Skip to content

GitLab

T
tangled
Commit 0af66703 authored by Yutaka Hirano's avatar Yutaka Hirano Committed by Commit Bot
Browse files
Options

Remove cors:: namespace specifier in the namespace 

Bug: None
Cq-Include-Trybots: luci.chromium.try:linux_mojo
Change-Id: Ib487fee40beaac941b74c090d31133b12d61ea4a
Reviewed-on: https://chromium-review.googlesource.com/1203517
Commit-Queue: Yutaka Hirano <yhirano@chromium.org>
Reviewed-by: default avatarTakashi Toyoshima <toyoshim@chromium.org>
Cr-Commit-Position: refs/heads/master@{#589158}
parent f34633d9
Show whitespace changes
Inline Side-by-side
Showing with 236 additions and 243 deletions
services/network/cors/cors_url_loader.cc
View file @ 0af66703
......@@ -27,7 +27,7 @@ base::Optional<std::string> GetHeaderString(
}
bool NeedsPreflight(const ResourceRequest& request) {
if (!cors::IsCORSEnabledRequestMode(request.fetch_request_mode))
if (!IsCORSEnabledRequestMode(request.fetch_request_mode))
return false;
if (request.is_external_request)
......@@ -88,7 +88,7 @@ CORSURLLoader::~CORSURLLoader() = default;
void CORSURLLoader::Start() {
if (fetch_cors_flag_ &&
cors::IsCORSEnabledRequestMode(request_.fetch_request_mode)) {
IsCORSEnabledRequestMode(request_.fetch_request_mode)) {
// Username and password should be stripped in a CORS-enabled request.
if (request_.url.has_username() || request_.url.has_password()) {
GURL::Replacements replacements;
......
services/network/cors/preflight_controller.cc
View file @ 0af66703
......@@ -81,18 +81,18 @@ std::unique_ptr<ResourceRequest> CreatePreflightRequest(
preflight_request->load_flags |= net::LOAD_DO_NOT_SEND_AUTH_DATA;
preflight_request->headers.SetHeader(
cors::header_names::kAccessControlRequestMethod, request.method);
header_names::kAccessControlRequestMethod, request.method);
std::string request_headers =
CreateAccessControlRequestHeadersHeader(request.headers);
if (!request_headers.empty()) {
preflight_request->headers.SetHeader(
cors::header_names::kAccessControlRequestHeaders, request_headers);
header_names::kAccessControlRequestHeaders, request_headers);
}
if (request.is_external_request) {
preflight_request->headers.SetHeader(
cors::header_names::kAccessControlRequestExternal, "true");
header_names::kAccessControlRequestExternal, "true");
}
DCHECK(request.request_initiator);
......@@ -123,10 +123,9 @@ std::unique_ptr<PreflightResult> CreatePreflightResult(
// TODO(toyoshim): Reflect --allow-file-access-from-files flag.
*detected_error_status = CheckPreflightAccess(
final_url, head.headers->response_code(),
GetHeaderString(head.headers, header_names::kAccessControlAllowOrigin),
GetHeaderString(head.headers,
cors::header_names::kAccessControlAllowOrigin),
GetHeaderString(head.headers,
cors::header_names::kAccessControlAllowCredentials),
header_names::kAccessControlAllowCredentials),
original_request.fetch_credentials_mode,
tainted ? url::Origin() : *original_request.request_initiator,
false /* allow_file_origin */);
......
services/network/cors/preflight_controller_unittest.cc
View file @ 0af66703
......@@ -50,7 +50,7 @@ TEST(PreflightControllerCreatePreflightRequestTest, LexicographicalOrder) {
EXPECT_EQ("null", header);
EXPECT_TRUE(preflight->headers.GetHeader(
cors::header_names::kAccessControlRequestHeaders, &header));
header_names::kAccessControlRequestHeaders, &header));
EXPECT_EQ("apple,content-type,kiwifruit,orange,strawberry", header);
}
......@@ -73,7 +73,7 @@ TEST(PreflightControllerCreatePreflightRequestTest, ExcludeSimpleHeaders) {
// left out in the preflight request.
std::string header;
EXPECT_FALSE(preflight->headers.GetHeader(
cors::header_names::kAccessControlRequestHeaders, &header));
header_names::kAccessControlRequestHeaders, &header));
}
TEST(PreflightControllerCreatePreflightRequestTest, Credentials) {
......@@ -108,7 +108,7 @@ TEST(PreflightControllerCreatePreflightRequestTest,
// Empty list also; see comment in test above.
