Almost all actions in Declarative Web Request require all_urls host permissions

chrome/browser/extensions/api/declarative_webrequest/webrequest_rules_registry_unittest.cc

 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "chrome/browser/extensions/api/declarative_webrequest/webrequest_rules_registry.h"
 
 #include <string>
 #include <vector>
 
 #include "base/basictypes.h"
 #include "base/json/json_reader.h"
 #include "base/memory/linked_ptr.h"
 #include "base/message_loop.h"
 #include "base/stl_util.h"
 #include "base/test/values_test_util.h"
 #include "base/values.h"
 #include "chrome/browser/extensions/api/declarative_webrequest/webrequest_constants.h"
 #include "chrome/browser/extensions/api/web_request/web_request_api_helpers.h"
+#include "chrome/common/extensions/extension_test_util.h"
 #include "content/public/test/test_browser_thread.h"
 #include "extensions/common/matcher/url_matcher_constants.h"
 #include "net/url_request/url_request_test_util.h"
 #include "testing/gmock/include/gmock/gmock.h"
 #include "testing/gtest/include/gtest/gtest-message.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace {
 const char kExtensionId[] = "ext1";
 const char kExtensionId2[] = "ext2";
 const char kRuleId1[] = "rule1";
 const char kRuleId2[] = "rule2";
 const char kRuleId3[] = "rule3";
 const char kRuleId4[] = "rule4";
 }  // namespace
 
 namespace extensions {
 
+using base::Value;
+using extension_test_util::LoadManifest;
+using extension_test_util::LoadManifestUnchecked;
 using testing::HasSubstr;
 
 namespace helpers = extension_web_request_api_helpers;
 namespace keys = declarative_webrequest_constants;
 namespace keys2 = url_matcher_constants;
 
 class TestWebRequestRulesRegistry : public WebRequestRulesRegistry {
  public:
-  TestWebRequestRulesRegistry()
-      : WebRequestRulesRegistry(NULL, NULL),
-        num_clear_cache_calls_(0) {}
+  explicit TestWebRequestRulesRegistry(
+      scoped_refptr<ExtensionInfoMap> extension_info_map)
+      : WebRequestRulesRegistry(NULL, NULL), num_clear_cache_calls_(0) {
+    SetExtensionInfoMapForTesting(extension_info_map);
+  }
 
   // Returns how often the in-memory caches of the renderers were instructed
   // to be cleared.
   int num_clear_cache_calls() const { return num_clear_cache_calls_; }
 
   // How many rules are there which have some conditions not triggered by URL
   // matches.
   size_t RulesWithoutTriggers() const {
     return rules_with_untriggered_conditions_for_test().size();
   }
 
  protected:
   virtual ~TestWebRequestRulesRegistry() {}
 
-  virtual base::Time GetExtensionInstallationTime(
-      const std::string& extension_id) const OVERRIDE {
-    if (extension_id == kExtensionId)
-      return base::Time() + base::TimeDelta::FromDays(1);
-    else if (extension_id == kExtensionId2)
-      return base::Time() + base::TimeDelta::FromDays(2);
-    else
-      return base::Time();
-  }
-
   virtual void ClearCacheOnNavigation() OVERRIDE {
     ++num_clear_cache_calls_;
   }
 
  private:
   int num_clear_cache_calls_;
 };
 
 class WebRequestRulesRegistryTest : public testing::Test {
  public:
   WebRequestRulesRegistryTest()
       : message_loop(MessageLoop::TYPE_IO),
         ui(content::BrowserThread::UI, &message_loop),
         io(content::BrowserThread::IO, &message_loop) {}
 
   virtual ~WebRequestRulesRegistryTest() {}
 
+  virtual void SetUp() OVERRIDE;
+
   virtual void TearDown() OVERRIDE {
     // Make sure that deletion traits of all registries are executed.
     message_loop.RunUntilIdle();
   }
 
   // Returns a rule that roughly matches http://*.example.com and
   // https://www.example.com and cancels it
   linked_ptr<RulesRegistry::Rule> CreateRule1() {
     ListValue* scheme_http = new ListValue();
     scheme_http->Append(Value::CreateStringValue("http"));
@@ skipping 117 matching lines @@
              attributes.begin();
          it != attributes.end(); ++it)
       rule->conditions.push_back(CreateCondition(**it));
     return rule;
   }
 
  protected:
   MessageLoop message_loop;
   content::TestBrowserThread ui;
   content::TestBrowserThread io;
+  // Two extensions with host permissions for all URLs and the DWR permission.
+  // Installation times will be so that |extension_| is older than
+  // |extension2_|.
+  scoped_refptr<Extension> extension_;
+  scoped_refptr<Extension> extension2_;
+  scoped_refptr<ExtensionInfoMap> extension_info_map_;
 };
 
+void WebRequestRulesRegistryTest::SetUp() {
+  testing::Test::SetUp();
+
+  std::string error;
+  extension_ = LoadManifestUnchecked("permissions",
+                                     "web_request_all_host_permissions.json",
+                                     Manifest::INVALID_LOCATION,
+                                     Extension::NO_FLAGS,
+                                     kExtensionId,
+                                     &error);
+  ASSERT_TRUE(extension_) << error;
+  extension2_ =
+      LoadManifestUnchecked("permissions",
+                            "web_request_all_host_permissions.json",
+                            Manifest::INVALID_LOCATION,
+                            Extension::NO_FLAGS,
+                            kExtensionId2,
+                            &error);
+  ASSERT_TRUE(extension2_) << error;
+  extension_info_map_ = new ExtensionInfoMap;
+  ASSERT_TRUE(extension_info_map_);
+  extension_info_map_->AddExtension(extension_.get(),
+                                    base::Time() + base::TimeDelta::FromDays(1),
+                                    false /*incognito_enabled*/);
+  extension_info_map_->AddExtension(extension2_.get(),
+                                    base::Time() + base::TimeDelta::FromDays(2),
+                                    false /*incognito_enabled*/);
+}
+
+
 TEST_F(WebRequestRulesRegistryTest, AddRulesImpl) {
   scoped_refptr<TestWebRequestRulesRegistry> registry(
-      new TestWebRequestRulesRegistry());
+      new TestWebRequestRulesRegistry(extension_info_map_));
   std::string error;
 
   std::vector<linked_ptr<RulesRegistry::Rule> > rules;
   rules.push_back(CreateRule1());
   rules.push_back(CreateRule2());
 
   error = registry->AddRules(kExtensionId, rules);
   EXPECT_EQ("", error);
   EXPECT_EQ(1, registry->num_clear_cache_calls());
 
@@ skipping 18 matching lines @@
   request_data.request = &foobar_request;
   matches = registry->GetMatches(request_data);
   EXPECT_EQ(1u, matches.size());
   WebRequestRule::GlobalRuleId expected_pair =
       std::make_pair(kExtensionId, kRuleId2);
   EXPECT_EQ(expected_pair, (*matches.begin())->id());
 }
 
 TEST_F(WebRequestRulesRegistryTest, RemoveRulesImpl) {
   scoped_refptr<TestWebRequestRulesRegistry> registry(
-      new TestWebRequestRulesRegistry());
+      new TestWebRequestRulesRegistry(extension_info_map_));
   std::string error;
 
   // Setup RulesRegistry to contain two rules.
   std::vector<linked_ptr<RulesRegistry::Rule> > rules_to_add;
   rules_to_add.push_back(CreateRule1());
   rules_to_add.push_back(CreateRule2());
   error = registry->AddRules(kExtensionId, rules_to_add);
   EXPECT_EQ("", error);
   EXPECT_EQ(1, registry->num_clear_cache_calls());
 
@@ skipping 27 matching lines @@
   registered_rules.clear();
   registry->GetAllRules(kExtensionId, &registered_rules);
   EXPECT_EQ(0u, registered_rules.size());
   EXPECT_EQ(0u, registry->RulesWithoutTriggers());
 
   EXPECT_TRUE(registry->IsEmpty());
 }
 
 TEST_F(WebRequestRulesRegistryTest, RemoveAllRulesImpl) {
   scoped_refptr<TestWebRequestRulesRegistry> registry(
-      new TestWebRequestRulesRegistry());
+      new TestWebRequestRulesRegistry(extension_info_map_));
   std::string error;
 
   // Setup RulesRegistry to contain two rules, one for each extension.
   std::vector<linked_ptr<RulesRegistry::Rule> > rules_to_add(1);
   rules_to_add[0] = CreateRule1();
   error = registry->AddRules(kExtensionId, rules_to_add);
   EXPECT_EQ("", error);
   EXPECT_EQ(1, registry->num_clear_cache_calls());
 
   rules_to_add[0] = CreateRule2();
@@ skipping 31 matching lines @@
   error = registry->RemoveAllRules(kExtensionId2);
   EXPECT_EQ("", error);
   EXPECT_EQ(5, registry->num_clear_cache_calls());
 
   EXPECT_TRUE(registry->IsEmpty());
 }
 
 // Test precedences between extensions.
 TEST_F(WebRequestRulesRegistryTest, Precedences) {
   scoped_refptr<WebRequestRulesRegistry> registry(
-      new TestWebRequestRulesRegistry());
+      new TestWebRequestRulesRegistry(extension_info_map_));
   std::string error;
 
   std::vector<linked_ptr<RulesRegistry::Rule> > rules_to_add_1(1);
   rules_to_add_1[0] = CreateRedirectRule("http://www.foo.com");
   error = registry->AddRules(kExtensionId, rules_to_add_1);
   EXPECT_EQ("", error);
 
   std::vector<linked_ptr<RulesRegistry::Rule> > rules_to_add_2(1);
   rules_to_add_2[0] = CreateRedirectRule("http://www.bar.com");
   error = registry->AddRules(kExtensionId2, rules_to_add_2);
@@ skipping 22 matching lines @@
 
   EXPECT_EQ(kExtensionId, loser->extension_id);
   EXPECT_EQ(base::Time() + base::TimeDelta::FromDays(1),
             loser->extension_install_time);
   EXPECT_EQ(GURL("http://www.foo.com"), loser->new_url);
 }
 
 // Test priorities of rules within one extension.
 TEST_F(WebRequestRulesRegistryTest, Priorities) {
   scoped_refptr<WebRequestRulesRegistry> registry(
-      new TestWebRequestRulesRegistry());
+      new TestWebRequestRulesRegistry(extension_info_map_));
   std::string error;
 
   std::vector<linked_ptr<RulesRegistry::Rule> > rules_to_add_1(1);
   rules_to_add_1[0] = CreateRedirectRule("http://www.foo.com");
   error = registry->AddRules(kExtensionId, rules_to_add_1);
   EXPECT_EQ("", error);
 
   std::vector<linked_ptr<RulesRegistry::Rule> > rules_to_add_2(1);
   rules_to_add_2[0] = CreateRedirectRule("http://www.bar.com");
   error = registry->AddRules(kExtensionId2, rules_to_add_2);
@@ skipping 65 matching lines @@
   scoped_ptr<Value> value2(base::JSONReader::Read(kRule2));
   ASSERT_TRUE(value2.get());
 
   std::vector<linked_ptr<RulesRegistry::Rule> > rules;
   rules.push_back(make_linked_ptr(new RulesRegistry::Rule));
   rules.push_back(make_linked_ptr(new RulesRegistry::Rule));
   ASSERT_TRUE(RulesRegistry::Rule::Populate(*value1, rules[0].get()));
   ASSERT_TRUE(RulesRegistry::Rule::Populate(*value2, rules[1].get()));
 
   scoped_refptr<WebRequestRulesRegistry> registry(
-      new TestWebRequestRulesRegistry());
+      new TestWebRequestRulesRegistry(extension_info_map_));
   std::string error = registry->AddRulesImpl(kExtensionId, rules);
   EXPECT_EQ("", error);
   EXPECT_FALSE(registry->IsEmpty());
 
   GURL url("http://www.foo.com/test");
   net::TestURLRequestContext context;
   net::TestURLRequest request(url, NULL, &context, NULL);
   WebRequestData request_data(&request, ON_BEFORE_REQUEST);
   std::list<LinkedPtrEventResponseDelta> deltas =
       registry->CreateDeltas(NULL, request_data, false);
 
   // The redirect by the redirect rule is ignored due to the ignore rule.
   std::set<const WebRequestRule*> matches = registry->GetMatches(request_data);
   EXPECT_EQ(2u, matches.size());
   ASSERT_EQ(0u, deltas.size());
 }
 
 // Test that rules failing IsFulfilled on their conditions are never returned by
 // GetMatches.
 TEST_F(WebRequestRulesRegistryTest, GetMatchesCheckFulfilled) {
   scoped_refptr<TestWebRequestRulesRegistry> registry(
-      new TestWebRequestRulesRegistry());
+      new TestWebRequestRulesRegistry(extension_info_map_));
   const std::string kMatchingUrlAttribute(
       "\"url\": { \"pathContains\": \"\" }, \n");
   const std::string kNonMatchingNonUrlAttribute(
       "\"resourceType\": [\"stylesheet\"], \n");
   const std::string kBothAttributes(kMatchingUrlAttribute +
                                     kNonMatchingNonUrlAttribute);
   std::string error;
   std::vector<const std::string*> attributes;
   std::vector<linked_ptr<RulesRegistry::Rule> > rules;
 
@@ skipping 27 matching lines @@
   WebRequestRule::GlobalRuleId expected_pair = std::make_pair(kExtensionId,
                                                               kRuleId3);
   EXPECT_EQ(expected_pair, (*matches.begin())->id());
 }
 
 // Test that the url and firstPartyForCookiesUrl attributes are evaluated
 // against corresponding URLs. Tested on requests where these URLs actually
 // differ.
 TEST_F(WebRequestRulesRegistryTest, GetMatchesDifferentUrls) {
   scoped_refptr<TestWebRequestRulesRegistry> registry(
-      new TestWebRequestRulesRegistry());
+      new TestWebRequestRulesRegistry(extension_info_map_));
   const std::string kUrlAttribute(
       "\"url\": { \"hostContains\": \"url\" }, \n");
   const std::string kFirstPartyUrlAttribute(
       "\"firstPartyForCookiesUrl\": { \"hostContains\": \"fpfc\" }, \n");
   std::string error;
   std::vector<const std::string*> attributes;
   std::vector<linked_ptr<RulesRegistry::Rule> > rules;
 
   // Rule 1 has one condition, with a url attribute
   attributes.push_back(&kUrlAttribute);
@@ skipping 36 matching lines @@
     SCOPED_TRACE(testing::Message("i = ") << i << ", rule id = "
                                           << matchingRuleIds[i]);
     // Make sure that the right rule succeeded.
     EXPECT_EQ(1u, matches.size());
     EXPECT_EQ(WebRequestRule::GlobalRuleId(std::make_pair(kExtensionId,
                                                           matchingRuleIds[i])),
               (*matches.begin())->id());
   }
 }
 
-TEST_F(WebRequestRulesRegistryTest, CheckConsistency) {
+TEST(WebRequestRulesRegistrySimpleTest, StageChecker) {
   // The contentType condition can only be evaluated during ON_HEADERS_RECEIVED
   // but the redirect action can only be executed during ON_BEFORE_REQUEST.
   // Therefore, this is an inconsistent rule that needs to be flagged.
   const char kRule[] =
       "{                                                                 \n"
       "  \"id\": \"rule1\",                                              \n"
       "  \"conditions\": [                                               \n"
       "    {                                                             \n"
       "      \"instanceType\": \"declarativeWebRequest.RequestMatcher\", \n"
       "      \"url\": {\"hostSuffix\": \"foo.com\"},                     \n"
       "      \"contentType\": [\"image/jpeg\"]                           \n"
       "    }                                                             \n"
       "  ],                                                              \n"
       "  \"actions\": [                                                  \n"
       "    {                                                             \n"
       "      \"instanceType\": \"declarativeWebRequest.RedirectRequest\",\n"
       "      \"redirectUrl\": \"http://bar.com\"                         \n"
       "    }                                                             \n"
       "  ],                                                              \n"
       "  \"priority\": 200                                               \n"
       "}                                                                 ";
 
   scoped_ptr<Value> value(base::JSONReader::Read(kRule));
-  ASSERT_TRUE(value.get());
+  ASSERT_TRUE(value);
 
-  std::vector<linked_ptr<RulesRegistry::Rule> > rules;
-  rules.push_back(make_linked_ptr(new RulesRegistry::Rule));
-  ASSERT_TRUE(RulesRegistry::Rule::Populate(*value, rules.back().get()));
+  RulesRegistry::Rule rule;
+  ASSERT_TRUE(RulesRegistry::Rule::Populate(*value, &rule));
 
-  scoped_refptr<WebRequestRulesRegistry> registry(
-      new TestWebRequestRulesRegistry());
+  std::string error;
+  URLMatcher matcher;
+  scoped_ptr<WebRequestConditionSet> conditions =
+      WebRequestConditionSet::Create(
+          matcher.condition_factory(), rule.conditions, &error);
+  ASSERT_TRUE(error.empty()) << error;
+  ASSERT_TRUE(conditions);
 
-  URLMatcher matcher;
-  std::string error = registry->AddRulesImpl(kExtensionId, rules);
+  bool bad_message = false;
+  scoped_ptr<WebRequestActionSet> actions =
+      WebRequestActionSet::Create(rule.actions, &error, &bad_message);
+  ASSERT_TRUE(error.empty()) << error;
+  ASSERT_FALSE(bad_message);
+  ASSERT_TRUE(actions);
+
+  EXPECT_FALSE(WebRequestRulesRegistry::StageChecker(
+      conditions.get(), actions.get(), &error));
   EXPECT_THAT(error, HasSubstr("no time in the request life-cycle"));
-  EXPECT_TRUE(registry->IsEmpty());
+  EXPECT_THAT(error, HasSubstr(actions->actions().back()->GetName()));
+}
+
+TEST(WebRequestRulesRegistrySimpleTest, HostPermissionsChecker) {
+  const char kAction[] =  // This action requires all URLs host permission.
+      "{                                                             \n"
+      "  \"instanceType\": \"declarativeWebRequest.RedirectRequest\",\n"
+      "  \"redirectUrl\": \"http://bar.com\"                         \n"
+      "}                                                             ";
+  scoped_ptr<Value> action_value(base::JSONReader::Read(kAction));
+  ASSERT_TRUE(action_value);
+
+  WebRequestActionSet::AnyVector actions;
+  actions.push_back(linked_ptr<base::Value>(action_value.release()));
+  ASSERT_TRUE(actions.back().get());
+
+  std::string error;
+  bool bad_message = false;
+  scoped_ptr<WebRequestActionSet> action_set(
+      WebRequestActionSet::Create(actions, &error, &bad_message));
+  ASSERT_TRUE(error.empty()) << error;
+  ASSERT_FALSE(bad_message);
+  ASSERT_TRUE(action_set);
+
+  scoped_refptr<Extension> extension_no_url(
+      LoadManifest("permissions", "web_request_no_host.json"));
+  scoped_refptr<Extension> extension_some_urls(
+      LoadManifest("permissions", "web_request_com_host_permissions.json"));
+  scoped_refptr<Extension> extension_all_urls(
+      LoadManifest("permissions", "web_request_all_host_permissions.json"));
+
+  EXPECT_TRUE(WebRequestRulesRegistry::HostPermissionsChecker(
+      extension_all_urls.get(), action_set.get(), &error));
+  EXPECT_TRUE(error.empty()) << error;
+
+  EXPECT_FALSE(WebRequestRulesRegistry::HostPermissionsChecker(
+      extension_some_urls.get(), action_set.get(), &error));
+  EXPECT_THAT(error, HasSubstr("permission for all"));
+  EXPECT_THAT(error, HasSubstr(action_set->actions().back()->GetName()));
+
+  EXPECT_FALSE(WebRequestRulesRegistry::HostPermissionsChecker(
+      extension_no_url.get(), action_set.get(), &error));
+  EXPECT_THAT(error, HasSubstr("permission for all"));
+  EXPECT_THAT(error, HasSubstr(action_set->actions().back()->GetName()));
 }
 
 TEST_F(WebRequestRulesRegistryTest, CheckOriginAndPathRegEx) {
   const char kRule[] =
       "{                                                                 \n"
       "  \"id\": \"rule1\",                                              \n"
       "  \"conditions\": [                                               \n"
       "    {                                                             \n"
       "      \"instanceType\": \"declarativeWebRequest.RequestMatcher\", \n"
       "      \"url\": {\"originAndPathMatches\": \"fo+.com\"}            \n"
       "    }                                                             \n"
       "  ],                                                              \n"
       "  \"actions\": [                                                  \n"
       "    {                                                             \n"
       "      \"instanceType\": \"declarativeWebRequest.RedirectRequest\",\n"
       "      \"redirectUrl\": \"http://bar.com\"                         \n"
       "    }                                                             \n"
       "  ],                                                              \n"
       "  \"priority\": 200                                               \n"
       "}                                                                 ";
 
   scoped_ptr<Value> value(base::JSONReader::Read(kRule));
   ASSERT_TRUE(value.get());
 
   std::vector<linked_ptr<RulesRegistry::Rule> > rules;
   rules.push_back(make_linked_ptr(new RulesRegistry::Rule));
   ASSERT_TRUE(RulesRegistry::Rule::Populate(*value, rules.back().get()));
 
   scoped_refptr<WebRequestRulesRegistry> registry(
-      new TestWebRequestRulesRegistry());
+      new TestWebRequestRulesRegistry(extension_info_map_));
 
   URLMatcher matcher;
   std::string error = registry->AddRulesImpl(kExtensionId, rules);
   EXPECT_EQ("", error);
 
   net::TestURLRequestContext context;
   std::list<LinkedPtrEventResponseDelta> deltas;
 
   // No match because match is in the query parameter.
   GURL url1("http://bar.com/index.html?foo.com");
   net::TestURLRequest request1(url1, NULL, &context, NULL);
   WebRequestData request_data1(&request1, ON_BEFORE_REQUEST);
   deltas = registry->CreateDeltas(NULL, request_data1, false);
   EXPECT_EQ(0u, deltas.size());
 
   // This is a correct match.
   GURL url2("http://foo.com/index.html");
   net::TestURLRequest request2(url2, NULL, &context, NULL);
   WebRequestData request_data2(&request2, ON_BEFORE_REQUEST);
   deltas = registry->CreateDeltas(NULL, request_data2, false);
   EXPECT_EQ(1u, deltas.size());
 }
 
 }  // namespace extensions