cookie_inclusion_status.cc 12 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316
  1. // Copyright 2020 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "net/cookies/cookie_inclusion_status.h"
  5. #include <initializer_list>
  6. #include <utility>
  7. #include "base/strings/strcat.h"
  8. #include "url/gurl.h"
  9. namespace net {
  10. CookieInclusionStatus::CookieInclusionStatus() = default;
  11. CookieInclusionStatus::CookieInclusionStatus(ExclusionReason reason) {
  12. exclusion_reasons_[reason] = true;
  13. }
  14. CookieInclusionStatus::CookieInclusionStatus(ExclusionReason reason,
  15. WarningReason warning) {
  16. exclusion_reasons_[reason] = true;
  17. warning_reasons_[warning] = true;
  18. }
  19. CookieInclusionStatus::CookieInclusionStatus(WarningReason warning) {
  20. warning_reasons_[warning] = true;
  21. }
  22. CookieInclusionStatus::CookieInclusionStatus(
  23. const CookieInclusionStatus& other) = default;
  24. CookieInclusionStatus& CookieInclusionStatus::operator=(
  25. const CookieInclusionStatus& other) = default;
  26. bool CookieInclusionStatus::operator==(
  27. const CookieInclusionStatus& other) const {
  28. return exclusion_reasons_ == other.exclusion_reasons_ &&
  29. warning_reasons_ == other.warning_reasons_;
  30. }
  31. bool CookieInclusionStatus::operator!=(
  32. const CookieInclusionStatus& other) const {
  33. return !operator==(other);
  34. }
  35. bool CookieInclusionStatus::IsInclude() const {
  36. return exclusion_reasons_.none();
  37. }
  38. bool CookieInclusionStatus::HasExclusionReason(ExclusionReason reason) const {
  39. return exclusion_reasons_[reason];
  40. }
  41. bool CookieInclusionStatus::HasOnlyExclusionReason(
  42. ExclusionReason reason) const {
  43. return exclusion_reasons_[reason] && exclusion_reasons_.count() == 1;
  44. }
  45. void CookieInclusionStatus::AddExclusionReason(ExclusionReason reason) {
  46. exclusion_reasons_[reason] = true;
  47. // If the cookie would be excluded for reasons other than the new SameSite
  48. // rules, don't bother warning about it.
  49. MaybeClearSameSiteWarning();
  50. }
  51. void CookieInclusionStatus::RemoveExclusionReason(ExclusionReason reason) {
  52. exclusion_reasons_[reason] = false;
  53. }
  54. void CookieInclusionStatus::RemoveExclusionReasons(
  55. const std::vector<ExclusionReason>& reasons) {
  56. exclusion_reasons_ = ExclusionReasonsWithout(reasons);
  57. }
  58. CookieInclusionStatus::ExclusionReasonBitset
  59. CookieInclusionStatus::ExclusionReasonsWithout(
  60. const std::vector<ExclusionReason>& reasons) const {
  61. CookieInclusionStatus::ExclusionReasonBitset result(exclusion_reasons_);
  62. for (const ExclusionReason reason : reasons) {
  63. result[reason] = false;
  64. }
  65. return result;
  66. }
  67. void CookieInclusionStatus::MaybeClearSameSiteWarning() {
  68. if (ExclusionReasonsWithout({
  69. EXCLUDE_SAMESITE_UNSPECIFIED_TREATED_AS_LAX,
  70. EXCLUDE_SAMESITE_NONE_INSECURE,
  71. }) != 0u) {
  72. RemoveWarningReason(WARN_SAMESITE_UNSPECIFIED_CROSS_SITE_CONTEXT);
