Skip to content

GitLab

T
tangled
Commit 0af66703 authored by Yutaka Hirano's avatar Yutaka Hirano Committed by Commit Bot
Browse files
Options

Remove cors:: namespace specifier in the namespace 

Bug: None
Cq-Include-Trybots: luci.chromium.try:linux_mojo
Change-Id: Ib487fee40beaac941b74c090d31133b12d61ea4a
Reviewed-on: https://chromium-review.googlesource.com/1203517
Commit-Queue: Yutaka Hirano <yhirano@chromium.org>
Reviewed-by: default avatarTakashi Toyoshima <toyoshim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#589158}
parent f34633d9
Hide whitespace changes
Inline Side-by-side
Showing with 236 additions and 243 deletions
services/network/cors/cors_url_loader.cc
View file @ 0af66703
...@@ -27,7 +27,7 @@ base::Optional<std::string> GetHeaderString( ...@@ -27,7 +27,7 @@ base::Optional<std::string> GetHeaderString(
} }
bool NeedsPreflight(const ResourceRequest& request) { bool NeedsPreflight(const ResourceRequest& request) {
if (!cors::IsCORSEnabledRequestMode(request.fetch_request_mode)) if (!IsCORSEnabledRequestMode(request.fetch_request_mode))
return false; return false;
if (request.is_external_request) if (request.is_external_request)
...@@ -88,7 +88,7 @@ CORSURLLoader::~CORSURLLoader() = default; ...@@ -88,7 +88,7 @@ CORSURLLoader::~CORSURLLoader() = default;
void CORSURLLoader::Start() { void CORSURLLoader::Start() {
if (fetch_cors_flag_ && if (fetch_cors_flag_ &&
cors::IsCORSEnabledRequestMode(request_.fetch_request_mode)) { IsCORSEnabledRequestMode(request_.fetch_request_mode)) {
// Username and password should be stripped in a CORS-enabled request. // Username and password should be stripped in a CORS-enabled request.
if (request_.url.has_username() || request_.url.has_password()) { if (request_.url.has_username() || request_.url.has_password()) {
GURL::Replacements replacements; GURL::Replacements replacements;
......
services/network/cors/preflight_controller.cc
View file @ 0af66703
...@@ -81,18 +81,18 @@ std::unique_ptr<ResourceRequest> CreatePreflightRequest( ...@@ -81,18 +81,18 @@ std::unique_ptr<ResourceRequest> CreatePreflightRequest(
preflight_request->load_flags |= net::LOAD_DO_NOT_SEND_AUTH_DATA; preflight_request->load_flags |= net::LOAD_DO_NOT_SEND_AUTH_DATA;
preflight_request->headers.SetHeader( preflight_request->headers.SetHeader(
cors::header_names::kAccessControlRequestMethod, request.method); header_names::kAccessControlRequestMethod, request.method);
std::string request_headers = std::string request_headers =
CreateAccessControlRequestHeadersHeader(request.headers); CreateAccessControlRequestHeadersHeader(request.headers);
if (!request_headers.empty()) { if (!request_headers.empty()) {
preflight_request->headers.SetHeader( preflight_request->headers.SetHeader(
cors::header_names::kAccessControlRequestHeaders, request_headers); header_names::kAccessControlRequestHeaders, request_headers);
} }
if (request.is_external_request) { if (request.is_external_request) {
preflight_request->headers.SetHeader( preflight_request->headers.SetHeader(
cors::header_names::kAccessControlRequestExternal, "true"); header_names::kAccessControlRequestExternal, "true");
} }
DCHECK(request.request_initiator); DCHECK(request.request_initiator);
...@@ -123,10 +123,9 @@ std::unique_ptr<PreflightResult> CreatePreflightResult( ...@@ -123,10 +123,9 @@ std::unique_ptr<PreflightResult> CreatePreflightResult(
// TODO(toyoshim): Reflect --allow-file-access-from-files flag. // TODO(toyoshim): Reflect --allow-file-access-from-files flag.
*detected_error_status = CheckPreflightAccess( *detected_error_status = CheckPreflightAccess(
final_url, head.headers->response_code(), final_url, head.headers->response_code(),
GetHeaderString(head.headers, header_names::kAccessControlAllowOrigin),
GetHeaderString(head.headers, GetHeaderString(head.headers,
cors::header_names::kAccessControlAllowOrigin), header_names::kAccessControlAllowCredentials),
GetHeaderString(head.headers,
cors::header_names::kAccessControlAllowCredentials),
original_request.fetch_credentials_mode, original_request.fetch_credentials_mode,
tainted ? url::Origin() : *original_request.request_initiator, tainted ? url::Origin() : *original_request.request_initiator,
false /* allow_file_origin */); false /* allow_file_origin */);
......
services/network/cors/preflight_controller_unittest.cc
View file @ 0af66703
...@@ -50,7 +50,7 @@ TEST(PreflightControllerCreatePreflightRequestTest, LexicographicalOrder) { ...@@ -50,7 +50,7 @@ TEST(PreflightControllerCreatePreflightRequestTest, LexicographicalOrder) {
EXPECT_EQ("null", header); EXPECT_EQ("null", header);
EXPECT_TRUE(preflight->headers.GetHeader( EXPECT_TRUE(preflight->headers.GetHeader(
cors::header_names::kAccessControlRequestHeaders, &header)); header_names::kAccessControlRequestHeaders, &header));
EXPECT_EQ("apple,content-type,kiwifruit,orange,strawberry", header); EXPECT_EQ("apple,content-type,kiwifruit,orange,strawberry", header);
} }
...@@ -73,7 +73,7 @@ TEST(PreflightControllerCreatePreflightRequestTest, ExcludeSimpleHeaders) { ...@@ -73,7 +73,7 @@ TEST(PreflightControllerCreatePreflightRequestTest, ExcludeSimpleHeaders) {
// left out in the preflight request. // left out in the preflight request.
std::string header; std::string header;
EXPECT_FALSE(preflight->headers.GetHeader( EXPECT_FALSE(preflight->headers.GetHeader(
cors::header_names::kAccessControlRequestHeaders, &header)); header_names::kAccessControlRequestHeaders, &header));
} }
TEST(PreflightControllerCreatePreflightRequestTest, Credentials) { TEST(PreflightControllerCreatePreflightRequestTest, Credentials) {
...@@ -108,7 +108,7 @@ TEST(PreflightControllerCreatePreflightRequestTest, ...@@ -108,7 +108,7 @@ TEST(PreflightControllerCreatePreflightRequestTest,
// Empty list also; see comment in test above. // Empty list also; see comment in test above.
