weblayer_ping_manager_browsertest.cc 10 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173174175176177178179180181182183184185186187188189190191192193194195196197198199200201202203204205206207208209210211212213214215216217218219220221222223224225226227228229230231232233234235236237
  1. // Copyright 2022 The Chromium Authors. All rights reserved.
  2. // Use of this source code is governed by a BSD-style license that can be
  3. // found in the LICENSE file.
  4. #include "base/bind.h"
  5. #include "base/callback.h"
  6. #include "base/test/bind.h"
  7. #include "base/test/metrics/histogram_tester.h"
  8. #include "base/test/scoped_feature_list.h"
  9. #include "base/time/time.h"
  10. #include "components/safe_browsing/content/browser/web_ui/safe_browsing_ui.h"
  11. #include "components/safe_browsing/core/browser/test_safe_browsing_token_fetcher.h"
  12. #include "components/safe_browsing/core/common/features.h"
  13. #include "components/safe_browsing/core/common/safe_browsing_prefs.h"
  14. #include "services/network/public/cpp/weak_wrapper_shared_url_loader_factory.h"
  15. #include "services/network/test/test_url_loader_factory.h"
  16. #include "services/network/test/test_utils.h"
  17. #include "testing/gmock/include/gmock/gmock.h"
  18. #include "testing/gtest/include/gtest/gtest.h"
  19. #include "weblayer/browser/browser_context_impl.h"
  20. #include "weblayer/browser/profile_impl.h"
  21. #include "weblayer/browser/safe_browsing/weblayer_ping_manager_factory.h"
  22. #include "weblayer/browser/safe_browsing/weblayer_user_population_helper.h"
  23. #include "weblayer/test/weblayer_browser_test.h"
  24. using safe_browsing::ClientSafeBrowsingReportRequest;
  25. using ReportThreatDetailsResult =
  26. safe_browsing::PingManager::ReportThreatDetailsResult;
  27. namespace weblayer {
  28. class WeblayerPingManagerTest : public WebLayerBrowserTest {
  29. public:
  30. WeblayerPingManagerTest() {
  31. feature_list_.InitWithFeatures(
  32. {safe_browsing::kSafeBrowsingRemoveCookiesInAuthRequests,
  33. safe_browsing::kSafeBrowsingCsbrrWithToken},
  34. {});
  35. }
  36. protected:
  37. void RunReportThreatDetailsTest(bool is_enhanced_protection,
  38. bool is_signed_in,
  39. bool expect_access_token,
  40. bool expect_cookies_removed);
  41. base::test::ScopedFeatureList feature_list_;
  42. bool is_csbrr_token_feature_enabled_ = true;
  43. bool is_remove_cookies_feature_enabled_ = true;
  44. private:
  45. safe_browsing::TestSafeBrowsingTokenFetcher* SetUpTokenFetcher(
  46. safe_browsing::PingManager* ping_manager);
  47. };
  48. class RemoveCookiesFeatureDisabledWeblayerPingManagerTest
  49. : public WeblayerPingManagerTest {
  50. public:
  51. RemoveCookiesFeatureDisabledWeblayerPingManagerTest() {
  52. feature_list_.Reset();
  53. feature_list_.InitWithFeatures(
  54. {safe_browsing::kSafeBrowsingCsbrrWithToken},
  55. {safe_browsing::kSafeBrowsingRemoveCookiesInAuthRequests});
  56. is_remove_cookies_feature_enabled_ = false;
  57. }
  58. };
  59. class CsbrrTokenFeatureDisabledWeblayerPingManagerTest
  60. : public WeblayerPingManagerTest {
  61. public:
  62. CsbrrTokenFeatureDisabledWeblayerPingManagerTest() {
  63. feature_list_.Reset();
  64. feature_list_.InitWithFeatures(
  65. {safe_browsing::kSafeBrowsingRemoveCookiesInAuthRequests},
  66. {safe_browsing::kSafeBrowsingCsbrrWithToken});
  67. is_csbrr_token_feature_enabled_ = false;
  68. }
  69. };
  70. class IncognitoModeWeblayerPingManagerTest : public WeblayerPingManagerTest {
  71. public:
  72. IncognitoModeWeblayerPingManagerTest() { SetShellStartsInIncognitoMode(); }