  73. RemoveWarningReason(WARN_SAMESITE_NONE_INSECURE);
  74. RemoveWarningReason(WARN_SAMESITE_UNSPECIFIED_LAX_ALLOW_UNSAFE);
  75. }
  76. if (!ShouldRecordDowngradeMetrics()) {
  77. RemoveWarningReason(WARN_STRICT_LAX_DOWNGRADE_STRICT_SAMESITE);
  78. RemoveWarningReason(WARN_STRICT_CROSS_DOWNGRADE_STRICT_SAMESITE);
  79. RemoveWarningReason(WARN_STRICT_CROSS_DOWNGRADE_LAX_SAMESITE);
  80. RemoveWarningReason(WARN_LAX_CROSS_DOWNGRADE_STRICT_SAMESITE);
  81. RemoveWarningReason(WARN_LAX_CROSS_DOWNGRADE_LAX_SAMESITE);
  82. RemoveWarningReason(WARN_CROSS_SITE_REDIRECT_DOWNGRADE_CHANGES_INCLUSION);
  83. }
  84. }
  85. bool CookieInclusionStatus::ShouldRecordDowngradeMetrics() const {
  86. return ExclusionReasonsWithout({
  87. EXCLUDE_SAMESITE_STRICT,
  88. EXCLUDE_SAMESITE_LAX,
  89. EXCLUDE_SAMESITE_UNSPECIFIED_TREATED_AS_LAX,
  90. }) == 0u;
  91. }
  92. bool CookieInclusionStatus::ShouldWarn() const {
  93. return warning_reasons_.any();
  94. }
  95. bool CookieInclusionStatus::HasWarningReason(WarningReason reason) const {
  96. return warning_reasons_[reason];
  97. }
  98. bool CookieInclusionStatus::HasDowngradeWarning(
  99. CookieInclusionStatus::WarningReason* reason) const {
  100. if (!ShouldWarn())
  101. return false;
  102. const CookieInclusionStatus::WarningReason kDowngradeWarnings[] = {
  103. WARN_STRICT_LAX_DOWNGRADE_STRICT_SAMESITE,
  104. WARN_STRICT_CROSS_DOWNGRADE_STRICT_SAMESITE,
  105. WARN_STRICT_CROSS_DOWNGRADE_LAX_SAMESITE,
  106. WARN_LAX_CROSS_DOWNGRADE_STRICT_SAMESITE,
  107. WARN_LAX_CROSS_DOWNGRADE_LAX_SAMESITE,
  108. };
  109. for (auto warning : kDowngradeWarnings) {
  110. if (!HasWarningReason(warning))
  111. continue;
  112. if (reason)
  113. *reason = warning;
  114. return true;
  115. }
  116. return false;
  117. }
  118. void CookieInclusionStatus::AddWarningReason(WarningReason reason) {
  119. warning_reasons_[reason] = true;
  120. }
  121. void CookieInclusionStatus::RemoveWarningReason(WarningReason reason) {
  122. warning_reasons_[reason] = false;
  123. }
  124. CookieInclusionStatus::ContextDowngradeMetricValues
  125. CookieInclusionStatus::GetBreakingDowngradeMetricsEnumValue(
  126. const GURL& url) const {
  127. bool url_is_secure = url.SchemeIsCryptographic();
  128. // Start the |reason| as something other than the downgrade warnings.
  129. WarningReason reason = WarningReason::NUM_WARNING_REASONS;
  130. // Don't bother checking the return value because the default switch case
  131. // will handle if no reason was found.
  132. HasDowngradeWarning(&reason);
  133. switch (reason) {
  134. case WarningReason::WARN_STRICT_LAX_DOWNGRADE_STRICT_SAMESITE:
  135. return url_is_secure
  136. ? ContextDowngradeMetricValues::kStrictLaxStrictSecure
  137. : ContextDowngradeMetricValues::kStrictLaxStrictInsecure;
  138. case WarningReason::WARN_STRICT_CROSS_DOWNGRADE_STRICT_SAMESITE:
  139. return url_is_secure
  140. ? ContextDowngradeMetricValues::kStrictCrossStrictSecure
  141. : ContextDowngradeMetricValues::kStrictCrossStrictInsecure;
