chrome/browser/safe_browsing/safe_browsing_service_browsertest.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4 //
   5 // This test creates a safebrowsing service using test safebrowsing database
   6 // and a test protocol manager. It is used to test logics in safebrowsing
   7 // service.
   8
   9 #include <algorithm>
  10
  11 #include "base/bind.h"
  12 #include "base/command_line.h"
  13 #include "base/files/file_path.h"
  14 #include "base/files/scoped_temp_dir.h"
  15 #include "base/memory/ref_counted.h"
  16 #include "base/metrics/field_trial.h"
  17 #include "base/path_service.h"
  18 #include "base/prefs/pref_service.h"
  19 #include "base/strings/string_split.h"
  20 #include "base/strings/string_util.h"
  21 #include "base/test/thread_test_helper.h"
  22 #include "base/time/time.h"
  23 #include "chrome/browser/browser_process.h"
  24 #include "chrome/browser/chrome_notification_types.h"
  25 #include "chrome/browser/prerender/prerender_manager.h"
  26 #include "chrome/browser/profiles/profile.h"
  27 #include "chrome/browser/profiles/profile_manager.h"
  28 #include "chrome/browser/profiles/startup_task_runner_service.h"
  29 #include "chrome/browser/profiles/startup_task_runner_service_factory.h"
  30 #include "chrome/browser/safe_browsing/client_side_detection_service.h"
  31 #include "chrome/browser/safe_browsing/database_manager.h"
  32 #include "chrome/browser/safe_browsing/local_database_manager.h"
  33 #include "chrome/browser/safe_browsing/metadata.pb.h"
  34 #include "chrome/browser/safe_browsing/protocol_manager.h"
  35 #include "chrome/browser/safe_browsing/safe_browsing_database.h"
  36 #include "chrome/browser/safe_browsing/safe_browsing_service.h"
  37 #include "chrome/browser/safe_browsing/safe_browsing_util.h"
  38 #include "chrome/browser/safe_browsing/ui_manager.h"
  39 #include "chrome/browser/ui/browser.h"
  40 #include "chrome/browser/ui/tabs/tab_strip_model.h"
  41 #include "chrome/common/chrome_paths.h"
  42 #include "chrome/common/chrome_switches.h"
  43 #include "chrome/common/pref_names.h"
  44 #include "chrome/test/base/in_process_browser_test.h"
  45 #include "chrome/test/base/ui_test_utils.h"
  46 #include "content/public/browser/web_contents.h"
  47 #include "net/cookies/cookie_store.h"
  48 #include "net/cookies/cookie_util.h"
  49 #include "net/test/embedded_test_server/embedded_test_server.h"
  50 #include "net/test/embedded_test_server/http_request.h"
  51 #include "net/test/embedded_test_server/http_response.h"
  52 #include "sql/connection.h"
  53 #include "sql/statement.h"
  54 #include "testing/gmock/include/gmock/gmock.h"
  55 #include "url/gurl.h"
  56
  57 #if defined(OS_CHROMEOS)
  58 #include "chrome/browser/chromeos/profiles/profile_helper.h"
  59 #include "chromeos/chromeos_switches.h"
  60 #endif
  61
  62 #if !defined(SAFE_BROWSING_DB_LOCAL)
  63 #error This test requires SAFE_BROWSING_DB_LOCAL.
  64 #endif
  65
  66 using content::BrowserThread;
  67 using content::InterstitialPage;
  68 using content::WebContents;
  69 using ::testing::_;
  70 using ::testing::Mock;
  71 using ::testing::StrictMock;
  72
  73 namespace {
  74
  75 void InvokeFullHashCallback(
  76     SafeBrowsingProtocolManager::FullHashCallback callback,
  77     const std::vector<SBFullHashResult>& result) {
  78   callback.Run(result, base::TimeDelta::FromMinutes(45));
  79 }
  80
  81 class FakeSafeBrowsingService : public SafeBrowsingService {
  82  public:
  83   explicit FakeSafeBrowsingService(const std::string& url_prefix)
  84       : url_prefix_(url_prefix) {}
  85
  86   SafeBrowsingProtocolConfig GetProtocolConfig() const override {
  87     SafeBrowsingProtocolConfig config;
  88     config.url_prefix = url_prefix_;
  89     // Makes sure the auto update is not triggered. The tests will force the
  90     // update when needed.
  91     config.disable_auto_update = true;
  92 #if defined(OS_ANDROID)
  93     config.disable_connection_check = true;
  94 #endif
  95     config.client_name = "browser_tests";
  96     return config;
  97   }
  98
  99  private:
 100   ~FakeSafeBrowsingService() override {}
 101
 102   std::string url_prefix_;
 103
 104   DISALLOW_COPY_AND_ASSIGN(FakeSafeBrowsingService);
 105 };
 106
 107 // Factory that creates FakeSafeBrowsingService instances.
 108 class TestSafeBrowsingServiceFactory : public SafeBrowsingServiceFactory {
 109  public:
 110   explicit TestSafeBrowsingServiceFactory(const std::string& url_prefix)
 111       : url_prefix_(url_prefix) {}
 112
 113   SafeBrowsingService* CreateSafeBrowsingService() override {
 114     return new FakeSafeBrowsingService(url_prefix_);
 115   }
 116
 117  private:
 118   std::string url_prefix_;
 119 };
 120
 121 // A SafeBrowingDatabase class that allows us to inject the malicious URLs.
 122 class TestSafeBrowsingDatabase :  public SafeBrowsingDatabase {
 123  public:
 124   TestSafeBrowsingDatabase() {}
 125
 126   ~TestSafeBrowsingDatabase() override {}
 127
 128   // Initializes the database with the given filename.
 129   void Init(const base::FilePath& filename) override {}
 130
 131   // Deletes the current database and creates a new one.
 132   bool ResetDatabase() override {
 133     badurls_.clear();
 134     return true;
 135   }
 136
 137   // Called on the IO thread to check if the given URL is safe or not.  If we
 138   // can synchronously determine that the URL is safe, CheckUrl returns true,
 139   // otherwise it returns false.
 140   bool ContainsBrowseUrl(const GURL& url,
 141                          std::vector<SBPrefix>* prefix_hits,
 142                          std::vector<SBFullHashResult>* cache_hits) override {
 143     cache_hits->clear();
 144     return ContainsUrl(safe_browsing_util::MALWARE,
 145                        safe_browsing_util::PHISH,
 146                        std::vector<GURL>(1, url),
 147                        prefix_hits);
 148   }
 149   bool ContainsUnwantedSoftwareUrl(
 150       const GURL& url,
 151       std::vector<SBPrefix>* prefix_hits,
 152       std::vector<SBFullHashResult>* cache_hits) override {
 153     cache_hits->clear();
 154     return ContainsUrl(safe_browsing_util::UNWANTEDURL,
 155                        safe_browsing_util::UNWANTEDURL,
 156                        std::vector<GURL>(1, url),
 157                        prefix_hits);
 158   }
 159   bool ContainsDownloadUrlPrefixes(
 160       const std::vector<SBPrefix>& prefixes,
 161       std::vector<SBPrefix>* prefix_hits) override {
 162     bool found =
 163         ContainsUrlPrefixes(safe_browsing_util::BINURL,
 164                             safe_browsing_util::BINURL, prefixes, prefix_hits);
 165     if (!found)
 166       return false;
 167     DCHECK_LE(1U, prefix_hits->size());
 168     return true;
 169   }
 170   bool ContainsCsdWhitelistedUrl(const GURL& url) override { return true; }
 171   bool ContainsDownloadWhitelistedString(const std::string& str) override {
 172     return true;
 173   }
 174   bool ContainsDownloadWhitelistedUrl(const GURL& url) override { return true; }
 175   bool ContainsInclusionWhitelistedUrl(const GURL& url) override {
 176     return true;
 177   }
 178   bool ContainsExtensionPrefixes(const std::vector<SBPrefix>& prefixes,
 179                                  std::vector<SBPrefix>* prefix_hits) override {
 180     return false;
 181   }
 182   bool ContainsMalwareIP(const std::string& ip_address) override {
 183     return true;
 184   }
 185   bool UpdateStarted(std::vector<SBListChunkRanges>* lists) override {
 186     ADD_FAILURE() << "Not implemented.";
 187     return false;
 188   }
 189   void InsertChunks(const std::string& list_name,
 190                     const std::vector<SBChunkData*>& chunks) override {
 191     ADD_FAILURE() << "Not implemented.";
 192   }
 193   void DeleteChunks(const std::vector<SBChunkDelete>& chunk_deletes) override {
 194     ADD_FAILURE() << "Not implemented.";
 195   }
 196   void UpdateFinished(bool update_succeeded) override {
 197     ADD_FAILURE() << "Not implemented.";
 198   }
 199   void CacheHashResults(const std::vector<SBPrefix>& prefixes,
 200                         const std::vector<SBFullHashResult>& cache_hits,
 201                         const base::TimeDelta& cache_lifetime) override {
 202     // Do nothing for the cache.
 203   }
 204   bool IsMalwareIPMatchKillSwitchOn() override { return false; }
 205   bool IsCsdWhitelistKillSwitchOn() override { return false; }
 206
 207   // Fill up the database with test URL.
 208   void AddUrl(const GURL& url,
 209               const SBFullHashResult& full_hash,
 210               const std::vector<SBPrefix>& prefix_hits) {
 211     Hits* hits_for_url = &badurls_[url.spec()];
 212     hits_for_url->list_ids.push_back(full_hash.list_id);
 213     hits_for_url->prefix_hits.insert(hits_for_url->prefix_hits.end(),
 214                                      prefix_hits.begin(),
 215                                      prefix_hits.end());
 216     bad_prefixes_.insert(
 217         std::make_pair(full_hash.list_id, full_hash.hash.prefix));
 218   }
 219
 220  private:
 221   // Stores |list_ids| of safe browsing lists that match some |prefix_hits|.
 222   struct Hits {
 223     std::vector<int> list_ids;
 224     std::vector<SBPrefix> prefix_hits;
 225   };
 226
 227   bool ContainsUrl(int list_id0,
 228                    int list_id1,
 229                    const std::vector<GURL>& urls,
 230                    std::vector<SBPrefix>* prefix_hits) {
 231     bool hit = false;
 232     for (const GURL& url : urls) {
 233       base::hash_map<std::string, Hits>::const_iterator
 234           badurls_it = badurls_.find(url.spec());
 235
 236       if (badurls_it == badurls_.end())
 237         continue;
 238
 239       std::vector<int> list_ids_for_url = badurls_it->second.list_ids;
 240       if (std::find(list_ids_for_url.begin(), list_ids_for_url.end(), list_id0)
 241               != list_ids_for_url.end() ||
 242           std::find(list_ids_for_url.begin(), list_ids_for_url.end(), list_id1)
 243               != list_ids_for_url.end()) {
 244         prefix_hits->insert(prefix_hits->end(),
 245                             badurls_it->second.prefix_hits.begin(),
 246                             badurls_it->second.prefix_hits.end());
 247         hit = true;
 248       }
 249     }
 250     return hit;
 251   }
 252
 253   bool ContainsUrlPrefixes(int list_id0,
 254                            int list_id1,
 255                            const std::vector<SBPrefix>& prefixes,
 256                            std::vector<SBPrefix>* prefix_hits) {
 257     bool hit = false;
 258     for (const SBPrefix& prefix : prefixes) {
 259       for (const std::pair<int, SBPrefix>& entry : bad_prefixes_) {
 260         if (entry.second == prefix &&
 261             (entry.first == list_id0 || entry.first == list_id1)) {
 262           prefix_hits->push_back(prefix);
 263           hit = true;
 264         }
 265       }
 266     }
 267     return hit;
 268   }
 269
 270   base::hash_map<std::string, Hits> badurls_;
 271   base::hash_set<std::pair<int, SBPrefix>> bad_prefixes_;
 272
 273   DISALLOW_COPY_AND_ASSIGN(TestSafeBrowsingDatabase);
 274 };
 275
 276 // Factory that creates TestSafeBrowsingDatabase instances.
 277 class TestSafeBrowsingDatabaseFactory : public SafeBrowsingDatabaseFactory {
 278  public:
 279   TestSafeBrowsingDatabaseFactory() : db_(NULL) {}
 280   ~TestSafeBrowsingDatabaseFactory() override {}
 281
 282   SafeBrowsingDatabase* CreateSafeBrowsingDatabase(
 283       const scoped_refptr<base::SequencedTaskRunner>& db_task_runner,
 284       bool enable_download_protection,
 285       bool enable_client_side_whitelist,
 286       bool enable_download_whitelist,
 287       bool enable_extension_blacklist,
 288       bool enable_ip_blacklist,
 289       bool enabled_unwanted_software_list) override {
 290     db_ = new TestSafeBrowsingDatabase();
 291     return db_;
 292   }
 293   TestSafeBrowsingDatabase* GetDb() {
 294     return db_;
 295   }
 296  private:
 297   // Owned by the SafebrowsingService.
 298   TestSafeBrowsingDatabase* db_;
 299 };
 300
 301 // A TestProtocolManager that could return fixed responses from
 302 // safebrowsing server for testing purpose.
 303 class TestProtocolManager :  public SafeBrowsingProtocolManager {
 304  public:
 305   TestProtocolManager(SafeBrowsingProtocolManagerDelegate* delegate,
 306                       net::URLRequestContextGetter* request_context_getter,
 307                       const SafeBrowsingProtocolConfig& config)
 308       : SafeBrowsingProtocolManager(delegate, request_context_getter, config) {
 309     create_count_++;
 310   }
 311
 312   ~TestProtocolManager() override { delete_count_++; }
 313
 314   // This function is called when there is a prefix hit in local safebrowsing
 315   // database and safebrowsing service issues a get hash request to backends.
 316   // We return a result from the prefilled full_hashes_ hash_map to simulate
 317   // server's response. At the same time, latency is added to simulate real
 318   // life network issues.
 319   void GetFullHash(const std::vector<SBPrefix>& prefixes,
 320                    SafeBrowsingProtocolManager::FullHashCallback callback,
 321                    bool is_download) override {
 322     BrowserThread::PostDelayedTask(
 323         BrowserThread::IO, FROM_HERE,
 324         base::Bind(InvokeFullHashCallback, callback, full_hashes_),
 325         delay_);
 326   }
 327
 328   // Prepare the GetFullHash results for the next request.
 329   void AddGetFullHashResponse(const SBFullHashResult& full_hash_result) {
 330     full_hashes_.push_back(full_hash_result);
 331   }
 332
 333   void IntroduceDelay(const base::TimeDelta& delay) {
 334     delay_ = delay;
 335   }
 336
 337   static int create_count() {
 338     return create_count_;
 339   }
 340
 341   static int delete_count() {
 342     return delete_count_;
 343   }
 344
 345  private:
 346   std::vector<SBFullHashResult> full_hashes_;
 347   base::TimeDelta delay_;
 348   static int create_count_;
 349   static int delete_count_;
 350 };
 351
 352 // static
 353 int TestProtocolManager::create_count_ = 0;
 354 // static
 355 int TestProtocolManager::delete_count_ = 0;
 356
 357 // Factory that creates TestProtocolManager instances.
 358 class TestSBProtocolManagerFactory : public SBProtocolManagerFactory {
 359  public:
 360   TestSBProtocolManagerFactory() : pm_(NULL) {}
 361   ~TestSBProtocolManagerFactory() override {}
 362
 363   SafeBrowsingProtocolManager* CreateProtocolManager(
 364       SafeBrowsingProtocolManagerDelegate* delegate,
 365       net::URLRequestContextGetter* request_context_getter,
 366       const SafeBrowsingProtocolConfig& config) override {
 367     pm_ = new TestProtocolManager(delegate, request_context_getter, config);
 368     return pm_;
 369   }
 370
 371   TestProtocolManager* GetProtocolManager() {
 372     return pm_;
 373   }
 374
 375  private:
 376   // Owned by the SafebrowsingService.
 377   TestProtocolManager* pm_;
 378 };
 379
 380 class MockObserver : public SafeBrowsingUIManager::Observer {
 381  public:
 382   MockObserver() {}
 383   virtual ~MockObserver() {}
 384   MOCK_METHOD1(OnSafeBrowsingHit,
 385                void(const SafeBrowsingUIManager::UnsafeResource&));
 386   MOCK_METHOD1(OnSafeBrowsingMatch,
 387                void(const SafeBrowsingUIManager::UnsafeResource&));
 388 };
 389
 390 MATCHER_P(IsUnsafeResourceFor, url, "") {
 391   return (arg.url.spec() == url.spec() &&
 392           arg.threat_type != SB_THREAT_TYPE_SAFE);
 393 }
 394
 395 class ServiceEnabledHelper : public base::ThreadTestHelper {
 396  public:
 397   ServiceEnabledHelper(
 398       SafeBrowsingService* service,
 399       bool enabled,
 400       scoped_refptr<base::SingleThreadTaskRunner> target_thread)
 401       : base::ThreadTestHelper(target_thread),
 402         service_(service),
 403         expected_enabled_(enabled) {}
 404
 405   void RunTest() override {
 406     set_test_result(service_->enabled() == expected_enabled_);
 407   }
 408
 409  private:
 410   ~ServiceEnabledHelper() override {}
 411
 412   scoped_refptr<SafeBrowsingService> service_;
 413   const bool expected_enabled_;
 414 };
 415
 416 }  // namespace
 417
 418 // Tests the safe browsing blocking page in a browser.
 419 class SafeBrowsingServiceTest : public InProcessBrowserTest {
 420  public:
 421   SafeBrowsingServiceTest() {
 422   }
 423
 424   static void GenUrlFullhashResult(const GURL& url,
 425                                    int list_id,
 426                                    SBFullHashResult* full_hash) {
 427     std::string host;
 428     std::string path;
 429     safe_browsing_util::CanonicalizeUrl(url, &host, &path, NULL);
 430     full_hash->hash = SBFullHashForString(host + path);
 431     full_hash->list_id = list_id;
 432   }
 433
 434   void SetUp() override {
 435     // InProcessBrowserTest::SetUp() instantiates SafebrowsingService and
 436     // RegisterFactory has to be called before SafeBrowsingService is created.
 437     sb_factory_.reset(new TestSafeBrowsingServiceFactory(
 438         "https://definatelynotarealdomain/safebrowsing"));
 439     SafeBrowsingService::RegisterFactory(sb_factory_.get());
 440     SafeBrowsingDatabase::RegisterFactory(&db_factory_);
 441     SafeBrowsingProtocolManager::RegisterFactory(&pm_factory_);
 442     InProcessBrowserTest::SetUp();
 443   }
 444
 445   void TearDown() override {
 446     InProcessBrowserTest::TearDown();
 447
 448     // Unregister test factories after InProcessBrowserTest::TearDown
 449     // (which destructs SafeBrowsingService).
 450     SafeBrowsingDatabase::RegisterFactory(NULL);
 451     SafeBrowsingProtocolManager::RegisterFactory(NULL);
 452     SafeBrowsingService::RegisterFactory(NULL);
 453   }
 454
 455   void SetUpCommandLine(base::CommandLine* command_line) override {
 456     // Makes sure the auto update is not triggered during the test.
 457     // This test will fill up the database using testing prefixes
 458     // and urls.
 459     command_line->AppendSwitch(switches::kSbDisableAutoUpdate);
 460 #if defined(OS_CHROMEOS)
 461     command_line->AppendSwitch(
 462         chromeos::switches::kIgnoreUserProfileMappingForTests);
 463 #endif
 464   }
 465
 466   void SetUpOnMainThread() override {
 467     InProcessBrowserTest::SetUpOnMainThread();
 468     g_browser_process->safe_browsing_service()->ui_manager()->AddObserver(
 469         &observer_);
 470   }
 471
 472   void TearDownOnMainThread() override {
 473     g_browser_process->safe_browsing_service()->ui_manager()->RemoveObserver(
 474         &observer_);
 475     InProcessBrowserTest::TearDownOnMainThread();
 476   }
 477
 478   void SetUpInProcessBrowserTestFixture() override {
 479     base::FilePath test_data_dir;
 480     PathService::Get(chrome::DIR_TEST_DATA, &test_data_dir);
 481     embedded_test_server()->ServeFilesFromDirectory(test_data_dir);
 482     ASSERT_TRUE(embedded_test_server()->InitializeAndWaitUntilReady());
 483   }
 484
 485   // This will setup the "url" prefix in database and prepare protocol manager
 486   // to respond with |full_hash|, as well as other |full_hash|es previously set
 487   // via this call, on GetFullHash requests.
 488   void SetupResponseForUrl(const GURL& url, const SBFullHashResult& full_hash) {
 489     std::vector<SBPrefix> prefix_hits;
 490     prefix_hits.push_back(full_hash.hash.prefix);
 491
 492     // Make sure the full hits is empty unless we need to test the
 493     // full hash is hit in database's local cache.
 494     TestSafeBrowsingDatabase* db = db_factory_.GetDb();
 495     db->AddUrl(url, full_hash, prefix_hits);
 496
 497     TestProtocolManager* pm = pm_factory_.GetProtocolManager();
 498     pm->AddGetFullHashResponse(full_hash);
 499   }
 500
 501   bool ShowingInterstitialPage() {
 502     WebContents* contents =
 503         browser()->tab_strip_model()->GetActiveWebContents();
 504     InterstitialPage* interstitial_page = contents->GetInterstitialPage();
 505     return interstitial_page != NULL;
 506   }
 507
 508   void IntroduceGetHashDelay(const base::TimeDelta& delay) {
 509     pm_factory_.GetProtocolManager()->IntroduceDelay(delay);
 510   }
 511
 512   // TODO(nparker): Remove the need for this by wiring in our own
 513   // SafeBrowsingDatabaseManager factory and keep a ptr to the subclass.
 514   // Or add a Get/SetTimeout to sbdbmgr.
 515   static LocalSafeBrowsingDatabaseManager* LocalDatabaseManagerForService(
 516       SafeBrowsingService* sb_service) {
 517     return static_cast<LocalSafeBrowsingDatabaseManager*>(
 518         sb_service->database_manager().get());
 519   }
 520
 521   static base::TimeDelta GetCheckTimeout(SafeBrowsingService* sb_service) {
 522     return LocalDatabaseManagerForService(sb_service)->check_timeout_;
 523   }
 524
 525   static void SetCheckTimeout(SafeBrowsingService* sb_service,
 526                               const base::TimeDelta& delay) {
 527     LocalDatabaseManagerForService(sb_service)->check_timeout_ = delay;
 528   }
 529
 530   void CreateCSDService() {
 531 #if defined(SAFE_BROWSING_CSD)
 532     safe_browsing::ClientSideDetectionService* csd_service =
 533         safe_browsing::ClientSideDetectionService::Create(NULL);
 534     SafeBrowsingService* sb_service =
 535         g_browser_process->safe_browsing_service();
 536
 537     // A CSD service should already exist.
 538     EXPECT_TRUE(sb_service->csd_service_);
 539
 540     sb_service->csd_service_.reset(csd_service);
 541     sb_service->RefreshState();
 542 #endif
 543   }
 544
 545   void ProceedAndWhitelist(
 546       const SafeBrowsingUIManager::UnsafeResource& resource) {
 547     std::vector<SafeBrowsingUIManager::UnsafeResource> resources;
 548     resources.push_back(resource);
 549     BrowserThread::PostTask(
 550         BrowserThread::IO, FROM_HERE,
 551         base::Bind(&SafeBrowsingUIManager::OnBlockingPageDone,
 552                    g_browser_process->safe_browsing_service()->ui_manager(),
 553                    resources, true));
 554     WaitForIOThread();
 555   }
 556
 557  protected:
 558   StrictMock<MockObserver> observer_;
 559
 560   // Temporary profile dir for test cases that create a second profile.  This is
 561   // owned by the SafeBrowsingServiceTest object so that it will not get
 562   // destructed until after the test Browser has been torn down, since the
 563   // ImportantFileWriter may still be modifying it after the Profile object has
 564   // been destroyed.
 565   base::ScopedTempDir temp_profile_dir_;
 566
 567   // Waits for pending tasks on the IO thread to complete. This is useful
 568   // to wait for the SafeBrowsingService to finish loading/stopping.
 569   void WaitForIOThread() {
 570     scoped_refptr<base::ThreadTestHelper> io_helper(new base::ThreadTestHelper(
 571         BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO).get()));
 572     ASSERT_TRUE(io_helper->Run());
 573   }
 574
 575   // Waits for pending tasks on the IO thread to complete and check if the
 576   // SafeBrowsingService enabled state matches |enabled|.
 577   void WaitForIOAndCheckEnabled(SafeBrowsingService* service, bool enabled) {
 578     scoped_refptr<ServiceEnabledHelper> enabled_helper(new ServiceEnabledHelper(
 579         service, enabled,
 580         BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO).get()));
 581     ASSERT_TRUE(enabled_helper->Run());
 582   }
 583
 584  private:
 585   scoped_ptr<TestSafeBrowsingServiceFactory> sb_factory_;
 586   TestSafeBrowsingDatabaseFactory db_factory_;
 587   TestSBProtocolManagerFactory pm_factory_;
 588
 589   DISALLOW_COPY_AND_ASSIGN(SafeBrowsingServiceTest);
 590 };
 591
 592 enum MalwareMetadataTestType {
 593   METADATA_NONE,
 594   METADATA_LANDING,
 595   METADATA_DISTRIBUTION,
 596 };
 597
 598 class SafeBrowsingServiceMetadataTest
 599     : public SafeBrowsingServiceTest,
 600       public ::testing::WithParamInterface<MalwareMetadataTestType> {
 601  public:
 602   SafeBrowsingServiceMetadataTest() {}
 603
 604   void GenUrlFullhashResultWithMetadata(const GURL& url,
 605                                         SBFullHashResult* full_hash) {
 606     GenUrlFullhashResult(url, safe_browsing_util::MALWARE, full_hash);
 607
 608     safe_browsing::MalwarePatternType proto;
 609     switch (GetParam()) {
 610       case METADATA_NONE:
 611         full_hash->metadata = std::string();
 612         break;
 613       case METADATA_LANDING:
 614         proto.set_pattern_type(safe_browsing::MalwarePatternType::LANDING);
 615         full_hash->metadata = proto.SerializeAsString();
 616         break;
 617       case METADATA_DISTRIBUTION:
 618         proto.set_pattern_type(safe_browsing::MalwarePatternType::DISTRIBUTION);
 619         full_hash->metadata = proto.SerializeAsString();
 620         break;
 621     }
 622   }
 623
 624  private:
 625   DISALLOW_COPY_AND_ASSIGN(SafeBrowsingServiceMetadataTest);
 626 };
 627
 628 namespace {
 629
 630 const char kEmptyPage[] = "/empty.html";
 631 const char kMalwareFile[] = "/downloads/dangerous/dangerous.exe";
 632 const char kMalwarePage[] = "/safe_browsing/malware.html";
 633 const char kMalwareIFrame[] = "/safe_browsing/malware_iframe.html";
 634 const char kMalwareImg[] = "/safe_browsing/malware_image.png";
 635
 636 // This test goes through DownloadResourceHandler.
 637 IN_PROC_BROWSER_TEST_P(SafeBrowsingServiceMetadataTest, MalwareMainFrame) {
 638   GURL url = embedded_test_server()->GetURL(kEmptyPage);
 639
 640   // After adding the url to safebrowsing database and getfullhash result,
 641   // we should see the interstitial page.
 642   SBFullHashResult malware_full_hash;
 643   GenUrlFullhashResultWithMetadata(url, &malware_full_hash);
 644   EXPECT_CALL(observer_,
 645               OnSafeBrowsingMatch(IsUnsafeResourceFor(url))).Times(1);
 646   EXPECT_CALL(observer_, OnSafeBrowsingHit(IsUnsafeResourceFor(url))).Times(1);
 647   SetupResponseForUrl(url, malware_full_hash);
 648   ui_test_utils::NavigateToURL(browser(), url);
 649   // All types should show the interstitial.
 650   EXPECT_TRUE(ShowingInterstitialPage());
 651 }
 652
 653 IN_PROC_BROWSER_TEST_P(SafeBrowsingServiceMetadataTest, MalwareIFrame) {
 654   GURL main_url = embedded_test_server()->GetURL(kMalwarePage);
 655   GURL iframe_url = embedded_test_server()->GetURL(kMalwareIFrame);
 656
 657   // Add the iframe url as malware and then load the parent page.
 658   SBFullHashResult malware_full_hash;
 659   GenUrlFullhashResultWithMetadata(iframe_url, &malware_full_hash);
 660   EXPECT_CALL(observer_, OnSafeBrowsingMatch(IsUnsafeResourceFor(iframe_url)))
 661       .Times(1);
 662   EXPECT_CALL(observer_, OnSafeBrowsingHit(IsUnsafeResourceFor(iframe_url)))
 663       .Times(1);
 664   SetupResponseForUrl(iframe_url, malware_full_hash);
 665   ui_test_utils::NavigateToURL(browser(), main_url);
 666   // All types should show the interstitial.
 667   EXPECT_TRUE(ShowingInterstitialPage());
 668 }
 669
 670 IN_PROC_BROWSER_TEST_P(SafeBrowsingServiceMetadataTest, MalwareImg) {
 671   GURL main_url = embedded_test_server()->GetURL(kMalwarePage);
 672   GURL img_url = embedded_test_server()->GetURL(kMalwareImg);
 673
 674   // Add the img url as malware and then load the parent page.
 675   SBFullHashResult malware_full_hash;
 676   GenUrlFullhashResultWithMetadata(img_url, &malware_full_hash);
 677   switch (GetParam()) {
 678     case METADATA_NONE:  // Falls through.
 679     case METADATA_DISTRIBUTION:
 680       EXPECT_CALL(observer_, OnSafeBrowsingMatch(IsUnsafeResourceFor(img_url)))
 681           .Times(1);
 682       EXPECT_CALL(observer_, OnSafeBrowsingHit(IsUnsafeResourceFor(img_url)))
 683           .Times(1);
 684       break;
 685     case METADATA_LANDING:
 686       // No interstitial shown, so no notifications expected.
 687       break;
 688   }
 689   SetupResponseForUrl(img_url, malware_full_hash);
 690   ui_test_utils::NavigateToURL(browser(), main_url);
 691   // Subresource which is tagged as a landing page should not show an
 692   // interstitial, the other types should.
 693   switch (GetParam()) {
 694     case METADATA_NONE:
 695     case METADATA_DISTRIBUTION:
 696       EXPECT_TRUE(ShowingInterstitialPage());
 697       break;
 698     case METADATA_LANDING:
 699       EXPECT_FALSE(ShowingInterstitialPage());
 700       break;
 701   }
 702 }
 703
 704 INSTANTIATE_TEST_CASE_P(MaybeSetMetadata,
 705                         SafeBrowsingServiceMetadataTest,
 706                         testing::Values(METADATA_NONE,
 707                                         METADATA_LANDING,
 708                                         METADATA_DISTRIBUTION));
 709
 710 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, UnwantedImgIgnored) {
 711   GURL main_url = embedded_test_server()->GetURL(kMalwarePage);
 712   GURL img_url = embedded_test_server()->GetURL(kMalwareImg);
 713
 714   // Add the img url as coming from a site serving UwS and then load the parent
 715   // page.
 716   SBFullHashResult uws_full_hash;
 717   GenUrlFullhashResult(img_url, safe_browsing_util::UNWANTEDURL,
 718                        &uws_full_hash);
 719   SetupResponseForUrl(img_url, uws_full_hash);
 720
 721   ui_test_utils::NavigateToURL(browser(), main_url);
 722
 723   EXPECT_FALSE(ShowingInterstitialPage());
 724 }
 725
 726 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, DISABLED_MalwareWithWhitelist) {
 727   GURL url = embedded_test_server()->GetURL(kEmptyPage);
 728
 729   // After adding the url to safebrowsing database and getfullhash result,
 730   // we should see the interstitial page.
 731   SBFullHashResult malware_full_hash;
 732   GenUrlFullhashResult(url, safe_browsing_util::MALWARE, &malware_full_hash);
 733   EXPECT_CALL(observer_,
 734               OnSafeBrowsingMatch(IsUnsafeResourceFor(url))).Times(1);
 735   EXPECT_CALL(observer_, OnSafeBrowsingHit(IsUnsafeResourceFor(url))).Times(1)
 736       .WillOnce(testing::Invoke(
 737           this, &SafeBrowsingServiceTest::ProceedAndWhitelist));
 738   SetupResponseForUrl(url, malware_full_hash);
 739
 740   ui_test_utils::NavigateToURL(browser(), url);
 741   // Mock calls OnBlockingPageDone set to proceed, so the interstitial
 742   // is removed.
 743   EXPECT_FALSE(ShowingInterstitialPage());
 744   Mock::VerifyAndClearExpectations(&observer_);
 745
 746   // Navigate back to kEmptyPage -- should hit the whitelist, and send a match
 747   // call, but no hit call.
 748   EXPECT_CALL(observer_,
 749               OnSafeBrowsingMatch(IsUnsafeResourceFor(url))).Times(1);
 750   EXPECT_CALL(observer_, OnSafeBrowsingHit(IsUnsafeResourceFor(url))).Times(0);
 751   ui_test_utils::NavigateToURL(browser(), url);
 752   EXPECT_FALSE(ShowingInterstitialPage());
 753 }
 754
 755 const char kPrefetchMalwarePage[] = "/safe_browsing/prefetch_malware.html";
 756
 757 // This test confirms that prefetches don't themselves get the
 758 // interstitial treatment.
 759 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, Prefetch) {
 760   GURL url = embedded_test_server()->GetURL(kPrefetchMalwarePage);
 761   GURL malware_url = embedded_test_server()->GetURL(kMalwarePage);
 762
 763   class SetPrefetchForTest {
 764    public:
 765     explicit SetPrefetchForTest(bool prefetch)
 766         : old_prerender_mode_(prerender::PrerenderManager::GetMode()) {
 767       std::string exp_group = prefetch ? "ExperimentYes" : "ExperimentNo";
 768       base::FieldTrialList::CreateFieldTrial("Prefetch", exp_group);
 769
 770       prerender::PrerenderManager::SetMode(
 771           prerender::PrerenderManager::PRERENDER_MODE_DISABLED);
 772     }
 773
 774     ~SetPrefetchForTest() {
 775       prerender::PrerenderManager::SetMode(old_prerender_mode_);
 776     }
 777
 778    private:
 779     prerender::PrerenderManager::PrerenderManagerMode old_prerender_mode_;
 780   } set_prefetch_for_test(true);
 781
 782   // Even though we have added this uri to the safebrowsing database and
 783   // getfullhash result, we should not see the interstitial page since the
 784   // only malware was a prefetch target.
 785   SBFullHashResult malware_full_hash;
 786   GenUrlFullhashResult(malware_url, safe_browsing_util::MALWARE,
 787                        &malware_full_hash);
 788   SetupResponseForUrl(malware_url, malware_full_hash);
 789   ui_test_utils::NavigateToURL(browser(), url);
 790   EXPECT_FALSE(ShowingInterstitialPage());
 791   Mock::VerifyAndClear(&observer_);
 792
 793   // However, when we navigate to the malware page, we should still get
 794   // the interstitial.
 795   EXPECT_CALL(observer_, OnSafeBrowsingMatch(IsUnsafeResourceFor(malware_url)))
 796       .Times(1);
 797   EXPECT_CALL(observer_, OnSafeBrowsingHit(IsUnsafeResourceFor(malware_url)))
 798       .Times(1);
 799   ui_test_utils::NavigateToURL(browser(), malware_url);
 800   EXPECT_TRUE(ShowingInterstitialPage());
 801   Mock::VerifyAndClear(&observer_);
 802 }
 803
 804 }  // namespace
 805
 806 class TestSBClient
 807     : public base::RefCountedThreadSafe<TestSBClient>,
 808       public SafeBrowsingDatabaseManager::Client {
 809  public:
 810   TestSBClient()
 811     : threat_type_(SB_THREAT_TYPE_SAFE),
 812       safe_browsing_service_(g_browser_process->safe_browsing_service()) {
 813   }
 814
 815   SBThreatType GetThreatType() const {
 816     return threat_type_;
 817   }
 818
 819   void CheckDownloadUrl(const std::vector<GURL>& url_chain) {
 820     BrowserThread::PostTask(
 821         BrowserThread::IO, FROM_HERE,
 822         base::Bind(&TestSBClient::CheckDownloadUrlOnIOThread,
 823                    this, url_chain));
 824     content::RunMessageLoop();  // Will stop in OnCheckDownloadUrlResult.
 825   }
 826
 827   void CheckBrowseUrl(const GURL& url) {
 828     BrowserThread::PostTask(
 829         BrowserThread::IO, FROM_HERE,
 830         base::Bind(&TestSBClient::CheckBrowseUrlOnIOThread, this, url));
 831     content::RunMessageLoop();  // Will stop in OnCheckBrowseUrlResult.
 832   }
 833
 834  private:
 835   friend class base::RefCountedThreadSafe<TestSBClient>;
 836   ~TestSBClient() override {}
 837
 838   void CheckDownloadUrlOnIOThread(const std::vector<GURL>& url_chain) {
 839     bool synchronous_safe_signal =
 840         safe_browsing_service_->database_manager()->CheckDownloadUrl(url_chain,
 841                                                                      this);
 842     if (synchronous_safe_signal) {
 843       threat_type_ = SB_THREAT_TYPE_SAFE;
 844       BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
 845                               base::Bind(&TestSBClient::CheckDone, this));
 846     }
 847   }
 848
 849   void CheckBrowseUrlOnIOThread(const GURL& url) {
 850     // The async CheckDone() hook will not be called when we have a synchronous
 851     // safe signal, handle it right away.
 852     bool synchronous_safe_signal =
 853         safe_browsing_service_->database_manager()->CheckBrowseUrl(url, this);
 854     if (synchronous_safe_signal) {
 855       threat_type_ = SB_THREAT_TYPE_SAFE;
 856       BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
 857                               base::Bind(&TestSBClient::CheckDone, this));
 858     }
 859   }
 860
 861   // Called when the result of checking a download URL is known.
 862   void OnCheckDownloadUrlResult(const std::vector<GURL>& /* url_chain */,
 863                                 SBThreatType threat_type) override {
 864     threat_type_ = threat_type;
 865     BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
 866                             base::Bind(&TestSBClient::CheckDone, this));
 867   }
 868
 869   // Called when the result of checking a browse URL is known.
 870   void OnCheckBrowseUrlResult(const GURL& /* url */,
 871                               SBThreatType threat_type,
 872                               const std::string& /* metadata */) override {
 873     threat_type_ = threat_type;
 874     BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
 875                             base::Bind(&TestSBClient::CheckDone, this));
 876   }
 877
 878   void CheckDone() {
 879     base::MessageLoopForUI::current()->Quit();
 880   }
 881
 882   SBThreatType threat_type_;
 883   SafeBrowsingService* safe_browsing_service_;
 884
 885   DISALLOW_COPY_AND_ASSIGN(TestSBClient);
 886 };
 887
 888 // These tests use SafeBrowsingService::Client to directly interact with
 889 // SafeBrowsingService.
 890 namespace {
 891
 892 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, CheckDownloadUrl) {
 893   GURL badbin_url = embedded_test_server()->GetURL(kMalwareFile);
 894   std::vector<GURL> badbin_urls(1, badbin_url);
 895
 896   scoped_refptr<TestSBClient> client(new TestSBClient);
 897   client->CheckDownloadUrl(badbin_urls);
 898
 899   // Since badbin_url is not in database, it is considered to be safe.
 900   EXPECT_EQ(SB_THREAT_TYPE_SAFE, client->GetThreatType());
 901
 902   SBFullHashResult full_hash_result;
 903   GenUrlFullhashResult(badbin_url, safe_browsing_util::BINURL,
 904                        &full_hash_result);
 905   SetupResponseForUrl(badbin_url, full_hash_result);
 906
 907   client->CheckDownloadUrl(badbin_urls);
 908
 909   // Now, the badbin_url is not safe since it is added to download database.
 910   EXPECT_EQ(SB_THREAT_TYPE_BINARY_MALWARE_URL, client->GetThreatType());
 911 }
 912
 913 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, CheckUnwantedSoftwareUrl) {
 914   const GURL bad_url = embedded_test_server()->GetURL(kMalwareFile);
 915   {
 916     scoped_refptr<TestSBClient> client(new TestSBClient);
 917
 918     // Since bad_url is not in database, it is considered to be
 919     // safe.
 920     client->CheckBrowseUrl(bad_url);
 921     EXPECT_EQ(SB_THREAT_TYPE_SAFE, client->GetThreatType());
 922
 923     SBFullHashResult full_hash_result;
 924     GenUrlFullhashResult(
 925         bad_url, safe_browsing_util::UNWANTEDURL, &full_hash_result);
 926     SetupResponseForUrl(bad_url, full_hash_result);
 927
 928     // Now, the bad_url is not safe since it is added to download
 929     // database.
 930     client->CheckBrowseUrl(bad_url);
 931     EXPECT_EQ(SB_THREAT_TYPE_URL_UNWANTED, client->GetThreatType());
 932   }
 933
 934   // The unwantedness should survive across multiple clients.
 935   {
 936     scoped_refptr<TestSBClient> client(new TestSBClient);
 937     client->CheckBrowseUrl(bad_url);
 938     EXPECT_EQ(SB_THREAT_TYPE_URL_UNWANTED, client->GetThreatType());
 939   }
 940
 941   // An unwanted URL also marked as malware should be flagged as malware.
 942   {
 943     scoped_refptr<TestSBClient> client(new TestSBClient);
 944
 945     SBFullHashResult full_hash_result;
 946     GenUrlFullhashResult(
 947         bad_url, safe_browsing_util::MALWARE, &full_hash_result);
 948     SetupResponseForUrl(bad_url, full_hash_result);
 949
 950     client->CheckBrowseUrl(bad_url);
 951     EXPECT_EQ(SB_THREAT_TYPE_URL_MALWARE, client->GetThreatType());
 952   }
 953 }
 954
 955 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, CheckBrowseUrl) {
 956   const GURL bad_url = embedded_test_server()->GetURL(kMalwareFile);
 957   {
 958     scoped_refptr<TestSBClient> client(new TestSBClient);
 959
 960     // Since bad_url is not in database, it is considered to be
 961     // safe.
 962     client->CheckBrowseUrl(bad_url);
 963     EXPECT_EQ(SB_THREAT_TYPE_SAFE, client->GetThreatType());
 964
 965     SBFullHashResult full_hash_result;
 966     GenUrlFullhashResult(
 967         bad_url, safe_browsing_util::MALWARE, &full_hash_result);
 968     SetupResponseForUrl(bad_url, full_hash_result);
 969
 970     // Now, the bad_url is not safe since it is added to download
 971     // database.
 972     client->CheckBrowseUrl(bad_url);
 973     EXPECT_EQ(SB_THREAT_TYPE_URL_MALWARE, client->GetThreatType());
 974   }
 975
 976   // The unwantedness should survive across multiple clients.
 977   {
 978     scoped_refptr<TestSBClient> client(new TestSBClient);
 979     client->CheckBrowseUrl(bad_url);
 980     EXPECT_EQ(SB_THREAT_TYPE_URL_MALWARE, client->GetThreatType());
 981   }
 982
 983   // Adding the unwanted state to an existing malware URL should have no impact
 984   // (i.e. a malware hit should still prevail).
 985   {
 986     scoped_refptr<TestSBClient> client(new TestSBClient);
 987
 988     SBFullHashResult full_hash_result;
 989     GenUrlFullhashResult(
 990         bad_url, safe_browsing_util::UNWANTEDURL, &full_hash_result);
 991     SetupResponseForUrl(bad_url, full_hash_result);
 992
 993     client->CheckBrowseUrl(bad_url);
 994     EXPECT_EQ(SB_THREAT_TYPE_URL_MALWARE, client->GetThreatType());
 995   }
 996 }
 997
 998 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, CheckDownloadUrlRedirects) {
 999   GURL original_url = embedded_test_server()->GetURL(kEmptyPage);
1000   GURL badbin_url = embedded_test_server()->GetURL(kMalwareFile);
1001   GURL final_url = embedded_test_server()->GetURL(kEmptyPage);
1002   std::vector<GURL> badbin_urls;
1003   badbin_urls.push_back(original_url);
1004   badbin_urls.push_back(badbin_url);
1005   badbin_urls.push_back(final_url);
1006
1007   scoped_refptr<TestSBClient> client(new TestSBClient);
1008   client->CheckDownloadUrl(badbin_urls);
1009
1010   // Since badbin_url is not in database, it is considered to be safe.
1011   EXPECT_EQ(SB_THREAT_TYPE_SAFE, client->GetThreatType());
1012
1013   SBFullHashResult full_hash_result;
1014   GenUrlFullhashResult(badbin_url, safe_browsing_util::BINURL,
1015                        &full_hash_result);
1016   SetupResponseForUrl(badbin_url, full_hash_result);
1017
1018   client->CheckDownloadUrl(badbin_urls);
1019
1020   // Now, the badbin_url is not safe since it is added to download database.
1021   EXPECT_EQ(SB_THREAT_TYPE_BINARY_MALWARE_URL, client->GetThreatType());
1022 }
1023
1024 #if defined(OS_WIN)
1025 // http://crbug.com/396409
1026 #define MAYBE_CheckDownloadUrlTimedOut DISABLED_CheckDownloadUrlTimedOut
1027 #else
1028 #define MAYBE_CheckDownloadUrlTimedOut CheckDownloadUrlTimedOut
1029 #endif
1030 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest,
1031                        MAYBE_CheckDownloadUrlTimedOut) {
1032   GURL badbin_url = embedded_test_server()->GetURL(kMalwareFile);
1033   std::vector<GURL> badbin_urls(1, badbin_url);
1034
1035   scoped_refptr<TestSBClient> client(new TestSBClient);
1036   SBFullHashResult full_hash_result;
1037   GenUrlFullhashResult(badbin_url, safe_browsing_util::BINURL,
1038                        &full_hash_result);
1039   SetupResponseForUrl(badbin_url, full_hash_result);
1040   client->CheckDownloadUrl(badbin_urls);
1041
1042   // badbin_url is not safe since it is added to download database.
1043   EXPECT_EQ(SB_THREAT_TYPE_BINARY_MALWARE_URL, client->GetThreatType());
1044
1045   //
1046   // Now introducing delays and we should hit timeout.
1047   //
1048   SafeBrowsingService* sb_service = g_browser_process->safe_browsing_service();
1049   base::TimeDelta default_urlcheck_timeout = GetCheckTimeout(sb_service);
1050   IntroduceGetHashDelay(base::TimeDelta::FromSeconds(1));
1051   SetCheckTimeout(sb_service, base::TimeDelta::FromMilliseconds(1));
1052   client->CheckDownloadUrl(badbin_urls);
1053
1054   // There should be a timeout and the hash would be considered as safe.
1055   EXPECT_EQ(SB_THREAT_TYPE_SAFE, client->GetThreatType());
1056
1057   // Need to set the timeout back to the default value.
1058   SetCheckTimeout(sb_service, default_urlcheck_timeout);
1059 }
1060
1061 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, StartAndStop) {
1062   CreateCSDService();
1063   SafeBrowsingService* sb_service = g_browser_process->safe_browsing_service();
1064   safe_browsing::ClientSideDetectionService* csd_service =
1065       sb_service->safe_browsing_detection_service();
1066   PrefService* pref_service = browser()->profile()->GetPrefs();
1067
1068   ASSERT_TRUE(sb_service != NULL);
1069   ASSERT_TRUE(csd_service != NULL);
1070   ASSERT_TRUE(pref_service != NULL);
1071
1072   EXPECT_TRUE(pref_service->GetBoolean(prefs::kSafeBrowsingEnabled));
1073
1074   // SBS might still be starting, make sure this doesn't flake.
1075   WaitForIOAndCheckEnabled(sb_service, true);
1076   EXPECT_TRUE(csd_service->enabled());
1077
1078   // Add a new Profile. SBS should keep running.
1079   ASSERT_TRUE(temp_profile_dir_.CreateUniqueTempDir());
1080   scoped_ptr<Profile> profile2(Profile::CreateProfile(
1081       temp_profile_dir_.path(), NULL, Profile::CREATE_MODE_SYNCHRONOUS));
1082   ASSERT_TRUE(profile2.get() != NULL);
1083   StartupTaskRunnerServiceFactory::GetForProfile(profile2.get())->
1084               StartDeferredTaskRunners();
1085   PrefService* pref_service2 = profile2->GetPrefs();
1086   EXPECT_TRUE(pref_service2->GetBoolean(prefs::kSafeBrowsingEnabled));
1087   // We don't expect the state to have changed, but if it did, wait for it.
1088   WaitForIOAndCheckEnabled(sb_service, true);
1089   EXPECT_TRUE(csd_service->enabled());
1090
1091   // Change one of the prefs. SBS should keep running.
1092   pref_service->SetBoolean(prefs::kSafeBrowsingEnabled, false);
1093   WaitForIOAndCheckEnabled(sb_service, true);
1094   EXPECT_TRUE(csd_service->enabled());
1095
1096   // Change the other pref. SBS should stop now.
1097   pref_service2->SetBoolean(prefs::kSafeBrowsingEnabled, false);
1098
1099 // TODO(mattm): Remove this when crbug.com/461493 is fixed.
1100 #if defined(OS_CHROMEOS)
1101   // On Chrome OS we should disable safe browsing for signin profile.
1102   WaitForIOAndCheckEnabled(sb_service, true);
1103   EXPECT_TRUE(csd_service->enabled());
1104   chromeos::ProfileHelper::GetSigninProfile()
1105       ->GetOriginalProfile()
1106       ->GetPrefs()
1107       ->SetBoolean(prefs::kSafeBrowsingEnabled, false);
1108   WaitForIOThread();
1109 #endif
1110   WaitForIOAndCheckEnabled(sb_service, false);
1111   EXPECT_FALSE(csd_service->enabled());
1112
1113   // Turn it back on. SBS comes back.
1114   pref_service2->SetBoolean(prefs::kSafeBrowsingEnabled, true);
1115   WaitForIOAndCheckEnabled(sb_service, true);
1116   EXPECT_TRUE(csd_service->enabled());
1117
1118   // Delete the Profile. SBS stops again.
1119   pref_service2 = NULL;
1120   profile2.reset();
1121   WaitForIOAndCheckEnabled(sb_service, false);
1122   EXPECT_FALSE(csd_service->enabled());
1123 }
1124
1125 }  // namespace
1126
1127 class SafeBrowsingServiceShutdownTest : public SafeBrowsingServiceTest {
1128  public:
1129   void TearDown() override {
1130     // Browser should be fully torn down by now, so we can safely check these
1131     // counters.
1132     EXPECT_EQ(1, TestProtocolManager::create_count());
1133     EXPECT_EQ(1, TestProtocolManager::delete_count());
1134
1135     SafeBrowsingServiceTest::TearDown();
1136   }
1137
1138   // An observer that returns back to test code after a new profile is
1139   // initialized.
1140   void OnUnblockOnProfileCreation(Profile* profile,
1141                                   Profile::CreateStatus status) {
1142     if (status == Profile::CREATE_STATUS_INITIALIZED) {
1143       profile2_ = profile;
1144       base::MessageLoop::current()->Quit();
1145     }
1146   }
1147
1148  protected:
1149   Profile* profile2_;
1150 };
1151
1152 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceShutdownTest,
1153                        DontStartAfterShutdown) {
1154   CreateCSDService();
1155   SafeBrowsingService* sb_service = g_browser_process->safe_browsing_service();
1156   safe_browsing::ClientSideDetectionService* csd_service =
1157       sb_service->safe_browsing_detection_service();
1158   PrefService* pref_service = browser()->profile()->GetPrefs();
1159
1160   ASSERT_TRUE(sb_service != NULL);
1161   ASSERT_TRUE(csd_service != NULL);
1162   ASSERT_TRUE(pref_service != NULL);
1163
1164   EXPECT_TRUE(pref_service->GetBoolean(prefs::kSafeBrowsingEnabled));
1165
1166   // SBS might still be starting, make sure this doesn't flake.
1167   WaitForIOThread();
1168   EXPECT_EQ(1, TestProtocolManager::create_count());
1169   EXPECT_EQ(0, TestProtocolManager::delete_count());
1170
1171   // Create an additional profile.  We need to use the ProfileManager so that
1172   // the profile will get destroyed in the normal browser shutdown process.
1173   ProfileManager* profile_manager = g_browser_process->profile_manager();
1174   ASSERT_TRUE(temp_profile_dir_.CreateUniqueTempDir());
1175   profile_manager->CreateProfileAsync(
1176       temp_profile_dir_.path(),
1177       base::Bind(&SafeBrowsingServiceShutdownTest::OnUnblockOnProfileCreation,
1178                  this),
1179       base::string16(), base::string16(), std::string());
1180
1181   // Spin to allow profile creation to take place, loop is terminated
1182   // by OnUnblockOnProfileCreation when the profile is created.
1183   content::RunMessageLoop();
1184
1185   PrefService* pref_service2 = profile2_->GetPrefs();
1186   EXPECT_TRUE(pref_service2->GetBoolean(prefs::kSafeBrowsingEnabled));
1187
1188   // We don't expect the state to have changed, but if it did, wait for it.
1189   WaitForIOThread();
1190   EXPECT_EQ(1, TestProtocolManager::create_count());
1191   EXPECT_EQ(0, TestProtocolManager::delete_count());
1192
1193   // End the test, shutting down the browser.
1194   // SafeBrowsingServiceShutdownTest::TearDown will check the create_count and
1195   // delete_count again.
1196 }
1197
1198 class SafeBrowsingDatabaseManagerCookieTest : public InProcessBrowserTest {
1199  public:
1200   SafeBrowsingDatabaseManagerCookieTest() {}
1201
1202   void SetUp() override {
1203     // We need to start the test server to get the host&port in the url.
1204     ASSERT_TRUE(embedded_test_server()->InitializeAndWaitUntilReady());
1205     embedded_test_server()->RegisterRequestHandler(
1206         base::Bind(&SafeBrowsingDatabaseManagerCookieTest::HandleRequest));
1207
1208     // Point to the testing server for all SafeBrowsing requests.
1209     GURL url_prefix = embedded_test_server()->GetURL("/testpath");
1210     sb_factory_.reset(new TestSafeBrowsingServiceFactory(url_prefix.spec()));
1211     SafeBrowsingService::RegisterFactory(sb_factory_.get());
1212
1213     InProcessBrowserTest::SetUp();
1214   }
1215
1216   void TearDown() override {
1217     InProcessBrowserTest::TearDown();
1218
1219     SafeBrowsingService::RegisterFactory(NULL);
1220   }
1221
1222   bool SetUpUserDataDirectory() override {
1223     base::FilePath cookie_path(
1224         SafeBrowsingService::GetCookieFilePathForTesting());
1225     EXPECT_FALSE(base::PathExists(cookie_path));
1226
1227     base::FilePath test_dir;
1228     if (!PathService::Get(chrome::DIR_TEST_DATA, &test_dir)) {
1229       EXPECT_TRUE(false);
1230       return false;
1231     }
1232
1233     // Initialize the SafeBrowsing cookies with a pre-created cookie store.  It
1234     // contains a single cookie, for domain 127.0.0.1, with value a=b, and
1235     // expires in 2038.
1236     base::FilePath initial_cookies = test_dir.AppendASCII("safe_browsing")
1237         .AppendASCII("Safe Browsing Cookies");
1238     if (!base::CopyFile(initial_cookies, cookie_path)) {
1239       EXPECT_TRUE(false);
1240       return false;
1241     }
1242
1243     sql::Connection db;
1244     if (!db.Open(cookie_path)) {
1245       EXPECT_TRUE(false);
1246       return false;
1247     }
1248     // Ensure the host value in the cookie file matches the test server we will
1249     // be connecting to.
1250     sql::Statement smt(db.GetUniqueStatement(
1251         "UPDATE cookies SET host_key = ?"));
1252     if (!smt.is_valid()) {
1253       EXPECT_TRUE(false);
1254       return false;
1255     }
1256     if (!smt.BindString(0, embedded_test_server()->base_url().host())) {
1257       EXPECT_TRUE(false);
1258       return false;
1259     }
1260     if (!smt.Run()) {
1261       EXPECT_TRUE(false);
1262       return false;
1263     }
1264
1265     return InProcessBrowserTest::SetUpUserDataDirectory();
1266   }
1267
1268   void TearDownInProcessBrowserTestFixture() override {
1269     InProcessBrowserTest::TearDownInProcessBrowserTestFixture();
1270
1271     sql::Connection db;
1272     base::FilePath cookie_path(
1273         SafeBrowsingService::GetCookieFilePathForTesting());
1274     ASSERT_TRUE(db.Open(cookie_path));
1275
1276     sql::Statement smt(db.GetUniqueStatement(
1277         "SELECT name, value FROM cookies ORDER BY name"));
1278     ASSERT_TRUE(smt.is_valid());
1279
1280     ASSERT_TRUE(smt.Step());
1281     ASSERT_EQ("a", smt.ColumnString(0));
1282     ASSERT_EQ("b", smt.ColumnString(1));
1283     ASSERT_TRUE(smt.Step());
1284     ASSERT_EQ("c", smt.ColumnString(0));
1285     ASSERT_EQ("d", smt.ColumnString(1));
1286     EXPECT_FALSE(smt.Step());
1287   }
1288
1289   void SetUpOnMainThread() override {
1290     sb_service_ = g_browser_process->safe_browsing_service();
1291     ASSERT_TRUE(sb_service_.get() != NULL);
1292   }
1293
1294   void TearDownOnMainThread() override { sb_service_ = NULL; }
1295
1296   void ForceUpdate() {
1297     sb_service_->protocol_manager()->ForceScheduleNextUpdate(
1298         base::TimeDelta::FromSeconds(0));
1299   }
1300
1301   scoped_refptr<SafeBrowsingService> sb_service_;
1302
1303  private:
1304   static scoped_ptr<net::test_server::HttpResponse> HandleRequest(
1305       const net::test_server::HttpRequest& request) {
1306     if (!StartsWithASCII(request.relative_url, "/testpath/", true)) {
1307       ADD_FAILURE() << "bad path";
1308       return nullptr;
1309     }
1310
1311     auto cookie_it = request.headers.find("Cookie");
1312     if (cookie_it == request.headers.end()) {
1313       ADD_FAILURE() << "no cookie header";
1314       return nullptr;
1315     }
1316
1317     net::cookie_util::ParsedRequestCookies req_cookies;
1318     net::cookie_util::ParseRequestCookieLine(cookie_it->second, &req_cookies);
1319     if (req_cookies.size() != 1) {
1320       ADD_FAILURE() << "req_cookies.size() = " << req_cookies.size();
1321       return nullptr;
1322     }
1323     const net::cookie_util::ParsedRequestCookie expected_cookie(
1324         std::make_pair("a", "b"));
1325     const net::cookie_util::ParsedRequestCookie& cookie = req_cookies.front();
1326     if (cookie != expected_cookie) {
1327       ADD_FAILURE() << "bad cookie " << cookie.first << "=" << cookie.second;
1328       return nullptr;
1329     }
1330
1331     scoped_ptr<net::test_server::BasicHttpResponse> http_response(
1332         new net::test_server::BasicHttpResponse());
1333     http_response->set_content("foo");
1334     http_response->set_content_type("text/plain");
1335     http_response->AddCustomHeader(
1336         "Set-Cookie", "c=d; Expires=Fri, 01 Jan 2038 01:01:01 GMT");
1337     return http_response.Pass();
1338   }
1339
1340   scoped_ptr<TestSafeBrowsingServiceFactory> sb_factory_;
1341
1342   DISALLOW_COPY_AND_ASSIGN(SafeBrowsingDatabaseManagerCookieTest);
1343 };
1344
1345 // Test that a Local Safe Browsing database update request both sends cookies
1346 // and can save cookies.
1347 IN_PROC_BROWSER_TEST_F(SafeBrowsingDatabaseManagerCookieTest,
1348                        TestSBUpdateCookies) {
1349   content::WindowedNotificationObserver observer(
1350       chrome::NOTIFICATION_SAFE_BROWSING_UPDATE_COMPLETE,
1351       content::Source<SafeBrowsingDatabaseManager>(
1352           sb_service_->database_manager().get()));
1353   BrowserThread::PostTask(
1354       BrowserThread::IO,
1355       FROM_HERE,
1356       base::Bind(&SafeBrowsingDatabaseManagerCookieTest::ForceUpdate, this));
1357   observer.Wait();
1358 }