std::string header;
EXPECT_FALSE(preflight->headers.GetHeader(
cors::header_names::kAccessControlRequestHeaders, &header));
header_names::kAccessControlRequestHeaders, &header));
}
TEST(PreflightControllerCreatePreflightRequestTest, IncludeNonSimpleHeader) {
......@@ -123,7 +123,7 @@ TEST(PreflightControllerCreatePreflightRequestTest, IncludeNonSimpleHeader) {
std::string header;
EXPECT_TRUE(preflight->headers.GetHeader(
cors::header_names::kAccessControlRequestHeaders, &header));
header_names::kAccessControlRequestHeaders, &header));
EXPECT_EQ("x-custom-header", header);
}
......@@ -141,7 +141,7 @@ TEST(PreflightControllerCreatePreflightRequestTest,
std::string header;
EXPECT_TRUE(preflight->headers.GetHeader(
cors::header_names::kAccessControlRequestHeaders, &header));
header_names::kAccessControlRequestHeaders, &header));
EXPECT_EQ("content-type", header);
}
......@@ -157,7 +157,7 @@ TEST(PreflightControllerCreatePreflightRequestTest, ExcludeForbiddenHeaders) {
std::string header;
EXPECT_FALSE(preflight->headers.GetHeader(
cors::header_names::kAccessControlRequestHeaders, &header));
header_names::kAccessControlRequestHeaders, &header));
}
TEST(PreflightControllerCreatePreflightRequestTest, Tainted) {
......@@ -256,7 +256,7 @@ class PreflightControllerTest : public testing::Test {
net::test_server::ShouldHandle(request, "/tainted")
? url::Origin()
: url::Origin::Create(test_server_.base_url());
response->AddCustomHeader(cors::header_names::kAccessControlAllowOrigin,
response->AddCustomHeader(header_names::kAccessControlAllowOrigin,
origin.Serialize());
response->AddCustomHeader(header_names::kAccessControlAllowMethods,
"GET, OPTIONS");
......
services/network/public/cpp/cors/cors_unittest.cc
View file @ 0af66703
......@@ -11,14 +11,14 @@
#include "url/origin.h"
namespace network {
namespace cors {
namespace {
using CORSTest = testing::Test;
TEST_F(CORSTest, CheckAccessDetectsInvalidResponse) {
base::Optional<CORSErrorStatus> error_status = cors::CheckAccess(
GURL(), 0 /* response_status_code */,
base::Optional<CORSErrorStatus> error_status =
CheckAccess(GURL(), 0 /* response_status_code */,
base::nullopt /* allow_origin_header */,
base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kOmit, url::Origin());
......@@ -26,7 +26,7 @@ TEST_F(CORSTest, CheckAccessDetectsInvalidResponse) {
EXPECT_EQ(mojom::CORSError::kInvalidResponse, error_status->cors_error);
}
// Tests if cors::CheckAccess detects kWildcardOriginNotAllowed error correctly.
// Tests if CheckAccess detects kWildcardOriginNotAllowed error correctly.
TEST_F(CORSTest, CheckAccessDetectsWildcardOriginNotAllowed) {
const GURL response_url("http://example.com/data");
const url::Origin origin = url::Origin::Create(GURL("http://google.com"));
......@@ -35,7 +35,7 @@ TEST_F(CORSTest, CheckAccessDetectsWildcardOriginNotAllowed) {
// Access-Control-Allow-Origin '*' works.
base::Optional<CORSErrorStatus> error1 =
cors::CheckAccess(response_url, response_status_code,
CheckAccess(response_url, response_status_code,
allow_all_header /* allow_origin_header */,
base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kOmit, origin);
......@@ -44,7 +44,7 @@ TEST_F(CORSTest, CheckAccessDetectsWildcardOriginNotAllowed) {
// Access-Control-Allow-Origin '*' should not be allowed if credentials mode
// is kInclude.
base::Optional<CORSErrorStatus> error2 =
cors::CheckAccess(response_url, response_status_code,
CheckAccess(response_url, response_status_code,
allow_all_header /* allow_origin_header */,
base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kInclude, origin);
......@@ -52,7 +52,7 @@ TEST_F(CORSTest, CheckAccessDetectsWildcardOriginNotAllowed) {
EXPECT_EQ(mojom::CORSError::kWildcardOriginNotAllowed, error2->cors_error);
}
// Tests if cors::CheckAccess detects kMissingAllowOriginHeader error correctly.
// Tests if CheckAccess detects kMissingAllowOriginHeader error correctly.
TEST_F(CORSTest, CheckAccessDetectsMissingAllowOriginHeader) {
const GURL response_url("http://example.com/data");
const url::Origin origin = url::Origin::Create(GURL("http://google.com"));
......@@ -60,7 +60,7 @@ TEST_F(CORSTest, CheckAccessDetectsMissingAllowOriginHeader) {
// Access-Control-Allow-Origin is missed.
base::Optional<CORSErrorStatus> error =
cors::CheckAccess(response_url, response_status_code,
CheckAccess(response_url, response_status_code,
base::nullopt /* allow_origin_header */,
base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kOmit, origin);
......@@ -68,7 +68,7 @@ TEST_F(CORSTest, CheckAccessDetectsMissingAllowOriginHeader) {
EXPECT_EQ(mojom::CORSError::kMissingAllowOriginHeader, error->cors_error);
}
// Tests if cors::CheckAccess detects kMultipleAllowOriginValues error
// Tests if CheckAccess detects kMultipleAllowOriginValues error
// correctly.
