POSTs to HSTS domains are no longer converted to GETs

net/url_request/url_request_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "build/build_config.h"
 
 #if defined(OS_WIN)
 #include <windows.h>
 #include <shlobj.h>
 #endif
@@ skipping 3664 matching lines @@
   TestDelegate d;
   URLRequest req(test_server_.GetURL("empty.html"), &d, &default_context_);
   req.set_method("POST");
   req.set_upload(CreateSimpleUploadData(kData).get());
   HttpRequestHeaders headers;
   headers.SetHeader(HttpRequestHeaders::kContentLength,
                     base::UintToString(arraysize(kData) - 1));
   req.SetExtraRequestHeaders(headers);
 
   URLRequestRedirectJob* job = new URLRequestRedirectJob(
-      &req, default_context_.network_delegate(), test_server_.GetURL("echo"));
+      &req, default_context_.network_delegate(), test_server_.GetURL("echo"),
+      URLRequestRedirectJob::REDIRECT_302_FOUND);
   AddTestInterceptor()->set_main_intercept_job(job);
 
   req.Start();
   MessageLoop::current()->Run();
   EXPECT_EQ("GET", req.method());
 }
 
 TEST_F(URLRequestTestHTTP, InterceptPost307RedirectPost) {
   ASSERT_TRUE(test_server_.Start());
 
   const char kData[] = "hello world";
 
   TestDelegate d;
   URLRequest req(test_server_.GetURL("empty.html"), &d, &default_context_);
   req.set_method("POST");
   req.set_upload(CreateSimpleUploadData(kData).get());
   HttpRequestHeaders headers;
   headers.SetHeader(HttpRequestHeaders::kContentLength,
                     base::UintToString(arraysize(kData) - 1));
   req.SetExtraRequestHeaders(headers);
 
   URLRequestRedirectJob* job = new URLRequestRedirectJob(
-      &req, default_context_.network_delegate(), test_server_.GetURL("echo"));
-  job->set_redirect_code(
+      &req, default_context_.network_delegate(), test_server_.GetURL("echo"),
       URLRequestRedirectJob::REDIRECT_307_TEMPORARY_REDIRECT);
   AddTestInterceptor()->set_main_intercept_job(job);
 
   req.Start();
   MessageLoop::current()->Run();
   EXPECT_EQ("POST", req.method());
   EXPECT_EQ(kData, d.data_received());
 }
 
 // Check that default A-L header is sent.
@@ skipping 452 matching lines @@
   EXPECT_EQ(new_domain_state.include_subdomains,
             domain_state.include_subdomains);
   EXPECT_TRUE(FingerprintsEqual(new_domain_state.static_spki_hashes,
                                 domain_state.static_spki_hashes));
   EXPECT_TRUE(FingerprintsEqual(new_domain_state.dynamic_spki_hashes,
                                 domain_state.dynamic_spki_hashes));
   EXPECT_TRUE(FingerprintsEqual(new_domain_state.bad_static_spki_hashes,
                                 domain_state.bad_static_spki_hashes));
 }
 
+// Make sure HSTS preserves a POST request's method and body.
+TEST_F(HTTPSRequestTest, HSTSPreservesPosts) {
+  static const char kData[] = "hello world";
+
+  TestServer::SSLOptions ssl_options(TestServer::SSLOptions::CERT_OK);
+  TestServer test_server(TestServer::TYPE_HTTPS,
+                         ssl_options,
+                         FilePath(FILE_PATH_LITERAL("net/data/ssl")));
+  ASSERT_TRUE(test_server.Start());
+
+
+  // Per spec, TransportSecurityState expects a domain name, rather than an IP
+  // address, so a MockHostResolver is needed to redirect www.somewhere.com to
+  // the TestServer.
+  MockHostResolver host_resolver;
+  host_resolver.rules()->AddRule("www.somewhere.com", "127.0.0.1");

[szym, 2012/11/28 18:04:16]

Drive-by: MockHostResolver redirects everything to 127.0.0.1 by default
(exceptions are allowed). I guess the header doc in mock_host_resolver.h should
explain that.

[mmenke, 2012/11/28 18:34:45]

Thanks.  This was copy/pasted directly from another test in this file.  I'll go
ahead land this as-is, and do a followup CL that removes them from this file,
and updates their (identical) comments as appropriate.

+
+  // Force https for www.somewhere.com.
+  TransportSecurityState transport_security_state;
+  net::TransportSecurityState::DomainState domain_state;
+  domain_state.upgrade_expiry =
+      domain_state.created + base::TimeDelta::FromDays(1000);
+  transport_security_state.EnableHost("www.somewhere.com", domain_state);
+
+  TestNetworkDelegate network_delegate;  // Must outlive URLRequest.
+
+  TestURLRequestContext context(true);
+  context.set_host_resolver(&host_resolver);
+  context.set_transport_security_state(&transport_security_state);
+  context.set_network_delegate(&network_delegate);
+  context.Init();
+
+  TestDelegate d;
+  // Navigating to https://www.somewhere.com instead of https://127.0.0.1 will
+  // cause a certificate error.  Ignore the error.
+  d.set_allow_certificate_errors(true);
+
+  URLRequest req(GURL(StringPrintf("http://www.somewhere.com:%d/echo",
+                                   test_server.host_port_pair().port())),
+                 &d,
+                 &context);
+  req.set_method("POST");
+  req.set_upload(CreateSimpleUploadData(kData).get());
+
+  req.Start();
+  MessageLoop::current()->Run();
+
+  EXPECT_EQ("https", req.url().scheme());
+  EXPECT_EQ("POST", req.method());
+  EXPECT_EQ(kData, d.data_received());
+}
+
 TEST_F(HTTPSRequestTest, SSLv3Fallback) {
   TestServer::SSLOptions ssl_options(
       TestServer::SSLOptions::CERT_OK);
   ssl_options.tls_intolerant = TestServer::SSLOptions::TLS_INTOLERANT_ALL;
   TestServer test_server(TestServer::TYPE_HTTPS,
                          ssl_options,
                          FilePath(FILE_PATH_LITERAL("net/data/ssl")));
   ASSERT_TRUE(test_server.Start());
 
   TestDelegate d;
@@ skipping 921 matching lines @@
 
     EXPECT_FALSE(r.is_pending());
     EXPECT_EQ(1, d->response_started_count());
     EXPECT_FALSE(d->received_data_before_response());
     EXPECT_EQ(d->bytes_received(), static_cast<int>(file_size));
   }
 }
 #endif  // !defined(DISABLE_FTP_SUPPORT)
 
 }  // namespace net