http_security_headers_unittest.cc 24 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237238239240241242243244245246247248249250251252253254255256257258259260261262263264265266267268269270271272273274275276277278279280281282283284285286287288289290291292293294295296297298299300301302303304305306307308309310311312313314315316317318319320321322323324325326327328329330331332333334335336337338339340341342343344345346347348349350351352353354355356357358359360361362363364365366367368369370371372373374375376377378379380381382383384385386387388389390391392393394395396397398399400401402403404405406407408409410411412413414415416417418419420421422423424425426427428429430431432433434435436437438439440441442443444445446447448449450451452453454455456457458459460461462463464465466467468469470471472473474475476477478479480481482483484485486487488489490491492493494495496497498499500501502503504505506507508509510511512513514515516517518519520521522523524525526527528529530531532533534535536537538539540541542543544545546547548549550551552553554555556557558559560561562563564565566567568569570571572
  1. // Copyright (c) 2012 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include <stdint.h>
  5. #include <iterator>
  6. #include "base/base64.h"
  7. #include "base/stl_util.h"
  8. #include "base/strings/string_piece.h"
  9. #include "crypto/sha2.h"
  10. #include "net/base/host_port_pair.h"
  11. #include "net/base/test_completion_callback.h"
  12. #include "net/http/http_security_headers.h"
  13. #include "net/http/http_util.h"
  14. #include "net/http/transport_security_state.h"
  15. #include "net/ssl/ssl_info.h"
  16. #include "testing/gtest/include/gtest/gtest.h"
  17. namespace net {
  18. namespace {
  19. namespace test_default {
  20. #include "base/time/time.h"
  21. #include "net/http/transport_security_state_static_unittest_default.h"
  22. }
  23. } // anonymous namespace
  24. class HttpSecurityHeadersTest : public testing::Test {
  25. public:
  26. ~HttpSecurityHeadersTest() override {
  27. SetTransportSecurityStateSourceForTesting(nullptr);
  28. }
  29. };
  30. TEST_F(HttpSecurityHeadersTest, BogusHeaders) {
  31. base::TimeDelta max_age;
  32. bool include_subdomains = false;
  33. EXPECT_FALSE(
  34. ParseHSTSHeader(std::string(), &max_age, &include_subdomains));
  35. EXPECT_FALSE(ParseHSTSHeader(" ", &max_age, &include_subdomains));
  36. EXPECT_FALSE(ParseHSTSHeader("abc", &max_age, &include_subdomains));
  37. EXPECT_FALSE(ParseHSTSHeader(" abc", &max_age, &include_subdomains));
  38. EXPECT_FALSE(ParseHSTSHeader(" abc ", &max_age, &include_subdomains));
  39. EXPECT_FALSE(ParseHSTSHeader("max-age", &max_age, &include_subdomains));
  40. EXPECT_FALSE(ParseHSTSHeader(" max-age", &max_age,
  41. &include_subdomains));
  42. EXPECT_FALSE(ParseHSTSHeader(" max-age ", &max_age,
  43. &include_subdomains));
  44. EXPECT_FALSE(ParseHSTSHeader("max-age=", &max_age, &include_subdomains));
  45. EXPECT_FALSE(ParseHSTSHeader(" max-age=", &max_age,
  46. &include_subdomains));
  47. EXPECT_FALSE(ParseHSTSHeader(" max-age =", &max_age,
  48. &include_subdomains));
  49. EXPECT_FALSE(ParseHSTSHeader(" max-age= ", &max_age,
  50. &include_subdomains));