std::string header; std::string header;
EXPECT_FALSE(preflight->headers.GetHeader( EXPECT_FALSE(preflight->headers.GetHeader(
cors::header_names::kAccessControlRequestHeaders, &header)); header_names::kAccessControlRequestHeaders, &header));
} }
TEST(PreflightControllerCreatePreflightRequestTest, IncludeNonSimpleHeader) { TEST(PreflightControllerCreatePreflightRequestTest, IncludeNonSimpleHeader) {
...@@ -123,7 +123,7 @@ TEST(PreflightControllerCreatePreflightRequestTest, IncludeNonSimpleHeader) { ...@@ -123,7 +123,7 @@ TEST(PreflightControllerCreatePreflightRequestTest, IncludeNonSimpleHeader) {
std::string header; std::string header;
EXPECT_TRUE(preflight->headers.GetHeader( EXPECT_TRUE(preflight->headers.GetHeader(
cors::header_names::kAccessControlRequestHeaders, &header)); header_names::kAccessControlRequestHeaders, &header));
EXPECT_EQ("x-custom-header", header); EXPECT_EQ("x-custom-header", header);
} }
...@@ -141,7 +141,7 @@ TEST(PreflightControllerCreatePreflightRequestTest, ...@@ -141,7 +141,7 @@ TEST(PreflightControllerCreatePreflightRequestTest,
std::string header; std::string header;
EXPECT_TRUE(preflight->headers.GetHeader( EXPECT_TRUE(preflight->headers.GetHeader(
cors::header_names::kAccessControlRequestHeaders, &header)); header_names::kAccessControlRequestHeaders, &header));
EXPECT_EQ("content-type", header); EXPECT_EQ("content-type", header);
} }
...@@ -157,7 +157,7 @@ TEST(PreflightControllerCreatePreflightRequestTest, ExcludeForbiddenHeaders) { ...@@ -157,7 +157,7 @@ TEST(PreflightControllerCreatePreflightRequestTest, ExcludeForbiddenHeaders) {
std::string header; std::string header;
EXPECT_FALSE(preflight->headers.GetHeader( EXPECT_FALSE(preflight->headers.GetHeader(
cors::header_names::kAccessControlRequestHeaders, &header)); header_names::kAccessControlRequestHeaders, &header));
} }
TEST(PreflightControllerCreatePreflightRequestTest, Tainted) { TEST(PreflightControllerCreatePreflightRequestTest, Tainted) {
...@@ -256,7 +256,7 @@ class PreflightControllerTest : public testing::Test { ...@@ -256,7 +256,7 @@ class PreflightControllerTest : public testing::Test {
net::test_server::ShouldHandle(request, "/tainted") net::test_server::ShouldHandle(request, "/tainted")
? url::Origin() ? url::Origin()
: url::Origin::Create(test_server_.base_url()); : url::Origin::Create(test_server_.base_url());
response->AddCustomHeader(cors::header_names::kAccessControlAllowOrigin, response->AddCustomHeader(header_names::kAccessControlAllowOrigin,
origin.Serialize()); origin.Serialize());
response->AddCustomHeader(header_names::kAccessControlAllowMethods, response->AddCustomHeader(header_names::kAccessControlAllowMethods,
"GET, OPTIONS"); "GET, OPTIONS");
......
services/network/public/cpp/cors/cors_unittest.cc
View file @ 0af66703
...@@ -11,22 +11,22 @@ ...@@ -11,22 +11,22 @@
#include "url/origin.h" #include "url/origin.h"
namespace network { namespace network {
namespace cors {
namespace { namespace {
using CORSTest = testing::Test; using CORSTest = testing::Test;
TEST_F(CORSTest, CheckAccessDetectsInvalidResponse) { TEST_F(CORSTest, CheckAccessDetectsInvalidResponse) {
base::Optional<CORSErrorStatus> error_status = cors::CheckAccess( base::Optional<CORSErrorStatus> error_status =
GURL(), 0 /* response_status_code */, CheckAccess(GURL(), 0 /* response_status_code */,
base::nullopt /* allow_origin_header */, base::nullopt /* allow_origin_header */,
base::nullopt /* allow_credentials_header */, base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kOmit, url::Origin()); network::mojom::FetchCredentialsMode::kOmit, url::Origin());
ASSERT_TRUE(error_status); ASSERT_TRUE(error_status);
EXPECT_EQ(mojom::CORSError::kInvalidResponse, error_status->cors_error); EXPECT_EQ(mojom::CORSError::kInvalidResponse, error_status->cors_error);
} }
// Tests if cors::CheckAccess detects kWildcardOriginNotAllowed error correctly. // Tests if CheckAccess detects kWildcardOriginNotAllowed error correctly.
TEST_F(CORSTest, CheckAccessDetectsWildcardOriginNotAllowed) { TEST_F(CORSTest, CheckAccessDetectsWildcardOriginNotAllowed) {
const GURL response_url("http://example.com/data"); const GURL response_url("http://example.com/data");
const url::Origin origin = url::Origin::Create(GURL("http://google.com")); const url::Origin origin = url::Origin::Create(GURL("http://google.com"));
...@@ -35,24 +35,24 @@ TEST_F(CORSTest, CheckAccessDetectsWildcardOriginNotAllowed) { ...@@ -35,24 +35,24 @@ TEST_F(CORSTest, CheckAccessDetectsWildcardOriginNotAllowed) {
// Access-Control-Allow-Origin '*' works. // Access-Control-Allow-Origin '*' works.
base::Optional<CORSErrorStatus> error1 = base::Optional<CORSErrorStatus> error1 =
cors::CheckAccess(response_url, response_status_code, CheckAccess(response_url, response_status_code,
allow_all_header /* allow_origin_header */, allow_all_header /* allow_origin_header */,
base::nullopt /* allow_credentials_header */, base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kOmit, origin); network::mojom::FetchCredentialsMode::kOmit, origin);
EXPECT_FALSE(error1); EXPECT_FALSE(error1);
// Access-Control-Allow-Origin '*' should not be allowed if credentials mode // Access-Control-Allow-Origin '*' should not be allowed if credentials mode
// is kInclude. // is kInclude.
base::Optional<CORSErrorStatus> error2 = base::Optional<CORSErrorStatus> error2 =
cors::CheckAccess(response_url, response_status_code, CheckAccess(response_url, response_status_code,
allow_all_header /* allow_origin_header */, allow_all_header /* allow_origin_header */,
base::nullopt /* allow_credentials_header */, base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kInclude, origin); network::mojom::FetchCredentialsMode::kInclude, origin);
ASSERT_TRUE(error2); ASSERT_TRUE(error2);
EXPECT_EQ(mojom::CORSError::kWildcardOriginNotAllowed, error2->cors_error); EXPECT_EQ(mojom::CORSError::kWildcardOriginNotAllowed, error2->cors_error);
} }
// Tests if cors::CheckAccess detects kMissingAllowOriginHeader error correctly. // Tests if CheckAccess detects kMissingAllowOriginHeader error correctly.
TEST_F(CORSTest, CheckAccessDetectsMissingAllowOriginHeader) { TEST_F(CORSTest, CheckAccessDetectsMissingAllowOriginHeader) {
const GURL response_url("http://example.com/data"); const GURL response_url("http://example.com/data");
const url::Origin origin = url::Origin::Create(GURL("http://google.com")); const url::Origin origin = url::Origin::Create(GURL("http://google.com"));
...@@ -60,15 +60,15 @@ TEST_F(CORSTest, CheckAccessDetectsMissingAllowOriginHeader) { ...@@ -60,15 +60,15 @@ TEST_F(CORSTest, CheckAccessDetectsMissingAllowOriginHeader) {
// Access-Control-Allow-Origin is missed. // Access-Control-Allow-Origin is missed.
base::Optional<CORSErrorStatus> error = base::Optional<CORSErrorStatus> error =
cors::CheckAccess(response_url, response_status_code, CheckAccess(response_url, response_status_code,
base::nullopt /* allow_origin_header */, base::nullopt /* allow_origin_header */,
base::nullopt /* allow_credentials_header */, base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kOmit, origin); network::mojom::FetchCredentialsMode::kOmit, origin);
ASSERT_TRUE(error); ASSERT_TRUE(error);
EXPECT_EQ(mojom::CORSError::kMissingAllowOriginHeader, error->cors_error); EXPECT_EQ(mojom::CORSError::kMissingAllowOriginHeader, error->cors_error);
} }
// Tests if cors::CheckAccess detects kMultipleAllowOriginValues error // Tests if CheckAccess detects kMultipleAllowOriginValues error
// correctly. // correctly.
