookieSameSite::UNSPECIFIED,
  4464. CookieSameSite::NO_RESTRICTION,
  4465. CookieSameSite::LAX_MODE,
  4466. CookieSameSite::STRICT_MODE,
  4467. }) {
  4468. for (bool same_party : {false, true}) {
  4469. // Skip setting SameParty and SameSite=Strict, since that is invalid.
  4470. if (same_party && same_site == CookieSameSite::STRICT_MODE)
  4471. continue;
  4472. auto cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  4473. "A", "2", "www.example.com", "/test", current_time, base::Time(),
  4474. base::Time(), base::Time(), secure, false /*httponly*/, same_site,
  4475. COOKIE_PRIORITY_DEFAULT, same_party);
  4476. for (bool delegate_treats_url_as_trustworthy : {false, true}) {
  4477. for (CookieAccessSemantics access_semantics : {
  4478. CookieAccessSemantics::UNKNOWN,
  4479. CookieAccessSemantics::LEGACY,
  4480. CookieAccessSemantics::NONLEGACY,
  4481. }) {
  4482. for (CookieSamePartyStatus same_party_status : {
  4483. CookieSamePartyStatus::kNoSamePartyEnforcement,
  4484. CookieSamePartyStatus::kEnforceSamePartyInclude,
  4485. CookieSamePartyStatus::kEnforceSamePartyExclude,
  4486. }) {
  4487. // Skip invalid combinations of `same_party` and
  4488. // `same_party_status`.
  4489. bool has_same_party_enforcement =
  4490. same_party_status !=
  4491. CookieSamePartyStatus::kNoSamePartyEnforcement;
  4492. if (has_same_party_enforcement != same_party) {
  4493. continue;
  4494. }
  4495. EXPECT_THAT(
  4496. cookie->IsSetPermittedInContext(
  4497. url, options,
  4498. CookieAccessParams(access_semantics,
  4499. delegate_treats_url_as_trustworthy,
  4500. same_party_status),
  4501. kCookieableSchemes),
  4502. MatchesCookieAccessResult(_, _, _, true));
  4503. EXPECT_THAT(
  4504. cookie->IsSetPermittedInContext(
  4505. insecure_url, options,
  4506. CookieAccessParams(access_semantics,
  4507. delegate_treats_url_as_trustworthy,
  4508. same_party_status),
  4509. kCookieableSchemes),
  4510. MatchesCookieAccessResult(
  4511. _, _, _, delegate_treats_url_as_trustworthy));
  4512. EXPECT_THAT(
  4513. cookie->IsSetPermittedInContext(
  4514. localhost_url, options,
  4515. CookieAccessParams(access_semantics,
  4516. delegate_treats_url_as_trustworthy,
  4517. same_party_status),
  4518. kCookieableSchemes),
  4519. MatchesCookieAccessResult(_, _, _, true));
  4520. }
  4521. }
  4522. }
  4523. }
  4524. }
  4525. }
  4526. }
  4527. TEST(CanonicalCookieTest, IsSetPermitted_SameSiteNone_Metrics) {
  4528. using SamePartyContextType = SamePartyContext::Type;
  4529. constexpr bool delegate_treats_url_as_trustworthy = false;
  4530. const base::Time now = base::Time::Now();
  4531. const auto make_cookie = [now](CookieSameSite same_site, bool same_party) {
  4532. return CanonicalCookie::CreateUnsafeCookieForTesting(
  4533. "A", "1", "www.example.com", "/test", now, base::Time(), base::Time(),
  4534. base::Time(), true /* secure */, false /*httponly*/, same_site,
  4535. COOKIE_PRIORITY_DEFAULT, same_party);
  4536. };
  4537. GURL url("https://www.example.com/test");
  4538. const std::unique_ptr<CanonicalCookie> same_site_none_cookie =
  4539. make_cookie(CookieSameSite::NO_RESTRICTION, false /* same_party */);