  142. case WarningReason::WARN_STRICT_CROSS_DOWNGRADE_LAX_SAMESITE:
  143. return url_is_secure
  144. ? ContextDowngradeMetricValues::kStrictCrossLaxSecure
  145. : ContextDowngradeMetricValues::kStrictCrossLaxInsecure;
  146. case WarningReason::WARN_LAX_CROSS_DOWNGRADE_STRICT_SAMESITE:
  147. return url_is_secure
  148. ? ContextDowngradeMetricValues::kLaxCrossStrictSecure
  149. : ContextDowngradeMetricValues::kLaxCrossStrictInsecure;
  150. case WarningReason::WARN_LAX_CROSS_DOWNGRADE_LAX_SAMESITE:
  151. return url_is_secure ? ContextDowngradeMetricValues::kLaxCrossLaxSecure
  152. : ContextDowngradeMetricValues::kLaxCrossLaxInsecure;
  153. default:
  154. return url_is_secure ? ContextDowngradeMetricValues::kNoDowngradeSecure
  155. : ContextDowngradeMetricValues::kNoDowngradeInsecure;
  156. }
  157. }
  158. std::string CookieInclusionStatus::GetDebugString() const {
  159. std::string out;
  160. if (IsInclude())
  161. base::StrAppend(&out, {"INCLUDE, "});
  162. for (const auto& reason :
  163. std::initializer_list<std::pair<ExclusionReason, std::string>>{
  164. {EXCLUDE_UNKNOWN_ERROR, "EXCLUDE_UNKNOWN_ERROR"},
  165. {EXCLUDE_HTTP_ONLY, "EXCLUDE_HTTP_ONLY"},
  166. {EXCLUDE_SECURE_ONLY, "EXCLUDE_SECURE_ONLY"},
  167. {EXCLUDE_DOMAIN_MISMATCH, "EXCLUDE_DOMAIN_MISMATCH"},
  168. {EXCLUDE_NOT_ON_PATH, "EXCLUDE_NOT_ON_PATH"},
  169. {EXCLUDE_SAMESITE_STRICT, "EXCLUDE_SAMESITE_STRICT"},
  170. {EXCLUDE_SAMESITE_LAX, "EXCLUDE_SAMESITE_LAX"},
  171. {EXCLUDE_SAMESITE_UNSPECIFIED_TREATED_AS_LAX,
  172. "EXCLUDE_SAMESITE_UNSPECIFIED_TREATED_AS_LAX"},
  173. {EXCLUDE_SAMESITE_NONE_INSECURE, "EXCLUDE_SAMESITE_NONE_INSECURE"},
  174. {EXCLUDE_USER_PREFERENCES, "EXCLUDE_USER_PREFERENCES"},
  175. {EXCLUDE_SAMEPARTY_CROSS_PARTY_CONTEXT,
  176. "EXCLUDE_SAMEPARTY_CROSS_PARTY_CONTEXT"},
  177. {EXCLUDE_FAILURE_TO_STORE, "EXCLUDE_FAILURE_TO_STORE"},
  178. {EXCLUDE_NONCOOKIEABLE_SCHEME, "EXCLUDE_NONCOOKIEABLE_SCHEME"},
  179. {EXCLUDE_OVERWRITE_SECURE, "EXCLUDE_OVERWRITE_SECURE"},
  180. {EXCLUDE_OVERWRITE_HTTP_ONLY, "EXCLUDE_OVERWRITE_HTTP_ONLY"},
  181. {EXCLUDE_INVALID_DOMAIN, "EXCLUDE_INVALID_DOMAIN"},
  182. {EXCLUDE_INVALID_PREFIX, "EXCLUDE_INVALID_PREFIX"},
  183. {EXCLUDE_INVALID_SAMEPARTY, "EXCLUDE_INVALID_SAMEPARTY"},
  184. {EXCLUDE_INVALID_PARTITIONED, "EXCLUDE_INVALID_PARTITIONED"},
  185. {EXCLUDE_NAME_VALUE_PAIR_EXCEEDS_MAX_SIZE,
  186. "EXCLUDE_NAME_VALUE_PAIR_EXCEEDS_MAX_SIZE"},
  187. {EXCLUDE_ATTRIBUTE_VALUE_EXCEEDS_MAX_SIZE,
  188. "EXCLUDE_ATTRIBUTE_VALUE_EXCEEDS_MAX_SIZE"},
  189. {EXCLUDE_DOMAIN_NON_ASCII, "EXCLUDE_DOMAIN_NON_ASCII"},
  190. }) {
  191. if (HasExclusionReason(reason.first))
  192. base::StrAppend(&out, {reason.second, ", "});
  193. }
  194. // Add warning
  195. if (!ShouldWarn()) {
  196. base::StrAppend(&out, {"DO_NOT_WARN"});
  197. return out;
  198. }
  199. for (const auto& reason :
  200. std::initializer_list<std::pair<WarningReason, std::string>>{
  201. {WARN_SAMESITE_UNSPECIFIED_CROSS_SITE_CONTEXT,
  202. "WARN_SAMESITE_UNSPECIFIED_CROSS_SITE_CONTEXT"},