TEST_F(CORSTest, CheckAccessDetectsMultipleAllowOriginValues) { TEST_F(CORSTest, CheckAccessDetectsMultipleAllowOriginValues) {
const GURL response_url("http://example.com/data"); const GURL response_url("http://example.com/data");
...@@ -77,55 +77,55 @@ TEST_F(CORSTest, CheckAccessDetectsMultipleAllowOriginValues) { ...@@ -77,55 +77,55 @@ TEST_F(CORSTest, CheckAccessDetectsMultipleAllowOriginValues) {
const std::string space_separated_multiple_origins( const std::string space_separated_multiple_origins(
"http://example.com http://another.example.com"); "http://example.com http://another.example.com");
base::Optional<CORSErrorStatus> error1 = cors::CheckAccess( base::Optional<CORSErrorStatus> error1 =
response_url, response_status_code, CheckAccess(response_url, response_status_code,
space_separated_multiple_origins /* allow_origin_header */, space_separated_multiple_origins /* allow_origin_header */,
base::nullopt /* allow_credentials_header */, base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kOmit, origin); network::mojom::FetchCredentialsMode::kOmit, origin);
ASSERT_TRUE(error1); ASSERT_TRUE(error1);
EXPECT_EQ(mojom::CORSError::kMultipleAllowOriginValues, error1->cors_error); EXPECT_EQ(mojom::CORSError::kMultipleAllowOriginValues, error1->cors_error);
const std::string comma_separated_multiple_origins( const std::string comma_separated_multiple_origins(
"http://example.com,http://another.example.com"); "http://example.com,http://another.example.com");
base::Optional<CORSErrorStatus> error2 = cors::CheckAccess( base::Optional<CORSErrorStatus> error2 =
response_url, response_status_code, CheckAccess(response_url, response_status_code,
comma_separated_multiple_origins /* allow_origin_header */, comma_separated_multiple_origins /* allow_origin_header */,
base::nullopt /* allow_credentials_header */, base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kOmit, origin); network::mojom::FetchCredentialsMode::kOmit, origin);
ASSERT_TRUE(error2); ASSERT_TRUE(error2);
EXPECT_EQ(mojom::CORSError::kMultipleAllowOriginValues, error2->cors_error); EXPECT_EQ(mojom::CORSError::kMultipleAllowOriginValues, error2->cors_error);
} }
// Tests if cors::CheckAccess detects kInvalidAllowOriginValue error correctly. // Tests if CheckAccess detects kInvalidAllowOriginValue error correctly.
TEST_F(CORSTest, CheckAccessDetectsInvalidAllowOriginValue) { TEST_F(CORSTest, CheckAccessDetectsInvalidAllowOriginValue) {
const GURL response_url("http://example.com/data"); const GURL response_url("http://example.com/data");
const url::Origin origin = url::Origin::Create(GURL("http://google.com")); const url::Origin origin = url::Origin::Create(GURL("http://google.com"));
const int response_status_code = 200; const int response_status_code = 200;
base::Optional<CORSErrorStatus> error = base::Optional<CORSErrorStatus> error =
cors::CheckAccess(response_url, response_status_code, CheckAccess(response_url, response_status_code,
std::string("invalid.origin") /* allow_origin_header */, std::string("invalid.origin") /* allow_origin_header */,
base::nullopt /* allow_credentials_header */, base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kOmit, origin); network::mojom::FetchCredentialsMode::kOmit, origin);
ASSERT_TRUE(error); ASSERT_TRUE(error);
EXPECT_EQ(mojom::CORSError::kInvalidAllowOriginValue, error->cors_error); EXPECT_EQ(mojom::CORSError::kInvalidAllowOriginValue, error->cors_error);
EXPECT_EQ("invalid.origin", error->failed_parameter); EXPECT_EQ("invalid.origin", error->failed_parameter);
} }
// Tests if cors::CheckAccess detects kAllowOriginMismatch error correctly. // Tests if CheckAccess detects kAllowOriginMismatch error correctly.
TEST_F(CORSTest, CheckAccessDetectsAllowOriginMismatch) { TEST_F(CORSTest, CheckAccessDetectsAllowOriginMismatch) {
const GURL response_url("http://example.com/data"); const GURL response_url("http://example.com/data");
const url::Origin origin = url::Origin::Create(GURL("http://google.com")); const url::Origin origin = url::Origin::Create(GURL("http://google.com"));
const int response_status_code = 200; const int response_status_code = 200;
base::Optional<CORSErrorStatus> error1 = base::Optional<CORSErrorStatus> error1 =
cors::CheckAccess(response_url, response_status_code, CheckAccess(response_url, response_status_code,
origin.Serialize() /* allow_origin_header */, origin.Serialize() /* allow_origin_header */,
base::nullopt /* allow_credentials_header */, base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kOmit, origin); network::mojom::FetchCredentialsMode::kOmit, origin);
ASSERT_FALSE(error1); ASSERT_FALSE(error1);
base::Optional<CORSErrorStatus> error2 = cors::CheckAccess( base::Optional<CORSErrorStatus> error2 = CheckAccess(
response_url, response_status_code, response_url, response_status_code,
std::string("http://not.google.com") /* allow_origin_header */, std::string("http://not.google.com") /* allow_origin_header */,
base::nullopt /* allow_credentials_header */, base::nullopt /* allow_credentials_header */,
...@@ -139,37 +139,37 @@ TEST_F(CORSTest, CheckAccessDetectsAllowOriginMismatch) { ...@@ -139,37 +139,37 @@ TEST_F(CORSTest, CheckAccessDetectsAllowOriginMismatch) {
const url::Origin null_origin; const url::Origin null_origin;
EXPECT_EQ(null_string, null_origin.Serialize()); EXPECT_EQ(null_string, null_origin.Serialize());
base::Optional<CORSErrorStatus> error3 = cors::CheckAccess( base::Optional<CORSErrorStatus> error3 = CheckAccess(
response_url, response_status_code, null_string /* allow_origin_header */, response_url, response_status_code, null_string /* allow_origin_header */,
base::nullopt /* allow_credentials_header */, base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kOmit, null_origin); network::mojom::FetchCredentialsMode::kOmit, null_origin);
EXPECT_FALSE(error3); EXPECT_FALSE(error3);
} }
// Tests if cors::CheckAccess detects kInvalidAllowCredentials error correctly. // Tests if CheckAccess detects kInvalidAllowCredentials error correctly.
TEST_F(CORSTest, CheckAccessDetectsInvalidAllowCredential) { TEST_F(CORSTest, CheckAccessDetectsInvalidAllowCredential) {
const GURL response_url("http://example.com/data"); const GURL response_url("http://example.com/data");
const url::Origin origin = url::Origin::Create(GURL("http://google.com")); const url::Origin origin = url::Origin::Create(GURL("http://google.com"));
const int response_status_code = 200; const int response_status_code = 200;
base::Optional<CORSErrorStatus> error1 = base::Optional<CORSErrorStatus> error1 =
cors::CheckAccess(response_url, response_status_code, CheckAccess(response_url, response_status_code,
origin.Serialize() /* allow_origin_header */, origin.Serialize() /* allow_origin_header */,
std::string("true") /* allow_credentials_header */, std::string("true") /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kInclude, origin); network::mojom::FetchCredentialsMode::kInclude, origin);
ASSERT_FALSE(error1); ASSERT_FALSE(error1);
base::Optional<CORSErrorStatus> error2 = base::Optional<CORSErrorStatus> error2 =
cors::CheckAccess(response_url, response_status_code, CheckAccess(response_url, response_status_code,
origin.Serialize() /* allow_origin_header */, origin.Serialize() /* allow_origin_header */,
std::string("fuga") /* allow_credentials_header */, std::string("fuga") /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kInclude, origin); network::mojom::FetchCredentialsMode::kInclude, origin);
ASSERT_TRUE(error2); ASSERT_TRUE(error2);
EXPECT_EQ(mojom::CORSError::kInvalidAllowCredentials, error2->cors_error); EXPECT_EQ(mojom::CORSError::kInvalidAllowCredentials, error2->cors_error);
EXPECT_EQ("fuga", error2->failed_parameter); EXPECT_EQ("fuga", error2->failed_parameter);
} }
// Tests if cors::CheckRedirectLocation detects kCORSDisabledScheme and // Tests if CheckRedirectLocation detects kCORSDisabledScheme and
// kRedirectContainsCredentials errors correctly. // kRedirectContainsCredentials errors correctly.
TEST_F(CORSTest, CheckRedirectLocation) { TEST_F(CORSTest, CheckRedirectLocation) {
struct TestCase { struct TestCase {
...@@ -279,30 +279,30 @@ TEST_F(CORSTest, CheckRedirectLocation) { ...@@ -279,30 +279,30 @@ TEST_F(CORSTest, CheckRedirectLocation) {
<< ", tainted: " << test.tainted); << ", tainted: " << test.tainted);
EXPECT_EQ(test.expectation, EXPECT_EQ(test.expectation,
cors::CheckRedirectLocation(test.url, test.request_mode, origin, CheckRedirectLocation(test.url, test.request_mode, origin,
test.cors_flag, test.tainted)); test.cors_flag, test.tainted));
} }
} }
TEST_F(CORSTest, CheckPreflightDetectsErrors) { TEST_F(CORSTest, CheckPreflightDetectsErrors) {
EXPECT_FALSE(cors::CheckPreflight(200)); EXPECT_FALSE(CheckPreflight(200));
EXPECT_FALSE(cors::CheckPreflight(299)); EXPECT_FALSE(CheckPreflight(299));
base::Optional<mojom::CORSError> error1 = cors::CheckPreflight(300); base::Optional<mojom::CORSError> error1 = CheckPreflight(300);
ASSERT_TRUE(error1); ASSERT_TRUE(error1);
EXPECT_EQ(mojom::CORSError::kPreflightInvalidStatus, *error1); EXPECT_EQ(mojom::CORSError::kPreflightInvalidStatus, *error1);
EXPECT_FALSE(cors::CheckExternalPreflight(std::string("true"))); EXPECT_FALSE(CheckExternalPreflight(std::string("true")));
base::Optional<CORSErrorStatus> error2 = base::Optional<CORSErrorStatus> error2 =
cors::CheckExternalPreflight(base::nullopt); CheckExternalPreflight(base::nullopt);
ASSERT_TRUE(error2); ASSERT_TRUE(error2);
EXPECT_EQ(mojom::CORSError::kPreflightMissingAllowExternal, EXPECT_EQ(mojom::CORSError::kPreflightMissingAllowExternal,
error2->cors_error); error2->cors_error);
EXPECT_EQ("", error2->failed_parameter); EXPECT_EQ("", error2->failed_parameter);
base::Optional<CORSErrorStatus> error3 = base::Optional<CORSErrorStatus> error3 =
cors::CheckExternalPreflight(std::string("TRUE")); CheckExternalPreflight(std::string("TRUE"));
ASSERT_TRUE(error3); ASSERT_TRUE(error3);
EXPECT_EQ(mojom::CORSError::kPreflightInvalidAllowExternal, EXPECT_EQ(mojom::CORSError::kPreflightInvalidAllowExternal,
error3->cors_error); error3->cors_error);
...@@ -320,86 +320,86 @@ TEST_F(CORSTest, CalculateResponseTainting) { ...@@ -320,86 +320,86 @@ TEST_F(CORSTest, CalculateResponseTainting) {
// CORS flag is false, same-origin request // CORS flag is false, same-origin request
EXPECT_EQ(FetchResponseType::kBasic, EXPECT_EQ(FetchResponseType::kBasic,
cors::CalculateResponseTainting( CalculateResponseTainting(
same_origin_url, FetchRequestMode::kSameOrigin, origin, false)); same_origin_url, FetchRequestMode::kSameOrigin, origin, false));
EXPECT_EQ(FetchResponseType::kBasic, EXPECT_EQ(FetchResponseType::kBasic,
cors::CalculateResponseTainting( CalculateResponseTainting(
same_origin_url, FetchRequestMode::kNoCORS, origin, false)); same_origin_url, FetchRequestMode::kNoCORS, origin, false));
EXPECT_EQ(FetchResponseType::kBasic, EXPECT_EQ(FetchResponseType::kBasic,
cors::CalculateResponseTainting( CalculateResponseTainting(same_origin_url, FetchRequestMode::kCORS,
same_origin_url, FetchRequestMode::kCORS, origin, false)); origin, false));
EXPECT_EQ(FetchResponseType::kBasic, EXPECT_EQ(FetchResponseType::kBasic,
cors::CalculateResponseTainting( CalculateResponseTainting(
same_origin_url, FetchRequestMode::kCORSWithForcedPreflight, same_origin_url, FetchRequestMode::kCORSWithForcedPreflight,
origin, false)); origin, false));
EXPECT_EQ(FetchResponseType::kBasic, EXPECT_EQ(FetchResponseType::kBasic,
cors::CalculateResponseTainting( CalculateResponseTainting(
same_origin_url, FetchRequestMode::kNavigate, origin, false)); same_origin_url, FetchRequestMode::kNavigate, origin, false));
// CORS flag is false, cross-origin request // CORS flag is false, cross-origin request
EXPECT_EQ(FetchResponseType::kOpaque, EXPECT_EQ(FetchResponseType::kOpaque,
cors::CalculateResponseTainting( CalculateResponseTainting(
cross_origin_url, FetchRequestMode::kNoCORS, origin, false)); cross_origin_url, FetchRequestMode::kNoCORS, origin, false));
EXPECT_EQ(FetchResponseType::kBasic, EXPECT_EQ(FetchResponseType::kBasic,
cors::CalculateResponseTainting( CalculateResponseTainting(
cross_origin_url, FetchRequestMode::kNavigate, origin, false)); cross_origin_url, FetchRequestMode::kNavigate, origin, false));
// CORS flag is true, same-origin request // CORS flag is true, same-origin request
EXPECT_EQ(FetchResponseType::kCORS, EXPECT_EQ(FetchResponseType::kCORS,
cors::CalculateResponseTainting( CalculateResponseTainting(same_origin_url, FetchRequestMode::kCORS,
same_origin_url, FetchRequestMode::kCORS, origin, true)); origin, true));
EXPECT_EQ(FetchResponseType::kCORS, EXPECT_EQ(FetchResponseType::kCORS,
cors::CalculateResponseTainting( CalculateResponseTainting(
same_origin_url, FetchRequestMode::kCORSWithForcedPreflight, same_origin_url, FetchRequestMode::kCORSWithForcedPreflight,
origin, true)); origin, true));
// CORS flag is true, cross-origin request // CORS flag is true, cross-origin request
EXPECT_EQ(FetchResponseType::kCORS, EXPECT_EQ(FetchResponseType::kCORS,
cors::CalculateResponseTainting( CalculateResponseTainting(cross_origin_url, FetchRequestMode::kCORS,
cross_origin_url, FetchRequestMode::kCORS, origin, true)); origin, true));
EXPECT_EQ(FetchResponseType::kCORS, EXPECT_EQ(FetchResponseType::kCORS,
cors::CalculateResponseTainting( CalculateResponseTainting(
cross_origin_url, FetchRequestMode::kCORSWithForcedPreflight, cross_origin_url, FetchRequestMode::kCORSWithForcedPreflight,
origin, true)); origin, true));
// Origin is not provided. // Origin is not provided.
