123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572 |
- // Copyright (c) 2012 The Chromium Authors. All rights reserved.
- // Use of this source code is governed by a BSD-style license that can be
- // found in the LICENSE file.
- #include <stdint.h>
- #include <iterator>
- #include "base/base64.h"
- #include "base/stl_util.h"
- #include "base/strings/string_piece.h"
- #include "crypto/sha2.h"
- #include "net/base/host_port_pair.h"
- #include "net/base/test_completion_callback.h"
- #include "net/http/http_security_headers.h"
- #include "net/http/http_util.h"
- #include "net/http/transport_security_state.h"
- #include "net/ssl/ssl_info.h"
- #include "testing/gtest/include/gtest/gtest.h"
- namespace net {
- namespace {
- namespace test_default {
- #include "base/time/time.h"
- #include "net/http/transport_security_state_static_unittest_default.h"
- }
- } // anonymous namespace
- class HttpSecurityHeadersTest : public testing::Test {
- public:
- ~HttpSecurityHeadersTest() override {
- SetTransportSecurityStateSourceForTesting(nullptr);
- }
- };
- TEST_F(HttpSecurityHeadersTest, BogusHeaders) {
- base::TimeDelta max_age;
- bool include_subdomains = false;
- EXPECT_FALSE(
- ParseHSTSHeader(std::string(), &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader(" ", &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("abc", &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader(" abc", &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader(" abc ", &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age", &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader(" max-age", &max_age,
- &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader(" max-age ", &max_age,
- &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age=", &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader(" max-age=", &max_age,
- &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader(" max-age =", &max_age,
- &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader(" max-age= ", &max_age,
- &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader(" max-age = ", &max_age,
- &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader(" max-age = xy", &max_age,
- &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader(" max-age = 3488a923", &max_age,
- &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age=3488a923 ", &max_age,
- &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-ag=3488923", &max_age,
- &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-aged=3488923", &max_age,
- &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age==3488923", &max_age,
- &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("amax-age=3488923", &max_age,
- &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age=-3488923", &max_age,
- &include_subdomains));
- EXPECT_FALSE(
- ParseHSTSHeader("max-age=+3488923", &max_age, &include_subdomains));
- EXPECT_FALSE(
- ParseHSTSHeader("max-age=13####", &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age=9223372036854775807#####", &max_age,
- &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age=18446744073709551615####", &max_age,
- &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age=999999999999999999999999$.&#!",
- &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 e", &max_age,
- &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 includesubdomain",
- &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age=3488923includesubdomains",
- &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age=3488923=includesubdomains",
- &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 includesubdomainx",
- &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 includesubdomain=",
- &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 includesubdomain=true",
- &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 includesubdomainsx",
- &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 includesubdomains x",
- &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age=34889.23 includesubdomains",
- &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age=34889 includesubdomains",
- &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader(";;;; ;;;",
- &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader(";;;; includeSubDomains;;;",
- &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader(" includeSubDomains; ",
- &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader(";",
- &max_age, &include_subdomains));
- EXPECT_FALSE(ParseHSTSHeader("max-age; ;",
- &max_age, &include_subdomains));
- // Check the out args were not updated by checking the default
- // values for its predictable fields.