  51. EXPECT_FALSE(ParseHSTSHeader(" max-age = ", &max_age,
  52. &include_subdomains));
  53. EXPECT_FALSE(ParseHSTSHeader(" max-age = xy", &max_age,
  54. &include_subdomains));
  55. EXPECT_FALSE(ParseHSTSHeader(" max-age = 3488a923", &max_age,
  56. &include_subdomains));
  57. EXPECT_FALSE(ParseHSTSHeader("max-age=3488a923 ", &max_age,
  58. &include_subdomains));
  59. EXPECT_FALSE(ParseHSTSHeader("max-ag=3488923", &max_age,
  60. &include_subdomains));
  61. EXPECT_FALSE(ParseHSTSHeader("max-aged=3488923", &max_age,
  62. &include_subdomains));
  63. EXPECT_FALSE(ParseHSTSHeader("max-age==3488923", &max_age,
  64. &include_subdomains));
  65. EXPECT_FALSE(ParseHSTSHeader("amax-age=3488923", &max_age,
  66. &include_subdomains));
  67. EXPECT_FALSE(ParseHSTSHeader("max-age=-3488923", &max_age,
  68. &include_subdomains));
  69. EXPECT_FALSE(
  70. ParseHSTSHeader("max-age=+3488923", &max_age, &include_subdomains));
  71. EXPECT_FALSE(
  72. ParseHSTSHeader("max-age=13####", &max_age, &include_subdomains));
  73. EXPECT_FALSE(ParseHSTSHeader("max-age=9223372036854775807#####", &max_age,
  74. &include_subdomains));
  75. EXPECT_FALSE(ParseHSTSHeader("max-age=18446744073709551615####", &max_age,
  76. &include_subdomains));
  77. EXPECT_FALSE(ParseHSTSHeader("max-age=999999999999999999999999$.&#!",
  78. &max_age, &include_subdomains));
  79. EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 e", &max_age,
  80. &include_subdomains));
  81. EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 includesubdomain",
  82. &max_age, &include_subdomains));
  83. EXPECT_FALSE(ParseHSTSHeader("max-age=3488923includesubdomains",
  84. &max_age, &include_subdomains));
  85. EXPECT_FALSE(ParseHSTSHeader("max-age=3488923=includesubdomains",
  86. &max_age, &include_subdomains));
  87. EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 includesubdomainx",
  88. &max_age, &include_subdomains));
  89. EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 includesubdomain=",
  90. &max_age, &include_subdomains));
  91. EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 includesubdomain=true",
  92. &max_age, &include_subdomains));
  93. EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 includesubdomainsx",
  94. &max_age, &include_subdomains));
  95. EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 includesubdomains x",
  96. &max_age, &include_subdomains));
  97. EXPECT_FALSE(ParseHSTSHeader("max-age=34889.23 includesubdomains",
  98. &max_age, &include_subdomains));
  99. EXPECT_FALSE(ParseHSTSHeader("max-age=34889 includesubdomains",
  100. &max_age, &include_subdomains));
  101. EXPECT_FALSE(ParseHSTSHeader(";;;; ;;;",
  102. &max_age, &include_subdomains));
  103. EXPECT_FALSE(ParseHSTSHeader(";;;; includeSubDomains;;;",
  104. &max_age, &include_subdomains));
  105. EXPECT_FALSE(ParseHSTSHeader(" includeSubDomains; ",
  106. &max_age, &include_subdomains));
  107. EXPECT_FALSE(ParseHSTSHeader(";",
  108. &max_age, &include_subdomains));
  109. EXPECT_FALSE(ParseHSTSHeader("max-age; ;",
  110. &max_age, &include_subdomains));
  111. // Check the out args were not updated by checking the default
  112. // values for its predictable fields.
