1.1 --- /dev/null Thu Jan 01 00:00:00 1970 +0000
1.2 +++ b/netwerk/test/TestSTSParser.cpp Wed Dec 31 06:09:35 2014 +0100
1.3 @@ -0,0 +1,189 @@
1.4 +/* This Source Code Form is subject to the terms of the Mozilla Public
1.5 + * License, v. 2.0. If a copy of the MPL was not distributed with this
1.6 + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
1.7 +
1.8 +#include "TestHarness.h"
1.9 +#include <stdio.h>
1.10 +#include "nsNetUtil.h"
1.11 +#include "nsISiteSecurityService.h"
1.12 +
1.13 +#define EXPECT_SUCCESS(rv, ...) \
1.14 + PR_BEGIN_MACRO \
1.15 + if (NS_FAILED(rv)) { \
1.16 + fail(__VA_ARGS__); \
1.17 + return false; \
1.18 + } \
1.19 + PR_END_MACRO
1.20 +
1.21 +
1.22 +#define EXPECT_FAILURE(rv, ...) \
1.23 + PR_BEGIN_MACRO \
1.24 + if (NS_SUCCEEDED(rv)) { \
1.25 + fail(__VA_ARGS__); \
1.26 + return false; \
1.27 + } \
1.28 + PR_END_MACRO
1.29 +
1.30 +#define REQUIRE_EQUAL(a, b, ...) \
1.31 + PR_BEGIN_MACRO \
1.32 + if (a != b) { \
1.33 + fail(__VA_ARGS__); \
1.34 + return false; \
1.35 + } \
1.36 + PR_END_MACRO
1.37 +
1.38 +bool
1.39 +TestSuccess(const char* hdr, bool extraTokens,
1.40 + uint64_t expectedMaxAge, bool expectedIncludeSubdomains,
1.41 + nsISiteSecurityService* sss)
1.42 +{
1.43 + nsCOMPtr<nsIURI> dummyUri;
1.44 + nsresult rv = NS_NewURI(getter_AddRefs(dummyUri), "https://foo.com/bar.html");
1.45 + EXPECT_SUCCESS(rv, "Failed to create URI");
1.46 +
1.47 + uint64_t maxAge = 0;
1.48 + bool includeSubdomains = false;
1.49 + rv = sss->ProcessHeader(nsISiteSecurityService::HEADER_HSTS, dummyUri, hdr,
1.50 + 0, &maxAge, &includeSubdomains);
1.51 + EXPECT_SUCCESS(rv, "Failed to process valid header: %s", hdr);
1.52 +
1.53 + REQUIRE_EQUAL(maxAge, expectedMaxAge, "Did not correctly parse maxAge");
1.54 + REQUIRE_EQUAL(includeSubdomains, expectedIncludeSubdomains, "Did not correctly parse presence/absence of includeSubdomains");
1.55 +
1.56 + if (extraTokens) {
1.57 + REQUIRE_EQUAL(rv, NS_SUCCESS_LOSS_OF_INSIGNIFICANT_DATA,
1.58 + "Extra tokens were expected when parsing, but were not encountered.");
1.59 + } else {
1.60 + REQUIRE_EQUAL(rv, NS_OK, "Unexpected tokens found during parsing.");
1.61 + }
1.62 +
1.63 + passed(hdr);
1.64 + return true;
1.65 +}
1.66 +
1.67 +bool TestFailure(const char* hdr,
1.68 + nsISiteSecurityService* sss)
1.69 +{
1.70 + nsCOMPtr<nsIURI> dummyUri;
1.71 + nsresult rv = NS_NewURI(getter_AddRefs(dummyUri), "https://foo.com/bar.html");
1.72 + EXPECT_SUCCESS(rv, "Failed to create URI");
1.73 +
1.74 + rv = sss->ProcessHeader(nsISiteSecurityService::HEADER_HSTS, dummyUri, hdr,
1.75 + 0, nullptr, nullptr);
1.76 + EXPECT_FAILURE(rv, "Parsed invalid header: %s", hdr);
1.77 + passed(hdr);
1.78 + return true;
1.79 +}
1.80 +
1.81 +
1.82 +int
1.83 +main(int32_t argc, char *argv[])
1.84 +{
1.85 + nsresult rv;
1.86 + ScopedXPCOM xpcom("STS Parser Tests");
1.87 + if (xpcom.failed())
1.88 + return -1;
1.89 + // Initialize a profile folder to ensure a clean shutdown.
1.90 + nsCOMPtr<nsIFile> profile = xpcom.GetProfileDirectory();
1.91 + if (!profile) {
1.92 + fail("Couldn't get the profile directory.");
1.93 + return -1;
1.94 + }
1.95 +
1.96 + // grab handle to the service
1.97 + nsCOMPtr<nsISiteSecurityService> sss;
1.98 + sss = do_GetService("@mozilla.org/ssservice;1", &rv);
1.99 + NS_ENSURE_SUCCESS(rv, -1);
1.100 +
1.101 + int rv0, rv1;
1.102 +
1.103 + nsTArray<bool> rvs(24);
1.104 +
1.105 + // *** parsing tests
1.106 + printf("*** Attempting to parse valid STS headers ...\n");
1.107 +
1.108 + // SHOULD SUCCEED:
1.109 + rvs.AppendElement(TestSuccess("max-age=100", false, 100, false, sss));
1.110 + rvs.AppendElement(TestSuccess("max-age =100", false, 100, false, sss));
1.111 + rvs.AppendElement(TestSuccess(" max-age=100", false, 100, false, sss));
1.112 + rvs.AppendElement(TestSuccess("max-age = 100 ", false, 100, false, sss));
1.113 + rvs.AppendElement(TestSuccess("max-age = \"100\" ", false, 100, false, sss));
1.114 + rvs.AppendElement(TestSuccess("max-age=\"100\"", false, 100, false, sss));
1.115 + rvs.AppendElement(TestSuccess(" max-age =\"100\" ", false, 100, false, sss));
1.116 + rvs.AppendElement(TestSuccess("\tmax-age\t=\t\"100\"\t", false, 100, false, sss));
1.117 + rvs.AppendElement(TestSuccess("max-age = 100 ", false, 100, false, sss));
1.118 +
1.119 + rvs.AppendElement(TestSuccess("maX-aGe=100", false, 100, false, sss));
1.120 + rvs.AppendElement(TestSuccess("MAX-age =100", false, 100, false, sss));
1.121 + rvs.AppendElement(TestSuccess("max-AGE=100", false, 100, false, sss));
1.122 + rvs.AppendElement(TestSuccess("Max-Age = 100 ", false, 100, false, sss));
1.123 + rvs.AppendElement(TestSuccess("MAX-AGE = 100 ", false, 100, false, sss));
1.124 +
1.125 + rvs.AppendElement(TestSuccess("max-age=100;includeSubdomains", false, 100, true, sss));
1.126 + rvs.AppendElement(TestSuccess("max-age=100\t; includeSubdomains", false, 100, true, sss));
1.127 + rvs.AppendElement(TestSuccess(" max-age=100; includeSubdomains", false, 100, true, sss));
1.128 + rvs.AppendElement(TestSuccess("max-age = 100 ; includeSubdomains", false, 100, true, sss));
1.129 + rvs.AppendElement(TestSuccess("max-age = 100 ; includeSubdomains", false, 100, true, sss));
1.130 +
1.131 + rvs.AppendElement(TestSuccess("maX-aGe=100; includeSUBDOMAINS", false, 100, true, sss));
1.132 + rvs.AppendElement(TestSuccess("MAX-age =100; includeSubDomains", false, 100, true, sss));
1.133 + rvs.AppendElement(TestSuccess("max-AGE=100; iNcLuDeSuBdoMaInS", false, 100, true, sss));
1.134 + rvs.AppendElement(TestSuccess("Max-Age = 100; includesubdomains ", false, 100, true, sss));
1.135 + rvs.AppendElement(TestSuccess("INCLUDESUBDOMAINS;MaX-AgE = 100 ", false, 100, true, sss));
1.136 + // Turns out, the actual directive is entirely optional (hence the
1.137 + // trailing semicolon)
1.138 + rvs.AppendElement(TestSuccess("max-age=100;includeSubdomains;", true, 100, true, sss));
1.139 +
1.140 + // these are weird tests, but are testing that some extended syntax is
1.141 + // still allowed (but it is ignored)
1.142 + rvs.AppendElement(TestSuccess("max-age=100 ; includesubdomainsSomeStuff", true, 100, false, sss));
1.143 + rvs.AppendElement(TestSuccess("\r\n\t\t \tcompletelyUnrelated = foobar; max-age= 34520103 \t \t; alsoUnrelated;asIsThis;\tincludeSubdomains\t\t \t", true, 34520103, true, sss));
1.144 + rvs.AppendElement(TestSuccess("max-age=100; unrelated=\"quoted \\\"thingy\\\"\"", true, 100, false, sss));
1.145 +
1.146 + rv0 = rvs.Contains(false) ? 1 : 0;
1.147 + if (rv0 == 0)
1.148 + passed("Successfully Parsed STS headers with mixed case and LWS");
1.149 +
1.150 + rvs.Clear();
1.151 +
1.152 + // SHOULD FAIL:
1.153 + printf("*** Attempting to parse invalid STS headers (should not parse)...\n");
1.154 + // invalid max-ages
1.155 + rvs.AppendElement(TestFailure("max-age", sss));
1.156 + rvs.AppendElement(TestFailure("max-age ", sss));
1.157 + rvs.AppendElement(TestFailure("max-age=p", sss));
1.158 + rvs.AppendElement(TestFailure("max-age=*1p2", sss));
1.159 + rvs.AppendElement(TestFailure("max-age=.20032", sss));
1.160 + rvs.AppendElement(TestFailure("max-age=!20032", sss));
1.161 + rvs.AppendElement(TestFailure("max-age==20032", sss));
1.162 +
1.163 + // invalid headers
1.164 + rvs.AppendElement(TestFailure("foobar", sss));
1.165 + rvs.AppendElement(TestFailure("maxage=100", sss));
1.166 + rvs.AppendElement(TestFailure("maxa-ge=100", sss));
1.167 + rvs.AppendElement(TestFailure("max-ag=100", sss));
1.168 + rvs.AppendElement(TestFailure("includesubdomains", sss));
1.169 + rvs.AppendElement(TestFailure(";", sss));
1.170 + rvs.AppendElement(TestFailure("max-age=\"100", sss));
1.171 + // The max-age directive here doesn't conform to the spec, so it MUST
1.172 + // be ignored. Consequently, the REQUIRED max-age directive is not
1.173 + // present in this header, and so it is invalid.
1.174 + rvs.AppendElement(TestFailure("max-age=100, max-age=200; includeSubdomains", sss));
1.175 + rvs.AppendElement(TestFailure("max-age=100 includesubdomains", sss));
1.176 + rvs.AppendElement(TestFailure("max-age=100 bar foo", sss));
1.177 + rvs.AppendElement(TestFailure("max-age=100randomstuffhere", sss));
1.178 + // All directives MUST appear only once in an STS header field.
1.179 + rvs.AppendElement(TestFailure("max-age=100; max-age=200", sss));
1.180 + rvs.AppendElement(TestFailure("includeSubdomains; max-age=200; includeSubdomains", sss));
1.181 + rvs.AppendElement(TestFailure("max-age=200; includeSubdomains; includeSubdomains", sss));
1.182 + // The includeSubdomains directive is valueless.
1.183 + rvs.AppendElement(TestFailure("max-age=100; includeSubdomains=unexpected", sss));
1.184 + // LWS must have at least one space or horizontal tab
1.185 + rvs.AppendElement(TestFailure("\r\nmax-age=200", sss));
1.186 +
1.187 + rv1 = rvs.Contains(false) ? 1 : 0;
1.188 + if (rv1 == 0)
1.189 + passed("Avoided parsing invalid STS headers");
1.190 +
1.191 + return (rv0 + rv1);
1.192 +}