- EXPECT_EQ(0, max_age.InSeconds());
- EXPECT_FALSE(include_subdomains);
- }
- TEST_F(HttpSecurityHeadersTest, ValidSTSHeaders) {
- base::TimeDelta max_age;
- base::TimeDelta expect_max_age;
- bool include_subdomains = false;
- EXPECT_TRUE(ParseHSTSHeader("max-age=243", &max_age,
- &include_subdomains));
- expect_max_age = base::Seconds(243);
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_FALSE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader("max-age=3488923;", &max_age,
- &include_subdomains));
- EXPECT_TRUE(ParseHSTSHeader(" Max-agE = 567", &max_age,
- &include_subdomains));
- expect_max_age = base::Seconds(567);
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_FALSE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader(" mAx-aGe = 890 ", &max_age,
- &include_subdomains));
- expect_max_age = base::Seconds(890);
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_FALSE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader("max-age=123;incLudesUbdOmains", &max_age,
- &include_subdomains));
- expect_max_age = base::Seconds(123);
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_TRUE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader("incLudesUbdOmains; max-age=123", &max_age,
- &include_subdomains));
- expect_max_age = base::Seconds(123);
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_TRUE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader(" incLudesUbdOmains; max-age=123",
- &max_age, &include_subdomains));
- expect_max_age = base::Seconds(123);
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_TRUE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader(
- " incLudesUbdOmains; max-age=123; pumpkin=kitten", &max_age,
- &include_subdomains));
- expect_max_age = base::Seconds(123);
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_TRUE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader(
- " pumpkin=894; incLudesUbdOmains; max-age=123 ", &max_age,
- &include_subdomains));
- expect_max_age = base::Seconds(123);
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_TRUE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader(
- " pumpkin; incLudesUbdOmains; max-age=123 ", &max_age,
- &include_subdomains));
- expect_max_age = base::Seconds(123);
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_TRUE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader(
- " pumpkin; incLudesUbdOmains; max-age=\"123\" ", &max_age,
- &include_subdomains));
- expect_max_age = base::Seconds(123);
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_TRUE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader(
- "animal=\"squirrel; distinguished\"; incLudesUbdOmains; max-age=123",
- &max_age, &include_subdomains));
- expect_max_age = base::Seconds(123);
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_TRUE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader("max-age=394082; incLudesUbdOmains",
- &max_age, &include_subdomains));
- expect_max_age = base::Seconds(394082);
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_TRUE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader(
- "max-age=39408299 ;incLudesUbdOmains", &max_age,
- &include_subdomains));
- expect_max_age = base::Seconds(std::min(kMaxHSTSAgeSecs, 39408299u));
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_TRUE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader(
- "max-age=394082038 ; incLudesUbdOmains", &max_age,
- &include_subdomains));
- expect_max_age = base::Seconds(std::min(kMaxHSTSAgeSecs, 394082038u));
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_TRUE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader(
- "max-age=394082038 ; incLudesUbdOmains;", &max_age,
- &include_subdomains));
- expect_max_age = base::Seconds(std::min(kMaxHSTSAgeSecs, 394082038u));
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_TRUE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader(
- ";; max-age=394082038 ; incLudesUbdOmains; ;", &max_age,
- &include_subdomains));
- expect_max_age = base::Seconds(std::min(kMaxHSTSAgeSecs, 394082038u));
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_TRUE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader(
- ";; max-age=394082038 ;", &max_age,
- &include_subdomains));
- expect_max_age = base::Seconds(std::min(kMaxHSTSAgeSecs, 394082038u));
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_FALSE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader(
- ";; ; ; max-age=394082038;;; includeSubdomains ;; ;", &max_age,
- &include_subdomains));
- expect_max_age = base::Seconds(std::min(kMaxHSTSAgeSecs, 394082038u));
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_TRUE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader(
- "incLudesUbdOmains ; max-age=394082038 ;;", &max_age,
- &include_subdomains));
- expect_max_age = base::Seconds(std::min(kMaxHSTSAgeSecs, 394082038u));
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_TRUE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader(
- " max-age=0 ; incLudesUbdOmains ", &max_age,
- &include_subdomains));
- expect_max_age = base::Seconds(0);
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_TRUE(include_subdomains);
- EXPECT_TRUE(ParseHSTSHeader(
- " max-age=999999999999999999999999999999999999999999999 ;"
- " incLudesUbdOmains ", &max_age, &include_subdomains));
- expect_max_age = base::Seconds(kMaxHSTSAgeSecs);
- EXPECT_EQ(expect_max_age, max_age);
- EXPECT_TRUE(include_subdomains);
- }
- TEST_F(HttpSecurityHeadersTest, BogusExpectCTHeaders) {
- base::TimeDelta max_age;
- bool enforce = false;
- GURL report_uri;
- EXPECT_FALSE(
- ParseExpectCTHeader(std::string(), &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader(" ", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("abc", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader(" abc", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(
- ParseExpectCTHeader(" abc ", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("max-age", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(
- ParseExpectCTHeader(" max-age", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(
- ParseExpectCTHeader(" max-age ", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(
- ParseExpectCTHeader("max-age=", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(
- ParseExpectCTHeader(" max-age=", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(
- ParseExpectCTHeader(" max-age =", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(
- ParseExpectCTHeader(" max-age= ", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader(" max-age = ", &max_age, &enforce,
- &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader(" max-age = xy", &max_age, &enforce,
- &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader(" max-age = 3488a923", &max_age,
- &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("max-age=3488a923 ", &max_age, &enforce,
- &report_uri));
- EXPECT_FALSE(
- ParseExpectCTHeader("max-ag=3488923", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(
- ParseExpectCTHeader("max-aged=3488923", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(
- ParseExpectCTHeader("max-age==3488923", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(
- ParseExpectCTHeader("amax-age=3488923", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(
- ParseExpectCTHeader("max-age=-3488923", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(
- ParseExpectCTHeader("max-age=+3488923", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(
- ParseExpectCTHeader("max-age=13####", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("max-age=9223372036854775807#####", &max_age,
- &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("max-age=18446744073709551615####", &max_age,
- &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("max-age=999999999999999999999999$.&#!",
- &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 e", &max_age, &enforce,
- &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomain",
- &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923includesubdomains", &max_age,
- &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923=includesubdomains",
- &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomainx",
- &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader(
- "max-age=3488923 includesubdomain=", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomain=true",
- &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomainsx",
- &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomains x",
- &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("max-age=34889.23 includesubdomains",
- &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("max-age=34889 includesubdomains", &max_age,
- &enforce, &report_uri));
- EXPECT_FALSE(
- ParseExpectCTHeader(",,,, ,,,", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader(",,,, includeSubDomains,,,", &max_age,
- &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader(" includeSubDomains, ", &max_age,
- &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader(",", &max_age, &enforce, &report_uri));
- EXPECT_FALSE(
- ParseExpectCTHeader("max-age, ,", &max_age, &enforce, &report_uri));
- // Test that the parser rejects misquoted or invalid report-uris.
- EXPECT_FALSE(ParseExpectCTHeader("max-age=999, report-uri=\"http://foo;bar\'",
- &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("max-age=999, report-uri=\"foo;bar\"",
- &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("max-age=999, report-uri=\"\"", &max_age,
- &enforce, &report_uri));
- // Test that the parser does not fix up misquoted values.
- EXPECT_FALSE(
- ParseExpectCTHeader("max-age=\"999", &max_age, &enforce, &report_uri));
- // Test that the parser rejects headers that contain duplicate directives.
- EXPECT_FALSE(ParseExpectCTHeader("max-age=999, enforce, max-age=99999",
- &max_age, &enforce, &report_uri));
- EXPECT_FALSE(ParseExpectCTHeader("enforce, max-age=999, enforce", &max_age,
- &enforce, &report_uri));
- EXPECT_FALSE(
- ParseExpectCTHeader("report-uri=\"http://foo\", max-age=999, enforce, "
- "report-uri=\"http://foo\"",
- &max_age, &enforce, &report_uri));
- // Test that the parser rejects headers with values for the valueless
- // 'enforce' directive.
- EXPECT_FALSE(ParseExpectCTHeader("max-age=999, enforce=true", &max_age,
- &enforce, &report_uri));
- // Check the out args were not updated by checking the default
- // values for its predictable fields.
- EXPECT_EQ(0, max_age.InSeconds());
- EXPECT_FALSE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- }
- TEST_F(HttpSecurityHeadersTest, ValidExpectCTHeaders) {
- base::TimeDelta max_age;
- bool enforce = false;
- GURL report_uri;
- EXPECT_TRUE(
- ParseExpectCTHeader("max-age=243", &max_age, &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(243), max_age);
- EXPECT_FALSE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- EXPECT_TRUE(ParseExpectCTHeader(" Max-agE = 567", &max_age, &enforce,
- &report_uri));
- EXPECT_EQ(base::Seconds(567), max_age);
- EXPECT_FALSE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- EXPECT_TRUE(ParseExpectCTHeader(" mAx-aGe = 890 ", &max_age,
- &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(890), max_age);
- EXPECT_FALSE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- EXPECT_TRUE(ParseExpectCTHeader("max-age=123,enFoRce", &max_age, &enforce,
- &report_uri));
- EXPECT_EQ(base::Seconds(123), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- enforce = false;
- EXPECT_TRUE(ParseExpectCTHeader("enFoRCE, max-age=123", &max_age, &enforce,
- &report_uri));
- EXPECT_EQ(base::Seconds(123), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- enforce = false;
- EXPECT_TRUE(ParseExpectCTHeader(" enFORce, max-age=123", &max_age, &enforce,
- &report_uri));
- EXPECT_EQ(base::Seconds(123), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- enforce = false;
- EXPECT_TRUE(ParseExpectCTHeader(
- "report-uri=\"https://foo.test\", enFORce, max-age=123", &max_age,
- &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(123), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_EQ(GURL("https://foo.test"), report_uri);
- enforce = false;
- report_uri = GURL();
- EXPECT_TRUE(
- ParseExpectCTHeader("enforce,report-uri=\"https://foo.test\",max-age=123",
- &max_age, &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(123), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_EQ(GURL("https://foo.test"), report_uri);
- enforce = false;
- report_uri = GURL();
- EXPECT_TRUE(
- ParseExpectCTHeader("enforce,report-uri=https://foo.test,max-age=123",
- &max_age, &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(123), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_EQ(GURL("https://foo.test"), report_uri);
- report_uri = GURL();
- enforce = false;
- EXPECT_TRUE(ParseExpectCTHeader("report-uri=\"https://foo.test\",max-age=123",
- &max_age, &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(123), max_age);
- EXPECT_FALSE(enforce);
- EXPECT_EQ(GURL("https://foo.test"), report_uri);
- report_uri = GURL();
- EXPECT_TRUE(ParseExpectCTHeader(" enFORcE, max-age=123, pumpkin=kitten",
- &max_age, &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(123), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- enforce = false;
- EXPECT_TRUE(ParseExpectCTHeader(
- " pumpkin=894, report-uri= \"https://bar\", enFORce, max-age=123 ",
- &max_age, &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(123), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_EQ(GURL("https://bar"), report_uri);
- enforce = false;
- report_uri = GURL();
- EXPECT_TRUE(ParseExpectCTHeader(" pumpkin, enFoRcE, max-age=123 ",
- &max_age, &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(123), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- enforce = false;
- EXPECT_TRUE(ParseExpectCTHeader(" pumpkin, enforce, max-age=\"123\" ",
- &max_age, &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(123), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- enforce = false;
- EXPECT_TRUE(ParseExpectCTHeader(
- "animal=\"squirrel, distinguished\", enFoRce, max-age=123", &max_age,
- &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(123), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- enforce = false;
- EXPECT_TRUE(ParseExpectCTHeader("max-age=394082, enforce", &max_age,
- &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(394082), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- enforce = false;
- EXPECT_TRUE(ParseExpectCTHeader("max-age=39408299 ,enforce", &max_age,
- &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(kMaxExpectCTAgeSecs), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- // Per RFC 7230, "a recipient MUST parse and ignore a reasonable number of
- // empty list elements".
- enforce = false;
- EXPECT_TRUE(ParseExpectCTHeader(",, max-age=394082038 , enfoRce, ,",
- &max_age, &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(kMaxExpectCTAgeSecs), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- enforce = false;
- EXPECT_TRUE(ParseExpectCTHeader(",, max-age=394082038 ,", &max_age, &enforce,
- &report_uri));
- EXPECT_EQ(base::Seconds(kMaxExpectCTAgeSecs), max_age);
- EXPECT_FALSE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- EXPECT_TRUE(
- ParseExpectCTHeader(",, , , max-age=394082038,,, enforce ,, ,",
- &max_age, &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(kMaxExpectCTAgeSecs), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- enforce = false;
- EXPECT_TRUE(ParseExpectCTHeader("enfORce , max-age=394082038 ,,", &max_age,
- &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(kMaxExpectCTAgeSecs), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- enforce = false;
- EXPECT_TRUE(ParseExpectCTHeader(" max-age=0 , enforce ", &max_age,
- &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(0), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- enforce = false;
- EXPECT_TRUE(ParseExpectCTHeader(
- " max-age=999999999999999999999999999999999999999999999 ,"
- " enforce ",
- &max_age, &enforce, &report_uri));
- EXPECT_EQ(base::Seconds(kMaxExpectCTAgeSecs), max_age);
- EXPECT_TRUE(enforce);
- EXPECT_TRUE(report_uri.is_empty());
- }
- } // namespace net
|