  73. };
  74. safe_browsing::TestSafeBrowsingTokenFetcher*
  75. WeblayerPingManagerTest::SetUpTokenFetcher(
  76. safe_browsing::PingManager* ping_manager) {
  77. auto token_fetcher =
  78. std::make_unique<safe_browsing::TestSafeBrowsingTokenFetcher>();
  79. auto* raw_token_fetcher = token_fetcher.get();
  80. ping_manager->SetTokenFetcherForTesting(std::move(token_fetcher));
  81. return raw_token_fetcher;
  82. }
  83. void WeblayerPingManagerTest::RunReportThreatDetailsTest(
  84. bool is_enhanced_protection,
  85. bool is_signed_in,
  86. bool expect_access_token,
  87. bool expect_cookies_removed) {
  88. base::RunLoop csbrr_logged_run_loop;
  89. base::HistogramTester histogram_tester;
  90. if (is_enhanced_protection) {
  91. SetSafeBrowsingState(GetProfile()->GetBrowserContext()->pref_service(),
  92. safe_browsing::SafeBrowsingState::ENHANCED_PROTECTION);
  93. }
  94. if (is_signed_in) {
  95. WebLayerPingManagerFactory::GetInstance()->SignInAccountForTesting();
  96. }
  97. auto* ping_manager = WebLayerPingManagerFactory::GetForBrowserContext(
  98. GetProfile()->GetBrowserContext());
  99. auto* raw_token_fetcher = SetUpTokenFetcher(ping_manager);
  100. safe_browsing::WebUIInfoSingleton::GetInstance()->AddListenerForTesting();
  101. safe_browsing::WebUIInfoSingleton::GetInstance()
  102. ->SetOnCSBRRLoggedCallbackForTesting(csbrr_logged_run_loop.QuitClosure());
  103. std::string access_token = "testing_access_token";
  104. std::string input_report_content;
  105. std::unique_ptr<ClientSafeBrowsingReportRequest> report =
  106. std::make_unique<ClientSafeBrowsingReportRequest>();
  107. // The report must be non-empty. The selected property to set is arbitrary.
  108. report->set_type(ClientSafeBrowsingReportRequest::URL_PHISHING);
  109. EXPECT_TRUE(report->SerializeToString(&input_report_content));
  110. ClientSafeBrowsingReportRequest expected_report;
  111. expected_report.ParseFromString(input_report_content);
  112. *expected_report.mutable_population() =
  113. GetUserPopulationForBrowserContext(GetProfile()->GetBrowserContext());
  114. std::string expected_report_content;
  115. EXPECT_TRUE(expected_report.SerializeToString(&expected_report_content));
  116. EXPECT_NE(input_report_content, expected_report_content);
  117. network::TestURLLoaderFactory test_url_loader_factory;
  118. test_url_loader_factory.SetInterceptor(
  119. base::BindLambdaForTesting([&](const network::ResourceRequest& request) {
  120. EXPECT_EQ(GetUploadData(request), expected_report_content);
  121. std::string header_value;
  122. bool found_header = request.headers.GetHeader(
  123. net::HttpRequestHeaders::kAuthorization, &header_value);
  124. EXPECT_EQ(found_header, expect_access_token);
  125. if (expect_access_token) {
  126. EXPECT_EQ(header_value, "Bearer " + access_token);
  127. }
  128. EXPECT_EQ(request.credentials_mode,
  129. expect_cookies_removed
  130. ? network::mojom::CredentialsMode::kOmit
  131. : network::mojom::CredentialsMode::kInclude);
  132. histogram_tester.ExpectUniqueSample(
  133. "SafeBrowsing.ClientSafeBrowsingReport.RequestHasToken",
  134. /*sample=*/expect_access_token,
  135. /*expected_bucket_count=*/1);
  136. }));
  137. ping_manager->SetURLLoaderFactoryForTesting(
  138. base::MakeRefCounted<network::WeakWrapperSharedURLLoaderFactory>(
  139. &test_url_loader_factory));
  140. ReportThreatDetailsResult result =
  141. ping_manager->ReportThreatDetails(std::move(report));
  142. EXPECT_EQ(result, ReportThreatDetailsResult::SUCCESS);
  143. EXPECT_EQ(raw_token_fetcher->WasStartCalled(), expect_access_token);