  113. EXPECT_EQ(0, max_age.InSeconds());
  114. EXPECT_FALSE(include_subdomains);
  115. }
  116. TEST_F(HttpSecurityHeadersTest, ValidSTSHeaders) {
  117. base::TimeDelta max_age;
  118. base::TimeDelta expect_max_age;
  119. bool include_subdomains = false;
  120. EXPECT_TRUE(ParseHSTSHeader("max-age=243", &max_age,
  121. &include_subdomains));
  122. expect_max_age = base::Seconds(243);
  123. EXPECT_EQ(expect_max_age, max_age);
  124. EXPECT_FALSE(include_subdomains);
  125. EXPECT_TRUE(ParseHSTSHeader("max-age=3488923;", &max_age,
  126. &include_subdomains));
  127. EXPECT_TRUE(ParseHSTSHeader(" Max-agE = 567", &max_age,
  128. &include_subdomains));
  129. expect_max_age = base::Seconds(567);
  130. EXPECT_EQ(expect_max_age, max_age);
  131. EXPECT_FALSE(include_subdomains);
  132. EXPECT_TRUE(ParseHSTSHeader(" mAx-aGe = 890 ", &max_age,
  133. &include_subdomains));
  134. expect_max_age = base::Seconds(890);
  135. EXPECT_EQ(expect_max_age, max_age);
  136. EXPECT_FALSE(include_subdomains);
  137. EXPECT_TRUE(ParseHSTSHeader("max-age=123;incLudesUbdOmains", &max_age,
  138. &include_subdomains));
  139. expect_max_age = base::Seconds(123);
  140. EXPECT_EQ(expect_max_age, max_age);
  141. EXPECT_TRUE(include_subdomains);
  142. EXPECT_TRUE(ParseHSTSHeader("incLudesUbdOmains; max-age=123", &max_age,
  143. &include_subdomains));
  144. expect_max_age = base::Seconds(123);
  145. EXPECT_EQ(expect_max_age, max_age);
  146. EXPECT_TRUE(include_subdomains);
  147. EXPECT_TRUE(ParseHSTSHeader(" incLudesUbdOmains; max-age=123",
  148. &max_age, &include_subdomains));
  149. expect_max_age = base::Seconds(123);
  150. EXPECT_EQ(expect_max_age, max_age);
  151. EXPECT_TRUE(include_subdomains);
  152. EXPECT_TRUE(ParseHSTSHeader(
  153. " incLudesUbdOmains; max-age=123; pumpkin=kitten", &max_age,
  154. &include_subdomains));
  155. expect_max_age = base::Seconds(123);
  156. EXPECT_EQ(expect_max_age, max_age);
  157. EXPECT_TRUE(include_subdomains);
  158. EXPECT_TRUE(ParseHSTSHeader(
  159. " pumpkin=894; incLudesUbdOmains; max-age=123 ", &max_age,
  160. &include_subdomains));
  161. expect_max_age = base::Seconds(123);
  162. EXPECT_EQ(expect_max_age, max_age);
  163. EXPECT_TRUE(include_subdomains);
  164. EXPECT_TRUE(ParseHSTSHeader(
  165. " pumpkin; incLudesUbdOmains; max-age=123 ", &max_age,
  166. &include_subdomains));
  167. expect_max_age = base::Seconds(123);
  168. EXPECT_EQ(expect_max_age, max_age);
  169. EXPECT_TRUE(include_subdomains);
  170. EXPECT_TRUE(ParseHSTSHeader(
  171. " pumpkin; incLudesUbdOmains; max-age=\"123\" ", &max_age,
  172. &include_subdomains));
  173. expect_max_age = base::Seconds(123);
  174. EXPECT_EQ(expect_max_age, max_age);
  175. EXPECT_TRUE(include_subdomains);
  176. EXPECT_TRUE(ParseHSTSHeader(
  177. "animal=\"squirrel; distinguished\"; incLudesUbdOmains; max-age=123",
  178. &max_age, &include_subdomains));
  179. expect_max_age = base::Seconds(123);
  180. EXPECT_EQ(expect_max_age, max_age);
  181. EXPECT_TRUE(include_subdomains);
  182. EXPECT_TRUE(ParseHSTSHeader("max-age=394082; incLudesUbdOmains",
  183. &max_age, &include_subdomains));
  184. expect_max_age = base::Seconds(394082);
  185. EXPECT_EQ(expect_max_age, max_age);
  186. EXPECT_TRUE(include_subdomains);
  187. EXPECT_TRUE(ParseHSTSHeader(
  188. "max-age=39408299 ;incLudesUbdOmains", &max_age,
  189. &include_subdomains));
  190. expect_max_age = base::Seconds(std::min(kMaxHSTSAgeSecs, 39408299u));