EXPECT_EQ(FetchResponseType::kBasic, EXPECT_EQ(FetchResponseType::kBasic,
cors::CalculateResponseTainting( CalculateResponseTainting(
same_origin_url, FetchRequestMode::kNoCORS, no_origin, false)); same_origin_url, FetchRequestMode::kNoCORS, no_origin, false));
EXPECT_EQ( EXPECT_EQ(
FetchResponseType::kBasic, FetchResponseType::kBasic,
cors::CalculateResponseTainting( CalculateResponseTainting(same_origin_url, FetchRequestMode::kNavigate,
same_origin_url, FetchRequestMode::kNavigate, no_origin, false)); no_origin, false));
EXPECT_EQ(FetchResponseType::kBasic, EXPECT_EQ(FetchResponseType::kBasic,
cors::CalculateResponseTainting( CalculateResponseTainting(
cross_origin_url, FetchRequestMode::kNoCORS, no_origin, false)); cross_origin_url, FetchRequestMode::kNoCORS, no_origin, false));
EXPECT_EQ( EXPECT_EQ(
FetchResponseType::kBasic, FetchResponseType::kBasic,
cors::CalculateResponseTainting( CalculateResponseTainting(cross_origin_url, FetchRequestMode::kNavigate,
cross_origin_url, FetchRequestMode::kNavigate, no_origin, false)); no_origin, false));
} }
TEST_F(CORSTest, SafelistedMethod) { TEST_F(CORSTest, SafelistedMethod) {
// Method check should be case-insensitive. // Method check should be case-insensitive.
EXPECT_TRUE(cors::IsCORSSafelistedMethod("get")); EXPECT_TRUE(IsCORSSafelistedMethod("get"));
EXPECT_TRUE(cors::IsCORSSafelistedMethod("Get")); EXPECT_TRUE(IsCORSSafelistedMethod("Get"));
EXPECT_TRUE(cors::IsCORSSafelistedMethod("GET")); EXPECT_TRUE(IsCORSSafelistedMethod("GET"));
EXPECT_TRUE(cors::IsCORSSafelistedMethod("HEAD")); EXPECT_TRUE(IsCORSSafelistedMethod("HEAD"));
EXPECT_TRUE(cors::IsCORSSafelistedMethod("POST")); EXPECT_TRUE(IsCORSSafelistedMethod("POST"));
EXPECT_FALSE(cors::IsCORSSafelistedMethod("OPTIONS")); EXPECT_FALSE(IsCORSSafelistedMethod("OPTIONS"));
} }
TEST_F(CORSTest, SafelistedHeader) { TEST_F(CORSTest, SafelistedHeader) {
// See SafelistedAccept/AcceptLanguage/ContentLanguage/ContentType also. // See SafelistedAccept/AcceptLanguage/ContentLanguage/ContentType also.
EXPECT_TRUE(cors::IsCORSSafelistedHeader("accept", "foo")); EXPECT_TRUE(IsCORSSafelistedHeader("accept", "foo"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("foo", "bar")); EXPECT_FALSE(IsCORSSafelistedHeader("foo", "bar"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("user-agent", "foo")); EXPECT_FALSE(IsCORSSafelistedHeader("user-agent", "foo"));
} }
TEST_F(CORSTest, SafelistedAccept) { TEST_F(CORSTest, SafelistedAccept) {
EXPECT_TRUE(cors::IsCORSSafelistedHeader("accept", "text/html")); EXPECT_TRUE(IsCORSSafelistedHeader("accept", "text/html"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("AccepT", "text/html")); EXPECT_TRUE(IsCORSSafelistedHeader("AccepT", "text/html"));
constexpr char kAllowed[] = constexpr char kAllowed[] =
"\t !#$%&'*+,-./0123456789;=" "\t !#$%&'*+,-./0123456789;="
...@@ -410,20 +410,20 @@ TEST_F(CORSTest, SafelistedAccept) { ...@@ -410,20 +410,20 @@ TEST_F(CORSTest, SafelistedAccept) {
// 1 for the trailing null character. // 1 for the trailing null character.
auto* end = kAllowed + base::size(kAllowed) - 1; auto* end = kAllowed + base::size(kAllowed) - 1;
EXPECT_EQ(std::find(kAllowed, end, c) != end, EXPECT_EQ(std::find(kAllowed, end, c) != end,
cors::IsCORSSafelistedHeader("accept", std::string(1, c))); IsCORSSafelistedHeader("accept", std::string(1, c)));
EXPECT_EQ(std::find(kAllowed, end, c) != end, EXPECT_EQ(std::find(kAllowed, end, c) != end,
cors::IsCORSSafelistedHeader("AccepT", std::string(1, c))); IsCORSSafelistedHeader("AccepT", std::string(1, c)));
} }
EXPECT_TRUE(cors::IsCORSSafelistedHeader("accept", std::string(128, 'a'))); EXPECT_TRUE(IsCORSSafelistedHeader("accept", std::string(128, 'a')));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("accept", std::string(129, 'a'))); EXPECT_FALSE(IsCORSSafelistedHeader("accept", std::string(129, 'a')));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("AccepT", std::string(128, 'a'))); EXPECT_TRUE(IsCORSSafelistedHeader("AccepT", std::string(128, 'a')));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("AccepT", std::string(129, 'a'))); EXPECT_FALSE(IsCORSSafelistedHeader("AccepT", std::string(129, 'a')));
} }
TEST_F(CORSTest, SafelistedAcceptLanguage) { TEST_F(CORSTest, SafelistedAcceptLanguage) {
EXPECT_TRUE(cors::IsCORSSafelistedHeader("accept-language", "en,ja")); EXPECT_TRUE(IsCORSSafelistedHeader("accept-language", "en,ja"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("aCcEPT-lAngUAge", "en,ja")); EXPECT_TRUE(IsCORSSafelistedHeader("aCcEPT-lAngUAge", "en,ja"));
constexpr char kAllowed[] = constexpr char kAllowed[] =
"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz *,-.;="; "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz *,-.;=";
...@@ -432,23 +432,20 @@ TEST_F(CORSTest, SafelistedAcceptLanguage) { ...@@ -432,23 +432,20 @@ TEST_F(CORSTest, SafelistedAcceptLanguage) {
char c = static_cast<char>(i); char c = static_cast<char>(i);
// 1 for the trailing null character. // 1 for the trailing null character.
auto* end = kAllowed + base::size(kAllowed) - 1; auto* end = kAllowed + base::size(kAllowed) - 1;
EXPECT_EQ( EXPECT_EQ(std::find(kAllowed, end, c) != end,
std::find(kAllowed, end, c) != end, IsCORSSafelistedHeader("aCcEPT-lAngUAge", std::string(1, c)));
cors::IsCORSSafelistedHeader("aCcEPT-lAngUAge", std::string(1, c)));
} }
EXPECT_TRUE( EXPECT_TRUE(IsCORSSafelistedHeader("accept-language", std::string(128, 'a')));
cors::IsCORSSafelistedHeader("accept-language", std::string(128, 'a')));
EXPECT_FALSE( EXPECT_FALSE(
cors::IsCORSSafelistedHeader("accept-language", std::string(129, 'a'))); IsCORSSafelistedHeader("accept-language", std::string(129, 'a')));
EXPECT_TRUE( EXPECT_TRUE(IsCORSSafelistedHeader("aCcEPT-lAngUAge", std::string(128, 'a')));
cors::IsCORSSafelistedHeader("aCcEPT-lAngUAge", std::string(128, 'a')));
EXPECT_FALSE( EXPECT_FALSE(
cors::IsCORSSafelistedHeader("aCcEPT-lAngUAge", std::string(129, 'a'))); IsCORSSafelistedHeader("aCcEPT-lAngUAge", std::string(129, 'a')));
} }
TEST_F(CORSTest, SafelistedContentLanguage) { TEST_F(CORSTest, SafelistedContentLanguage) {
EXPECT_TRUE(cors::IsCORSSafelistedHeader("content-language", "en,ja")); EXPECT_TRUE(IsCORSSafelistedHeader("content-language", "en,ja"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("cONTent-LANguaGe", "en,ja")); EXPECT_TRUE(IsCORSSafelistedHeader("cONTent-LANguaGe", "en,ja"));
constexpr char kAllowed[] = constexpr char kAllowed[] =
"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz *,-.;="; "0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz *,-.;=";
...@@ -457,103 +454,100 @@ TEST_F(CORSTest, SafelistedContentLanguage) { ...@@ -457,103 +454,100 @@ TEST_F(CORSTest, SafelistedContentLanguage) {
char c = static_cast<char>(i); char c = static_cast<char>(i);
// 1 for the trailing null character. // 1 for the trailing null character.
auto* end = kAllowed + base::size(kAllowed) - 1; auto* end = kAllowed + base::size(kAllowed) - 1;
EXPECT_EQ( EXPECT_EQ(std::find(kAllowed, end, c) != end,
std::find(kAllowed, end, c) != end, IsCORSSafelistedHeader("content-language", std::string(1, c)));
cors::IsCORSSafelistedHeader("content-language", std::string(1, c))); EXPECT_EQ(std::find(kAllowed, end, c) != end,
EXPECT_EQ( IsCORSSafelistedHeader("cONTent-LANguaGe", std::string(1, c)));
std::find(kAllowed, end, c) != end,
cors::IsCORSSafelistedHeader("cONTent-LANguaGe", std::string(1, c)));
} }
EXPECT_TRUE( EXPECT_TRUE(
cors::IsCORSSafelistedHeader("content-language", std::string(128, 'a'))); IsCORSSafelistedHeader("content-language", std::string(128, 'a')));
EXPECT_FALSE( EXPECT_FALSE(
cors::IsCORSSafelistedHeader("content-language", std::string(129, 'a'))); IsCORSSafelistedHeader("content-language", std::string(129, 'a')));
EXPECT_TRUE( EXPECT_TRUE(
cors::IsCORSSafelistedHeader("cONTent-LANguaGe", std::string(128, 'a'))); IsCORSSafelistedHeader("cONTent-LANguaGe", std::string(128, 'a')));
EXPECT_FALSE( EXPECT_FALSE(
cors::IsCORSSafelistedHeader("cONTent-LANguaGe", std::string(129, 'a'))); IsCORSSafelistedHeader("cONTent-LANguaGe", std::string(129, 'a')));
} }
TEST_F(CORSTest, SafelistedContentType) { TEST_F(CORSTest, SafelistedContentType) {
EXPECT_TRUE(cors::IsCORSSafelistedHeader("content-type", "text/plain")); EXPECT_TRUE(IsCORSSafelistedHeader("content-type", "text/plain"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("CoNtEnt-TyPE", "text/plain")); EXPECT_TRUE(IsCORSSafelistedHeader("CoNtEnt-TyPE", "text/plain"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("content-type",
"text/plain; charset=utf-8"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("content-type",
" text/plain ; charset=UTF-8"));
EXPECT_TRUE( EXPECT_TRUE(
cors::IsCORSSafelistedHeader("content-type", "text/plain; param=BOGUS")); IsCORSSafelistedHeader("content-type", "text/plain; charset=utf-8"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader(
"content-type", "application/x-www-form-urlencoded"));
EXPECT_TRUE( EXPECT_TRUE(
cors::IsCORSSafelistedHeader("content-type", "multipart/form-data")); IsCORSSafelistedHeader("content-type", " text/plain ; charset=UTF-8"));
EXPECT_TRUE(
EXPECT_TRUE(cors::IsCORSSafelistedHeader("content-type", "Text/plain")); IsCORSSafelistedHeader("content-type", "text/plain; param=BOGUS"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("content-type", "tEXT/PLAIN")); EXPECT_TRUE(IsCORSSafelistedHeader("content-type",
EXPECT_FALSE(cors::IsCORSSafelistedHeader("content-type", "text/html")); "application/x-www-form-urlencoded"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("CoNtEnt-TyPE", "text/html")); EXPECT_TRUE(IsCORSSafelistedHeader("content-type", "multipart/form-data"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("content-type", "image/png")); EXPECT_TRUE(IsCORSSafelistedHeader("content-type", "Text/plain"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("CoNtEnt-TyPE", "image/png")); EXPECT_TRUE(IsCORSSafelistedHeader("content-type", "tEXT/PLAIN"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader( EXPECT_FALSE(IsCORSSafelistedHeader("content-type", "text/html"));
EXPECT_FALSE(IsCORSSafelistedHeader("CoNtEnt-TyPE", "text/html"));
EXPECT_FALSE(IsCORSSafelistedHeader("content-type", "image/png"));
EXPECT_FALSE(IsCORSSafelistedHeader("CoNtEnt-TyPE", "image/png"));
EXPECT_TRUE(IsCORSSafelistedHeader(
"content-type", "text/plain; charset=" + std::string(108, 'a'))); "content-type", "text/plain; charset=" + std::string(108, 'a')));
EXPECT_TRUE(cors::IsCORSSafelistedHeader( EXPECT_TRUE(IsCORSSafelistedHeader(
"cONTent-tYPE", "text/plain; charset=" + std::string(108, 'a'))); "cONTent-tYPE", "text/plain; charset=" + std::string(108, 'a')));
EXPECT_FALSE(cors::IsCORSSafelistedHeader( EXPECT_FALSE(IsCORSSafelistedHeader(
"content-type", "text/plain; charset=" + std::string(109, 'a'))); "content-type", "text/plain; charset=" + std::string(109, 'a')));
EXPECT_FALSE(cors::IsCORSSafelistedHeader( EXPECT_FALSE(IsCORSSafelistedHeader(
"cONTent-tYPE", "text/plain; charset=" + std::string(109, 'a'))); "cONTent-tYPE", "text/plain; charset=" + std::string(109, 'a')));
} }
TEST_F(CORSTest, CheckCORSClientHintsSafelist) { TEST_F(CORSTest, CheckCORSClientHintsSafelist) {
EXPECT_FALSE(cors::IsCORSSafelistedHeader("device-memory", "")); EXPECT_FALSE(IsCORSSafelistedHeader("device-memory", ""));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("device-memory", "abc")); EXPECT_FALSE(IsCORSSafelistedHeader("device-memory", "abc"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("device-memory", "1.25")); EXPECT_TRUE(IsCORSSafelistedHeader("device-memory", "1.25"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("DEVICE-memory", "1.25")); EXPECT_TRUE(IsCORSSafelistedHeader("DEVICE-memory", "1.25"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("device-memory", "1.25-2.5")); EXPECT_FALSE(IsCORSSafelistedHeader("device-memory", "1.25-2.5"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("device-memory", "-1.25")); EXPECT_FALSE(IsCORSSafelistedHeader("device-memory", "-1.25"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("device-memory", "1e2")); EXPECT_FALSE(IsCORSSafelistedHeader("device-memory", "1e2"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("device-memory", "inf")); EXPECT_FALSE(IsCORSSafelistedHeader("device-memory", "inf"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("device-memory", "-2.3")); EXPECT_FALSE(IsCORSSafelistedHeader("device-memory", "-2.3"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("device-memory", "NaN")); EXPECT_FALSE(IsCORSSafelistedHeader("device-memory", "NaN"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("DEVICE-memory", "1.25.3")); EXPECT_FALSE(IsCORSSafelistedHeader("DEVICE-memory", "1.25.3"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("DEVICE-memory", "1.")); EXPECT_FALSE(IsCORSSafelistedHeader("DEVICE-memory", "1."));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("DEVICE-memory", ".1")); EXPECT_FALSE(IsCORSSafelistedHeader("DEVICE-memory", ".1"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("DEVICE-memory", ".")); EXPECT_FALSE(IsCORSSafelistedHeader("DEVICE-memory", "."));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("DEVICE-memory", "1")); EXPECT_TRUE(IsCORSSafelistedHeader("DEVICE-memory", "1"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "")); EXPECT_FALSE(IsCORSSafelistedHeader("dpr", ""));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "abc")); EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "abc"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("dpr", "1.25")); EXPECT_TRUE(IsCORSSafelistedHeader("dpr", "1.25"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("Dpr", "1.25")); EXPECT_TRUE(IsCORSSafelistedHeader("Dpr", "1.25"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "1.25-2.5")); EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "1.25-2.5"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "-1.25")); EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "-1.25"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "1e2")); EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "1e2"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "inf")); EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "inf"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "-2.3")); EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "-2.3"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "NaN")); EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "NaN"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "1.25.3")); EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "1.25.3"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "1.")); EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "1."));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", ".1")); EXPECT_FALSE(IsCORSSafelistedHeader("dpr", ".1"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", ".")); EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "."));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("dpr", "1")); EXPECT_TRUE(IsCORSSafelistedHeader("dpr", "1"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("width", "")); EXPECT_FALSE(IsCORSSafelistedHeader("width", ""));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("width", "abc")); EXPECT_FALSE(IsCORSSafelistedHeader("width", "abc"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("width", "125")); EXPECT_TRUE(IsCORSSafelistedHeader("width", "125"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("width", "1")); EXPECT_TRUE(IsCORSSafelistedHeader("width", "1"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("WIDTH", "125")); EXPECT_TRUE(IsCORSSafelistedHeader("WIDTH", "125"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("width", "125.2")); EXPECT_FALSE(IsCORSSafelistedHeader("width", "125.2"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("width", "-125")); EXPECT_FALSE(IsCORSSafelistedHeader("width", "-125"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("width", "2147483648")); EXPECT_TRUE(IsCORSSafelistedHeader("width", "2147483648"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("viewport-width", "")); EXPECT_FALSE(IsCORSSafelistedHeader("viewport-width", ""));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("viewport-width", "abc")); EXPECT_FALSE(IsCORSSafelistedHeader("viewport-width", "abc"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("viewport-width", "125")); EXPECT_TRUE(IsCORSSafelistedHeader("viewport-width", "125"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("viewport-width", "1")); EXPECT_TRUE(IsCORSSafelistedHeader("viewport-width", "1"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("viewport-Width", "125")); EXPECT_TRUE(IsCORSSafelistedHeader("viewport-Width", "125"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("viewport-width", "125.2")); EXPECT_FALSE(IsCORSSafelistedHeader("viewport-width", "125.2"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("viewport-width", "2147483648")); EXPECT_TRUE(IsCORSSafelistedHeader("viewport-width", "2147483648"));
} }
TEST_F(CORSTest, CORSUnsafeRequestHeaderNames) { TEST_F(CORSTest, CORSUnsafeRequestHeaderNames) {
...@@ -561,30 +555,30 @@ TEST_F(CORSTest, CORSUnsafeRequestHeaderNames) { ...@@ -561,30 +555,30 @@ TEST_F(CORSTest, CORSUnsafeRequestHeaderNames) {
using List = std::vector<std::string>; using List = std::vector<std::string>;
// Empty => Empty // Empty => Empty
EXPECT_EQ(cors::CORSUnsafeRequestHeaderNames({}), List({})); EXPECT_EQ(CORSUnsafeRequestHeaderNames({}), List({}));
// Some headers are safelisted. // Some headers are safelisted.
EXPECT_EQ(cors::CORSUnsafeRequestHeaderNames({{"content-type", "text/plain"}, EXPECT_EQ(CORSUnsafeRequestHeaderNames({{"content-type", "text/plain"},
{"dpr", "12345"}, {"dpr", "12345"},
{"aCCept", "en,ja"},
{"accept-charset", "utf-8"},
{"uSer-Agent", "foo"},
{"hogE", "fuga"}}),
List({"accept-charset", "user-agent", "hoge"}));
// All headers are not safelisted.
EXPECT_EQ(
cors::CORSUnsafeRequestHeaderNames({{"content-type", "text/html"},
{"dpr", "123-45"},
{"aCCept", "en,ja"}, {"aCCept", "en,ja"},
{"accept-charset", "utf-8"}, {"accept-charset", "utf-8"},
{"uSer-Agent", "foo"}, {"uSer-Agent", "foo"},
{"hogE", "fuga"}}), {"hogE", "fuga"}}),
List({"accept-charset", "user-agent", "hoge"}));
// All headers are not safelisted.
EXPECT_EQ(
CORSUnsafeRequestHeaderNames({{"content-type", "text/html"},
{"dpr", "123-45"},
{"aCCept", "en,ja"},
{"accept-charset", "utf-8"},
{"uSer-Agent", "foo"},
{"hogE", "fuga"}}),
List({"content-type", "dpr", "accept-charset", "user-agent", "hoge"})); List({"content-type", "dpr", "accept-charset", "user-agent", "hoge"}));
// |safelistValueSize| is 1024. // |safelistValueSize| is 1024.
EXPECT_EQ( EXPECT_EQ(
cors::CORSUnsafeRequestHeaderNames( CORSUnsafeRequestHeaderNames(
{{"content-type", "text/plain; charset=" + std::string(108, '1')}, {{"content-type", "text/plain; charset=" + std::string(108, '1')},
{"accept", std::string(128, '1')}, {"accept", std::string(128, '1')},
{"accept-language", std::string(128, '1')}, {"accept-language", std::string(128, '1')},
...@@ -599,7 +593,7 @@ TEST_F(CORSTest, CORSUnsafeRequestHeaderNames) { ...@@ -599,7 +593,7 @@ TEST_F(CORSTest, CORSUnsafeRequestHeaderNames) {
// |safelistValueSize| is 1025. // |safelistValueSize| is 1025.
EXPECT_EQ( EXPECT_EQ(
cors::CORSUnsafeRequestHeaderNames( CORSUnsafeRequestHeaderNames(
{{"content-type", "text/plain; charset=" + std::string(108, '1')}, {{"content-type", "text/plain; charset=" + std::string(108, '1')},
{"accept", std::string(128, '1')}, {"accept", std::string(128, '1')},
{"accept-language", std::string(128, '1')}, {"accept-language", std::string(128, '1')},
...@@ -616,7 +610,7 @@ TEST_F(CORSTest, CORSUnsafeRequestHeaderNames) { ...@@ -616,7 +610,7 @@ TEST_F(CORSTest, CORSUnsafeRequestHeaderNames) {
// |safelistValueSize| is 897 because "content-type" is not safelisted. // |safelistValueSize| is 897 because "content-type" is not safelisted.
EXPECT_EQ( EXPECT_EQ(
cors::CORSUnsafeRequestHeaderNames( CORSUnsafeRequestHeaderNames(
{{"content-type", "text/plain; charset=" + std::string(128, '1')}, {{"content-type", "text/plain; charset=" + std::string(128, '1')},
{"accept", std::string(128, '1')}, {"accept", std::string(128, '1')},
{"accept-language", std::string(128, '1')}, {"accept-language", std::string(128, '1')},
...@@ -635,29 +629,29 @@ TEST_F(CORSTest, CORSUnsafeNotForbiddenRequestHeaderNames) { ...@@ -635,29 +629,29 @@ TEST_F(CORSTest, CORSUnsafeNotForbiddenRequestHeaderNames) {
using List = std::vector<std::string>; using List = std::vector<std::string>;
// Empty => Empty // Empty => Empty
EXPECT_EQ(cors::CORSUnsafeNotForbiddenRequestHeaderNames({}), List({})); EXPECT_EQ(CORSUnsafeNotForbiddenRequestHeaderNames({}), List({}));
// "user-agent" is NOT forbidden per spec, but forbidden in Chromium. // "user-agent" is NOT forbidden per spec, but forbidden in Chromium.
EXPECT_EQ(cors::CORSUnsafeNotForbiddenRequestHeaderNames( EXPECT_EQ(
{{"content-type", "text/plain"}, CORSUnsafeNotForbiddenRequestHeaderNames({{"content-type", "text/plain"},
{"dpr", "12345"}, {"dpr", "12345"},
{"aCCept", "en,ja"}, {"aCCept", "en,ja"},
{"accept-charset", "utf-8"}, {"accept-charset", "utf-8"},
{"uSer-Agent", "foo"}, {"uSer-Agent", "foo"},
{"hogE", "fuga"}}), {"hogE", "fuga"}}),
List({"hoge"})); List({"hoge"}));
EXPECT_EQ(cors::CORSUnsafeNotForbiddenRequestHeaderNames( EXPECT_EQ(
{{"content-type", "text/html"}, CORSUnsafeNotForbiddenRequestHeaderNames({{"content-type", "text/html"},
{"dpr", "123-45"}, {"dpr", "123-45"},
{"aCCept", "en,ja"}, {"aCCept", "en,ja"},
{"accept-charset", "utf-8"}, {"accept-charset", "utf-8"},
{"hogE", "fuga"}}), {"hogE", "fuga"}}),
List({"content-type", "dpr", "hoge"})); List({"content-type", "dpr", "hoge"}));
// |safelistValueSize| is 1024. // |safelistValueSize| is 1024.
EXPECT_EQ( EXPECT_EQ(
cors::CORSUnsafeNotForbiddenRequestHeaderNames( CORSUnsafeNotForbiddenRequestHeaderNames(
{{"content-type", "text/plain; charset=" + std::string(108, '1')}, {{"content-type", "text/plain; charset=" + std::string(108, '1')},
{"accept", std::string(128, '1')}, {"accept", std::string(128, '1')},
{"accept-language", std::string(128, '1')}, {"accept-language", std::string(128, '1')},
...@@ -673,7 +667,7 @@ TEST_F(CORSTest, CORSUnsafeNotForbiddenRequestHeaderNames) { ...@@ -673,7 +667,7 @@ TEST_F(CORSTest, CORSUnsafeNotForbiddenRequestHeaderNames) {
// |safelistValueSize| is 1025. // |safelistValueSize| is 1025.
EXPECT_EQ( EXPECT_EQ(
cors::CORSUnsafeNotForbiddenRequestHeaderNames( CORSUnsafeNotForbiddenRequestHeaderNames(
{{"content-type", "text/plain; charset=" + std::string(108, '1')}, {{"content-type", "text/plain; charset=" + std::string(108, '1')},
{"accept", std::string(128, '1')}, {"accept", std::string(128, '1')},
{"accept-language", std::string(128, '1')}, {"accept-language", std::string(128, '1')},
...@@ -691,7 +685,7 @@ TEST_F(CORSTest, CORSUnsafeNotForbiddenRequestHeaderNames) { ...@@ -691,7 +685,7 @@ TEST_F(CORSTest, CORSUnsafeNotForbiddenRequestHeaderNames) {
// |safelistValueSize| is 897 because "content-type" is not safelisted. // |safelistValueSize| is 897 because "content-type" is not safelisted.
EXPECT_EQ( EXPECT_EQ(
cors::CORSUnsafeNotForbiddenRequestHeaderNames( CORSUnsafeNotForbiddenRequestHeaderNames(
{{"content-type", "text/plain; charset=" + std::string(128, '1')}, {{"content-type", "text/plain; charset=" + std::string(128, '1')},
{"accept", std::string(128, '1')}, {"accept", std::string(128, '1')},
{"accept-language", std::string(128, '1')}, {"accept-language", std::string(128, '1')},
...@@ -707,5 +701,5 @@ TEST_F(CORSTest, CORSUnsafeNotForbiddenRequestHeaderNames) { ...@@ -707,5 +701,5 @@ TEST_F(CORSTest, CORSUnsafeNotForbiddenRequestHeaderNames) {
} }
} // namespace } // namespace
} // namespace cors
} // namespace network } // namespace network
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment