Add test coverage for setting cookie priority via document.cookie

Chrome supports a non-standard "priority" option for cookies, which is
used to prioritize eviction when the cookie jar is full. Since the
document.cookie setter just passes the cookie string through IPC to
RenderFrameMessageFilter::SetCookie and, after various hops, into the
net::CookieStore, the option is implicitly supported even though it was
intended primarily for use by the Set-Cookie HTTP header.

Add test coverage so we don't unintentionally regress support for
this if, for example, we change the way document.cookie passes
cookies into net::CookieStore.

Change-Id: I0084d2f177ca7dac88a3f20603198c689351c4a2
Reviewed-on: https://chromium-review.googlesource.com/1116059Reviewed-by: Victor Costan <pwnall@chromium.org>
Reviewed-by: John Abd-El-Malek <jam@chromium.org>
Commit-Queue: Joshua Bell <jsbell@chromium.org>
Cr-Commit-Position: refs/heads/master@{#570874}

content/browser/frame_host/render_frame_message_filter_browsertest.cc

@@ -126,6 +126,32 @@ IN_PROC_BROWSER_TEST_F(RenderFrameMessageFilterBrowserTest, Cookies) {
   EXPECT_EQ("B=2; D=4", GetCookieFromJS(web_contents_http->GetMainFrame()));
 }
 
+// Ensure "priority" cookie option is settable via document.cookie.
+IN_PROC_BROWSER_TEST_F(RenderFrameMessageFilterBrowserTest, CookiePriority) {
+  ASSERT_TRUE(embedded_test_server()->Start());
+
+  struct {
+    std::string param;
+    net::CookiePriority priority;
+  } cases[] = {{"name=value", net::COOKIE_PRIORITY_DEFAULT},
+               {"name=value;priority=Low", net::COOKIE_PRIORITY_LOW},
+               {"name=value;priority=Medium", net::COOKIE_PRIORITY_MEDIUM},
+               {"name=value;priority=High", net::COOKIE_PRIORITY_HIGH}};
+
+  for (auto test_case : cases) {
+    GURL url = embedded_test_server()->GetURL("/set_document_cookie.html?" +
+                                              test_case.param);
+    NavigateToURL(shell(), url);
+    std::vector<net::CanonicalCookie> cookies =
+        GetCanonicalCookies(shell()->web_contents()->GetBrowserContext(), url);
+
+    EXPECT_EQ(1u, cookies.size());
+    EXPECT_EQ("name", cookies[0].Name());
+    EXPECT_EQ("value", cookies[0].Value());
+    EXPECT_EQ(test_case.priority, cookies[0].Priority());
+  }
+}
+
 // SameSite cookies (that aren't marked as http-only) should be available to
 // JavaScript.
 IN_PROC_BROWSER_TEST_F(RenderFrameMessageFilterBrowserTest, SameSiteCookies) {

content/public/test/browser_test_utils.cc

@@ -413,18 +413,6 @@ void SimulateKeyPressImpl(WebContents* web_contents,
   ASSERT_EQ(modifiers, 0);
 }
 
-void GetCookiesCallback(std::string* cookies_out,
-                        base::RunLoop* run_loop,
-                        const std::vector<net::CanonicalCookie>& cookies) {
-  *cookies_out = net::CanonicalCookie::BuildCookieLine(cookies);
-  run_loop->Quit();
-}
-
-void SetCookieCallback(bool* result, base::RunLoop* run_loop, bool success) {
-  *result = success;
-  run_loop->Quit();
-}
-
 std::unique_ptr<net::test_server::HttpResponse>
 CrossSiteRedirectResponseHandler(const net::EmbeddedTestServer* test_server,
                                  const net::test_server::HttpRequest& request) {
@@ -1337,7 +1325,36 @@ std::string GetCookies(BrowserContext* browser_context, const GURL& url) {
       ->GetCookieManager(mojo::MakeRequest(&cookie_manager));
   cookie_manager->GetCookieList(
       url, net::CookieOptions(),
-      base::BindOnce(&GetCookiesCallback, &cookies, &run_loop));
+      base::BindOnce(
+          [](std::string* cookies_out, base::RunLoop* run_loop,
+             const std::vector<net::CanonicalCookie>& cookies) {
+            *cookies_out = net::CanonicalCookie::BuildCookieLine(cookies);
+            run_loop->Quit();
+          },
+          &cookies, &run_loop));
+  run_loop.Run();
+  return cookies;
+}
+
+std::vector<net::CanonicalCookie> GetCanonicalCookies(
+    BrowserContext* browser_context,
+    const GURL& url) {
+  std::vector<net::CanonicalCookie> cookies;
+  base::RunLoop run_loop;
+  network::mojom::CookieManagerPtr cookie_manager;
+  BrowserContext::GetDefaultStoragePartition(browser_context)
+      ->GetNetworkContext()
+      ->GetCookieManager(mojo::MakeRequest(&cookie_manager));
+  cookie_manager->GetCookieList(
+      url, net::CookieOptions(),
+      base::BindOnce(
+          [](base::RunLoop* run_loop,
+             std::vector<net::CanonicalCookie>* cookies_out,
+             const std::vector<net::CanonicalCookie>& cookies) {
+            *cookies_out = cookies;
+            run_loop->Quit();
+          },
+          &run_loop, &cookies));
   run_loop.Run();
   return cookies;
 }
@@ -1357,7 +1374,12 @@ bool SetCookie(BrowserContext* browser_context,
 
   cookie_manager->SetCanonicalCookie(
       *cc.get(), true /* secure_source */, true /* modify_http_only */,
-      base::BindOnce(&SetCookieCallback, &result, &run_loop));
+      base::BindOnce(
+          [](bool* result, base::RunLoop* run_loop, bool success) {
+            *result = success;
+            run_loop->Quit();
+          },
+          &result, &run_loop));
   run_loop.Run();
   return result;
 }

content/public/test/browser_test_utils.h

@@ -55,6 +55,7 @@ class Point;
 }
 
 namespace net {
+class CanonicalCookie;
 namespace test_server {
 class EmbeddedTestServer;
 }
@@ -419,9 +420,14 @@ RenderFrameHost* ChildFrameAt(RenderFrameHost* frame, size_t index);
 bool ExecuteWebUIResourceTest(WebContents* web_contents,
                               const std::vector<int>& js_resource_ids);
 
-// Returns the cookies for the given url.
+// Returns the serialized cookie string for the given url.
 std::string GetCookies(BrowserContext* browser_context, const GURL& url);
 
+// Returns the canonical cookies for the given url.
+std::vector<net::CanonicalCookie> GetCanonicalCookies(
+    BrowserContext* browser_context,
+    const GURL& url);
+
 // Sets a cookie for the given url. Returns true on success.
 bool SetCookie(BrowserContext* browser_context,
                const GURL& url,

content/test/data/set_document_cookie.html

+<!doctype html>
+<meta charset=utf-8>
+<title>Set a cookie string defined in the query string using document.cookie API</title>
+<script type="text/javascript">
+document.cookie = document.location.search.substring(1);
+</script>