  191. EXPECT_EQ(expect_max_age, max_age);
  192. EXPECT_TRUE(include_subdomains);
  193. EXPECT_TRUE(ParseHSTSHeader(
  194. "max-age=394082038 ; incLudesUbdOmains", &max_age,
  195. &include_subdomains));
  196. expect_max_age = base::Seconds(std::min(kMaxHSTSAgeSecs, 394082038u));
  197. EXPECT_EQ(expect_max_age, max_age);
  198. EXPECT_TRUE(include_subdomains);
  199. EXPECT_TRUE(ParseHSTSHeader(
  200. "max-age=394082038 ; incLudesUbdOmains;", &max_age,
  201. &include_subdomains));
  202. expect_max_age = base::Seconds(std::min(kMaxHSTSAgeSecs, 394082038u));
  203. EXPECT_EQ(expect_max_age, max_age);
  204. EXPECT_TRUE(include_subdomains);
  205. EXPECT_TRUE(ParseHSTSHeader(
  206. ";; max-age=394082038 ; incLudesUbdOmains; ;", &max_age,
  207. &include_subdomains));
  208. expect_max_age = base::Seconds(std::min(kMaxHSTSAgeSecs, 394082038u));
  209. EXPECT_EQ(expect_max_age, max_age);
  210. EXPECT_TRUE(include_subdomains);
  211. EXPECT_TRUE(ParseHSTSHeader(
  212. ";; max-age=394082038 ;", &max_age,
  213. &include_subdomains));
  214. expect_max_age = base::Seconds(std::min(kMaxHSTSAgeSecs, 394082038u));
  215. EXPECT_EQ(expect_max_age, max_age);
  216. EXPECT_FALSE(include_subdomains);
  217. EXPECT_TRUE(ParseHSTSHeader(
  218. ";; ; ; max-age=394082038;;; includeSubdomains ;; ;", &max_age,
  219. &include_subdomains));
  220. expect_max_age = base::Seconds(std::min(kMaxHSTSAgeSecs, 394082038u));
  221. EXPECT_EQ(expect_max_age, max_age);
  222. EXPECT_TRUE(include_subdomains);
  223. EXPECT_TRUE(ParseHSTSHeader(
  224. "incLudesUbdOmains ; max-age=394082038 ;;", &max_age,
  225. &include_subdomains));
  226. expect_max_age = base::Seconds(std::min(kMaxHSTSAgeSecs, 394082038u));
  227. EXPECT_EQ(expect_max_age, max_age);
  228. EXPECT_TRUE(include_subdomains);
  229. EXPECT_TRUE(ParseHSTSHeader(
  230. " max-age=0 ; incLudesUbdOmains ", &max_age,
  231. &include_subdomains));
  232. expect_max_age = base::Seconds(0);
  233. EXPECT_EQ(expect_max_age, max_age);
  234. EXPECT_TRUE(include_subdomains);
  235. EXPECT_TRUE(ParseHSTSHeader(
  236. " max-age=999999999999999999999999999999999999999999999 ;"
  237. " incLudesUbdOmains ", &max_age, &include_subdomains));
  238. expect_max_age = base::Seconds(kMaxHSTSAgeSecs);
  239. EXPECT_EQ(expect_max_age, max_age);
  240. EXPECT_TRUE(include_subdomains);
  241. }
  242. TEST_F(HttpSecurityHeadersTest, BogusExpectCTHeaders) {
  243. base::TimeDelta max_age;
  244. bool enforce = false;
  245. GURL report_uri;
  246. EXPECT_FALSE(
  247. ParseExpectCTHeader(std::string(), &max_age, &enforce, &report_uri));
  248. EXPECT_FALSE(ParseExpectCTHeader(" ", &max_age, &enforce, &report_uri));
  249. EXPECT_FALSE(ParseExpectCTHeader("abc", &max_age, &enforce, &report_uri));
  250. EXPECT_FALSE(ParseExpectCTHeader(" abc", &max_age, &enforce, &report_uri));
  251. EXPECT_FALSE(
  252. ParseExpectCTHeader(" abc ", &max_age, &enforce, &report_uri));
  253. EXPECT_FALSE(ParseExpectCTHeader("max-age", &max_age, &enforce, &report_uri));
  254. EXPECT_FALSE(
  255. ParseExpectCTHeader(" max-age", &max_age, &enforce, &report_uri));
  256. EXPECT_FALSE(
  257. ParseExpectCTHeader(" max-age ", &max_age, &enforce, &report_uri));
  258. EXPECT_FALSE(
  259. ParseExpectCTHeader("max-age=", &max_age, &enforce, &report_uri));
  260. EXPECT_FALSE(
  261. ParseExpectCTHeader(" max-age=", &max_age, &enforce, &report_uri));
  262. EXPECT_FALSE(
  263. ParseExpectCTHeader(" max-age =", &max_age, &enforce, &report_uri));
  264. EXPECT_FALSE(
  265. ParseExpectCTHeader(" max-age= ", &max_age, &enforce, &report_uri));
  266. EXPECT_FALSE(ParseExpectCTHeader(" max-age = ", &max_age, &enforce,
  267. &report_uri));
  268. EXPECT_FALSE(ParseExpectCTHeader(" max-age = xy", &max_age, &enforce,
  269. &report_uri));
  270. EXPECT_FALSE(ParseExpectCTHeader(" max-age = 3488a923", &max_age,
  271. &enforce, &report_uri));
  272. EXPECT_FALSE(ParseExpectCTHeader("max-age=3488a923 ", &max_age, &enforce,
  273. &report_uri));
  274. EXPECT_FALSE(
  275. ParseExpectCTHeader("max-ag=3488923", &max_age, &enforce, &report_uri));
  276. EXPECT_FALSE(
  277. ParseExpectCTHeader("max-aged=3488923", &max_age, &enforce, &report_uri));
  278. EXPECT_FALSE(
  279. ParseExpectCTHeader("max-age==3488923", &max_age, &enforce, &report_uri));
  280. EXPECT_FALSE(
  281. ParseExpectCTHeader("amax-age=3488923", &max_age, &enforce, &report_uri));
  282. EXPECT_FALSE(
  283. ParseExpectCTHeader("max-age=-3488923", &max_age, &enforce, &report_uri));
  284. EXPECT_FALSE(
  285. ParseExpectCTHeader("max-age=+3488923", &max_age, &enforce, &report_uri));
  286. EXPECT_FALSE(
  287. ParseExpectCTHeader("max-age=13####", &max_age, &enforce, &report_uri));
  288. EXPECT_FALSE(ParseExpectCTHeader("max-age=9223372036854775807#####", &max_age,
  289. &enforce, &report_uri));
  290. EXPECT_FALSE(ParseExpectCTHeader("max-age=18446744073709551615####", &max_age,
  291. &enforce, &report_uri));
  292. EXPECT_FALSE(ParseExpectCTHeader("max-age=999999999999999999999999$.&#!",
  293. &max_age, &enforce, &report_uri));
  294. EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 e", &max_age, &enforce,
  295. &report_uri));
  296. EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomain",
  297. &max_age, &enforce, &report_uri));
  298. EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923includesubdomains", &max_age,
  299. &enforce, &report_uri));
  300. EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923=includesubdomains",
  301. &max_age, &enforce, &report_uri));
  302. EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomainx",
  303. &max_age, &enforce, &report_uri));
  304. EXPECT_FALSE(ParseExpectCTHeader(
  305. "max-age=3488923 includesubdomain=", &max_age, &enforce, &report_uri));
  306. EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomain=true",
  307. &max_age, &enforce, &report_uri));
  308. EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomainsx",
  309. &max_age, &enforce, &report_uri));
  310. EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomains x",
  311. &max_age, &enforce, &report_uri));
  312. EXPECT_FALSE(ParseExpectCTHeader("max-age=34889.23 includesubdomains",
  313. &max_age, &enforce, &report_uri));
  314. EXPECT_FALSE(ParseExpectCTHeader("max-age=34889 includesubdomains", &max_age,
  315. &enforce, &report_uri));
  316. EXPECT_FALSE(
  317. ParseExpectCTHeader(",,,, ,,,", &max_age, &enforce, &report_uri));
  318. EXPECT_FALSE(ParseExpectCTHeader(",,,, includeSubDomains,,,", &max_age,
  319. &enforce, &report_uri));
  320. EXPECT_FALSE(ParseExpectCTHeader(" includeSubDomains, ", &max_age,
  321. &enforce, &report_uri));
  322. EXPECT_FALSE(ParseExpectCTHeader(",", &max_age, &enforce, &report_uri));
  323. EXPECT_FALSE(
  324. ParseExpectCTHeader("max-age, ,", &max_age, &enforce, &report_uri));
  325. // Test that the parser rejects misquoted or invalid report-uris.