TEST_F(CORSTest, CheckAccessDetectsMultipleAllowOriginValues) {
const GURL response_url("http://example.com/data");
......@@ -77,8 +77,8 @@ TEST_F(CORSTest, CheckAccessDetectsMultipleAllowOriginValues) {
const std::string space_separated_multiple_origins(
"http://example.com http://another.example.com");
base::Optional<CORSErrorStatus> error1 = cors::CheckAccess(
response_url, response_status_code,
base::Optional<CORSErrorStatus> error1 =
CheckAccess(response_url, response_status_code,
space_separated_multiple_origins /* allow_origin_header */,
base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kOmit, origin);
......@@ -87,8 +87,8 @@ TEST_F(CORSTest, CheckAccessDetectsMultipleAllowOriginValues) {
const std::string comma_separated_multiple_origins(
"http://example.com,http://another.example.com");
base::Optional<CORSErrorStatus> error2 = cors::CheckAccess(
response_url, response_status_code,
base::Optional<CORSErrorStatus> error2 =
CheckAccess(response_url, response_status_code,
comma_separated_multiple_origins /* allow_origin_header */,
base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kOmit, origin);
......@@ -96,14 +96,14 @@ TEST_F(CORSTest, CheckAccessDetectsMultipleAllowOriginValues) {
EXPECT_EQ(mojom::CORSError::kMultipleAllowOriginValues, error2->cors_error);
}
// Tests if cors::CheckAccess detects kInvalidAllowOriginValue error correctly.
// Tests if CheckAccess detects kInvalidAllowOriginValue error correctly.
TEST_F(CORSTest, CheckAccessDetectsInvalidAllowOriginValue) {
const GURL response_url("http://example.com/data");
const url::Origin origin = url::Origin::Create(GURL("http://google.com"));
const int response_status_code = 200;
base::Optional<CORSErrorStatus> error =
cors::CheckAccess(response_url, response_status_code,
CheckAccess(response_url, response_status_code,
std::string("invalid.origin") /* allow_origin_header */,
base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kOmit, origin);
......@@ -112,20 +112,20 @@ TEST_F(CORSTest, CheckAccessDetectsInvalidAllowOriginValue) {
EXPECT_EQ("invalid.origin", error->failed_parameter);
}
// Tests if cors::CheckAccess detects kAllowOriginMismatch error correctly.
// Tests if CheckAccess detects kAllowOriginMismatch error correctly.
TEST_F(CORSTest, CheckAccessDetectsAllowOriginMismatch) {
const GURL response_url("http://example.com/data");
const url::Origin origin = url::Origin::Create(GURL("http://google.com"));
const int response_status_code = 200;
base::Optional<CORSErrorStatus> error1 =
cors::CheckAccess(response_url, response_status_code,
CheckAccess(response_url, response_status_code,
origin.Serialize() /* allow_origin_header */,
base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kOmit, origin);
ASSERT_FALSE(error1);
base::Optional<CORSErrorStatus> error2 = cors::CheckAccess(
base::Optional<CORSErrorStatus> error2 = CheckAccess(
response_url, response_status_code,
std::string("http://not.google.com") /* allow_origin_header */,
base::nullopt /* allow_credentials_header */,
......@@ -139,28 +139,28 @@ TEST_F(CORSTest, CheckAccessDetectsAllowOriginMismatch) {
const url::Origin null_origin;
EXPECT_EQ(null_string, null_origin.Serialize());
base::Optional<CORSErrorStatus> error3 = cors::CheckAccess(
base::Optional<CORSErrorStatus> error3 = CheckAccess(
response_url, response_status_code, null_string /* allow_origin_header */,
base::nullopt /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kOmit, null_origin);
EXPECT_FALSE(error3);
}
// Tests if cors::CheckAccess detects kInvalidAllowCredentials error correctly.
// Tests if CheckAccess detects kInvalidAllowCredentials error correctly.
TEST_F(CORSTest, CheckAccessDetectsInvalidAllowCredential) {
const GURL response_url("http://example.com/data");
const url::Origin origin = url::Origin::Create(GURL("http://google.com"));
const int response_status_code = 200;
base::Optional<CORSErrorStatus> error1 =
cors::CheckAccess(response_url, response_status_code,
CheckAccess(response_url, response_status_code,
origin.Serialize() /* allow_origin_header */,
std::string("true") /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kInclude, origin);
ASSERT_FALSE(error1);
base::Optional<CORSErrorStatus> error2 =
cors::CheckAccess(response_url, response_status_code,
CheckAccess(response_url, response_status_code,
origin.Serialize() /* allow_origin_header */,
std::string("fuga") /* allow_credentials_header */,
network::mojom::FetchCredentialsMode::kInclude, origin);
......@@ -169,7 +169,7 @@ TEST_F(CORSTest, CheckAccessDetectsInvalidAllowCredential) {
EXPECT_EQ("fuga", error2->failed_parameter);
}
// Tests if cors::CheckRedirectLocation detects kCORSDisabledScheme and
// Tests if CheckRedirectLocation detects kCORSDisabledScheme and
// kRedirectContainsCredentials errors correctly.