  203. {WARN_SAMESITE_NONE_INSECURE, "WARN_SAMESITE_NONE_INSECURE"},
  204. {WARN_SAMESITE_UNSPECIFIED_LAX_ALLOW_UNSAFE,
  205. "WARN_SAMESITE_UNSPECIFIED_LAX_ALLOW_UNSAFE"},
  206. {WARN_STRICT_LAX_DOWNGRADE_STRICT_SAMESITE,
  207. "WARN_STRICT_LAX_DOWNGRADE_STRICT_SAMESITE"},
  208. {WARN_STRICT_CROSS_DOWNGRADE_STRICT_SAMESITE,
  209. "WARN_STRICT_CROSS_DOWNGRADE_STRICT_SAMESITE"},
  210. {WARN_STRICT_CROSS_DOWNGRADE_LAX_SAMESITE,
  211. "WARN_STRICT_CROSS_DOWNGRADE_LAX_SAMESITE"},
  212. {WARN_LAX_CROSS_DOWNGRADE_STRICT_SAMESITE,
  213. "WARN_LAX_CROSS_DOWNGRADE_STRICT_SAMESITE"},
  214. {WARN_LAX_CROSS_DOWNGRADE_LAX_SAMESITE,
  215. "WARN_LAX_CROSS_DOWNGRADE_LAX_SAMESITE"},
  216. {WARN_SECURE_ACCESS_GRANTED_NON_CRYPTOGRAPHIC,
  217. "WARN_SECURE_ACCESS_GRANTED_NON_CRYPTOGRAPHIC"},
  218. {WARN_SAMEPARTY_EXCLUSION_OVERRULED_SAMESITE,
  219. "WARN_SAMEPARTY_EXCLUSION_OVERRULED_SAMESITE"},
  220. {WARN_SAMEPARTY_INCLUSION_OVERRULED_SAMESITE,
  221. "WARN_SAMEPARTY_INCLUSION_OVERRULED_SAMESITE"},
  222. {WARN_CROSS_SITE_REDIRECT_DOWNGRADE_CHANGES_INCLUSION,
  223. "WARN_CROSS_SITE_REDIRECT_DOWNGRADE_CHANGES_INCLUSION"},
  224. {WARN_ATTRIBUTE_VALUE_EXCEEDS_MAX_SIZE,
  225. "WARN_ATTRIBUTE_VALUE_EXCEEDS_MAX_SIZE"},
  226. {WARN_DOMAIN_NON_ASCII, "WARN_DOMAIN_NON_ASCII"},
  227. }) {
  228. if (HasWarningReason(reason.first))
  229. base::StrAppend(&out, {reason.second, ", "});
  230. }
  231. // Strip trailing comma and space.
  232. out.erase(out.end() - 2, out.end());
  233. return out;
  234. }
  235. bool CookieInclusionStatus::HasExactlyExclusionReasonsForTesting(
  236. std::vector<CookieInclusionStatus::ExclusionReason> reasons) const {
  237. CookieInclusionStatus expected = MakeFromReasonsForTesting(reasons);
  238. return expected.exclusion_reasons_ == exclusion_reasons_;
  239. }
  240. bool CookieInclusionStatus::HasExactlyWarningReasonsForTesting(
  241. std::vector<WarningReason> reasons) const {
  242. CookieInclusionStatus expected = MakeFromReasonsForTesting({}, reasons);
  243. return expected.warning_reasons_ == warning_reasons_;
  244. }
  245. // static
  246. bool CookieInclusionStatus::ValidateExclusionAndWarningFromWire(
  247. uint32_t exclusion_reasons,
  248. uint32_t warning_reasons) {
  249. uint32_t exclusion_mask =
  250. static_cast<uint32_t>(~0ul << ExclusionReason::NUM_EXCLUSION_REASONS);
  251. uint32_t warning_mask =
  252. static_cast<uint32_t>(~0ul << WarningReason::NUM_WARNING_REASONS);
  253. return (exclusion_reasons & exclusion_mask) == 0 &&
  254. (warning_reasons & warning_mask) == 0;
  255. }
  256. CookieInclusionStatus CookieInclusionStatus::MakeFromReasonsForTesting(
  257. std::vector<ExclusionReason> reasons,
  258. std::vector<WarningReason> warnings) {
  259. CookieInclusionStatus status;
  260. for (ExclusionReason reason : reasons) {
  261. status.AddExclusionReason(reason);
  262. }
  263. for (WarningReason warning : warnings) {
  264. status.AddWarningReason(warning);
  265. }
  266. return status;
  267. }
  268. } // namespace net