  4540. const std::unique_ptr<CanonicalCookie> same_party_cookie =
  4541. make_cookie(CookieSameSite::NO_RESTRICTION, true /* same_party */);
  4542. const std::unique_ptr<CanonicalCookie> same_site_lax_cookie =
  4543. make_cookie(CookieSameSite::LAX_MODE, false /* same_party */);
  4544. const std::unique_ptr<CanonicalCookie> same_site_strict_cookie =
  4545. make_cookie(CookieSameSite::STRICT_MODE, false /* same_party */);
  4546. CookieOptions options;
  4547. options.set_same_site_cookie_context(CookieOptions::SameSiteCookieContext(
  4548. CookieOptions::SameSiteCookieContext::ContextType::CROSS_SITE));
  4549. // Same as default, but just to be explicit:
  4550. options.set_same_party_context(
  4551. SamePartyContext(SamePartyContext::Type::kCrossParty));
  4552. EXPECT_THAT(
  4553. same_site_none_cookie->IsSetPermittedInContext(
  4554. url, options,
  4555. CookieAccessParams(CookieAccessSemantics::LEGACY,
  4556. delegate_treats_url_as_trustworthy,
  4557. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4558. kCookieableSchemes),
  4559. MatchesCookieAccessResult(CookieInclusionStatus(), _, _, true));
  4560. EXPECT_THAT(
  4561. same_party_cookie->IsSetPermittedInContext(
  4562. url, options,
  4563. CookieAccessParams(CookieAccessSemantics::LEGACY,
  4564. delegate_treats_url_as_trustworthy,
  4565. CookieSamePartyStatus::kEnforceSamePartyExclude),
  4566. kCookieableSchemes),
  4567. MatchesCookieAccessResult(Not(net::IsInclude()), _, _, true));
  4568. // Now tweak the context to allow a SameParty cookie (using the top&resource
  4569. // definition) and make sure we get the right warning. (Note: we make the
  4570. // "real" same-partyness value match the value computed for the metric, even
  4571. // though they would differ unless we changed the real definition.) Then
  4572. // check that if we modify the cookie as indicated, the set would be allowed.
  4573. options.set_same_party_context(
  4574. SamePartyContext(SamePartyContextType::kSameParty));
  4575. EXPECT_THAT(
  4576. same_site_none_cookie->IsSetPermittedInContext(
  4577. url, options,
  4578. CookieAccessParams(CookieAccessSemantics::LEGACY,
  4579. delegate_treats_url_as_trustworthy,
  4580. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4581. kCookieableSchemes),
  4582. MatchesCookieAccessResult(CookieInclusionStatus(), _, _, true));
  4583. EXPECT_THAT(
  4584. same_party_cookie->IsSetPermittedInContext(
  4585. url, options,
  4586. CookieAccessParams(CookieAccessSemantics::LEGACY,
  4587. delegate_treats_url_as_trustworthy,
  4588. CookieSamePartyStatus::kEnforceSamePartyInclude),
  4589. kCookieableSchemes),
  4590. MatchesCookieAccessResult(net::IsInclude(), _, _, true));
  4591. EXPECT_THAT(
  4592. same_site_lax_cookie->IsSetPermittedInContext(
  4593. url, options,
  4594. CookieAccessParams(CookieAccessSemantics::LEGACY,
  4595. delegate_treats_url_as_trustworthy,
  4596. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4597. kCookieableSchemes),
  4598. MatchesCookieAccessResult(Not(net::IsInclude()), _, _, true));
  4599. // Next: allow a SameParty cookie (using both definitions).
  4600. options.set_same_party_context(SamePartyContext::MakeInclusive());
  4601. EXPECT_THAT(
  4602. same_site_none_cookie->IsSetPermittedInContext(
  4603. url, options,
  4604. CookieAccessParams(CookieAccessSemantics::LEGACY,
  4605. delegate_treats_url_as_trustworthy,
  4606. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4607. kCookieableSchemes),
  4608. MatchesCookieAccessResult(CookieInclusionStatus(), _, _, true));
  4609. EXPECT_THAT(
  4610. same_party_cookie->IsSetPermittedInContext(
  4611. url, options,
  4612. CookieAccessParams(CookieAccessSemantics::LEGACY,
  4613. delegate_treats_url_as_trustworthy,
  4614. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4615. kCookieableSchemes),
  4616. MatchesCookieAccessResult(net::IsInclude(), _, _, true));
  4617. EXPECT_THAT(
  4618. same_site_lax_cookie->IsSetPermittedInContext(
  4619. url, options,
  4620. CookieAccessParams(CookieAccessSemantics::LEGACY,
  4621. delegate_treats_url_as_trustworthy,
  4622. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4623. kCookieableSchemes),
  4624. MatchesCookieAccessResult(Not(net::IsInclude()), _, _, true));
  4625. // Next: allow a SameSite=Lax or SameSite=Strict cookie.
  4626. options.set_same_site_cookie_context(CookieOptions::SameSiteCookieContext(
  4627. CookieOptions::SameSiteCookieContext::ContextType::SAME_SITE_LAX));
  4628. EXPECT_THAT(
  4629. same_site_none_cookie->IsSetPermittedInContext(
  4630. url, options,
  4631. CookieAccessParams(CookieAccessSemantics::LEGACY,
  4632. delegate_treats_url_as_trustworthy,
  4633. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4634. kCookieableSchemes),
  4635. MatchesCookieAccessResult(CookieInclusionStatus(), _, _, true));
  4636. EXPECT_THAT(
  4637. same_site_lax_cookie->IsSetPermittedInContext(
  4638. url, options,
  4639. CookieAccessParams(CookieAccessSemantics::LEGACY,
  4640. delegate_treats_url_as_trustworthy,
  4641. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4642. kCookieableSchemes),
  4643. MatchesCookieAccessResult(net::IsInclude(), _, _, true));
  4644. EXPECT_THAT(
  4645. same_site_strict_cookie->IsSetPermittedInContext(
  4646. url, options,
  4647. CookieAccessParams(CookieAccessSemantics::LEGACY,
  4648. delegate_treats_url_as_trustworthy,
  4649. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4650. kCookieableSchemes),
  4651. MatchesCookieAccessResult(net::IsInclude(), _, _, true));
  4652. }
  4653. TEST(CanonicalCookieTest, IsSetPermitted_SameParty) {
  4654. GURL url("https://www.example.com/test");
  4655. base::Time current_time = base::Time::Now();
  4656. CookieOptions options;
  4657. options.set_same_site_cookie_context(CookieOptions::SameSiteCookieContext(
  4658. CookieOptions::SameSiteCookieContext::ContextType::CROSS_SITE));
  4659. options.set_same_party_context(
  4660. SamePartyContext(SamePartyContext::Type::kSameParty));
  4661. {
  4662. bool delegate_treats_url_as_trustworthy = false;
  4663. auto cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  4664. "A", "2", "www.example.com", "/test", current_time, base::Time(),
  4665. base::Time(), base::Time(), true /* secure */, false /*httponly*/,
  4666. CookieSameSite::LAX_MODE, COOKIE_PRIORITY_DEFAULT,
  4667. true /* same_party */);
  4668. // The following access would normally be excluded due to SameSite=Lax, but
  4669. // SameParty overrides SameSite.
  4670. EXPECT_THAT(
  4671. cookie->IsSetPermittedInContext(
  4672. url, options,
  4673. CookieAccessParams(CookieAccessSemantics::LEGACY,
  4674. delegate_treats_url_as_trustworthy,
  4675. CookieSamePartyStatus::kEnforceSamePartyExclude),
  4676. kCookieableSchemes),
  4677. MatchesCookieAccessResult(
  4678. CookieInclusionStatus::MakeFromReasonsForTesting(
  4679. {CookieInclusionStatus::EXCLUDE_SAMEPARTY_CROSS_PARTY_CONTEXT},
  4680. {CookieInclusionStatus::WARN_TREATED_AS_SAMEPARTY}),
  4681. _, _, true));
  4682. }
  4683. for (CookieSameSite same_site : {
  4684. CookieSameSite::UNSPECIFIED,
  4685. CookieSameSite::NO_RESTRICTION,
  4686. CookieSameSite::LAX_MODE,
  4687. }) {
  4688. auto cookie = CanonicalCookie::CreateUnsafeCookieForTesting(
  4689. "A", "2", "www.example.com", "/test", current_time, base::Time(),
  4690. base::Time(), base::Time(), true /* secure */, false /*httponly*/,
  4691. same_site, COOKIE_PRIORITY_DEFAULT, true /* same_party */);
  4692. for (bool delegate_treats_url_as_trustworthy : {false, true}) {
  4693. for (CookieAccessSemantics access_semantics : {
  4694. CookieAccessSemantics::UNKNOWN,
  4695. CookieAccessSemantics::LEGACY,
  4696. CookieAccessSemantics::NONLEGACY,
  4697. }) {
  4698. EXPECT_THAT(
  4699. cookie->IsSetPermittedInContext(
  4700. url, options,
  4701. CookieAccessParams(
  4702. access_semantics, delegate_treats_url_as_trustworthy,
  4703. CookieSamePartyStatus::kEnforceSamePartyInclude),
  4704. kCookieableSchemes),
  4705. MatchesCookieAccessResult(IsInclude(), _, _, true));
  4706. }
  4707. }
  4708. }
  4709. }
  4710. // Test that the CookieInclusionStatus warning for inclusion changed by
  4711. // cross-site redirect context downgrade is applied correctly.
  4712. TEST(CanonicalCookieTest, IsSetPermittedInContext_RedirectDowngradeWarning) {
  4713. using Context = CookieOptions::SameSiteCookieContext;
  4714. using ContextType = Context::ContextType;
  4715. GURL url("https://www.example.test/test");
  4716. GURL insecure_url("http://www.example.test/test");
  4717. // Test cases to be used with a lax-to-cross context downgrade.
  4718. const struct {
  4719. ContextType context_type;
  4720. CookieSameSite samesite;
  4721. bool expect_cross_site_redirect_warning;
  4722. } kTestCases[] = {
  4723. {ContextType::SAME_SITE_LAX, CookieSameSite::STRICT_MODE, true},
  4724. {ContextType::CROSS_SITE, CookieSameSite::STRICT_MODE, true},
  4725. {ContextType::SAME_SITE_LAX, CookieSameSite::LAX_MODE, true},
  4726. {ContextType::CROSS_SITE, CookieSameSite::LAX_MODE, true},
  4727. {ContextType::SAME_SITE_LAX, CookieSameSite::NO_RESTRICTION, false},
  4728. {ContextType::CROSS_SITE, CookieSameSite::NO_RESTRICTION, false},
  4729. };
  4730. for (bool consider_redirects : {true, false}) {
  4731. base::test::ScopedFeatureList feature_list;
  4732. feature_list.InitWithFeatureState(
  4733. features::kCookieSameSiteConsidersRedirectChain, consider_redirects);
  4734. for (CookieAccessSemantics semantics :
  4735. {CookieAccessSemantics::LEGACY, CookieAccessSemantics::NONLEGACY}) {
  4736. // There are no downgrade warnings for undowngraded contexts.
  4737. for (ContextType context_type : {ContextType::SAME_SITE_LAX,
  4738. ContextType::SAME_SITE_LAX_METHOD_UNSAFE,
  4739. ContextType::CROSS_SITE}) {
  4740. for (CookieSameSite samesite :
  4741. {CookieSameSite::UNSPECIFIED, CookieSameSite::NO_RESTRICTION,
  4742. CookieSameSite::LAX_MODE, CookieSameSite::STRICT_MODE}) {
  4743. std::unique_ptr<CanonicalCookie> cookie =
  4744. CanonicalCookie::CreateUnsafeCookieForTesting(
  4745. "A", "1", "www.example.test", "/test", base::Time::Now(),
  4746. base::Time(), base::Time(), base::Time(), /*secure=*/true,
  4747. /*httponly=*/false, samesite, COOKIE_PRIORITY_DEFAULT,
  4748. /*same_party=*/false);
  4749. CookieOptions options;
  4750. options.set_same_site_cookie_context(Context(context_type));
  4751. EXPECT_FALSE(
  4752. cookie
  4753. ->IsSetPermittedInContext(
  4754. url, options,
  4755. CookieAccessParams(
  4756. semantics,
  4757. /*delegate_treats_url_as_trustworthy=*/false,
  4758. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4759. kCookieableSchemes)
  4760. .status.HasWarningReason(
  4761. CookieInclusionStatus::
  4762. WARN_CROSS_SITE_REDIRECT_DOWNGRADE_CHANGES_INCLUSION));
  4763. }
  4764. }
  4765. for (const auto& test : kTestCases) {
  4766. std::unique_ptr<CanonicalCookie> cookie =
  4767. CanonicalCookie::CreateUnsafeCookieForTesting(
  4768. "A", "1", "www.example.test", "/test", base::Time::Now(),
  4769. base::Time(), base::Time(), base::Time(), /*secure=*/true,
  4770. /*httponly=*/false, test.samesite, COOKIE_PRIORITY_DEFAULT,
  4771. /*same_party=*/false);
  4772. Context::ContextMetadata lax_cross_downgrade_metadata;
  4773. lax_cross_downgrade_metadata.cross_site_redirect_downgrade =
  4774. Context::ContextMetadata::ContextDowngradeType::kLaxToCross;
  4775. CookieOptions options;
  4776. options.set_same_site_cookie_context(Context(
  4777. test.context_type, test.context_type, lax_cross_downgrade_metadata,
  4778. lax_cross_downgrade_metadata));
  4779. EXPECT_EQ(
  4780. cookie
  4781. ->IsSetPermittedInContext(
  4782. url, options,
  4783. CookieAccessParams(
  4784. semantics,
  4785. /*delegate_treats_url_as_trustworthy=*/false,
  4786. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4787. kCookieableSchemes)
  4788. .status.HasWarningReason(
  4789. CookieInclusionStatus::
  4790. WARN_CROSS_SITE_REDIRECT_DOWNGRADE_CHANGES_INCLUSION),
  4791. test.expect_cross_site_redirect_warning);
  4792. // SameSite warnings not applied if other exclusion reasons apply (e.g.
  4793. // non-https with Secure attribute).
  4794. EXPECT_FALSE(
  4795. cookie
  4796. ->IsSetPermittedInContext(
  4797. insecure_url, options,
  4798. CookieAccessParams(
  4799. semantics,
  4800. /*delegate_treats_url_as_trustworthy=*/false,
  4801. CookieSamePartyStatus::kNoSamePartyEnforcement),
  4802. kCookieableSchemes)
  4803. .status.HasWarningReason(
  4804. CookieInclusionStatus::
  4805. WARN_CROSS_SITE_REDIRECT_DOWNGRADE_CHANGES_INCLUSION));
  4806. }
  4807. }
  4808. }
  4809. }
  4810. TEST(CanonicalCookieTest, TestIsCanonicalWithInvalidSizeHistograms) {
  4811. base::HistogramTester histograms;
  4812. const char kFromStorageWithValidLengthHistogram[] =
  4813. "Cookie.FromStorageWithValidLength";
  4814. const base::HistogramBase::Sample kInValid = 0;
  4815. const base::HistogramBase::Sample kValid = 1;
  4816. base::Time two_hours_ago = base::Time::Now() - base::Hours(2);
  4817. base::Time one_hour_ago = base::Time::Now() - base::Hours(1);
  4818. base::Time one_hour_from_now = base::Time::Now() + base::Hours(1);
  4819. // Test a cookie that is canonical and valid size
  4820. EXPECT_TRUE(CanonicalCookie::FromStorage(
  4821. "A", "B", "www.foo.com", "/bar", two_hours_ago, one_hour_from_now,
  4822. one_hour_ago, one_hour_ago, false /*secure*/, false /*httponly*/,
  4823. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  4824. false /*same_party*/, absl::nullopt /*partition_key*/,
  4825. CookieSourceScheme::kSecure, 87));
  4826. histograms.ExpectBucketCount(kFromStorageWithValidLengthHistogram, kInValid,
  4827. 0);
  4828. histograms.ExpectBucketCount(kFromStorageWithValidLengthHistogram, kValid, 1);
  4829. // Test loading a couple of cookies which are canonical but with an invalid
  4830. // size
  4831. const std::string kCookieBig(4096, 'a');
  4832. EXPECT_TRUE(CanonicalCookie::FromStorage(
  4833. kCookieBig, "B", "www.foo.com", "/bar", two_hours_ago, one_hour_from_now,
  4834. one_hour_ago, one_hour_ago, false /*secure*/, false /*httponly*/,
  4835. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  4836. false /*same_party*/, absl::nullopt /*partition_key*/,
  4837. CookieSourceScheme::kSecure, 87));
  4838. EXPECT_TRUE(CanonicalCookie::FromStorage(
  4839. "A", kCookieBig, "www.foo.com", "/bar", two_hours_ago, one_hour_from_now,
  4840. one_hour_ago, one_hour_ago, false /*secure*/, false /*httponly*/,
  4841. CookieSameSite::NO_RESTRICTION, COOKIE_PRIORITY_DEFAULT,
  4842. false /*same_party*/, absl::nullopt /*partition_key*/,
  4843. CookieSourceScheme::kSecure, 87));
  4844. histograms.ExpectBucketCount(kFromStorageWithValidLengthHistogram, kInValid,
  4845. 2);
  4846. histograms.ExpectBucketCount(kFromStorageWithValidLengthHistogram, kValid, 1);
  4847. }
  4848. TEST(CanonicalCookieTest, TestHasHiddenPrefixName) {
  4849. const struct {
  4850. const char* value;
  4851. bool result;
  4852. } kTestCases[] = {
  4853. {"", false},
  4854. {" ", false},
  4855. {"foobar=", false},
  4856. {"foo=bar", false},
  4857. {" \t ", false},
  4858. {"\t", false},
  4859. {"__Secure-abc", false},
  4860. {"__Secure=-", false},
  4861. {"__Secure=-abc", false},
  4862. {"__Secur=e-abc", false},
  4863. {"__Secureabc", false},
  4864. {"__Host=-", false},
  4865. {"__Host=-abc", false},
  4866. {"__Host-abc", false},
  4867. {"__Hos=t-abc", false},
  4868. {"_Host", false},
  4869. {" __Secure-abc", false},
  4870. {"\t__Host-", false},
  4871. {"a__Host-abc=123", false},
  4872. {"a__Secure-abc=123", false},
  4873. {"__Host-=", true},
  4874. {"__Host-=123", true},
  4875. {"__Host-abc=", true},
  4876. {"__Host-abc=123", true},
  4877. {" __Host-abc=123", true},
  4878. {" __Host-abc=", true},
  4879. {"\t\t\t\t\t__Host-abc=123", true},
  4880. {"\t __Host-abc=", true},
  4881. {"__Secure-=", true},
  4882. {"__Secure-=123", true},
  4883. {"__Secure-abc=", true},
  4884. {"__Secure-abc=123", true},
  4885. {" __Secure-abc=123", true},
  4886. {" __Secure-abc=", true},
  4887. {"\t\t\t\t\t__Secure-abc=123", true},
  4888. {"\t __Secure-abc=", true},
  4889. {"__Secure-abc=123=d=4=fg=", true},
  4890. };
  4891. for (auto test_case : kTestCases) {
  4892. EXPECT_EQ(CanonicalCookie::HasHiddenPrefixName(test_case.value),
  4893. test_case.result)
  4894. << test_case.value << " failed check";
  4895. }
  4896. }
  4897. } // namespace net