  326. EXPECT_FALSE(ParseExpectCTHeader("max-age=999, report-uri=\"http://foo;bar\'",
  327. &max_age, &enforce, &report_uri));
  328. EXPECT_FALSE(ParseExpectCTHeader("max-age=999, report-uri=\"foo;bar\"",
  329. &max_age, &enforce, &report_uri));
  330. EXPECT_FALSE(ParseExpectCTHeader("max-age=999, report-uri=\"\"", &max_age,
  331. &enforce, &report_uri));
  332. // Test that the parser does not fix up misquoted values.
  333. EXPECT_FALSE(
  334. ParseExpectCTHeader("max-age=\"999", &max_age, &enforce, &report_uri));
  335. // Test that the parser rejects headers that contain duplicate directives.
  336. EXPECT_FALSE(ParseExpectCTHeader("max-age=999, enforce, max-age=99999",
  337. &max_age, &enforce, &report_uri));
  338. EXPECT_FALSE(ParseExpectCTHeader("enforce, max-age=999, enforce", &max_age,
  339. &enforce, &report_uri));
  340. EXPECT_FALSE(
  341. ParseExpectCTHeader("report-uri=\"http://foo\", max-age=999, enforce, "
  342. "report-uri=\"http://foo\"",
  343. &max_age, &enforce, &report_uri));
  344. // Test that the parser rejects headers with values for the valueless
  345. // 'enforce' directive.
  346. EXPECT_FALSE(ParseExpectCTHeader("max-age=999, enforce=true", &max_age,
  347. &enforce, &report_uri));
  348. // Check the out args were not updated by checking the default
  349. // values for its predictable fields.
  350. EXPECT_EQ(0, max_age.InSeconds());
  351. EXPECT_FALSE(enforce);
  352. EXPECT_TRUE(report_uri.is_empty());
  353. }
  354. TEST_F(HttpSecurityHeadersTest, ValidExpectCTHeaders) {
  355. base::TimeDelta max_age;
  356. bool enforce = false;
  357. GURL report_uri;
  358. EXPECT_TRUE(
  359. ParseExpectCTHeader("max-age=243", &max_age, &enforce, &report_uri));
  360. EXPECT_EQ(base::Seconds(243), max_age);
  361. EXPECT_FALSE(enforce);
  362. EXPECT_TRUE(report_uri.is_empty());
  363. EXPECT_TRUE(ParseExpectCTHeader(" Max-agE = 567", &max_age, &enforce,
  364. &report_uri));
  365. EXPECT_EQ(base::Seconds(567), max_age);
  366. EXPECT_FALSE(enforce);
  367. EXPECT_TRUE(report_uri.is_empty());
  368. EXPECT_TRUE(ParseExpectCTHeader(" mAx-aGe = 890 ", &max_age,
  369. &enforce, &report_uri));
  370. EXPECT_EQ(base::Seconds(890), max_age);
  371. EXPECT_FALSE(enforce);
  372. EXPECT_TRUE(report_uri.is_empty());
  373. EXPECT_TRUE(ParseExpectCTHeader("max-age=123,enFoRce", &max_age, &enforce,
  374. &report_uri));
  375. EXPECT_EQ(base::Seconds(123), max_age);
  376. EXPECT_TRUE(enforce);
  377. EXPECT_TRUE(report_uri.is_empty());
  378. enforce = false;
  379. EXPECT_TRUE(ParseExpectCTHeader("enFoRCE, max-age=123", &max_age, &enforce,
  380. &report_uri));
  381. EXPECT_EQ(base::Seconds(123), max_age);
  382. EXPECT_TRUE(enforce);
  383. EXPECT_TRUE(report_uri.is_empty());
  384. enforce = false;
  385. EXPECT_TRUE(ParseExpectCTHeader(" enFORce, max-age=123", &max_age, &enforce,
  386. &report_uri));
  387. EXPECT_EQ(base::Seconds(123), max_age);
  388. EXPECT_TRUE(enforce);
  389. EXPECT_TRUE(report_uri.is_empty());
  390. enforce = false;
  391. EXPECT_TRUE(ParseExpectCTHeader(
  392. "report-uri=\"https://foo.test\", enFORce, max-age=123", &max_age,
  393. &enforce, &report_uri));
  394. EXPECT_EQ(base::Seconds(123), max_age);
  395. EXPECT_TRUE(enforce);
  396. EXPECT_EQ(GURL("https://foo.test"), report_uri);
  397. enforce = false;
  398. report_uri = GURL();
  399. EXPECT_TRUE(
  400. ParseExpectCTHeader("enforce,report-uri=\"https://foo.test\",max-age=123",
  401. &max_age, &enforce, &report_uri));
  402. EXPECT_EQ(base::Seconds(123), max_age);
  403. EXPECT_TRUE(enforce);
  404. EXPECT_EQ(GURL("https://foo.test"), report_uri);
  405. enforce = false;
  406. report_uri = GURL();
  407. EXPECT_TRUE(
  408. ParseExpectCTHeader("enforce,report-uri=https://foo.test,max-age=123",
  409. &max_age, &enforce, &report_uri));
  410. EXPECT_EQ(base::Seconds(123), max_age);
  411. EXPECT_TRUE(enforce);
  412. EXPECT_EQ(GURL("https://foo.test"), report_uri);
  413. report_uri = GURL();
  414. enforce = false;
  415. EXPECT_TRUE(ParseExpectCTHeader("report-uri=\"https://foo.test\",max-age=123",
  416. &max_age, &enforce, &report_uri));
  417. EXPECT_EQ(base::Seconds(123), max_age);
  418. EXPECT_FALSE(enforce);
  419. EXPECT_EQ(GURL("https://foo.test"), report_uri);
  420. report_uri = GURL();
  421. EXPECT_TRUE(ParseExpectCTHeader(" enFORcE, max-age=123, pumpkin=kitten",
  422. &max_age, &enforce, &report_uri));
  423. EXPECT_EQ(base::Seconds(123), max_age);
  424. EXPECT_TRUE(enforce);
  425. EXPECT_TRUE(report_uri.is_empty());
  426. enforce = false;
  427. EXPECT_TRUE(ParseExpectCTHeader(
  428. " pumpkin=894, report-uri= \"https://bar\", enFORce, max-age=123 ",
  429. &max_age, &enforce, &report_uri));
  430. EXPECT_EQ(base::Seconds(123), max_age);
  431. EXPECT_TRUE(enforce);
  432. EXPECT_EQ(GURL("https://bar"), report_uri);
  433. enforce = false;
  434. report_uri = GURL();
  435. EXPECT_TRUE(ParseExpectCTHeader(" pumpkin, enFoRcE, max-age=123 ",
  436. &max_age, &enforce, &report_uri));
  437. EXPECT_EQ(base::Seconds(123), max_age);
  438. EXPECT_TRUE(enforce);
  439. EXPECT_TRUE(report_uri.is_empty());
  440. enforce = false;
  441. EXPECT_TRUE(ParseExpectCTHeader(" pumpkin, enforce, max-age=\"123\" ",
  442. &max_age, &enforce, &report_uri));
  443. EXPECT_EQ(base::Seconds(123), max_age);
  444. EXPECT_TRUE(enforce);
  445. EXPECT_TRUE(report_uri.is_empty());
  446. enforce = false;
  447. EXPECT_TRUE(ParseExpectCTHeader(
  448. "animal=\"squirrel, distinguished\", enFoRce, max-age=123", &max_age,
  449. &enforce, &report_uri));
  450. EXPECT_EQ(base::Seconds(123), max_age);
  451. EXPECT_TRUE(enforce);
  452. EXPECT_TRUE(report_uri.is_empty());
  453. enforce = false;
  454. EXPECT_TRUE(ParseExpectCTHeader("max-age=394082, enforce", &max_age,
  455. &enforce, &report_uri));
  456. EXPECT_EQ(base::Seconds(394082), max_age);
  457. EXPECT_TRUE(enforce);
  458. EXPECT_TRUE(report_uri.is_empty());
  459. enforce = false;
  460. EXPECT_TRUE(ParseExpectCTHeader("max-age=39408299 ,enforce", &max_age,
  461. &enforce, &report_uri));
  462. EXPECT_EQ(base::Seconds(kMaxExpectCTAgeSecs), max_age);
  463. EXPECT_TRUE(enforce);
  464. EXPECT_TRUE(report_uri.is_empty());
  465. // Per RFC 7230, "a recipient MUST parse and ignore a reasonable number of
  466. // empty list elements".
  467. enforce = false;
  468. EXPECT_TRUE(ParseExpectCTHeader(",, max-age=394082038 , enfoRce, ,",
  469. &max_age, &enforce, &report_uri));
  470. EXPECT_EQ(base::Seconds(kMaxExpectCTAgeSecs), max_age);
  471. EXPECT_TRUE(enforce);
  472. EXPECT_TRUE(report_uri.is_empty());
  473. enforce = false;
  474. EXPECT_TRUE(ParseExpectCTHeader(",, max-age=394082038 ,", &max_age, &enforce,
  475. &report_uri));
  476. EXPECT_EQ(base::Seconds(kMaxExpectCTAgeSecs), max_age);
  477. EXPECT_FALSE(enforce);
  478. EXPECT_TRUE(report_uri.is_empty());
  479. EXPECT_TRUE(
  480. ParseExpectCTHeader(",, , , max-age=394082038,,, enforce ,, ,",
  481. &max_age, &enforce, &report_uri));
  482. EXPECT_EQ(base::Seconds(kMaxExpectCTAgeSecs), max_age);
  483. EXPECT_TRUE(enforce);
  484. EXPECT_TRUE(report_uri.is_empty());
  485. enforce = false;
  486. EXPECT_TRUE(ParseExpectCTHeader("enfORce , max-age=394082038 ,,", &max_age,
  487. &enforce, &report_uri));
  488. EXPECT_EQ(base::Seconds(kMaxExpectCTAgeSecs), max_age);
  489. EXPECT_TRUE(enforce);
  490. EXPECT_TRUE(report_uri.is_empty());
  491. enforce = false;
  492. EXPECT_TRUE(ParseExpectCTHeader(" max-age=0 , enforce ", &max_age,
  493. &enforce, &report_uri));
  494. EXPECT_EQ(base::Seconds(0), max_age);
  495. EXPECT_TRUE(enforce);
  496. EXPECT_TRUE(report_uri.is_empty());
  497. enforce = false;
  498. EXPECT_TRUE(ParseExpectCTHeader(
  499. " max-age=999999999999999999999999999999999999999999999 ,"
  500. " enforce ",
  501. &max_age, &enforce, &report_uri));
  502. EXPECT_EQ(base::Seconds(kMaxExpectCTAgeSecs), max_age);
  503. EXPECT_TRUE(enforce);
  504. EXPECT_TRUE(report_uri.is_empty());
  505. }
  506. } // namespace net