  144. if (expect_access_token) {
  145. raw_token_fetcher->RunAccessTokenCallback(access_token);
  146. }
  147. csbrr_logged_run_loop.Run();
  148. EXPECT_EQ(
  149. safe_browsing::WebUIInfoSingleton::GetInstance()->csbrrs_sent().size(),
  150. 1u);
  151. safe_browsing::WebUIInfoSingleton::GetInstance()->ClearListenerForTesting();
  152. }
  153. IN_PROC_BROWSER_TEST_F(WeblayerPingManagerTest,
  154. ReportThreatDetailsWithAccessToken) {
  155. RunReportThreatDetailsTest(/*is_enhanced_protection=*/true,
  156. /*is_signed_in=*/true,
  157. /*expect_access_token=*/true,
  158. /*expect_cookies_removed=*/true);
  159. }
  160. IN_PROC_BROWSER_TEST_F(
  161. RemoveCookiesFeatureDisabledWeblayerPingManagerTest,
  162. ReportThreatDetailsWithAccessToken_RemoveCookiesFeatureDisabled) {
  163. RunReportThreatDetailsTest(/*is_enhanced_protection=*/true,
  164. /*is_signed_in=*/true,
  165. /*expect_access_token=*/true,
  166. /*expect_cookies_removed=*/false);
  167. }
  168. IN_PROC_BROWSER_TEST_F(IncognitoModeWeblayerPingManagerTest,
  169. ReportThreatDetailsWithoutAccessToken_Incognito) {
  170. EXPECT_EQ(WebLayerPingManagerFactory::GetForBrowserContext(
  171. GetProfile()->GetBrowserContext()),
  172. nullptr);
  173. }
  174. IN_PROC_BROWSER_TEST_F(
  175. WeblayerPingManagerTest,
  176. ReportThreatDetailsWithoutAccessToken_NotEnhancedProtection) {
  177. RunReportThreatDetailsTest(/*is_enhanced_protection=*/false,
  178. /*is_signed_in=*/true,
  179. /*expect_access_token=*/false,
  180. /*expect_cookies_removed=*/false);
  181. }
  182. IN_PROC_BROWSER_TEST_F(WeblayerPingManagerTest,
  183. ReportThreatDetailsWithoutAccessToken_NotSignedIn) {
  184. RunReportThreatDetailsTest(/*is_enhanced_protection=*/true,
  185. /*is_signed_in=*/false,
  186. /*expect_access_token=*/false,
  187. /*expect_cookies_removed=*/false);
  188. }
  189. // TODO(crbug.com/1296615): remove test case,
  190. // CsbrrTokenFeatureDisabledWeblayerPingManagerTest class, and
  191. // is_csbrr_token_feature_enabled_ property when deprecating
  192. // kSafeBrowsingCsbrrWithToken feature
  193. IN_PROC_BROWSER_TEST_F(
  194. CsbrrTokenFeatureDisabledWeblayerPingManagerTest,
  195. ReportThreatDetailsWithoutAccessToken_CsbrrTokenFeatureDisabled) {
  196. RunReportThreatDetailsTest(/*is_enhanced_protection=*/true,
  197. /*is_signed_in=*/true,
  198. /*expect_access_token=*/false,
  199. /*expect_cookies_removed=*/false);
  200. }
  201. IN_PROC_BROWSER_TEST_F(WeblayerPingManagerTest, ReportSafeBrowsingHit) {
  202. safe_browsing::HitReport hit_report;
  203. hit_report.post_data = "testing_hit_report_post_data";
  204. // Threat type and source are arbitrary but specified so that determining the
  205. // URL does not does throw an error due to input validation.
  206. hit_report.threat_type = safe_browsing::SB_THREAT_TYPE_URL_PHISHING;
  207. hit_report.threat_source = safe_browsing::ThreatSource::LOCAL_PVER4;
  208. auto* ping_manager = WebLayerPingManagerFactory::GetForBrowserContext(
  209. GetProfile()->GetBrowserContext());
  210. network::TestURLLoaderFactory test_url_loader_factory;
  211. test_url_loader_factory.SetInterceptor(
  212. base::BindLambdaForTesting([&](const network::ResourceRequest& request) {
  213. EXPECT_EQ(GetUploadData(request), hit_report.post_data);
  214. }));
  215. ping_manager->SetURLLoaderFactoryForTesting(
  216. base::MakeRefCounted<network::WeakWrapperSharedURLLoaderFactory>(
  217. &test_url_loader_factory));
  218. ping_manager->ReportSafeBrowsingHit(hit_report);
  219. }
  220. } // namespace weblayer