TEST_F(CORSTest, CheckRedirectLocation) {
struct TestCase {
......@@ -279,30 +279,30 @@ TEST_F(CORSTest, CheckRedirectLocation) {
<< ", tainted: " << test.tainted);
EXPECT_EQ(test.expectation,
cors::CheckRedirectLocation(test.url, test.request_mode, origin,
CheckRedirectLocation(test.url, test.request_mode, origin,
test.cors_flag, test.tainted));
}
}
TEST_F(CORSTest, CheckPreflightDetectsErrors) {
EXPECT_FALSE(cors::CheckPreflight(200));
EXPECT_FALSE(cors::CheckPreflight(299));
EXPECT_FALSE(CheckPreflight(200));
EXPECT_FALSE(CheckPreflight(299));
base::Optional<mojom::CORSError> error1 = cors::CheckPreflight(300);
base::Optional<mojom::CORSError> error1 = CheckPreflight(300);
ASSERT_TRUE(error1);
EXPECT_EQ(mojom::CORSError::kPreflightInvalidStatus, *error1);
EXPECT_FALSE(cors::CheckExternalPreflight(std::string("true")));
EXPECT_FALSE(CheckExternalPreflight(std::string("true")));
base::Optional<CORSErrorStatus> error2 =
cors::CheckExternalPreflight(base::nullopt);
CheckExternalPreflight(base::nullopt);
ASSERT_TRUE(error2);
EXPECT_EQ(mojom::CORSError::kPreflightMissingAllowExternal,
error2->cors_error);
EXPECT_EQ("", error2->failed_parameter);
base::Optional<CORSErrorStatus> error3 =
cors::CheckExternalPreflight(std::string("TRUE"));
CheckExternalPreflight(std::string("TRUE"));
ASSERT_TRUE(error3);
EXPECT_EQ(mojom::CORSError::kPreflightInvalidAllowExternal,
error3->cors_error);
......@@ -320,86 +320,86 @@ TEST_F(CORSTest, CalculateResponseTainting) {
// CORS flag is false, same-origin request
EXPECT_EQ(FetchResponseType::kBasic,
cors::CalculateResponseTainting(
CalculateResponseTainting(
same_origin_url, FetchRequestMode::kSameOrigin, origin, false));
EXPECT_EQ(FetchResponseType::kBasic,
cors::CalculateResponseTainting(
CalculateResponseTainting(
same_origin_url, FetchRequestMode::kNoCORS, origin, false));
EXPECT_EQ(FetchResponseType::kBasic,
cors::CalculateResponseTainting(
same_origin_url, FetchRequestMode::kCORS, origin, false));
CalculateResponseTainting(same_origin_url, FetchRequestMode::kCORS,
origin, false));
EXPECT_EQ(FetchResponseType::kBasic,
cors::CalculateResponseTainting(
CalculateResponseTainting(
same_origin_url, FetchRequestMode::kCORSWithForcedPreflight,
origin, false));
EXPECT_EQ(FetchResponseType::kBasic,
cors::CalculateResponseTainting(
CalculateResponseTainting(
same_origin_url, FetchRequestMode::kNavigate, origin, false));
// CORS flag is false, cross-origin request
EXPECT_EQ(FetchResponseType::kOpaque,
cors::CalculateResponseTainting(
CalculateResponseTainting(
cross_origin_url, FetchRequestMode::kNoCORS, origin, false));
EXPECT_EQ(FetchResponseType::kBasic,
cors::CalculateResponseTainting(
CalculateResponseTainting(
cross_origin_url, FetchRequestMode::kNavigate, origin, false));
// CORS flag is true, same-origin request
EXPECT_EQ(FetchResponseType::kCORS,
cors::CalculateResponseTainting(
same_origin_url, FetchRequestMode::kCORS, origin, true));
CalculateResponseTainting(same_origin_url, FetchRequestMode::kCORS,
origin, true));
EXPECT_EQ(FetchResponseType::kCORS,
cors::CalculateResponseTainting(
CalculateResponseTainting(
same_origin_url, FetchRequestMode::kCORSWithForcedPreflight,
origin, true));
// CORS flag is true, cross-origin request
EXPECT_EQ(FetchResponseType::kCORS,
cors::CalculateResponseTainting(
cross_origin_url, FetchRequestMode::kCORS, origin, true));
CalculateResponseTainting(cross_origin_url, FetchRequestMode::kCORS,
origin, true));
EXPECT_EQ(FetchResponseType::kCORS,
cors::CalculateResponseTainting(
CalculateResponseTainting(
cross_origin_url, FetchRequestMode::kCORSWithForcedPreflight,
origin, true));
// Origin is not provided.
EXPECT_EQ(FetchResponseType::kBasic,
cors::CalculateResponseTainting(
CalculateResponseTainting(
same_origin_url, FetchRequestMode::kNoCORS, no_origin, false));
EXPECT_EQ(
FetchResponseType::kBasic,
cors::CalculateResponseTainting(
same_origin_url, FetchRequestMode::kNavigate, no_origin, false));
CalculateResponseTainting(same_origin_url, FetchRequestMode::kNavigate,
no_origin, false));
EXPECT_EQ(FetchResponseType::kBasic,
cors::CalculateResponseTainting(
CalculateResponseTainting(
cross_origin_url, FetchRequestMode::kNoCORS, no_origin, false));
EXPECT_EQ(
FetchResponseType::kBasic,
cors::CalculateResponseTainting(
cross_origin_url, FetchRequestMode::kNavigate, no_origin, false));
CalculateResponseTainting(cross_origin_url, FetchRequestMode::kNavigate,
no_origin, false));
}
TEST_F(CORSTest, SafelistedMethod) {
// Method check should be case-insensitive.
EXPECT_TRUE(cors::IsCORSSafelistedMethod("get"));
EXPECT_TRUE(cors::IsCORSSafelistedMethod("Get"));
EXPECT_TRUE(cors::IsCORSSafelistedMethod("GET"));
EXPECT_TRUE(cors::IsCORSSafelistedMethod("HEAD"));
EXPECT_TRUE(cors::IsCORSSafelistedMethod("POST"));
EXPECT_FALSE(cors::IsCORSSafelistedMethod("OPTIONS"));
EXPECT_TRUE(IsCORSSafelistedMethod("get"));
EXPECT_TRUE(IsCORSSafelistedMethod("Get"));
EXPECT_TRUE(IsCORSSafelistedMethod("GET"));
EXPECT_TRUE(IsCORSSafelistedMethod("HEAD"));
EXPECT_TRUE(IsCORSSafelistedMethod("POST"));
EXPECT_FALSE(IsCORSSafelistedMethod("OPTIONS"));
}
TEST_F(CORSTest, SafelistedHeader) {
// See SafelistedAccept/AcceptLanguage/ContentLanguage/ContentType also.
EXPECT_TRUE(cors::IsCORSSafelistedHeader("accept", "foo"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("foo", "bar"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("user-agent", "foo"));
EXPECT_TRUE(IsCORSSafelistedHeader("accept", "foo"));
EXPECT_FALSE(IsCORSSafelistedHeader("foo", "bar"));
EXPECT_FALSE(IsCORSSafelistedHeader("user-agent", "foo"));
}
TEST_F(CORSTest, SafelistedAccept) {
EXPECT_TRUE(cors::IsCORSSafelistedHeader("accept", "text/html"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("AccepT", "text/html"));
EXPECT_TRUE(IsCORSSafelistedHeader("accept", "text/html"));
EXPECT_TRUE(IsCORSSafelistedHeader("AccepT", "text/html"));
constexpr char kAllowed[] =
"\t !#$%&'*+,-./0123456789;="
......@@ -410,20 +410,20 @@ TEST_F(CORSTest, SafelistedAccept) {
// 1 for the trailing null character.
auto* end = kAllowed + base::size(kAllowed) - 1;
EXPECT_EQ(std::find(kAllowed, end, c) != end,
cors::IsCORSSafelistedHeader("accept", std::string(1, c)));
IsCORSSafelistedHeader("accept", std::string(1, c)));
EXPECT_EQ(std::find(kAllowed, end, c) != end,
cors::IsCORSSafelistedHeader("AccepT", std::string(1, c)));
IsCORSSafelistedHeader("AccepT", std::string(1, c)));
}
EXPECT_TRUE(cors::IsCORSSafelistedHeader("accept", std::string(128, 'a')));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("accept", std::string(129, 'a')));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("AccepT", std::string(128, 'a')));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("AccepT", std::string(129, 'a')));
EXPECT_TRUE(IsCORSSafelistedHeader("accept", std::string(128, 'a')));
EXPECT_FALSE(IsCORSSafelistedHeader("accept", std::string(129, 'a')));
EXPECT_TRUE(IsCORSSafelistedHeader("AccepT", std::string(128, 'a')));
EXPECT_FALSE(IsCORSSafelistedHeader("AccepT", std::string(129, 'a')));
}
TEST_F(CORSTest, SafelistedAcceptLanguage) {
EXPECT_TRUE(cors::IsCORSSafelistedHeader("accept-language", "en,ja"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("aCcEPT-lAngUAge", "en,ja"));
EXPECT_TRUE(IsCORSSafelistedHeader("accept-language", "en,ja"));
EXPECT_TRUE(IsCORSSafelistedHeader("aCcEPT-lAngUAge", "en,ja"));
constexpr char kAllowed[] =
"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz *,-.;=";
......@@ -432,23 +432,20 @@ TEST_F(CORSTest, SafelistedAcceptLanguage) {
char c = static_cast<char>(i);
// 1 for the trailing null character.
auto* end = kAllowed + base::size(kAllowed) - 1;
EXPECT_EQ(
std::find(kAllowed, end, c) != end,
cors::IsCORSSafelistedHeader("aCcEPT-lAngUAge", std::string(1, c)));
EXPECT_EQ(std::find(kAllowed, end, c) != end,
IsCORSSafelistedHeader("aCcEPT-lAngUAge", std::string(1, c)));
}
EXPECT_TRUE(
cors::IsCORSSafelistedHeader("accept-language", std::string(128, 'a')));
EXPECT_TRUE(IsCORSSafelistedHeader("accept-language", std::string(128, 'a')));
EXPECT_FALSE(
cors::IsCORSSafelistedHeader("accept-language", std::string(129, 'a')));
EXPECT_TRUE(
cors::IsCORSSafelistedHeader("aCcEPT-lAngUAge", std::string(128, 'a')));
IsCORSSafelistedHeader("accept-language", std::string(129, 'a')));
EXPECT_TRUE(IsCORSSafelistedHeader("aCcEPT-lAngUAge", std::string(128, 'a')));
EXPECT_FALSE(
cors::IsCORSSafelistedHeader("aCcEPT-lAngUAge", std::string(129, 'a')));
IsCORSSafelistedHeader("aCcEPT-lAngUAge", std::string(129, 'a')));
}
TEST_F(CORSTest, SafelistedContentLanguage) {
EXPECT_TRUE(cors::IsCORSSafelistedHeader("content-language", "en,ja"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("cONTent-LANguaGe", "en,ja"));
EXPECT_TRUE(IsCORSSafelistedHeader("content-language", "en,ja"));
EXPECT_TRUE(IsCORSSafelistedHeader("cONTent-LANguaGe", "en,ja"));
constexpr char kAllowed[] =
"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz *,-.;=";
......@@ -457,103 +454,100 @@ TEST_F(CORSTest, SafelistedContentLanguage) {
char c = static_cast<char>(i);
// 1 for the trailing null character.
auto* end = kAllowed + base::size(kAllowed) - 1;
EXPECT_EQ(
std::find(kAllowed, end, c) != end,
cors::IsCORSSafelistedHeader("content-language", std::string(1, c)));
EXPECT_EQ(
std::find(kAllowed, end, c) != end,
cors::IsCORSSafelistedHeader("cONTent-LANguaGe", std::string(1, c)));
EXPECT_EQ(std::find(kAllowed, end, c) != end,
IsCORSSafelistedHeader("content-language", std::string(1, c)));
EXPECT_EQ(std::find(kAllowed, end, c) != end,
IsCORSSafelistedHeader("cONTent-LANguaGe", std::string(1, c)));
}
EXPECT_TRUE(
cors::IsCORSSafelistedHeader("content-language", std::string(128, 'a')));
IsCORSSafelistedHeader("content-language", std::string(128, 'a')));
EXPECT_FALSE(
cors::IsCORSSafelistedHeader("content-language", std::string(129, 'a')));
IsCORSSafelistedHeader("content-language", std::string(129, 'a')));
EXPECT_TRUE(
cors::IsCORSSafelistedHeader("cONTent-LANguaGe", std::string(128, 'a')));
IsCORSSafelistedHeader("cONTent-LANguaGe", std::string(128, 'a')));
EXPECT_FALSE(
cors::IsCORSSafelistedHeader("cONTent-LANguaGe", std::string(129, 'a')));
IsCORSSafelistedHeader("cONTent-LANguaGe", std::string(129, 'a')));
}
TEST_F(CORSTest, SafelistedContentType) {
EXPECT_TRUE(cors::IsCORSSafelistedHeader("content-type", "text/plain"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("CoNtEnt-TyPE", "text/plain"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("content-type",
"text/plain; charset=utf-8"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("content-type",
" text/plain ; charset=UTF-8"));
EXPECT_TRUE(IsCORSSafelistedHeader("content-type", "text/plain"));
EXPECT_TRUE(IsCORSSafelistedHeader("CoNtEnt-TyPE", "text/plain"));
EXPECT_TRUE(
cors::IsCORSSafelistedHeader("content-type", "text/plain; param=BOGUS"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader(
"content-type", "application/x-www-form-urlencoded"));
IsCORSSafelistedHeader("content-type", "text/plain; charset=utf-8"));
EXPECT_TRUE(
cors::IsCORSSafelistedHeader("content-type", "multipart/form-data"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("content-type", "Text/plain"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("content-type", "tEXT/PLAIN"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("content-type", "text/html"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("CoNtEnt-TyPE", "text/html"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("content-type", "image/png"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("CoNtEnt-TyPE", "image/png"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader(
IsCORSSafelistedHeader("content-type", " text/plain ; charset=UTF-8"));
EXPECT_TRUE(
IsCORSSafelistedHeader("content-type", "text/plain; param=BOGUS"));
EXPECT_TRUE(IsCORSSafelistedHeader("content-type",
"application/x-www-form-urlencoded"));
EXPECT_TRUE(IsCORSSafelistedHeader("content-type", "multipart/form-data"));
EXPECT_TRUE(IsCORSSafelistedHeader("content-type", "Text/plain"));
EXPECT_TRUE(IsCORSSafelistedHeader("content-type", "tEXT/PLAIN"));
EXPECT_FALSE(IsCORSSafelistedHeader("content-type", "text/html"));
EXPECT_FALSE(IsCORSSafelistedHeader("CoNtEnt-TyPE", "text/html"));
EXPECT_FALSE(IsCORSSafelistedHeader("content-type", "image/png"));
EXPECT_FALSE(IsCORSSafelistedHeader("CoNtEnt-TyPE", "image/png"));
EXPECT_TRUE(IsCORSSafelistedHeader(
"content-type", "text/plain; charset=" + std::string(108, 'a')));
EXPECT_TRUE(cors::IsCORSSafelistedHeader(
EXPECT_TRUE(IsCORSSafelistedHeader(
"cONTent-tYPE", "text/plain; charset=" + std::string(108, 'a')));
EXPECT_FALSE(cors::IsCORSSafelistedHeader(
EXPECT_FALSE(IsCORSSafelistedHeader(
"content-type", "text/plain; charset=" + std::string(109, 'a')));
EXPECT_FALSE(cors::IsCORSSafelistedHeader(
EXPECT_FALSE(IsCORSSafelistedHeader(
"cONTent-tYPE", "text/plain; charset=" + std::string(109, 'a')));
}
TEST_F(CORSTest, CheckCORSClientHintsSafelist) {
EXPECT_FALSE(cors::IsCORSSafelistedHeader("device-memory", ""));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("device-memory", "abc"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("device-memory", "1.25"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("DEVICE-memory", "1.25"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("device-memory", "1.25-2.5"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("device-memory", "-1.25"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("device-memory", "1e2"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("device-memory", "inf"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("device-memory", "-2.3"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("device-memory", "NaN"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("DEVICE-memory", "1.25.3"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("DEVICE-memory", "1."));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("DEVICE-memory", ".1"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("DEVICE-memory", "."));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("DEVICE-memory", "1"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", ""));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "abc"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("dpr", "1.25"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("Dpr", "1.25"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "1.25-2.5"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "-1.25"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "1e2"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "inf"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "-2.3"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "NaN"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "1.25.3"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "1."));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", ".1"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("dpr", "."));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("dpr", "1"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("width", ""));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("width", "abc"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("width", "125"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("width", "1"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("WIDTH", "125"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("width", "125.2"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("width", "-125"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("width", "2147483648"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("viewport-width", ""));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("viewport-width", "abc"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("viewport-width", "125"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("viewport-width", "1"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("viewport-Width", "125"));
EXPECT_FALSE(cors::IsCORSSafelistedHeader("viewport-width", "125.2"));
EXPECT_TRUE(cors::IsCORSSafelistedHeader("viewport-width", "2147483648"));
EXPECT_FALSE(IsCORSSafelistedHeader("device-memory", ""));
EXPECT_FALSE(IsCORSSafelistedHeader("device-memory", "abc"));
EXPECT_TRUE(IsCORSSafelistedHeader("device-memory", "1.25"));
EXPECT_TRUE(IsCORSSafelistedHeader("DEVICE-memory", "1.25"));
EXPECT_FALSE(IsCORSSafelistedHeader("device-memory", "1.25-2.5"));
EXPECT_FALSE(IsCORSSafelistedHeader("device-memory", "-1.25"));
EXPECT_FALSE(IsCORSSafelistedHeader("device-memory", "1e2"));
EXPECT_FALSE(IsCORSSafelistedHeader("device-memory", "inf"));
EXPECT_FALSE(IsCORSSafelistedHeader("device-memory", "-2.3"));
EXPECT_FALSE(IsCORSSafelistedHeader("device-memory", "NaN"));
EXPECT_FALSE(IsCORSSafelistedHeader("DEVICE-memory", "1.25.3"));
EXPECT_FALSE(IsCORSSafelistedHeader("DEVICE-memory", "1."));
EXPECT_FALSE(IsCORSSafelistedHeader("DEVICE-memory", ".1"));
EXPECT_FALSE(IsCORSSafelistedHeader("DEVICE-memory", "."));
EXPECT_TRUE(IsCORSSafelistedHeader("DEVICE-memory", "1"));
EXPECT_FALSE(IsCORSSafelistedHeader("dpr", ""));
EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "abc"));
EXPECT_TRUE(IsCORSSafelistedHeader("dpr", "1.25"));
EXPECT_TRUE(IsCORSSafelistedHeader("Dpr", "1.25"));
EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "1.25-2.5"));
EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "-1.25"));
EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "1e2"));
EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "inf"));
EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "-2.3"));
EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "NaN"));
EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "1.25.3"));
EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "1."));
EXPECT_FALSE(IsCORSSafelistedHeader("dpr", ".1"));
EXPECT_FALSE(IsCORSSafelistedHeader("dpr", "."));
EXPECT_TRUE(IsCORSSafelistedHeader("dpr", "1"));
EXPECT_FALSE(IsCORSSafelistedHeader("width", ""));
EXPECT_FALSE(IsCORSSafelistedHeader("width", "abc"));
EXPECT_TRUE(IsCORSSafelistedHeader("width", "125"));
EXPECT_TRUE(IsCORSSafelistedHeader("width", "1"));
EXPECT_TRUE(IsCORSSafelistedHeader("WIDTH", "125"));
EXPECT_FALSE(IsCORSSafelistedHeader("width", "125.2"));
EXPECT_FALSE(IsCORSSafelistedHeader("width", "-125"));
EXPECT_TRUE(IsCORSSafelistedHeader("width", "2147483648"));
EXPECT_FALSE(IsCORSSafelistedHeader("viewport-width", ""));
EXPECT_FALSE(IsCORSSafelistedHeader("viewport-width", "abc"));
EXPECT_TRUE(IsCORSSafelistedHeader("viewport-width", "125"));
EXPECT_TRUE(IsCORSSafelistedHeader("viewport-width", "1"));
EXPECT_TRUE(IsCORSSafelistedHeader("viewport-Width", "125"));
EXPECT_FALSE(IsCORSSafelistedHeader("viewport-width", "125.2"));
EXPECT_TRUE(IsCORSSafelistedHeader("viewport-width", "2147483648"));
}
TEST_F(CORSTest, CORSUnsafeRequestHeaderNames) {
......@@ -561,10 +555,10 @@ TEST_F(CORSTest, CORSUnsafeRequestHeaderNames) {
using List = std::vector<std::string>;
// Empty => Empty
EXPECT_EQ(cors::CORSUnsafeRequestHeaderNames({}), List({}));
EXPECT_EQ(CORSUnsafeRequestHeaderNames({}), List({}));
// Some headers are safelisted.
EXPECT_EQ(cors::CORSUnsafeRequestHeaderNames({{"content-type", "text/plain"},
EXPECT_EQ(CORSUnsafeRequestHeaderNames({{"content-type", "text/plain"},
{"dpr", "12345"},
{"aCCept", "en,ja"},
{"accept-charset", "utf-8"},
......@@ -574,7 +568,7 @@ TEST_F(CORSTest, CORSUnsafeRequestHeaderNames) {
// All headers are not safelisted.
EXPECT_EQ(
cors::CORSUnsafeRequestHeaderNames({{"content-type", "text/html"},
CORSUnsafeRequestHeaderNames({{"content-type", "text/html"},
{"dpr", "123-45"},
{"aCCept", "en,ja"},
{"accept-charset", "utf-8"},
......@@ -584,7 +578,7 @@ TEST_F(CORSTest, CORSUnsafeRequestHeaderNames) {
// |safelistValueSize| is 1024.
EXPECT_EQ(
cors::CORSUnsafeRequestHeaderNames(
CORSUnsafeRequestHeaderNames(
{{"content-type", "text/plain; charset=" + std::string(108, '1')},
{"accept", std::string(128, '1')},
{"accept-language", std::string(128, '1')},
......@@ -599,7 +593,7 @@ TEST_F(CORSTest, CORSUnsafeRequestHeaderNames) {
// |safelistValueSize| is 1025.
EXPECT_EQ(
cors::CORSUnsafeRequestHeaderNames(
CORSUnsafeRequestHeaderNames(
{{"content-type", "text/plain; charset=" + std::string(108, '1')},
{"accept", std::string(128, '1')},
{"accept-language", std::string(128, '1')},
......@@ -616,7 +610,7 @@ TEST_F(CORSTest, CORSUnsafeRequestHeaderNames) {
// |safelistValueSize| is 897 because "content-type" is not safelisted.
EXPECT_EQ(
cors::CORSUnsafeRequestHeaderNames(
CORSUnsafeRequestHeaderNames(
{{"content-type", "text/plain; charset=" + std::string(128, '1')},
{"accept", std::string(128, '1')},
{"accept-language", std::string(128, '1')},
......@@ -635,11 +629,11 @@ TEST_F(CORSTest, CORSUnsafeNotForbiddenRequestHeaderNames) {
using List = std::vector<std::string>;
// Empty => Empty
EXPECT_EQ(cors::CORSUnsafeNotForbiddenRequestHeaderNames({}), List({}));
EXPECT_EQ(CORSUnsafeNotForbiddenRequestHeaderNames({}), List({}));
// "user-agent" is NOT forbidden per spec, but forbidden in Chromium.
EXPECT_EQ(cors::CORSUnsafeNotForbiddenRequestHeaderNames(
{{"content-type", "text/plain"},
EXPECT_EQ(
CORSUnsafeNotForbiddenRequestHeaderNames({{"content-type", "text/plain"},
{"dpr", "12345"},
{"aCCept", "en,ja"},
{"accept-charset", "utf-8"},
......@@ -647,8 +641,8 @@ TEST_F(CORSTest, CORSUnsafeNotForbiddenRequestHeaderNames) {
{"hogE", "fuga"}}),
List({"hoge"}));
EXPECT_EQ(cors::CORSUnsafeNotForbiddenRequestHeaderNames(
{{"content-type", "text/html"},
EXPECT_EQ(
CORSUnsafeNotForbiddenRequestHeaderNames({{"content-type", "text/html"},
{"dpr", "123-45"},
{"aCCept", "en,ja"},
{"accept-charset", "utf-8"},
......@@ -657,7 +651,7 @@ TEST_F(CORSTest, CORSUnsafeNotForbiddenRequestHeaderNames) {
// |safelistValueSize| is 1024.
EXPECT_EQ(
cors::CORSUnsafeNotForbiddenRequestHeaderNames(
CORSUnsafeNotForbiddenRequestHeaderNames(
{{"content-type", "text/plain; charset=" + std::string(108, '1')},
{"accept", std::string(128, '1')},
{"accept-language", std::string(128, '1')},
......@@ -673,7 +667,7 @@ TEST_F(CORSTest, CORSUnsafeNotForbiddenRequestHeaderNames) {
// |safelistValueSize| is 1025.
EXPECT_EQ(
cors::CORSUnsafeNotForbiddenRequestHeaderNames(
CORSUnsafeNotForbiddenRequestHeaderNames(
{{"content-type", "text/plain; charset=" + std::string(108, '1')},
{"accept", std::string(128, '1')},
{"accept-language", std::string(128, '1')},
......@@ -691,7 +685,7 @@ TEST_F(CORSTest, CORSUnsafeNotForbiddenRequestHeaderNames) {
// |safelistValueSize| is 897 because "content-type" is not safelisted.
EXPECT_EQ(
cors::CORSUnsafeNotForbiddenRequestHeaderNames(
CORSUnsafeNotForbiddenRequestHeaderNames(
{{"content-type", "text/plain; charset=" + std::string(128, '1')},
{"accept", std::string(128, '1')},
{"accept-language", std::string(128, '1')},
......@@ -707,5 +701,5 @@ TEST_F(CORSTest, CORSUnsafeNotForbiddenRequestHeaderNames) {
}
} // namespace
} // namespace cors
} // namespace network
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment