chrome/browser/safe_browsing/safe_browsing_blocking_page_test.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4 //
   5 // This test creates a fake safebrowsing service, where we can inject
   6 // malware and phishing urls.  It then uses a real browser to go to
   7 // these urls, and sends "goback" or "proceed" commands and verifies
   8 // they work.
   9
  10 #include "base/bind.h"
  11 #include "base/command_line.h"
  12 #include "base/prefs/pref_service.h"
  13 #include "base/strings/utf_string_conversions.h"
  14 #include "base/values.h"
  15 #include "chrome/browser/browser_process.h"
  16 #include "chrome/browser/profiles/profile.h"
  17 #include "chrome/browser/safe_browsing/database_manager.h"
  18 #include "chrome/browser/safe_browsing/malware_details.h"
  19 #include "chrome/browser/safe_browsing/safe_browsing_blocking_page.h"
  20 #include "chrome/browser/safe_browsing/safe_browsing_service.h"
  21 #include "chrome/browser/safe_browsing/safe_browsing_util.h"
  22 #include "chrome/browser/safe_browsing/ui_manager.h"
  23 #include "chrome/browser/ui/browser.h"
  24 #include "chrome/browser/ui/browser_tabstrip.h"
  25 #include "chrome/browser/ui/tabs/tab_strip_model.h"
  26 #include "chrome/common/pref_names.h"
  27 #include "chrome/common/url_constants.h"
  28 #include "chrome/test/base/in_process_browser_test.h"
  29 #include "chrome/test/base/test_switches.h"
  30 #include "chrome/test/base/ui_test_utils.h"
  31 #include "content/public/browser/interstitial_page.h"
  32 #include "content/public/browser/navigation_controller.h"
  33 #include "content/public/browser/notification_types.h"
  34 #include "content/public/browser/render_frame_host.h"
  35 #include "content/public/browser/render_view_host.h"
  36 #include "content/public/browser/web_contents.h"
  37 #include "content/public/test/test_browser_thread.h"
  38 #include "content/public/test/test_utils.h"
  39
  40 using content::BrowserThread;
  41 using content::InterstitialPage;
  42 using content::NavigationController;
  43 using content::WebContents;
  44
  45 namespace {
  46
  47 const char kEmptyPage[] = "files/empty.html";
  48 const char kMalwarePage[] = "files/safe_browsing/malware.html";
  49 const char kMalwareIframe[] = "files/safe_browsing/malware_iframe.html";
  50
  51 class InterstitialObserver : public content::WebContentsObserver {
  52  public:
  53   InterstitialObserver(content::WebContents* web_contents,
  54                        const base::Closure& attach_callback,
  55                        const base::Closure& detach_callback)
  56       : WebContentsObserver(web_contents),
  57         attach_callback_(attach_callback),
  58         detach_callback_(detach_callback) {
  59   }
  60
  61   virtual void DidAttachInterstitialPage() OVERRIDE {
  62     LOG(INFO) << __FUNCTION__;
  63     attach_callback_.Run();
  64   }
  65
  66   virtual void DidDetachInterstitialPage() OVERRIDE {
  67     LOG(INFO) << __FUNCTION__;
  68     detach_callback_.Run();
  69   }
  70
  71  private:
  72   base::Closure attach_callback_;
  73   base::Closure detach_callback_;
  74
  75   DISALLOW_COPY_AND_ASSIGN(InterstitialObserver);
  76 };
  77
  78 // A SafeBrowsingDatabaseManager class that allows us to inject the malicious
  79 // URLs.
  80 class FakeSafeBrowsingDatabaseManager :  public SafeBrowsingDatabaseManager {
  81  public:
  82   explicit FakeSafeBrowsingDatabaseManager(SafeBrowsingService* service)
  83       : SafeBrowsingDatabaseManager(service) { }
  84
  85   // Called on the IO thread to check if the given url is safe or not.  If we
  86   // can synchronously determine that the url is safe, CheckUrl returns true.
  87   // Otherwise it returns false, and "client" is called asynchronously with the
  88   // result when it is ready.
  89   // Overrides SafeBrowsingDatabaseManager::CheckBrowseUrl.
  90   virtual bool CheckBrowseUrl(const GURL& gurl, Client* client) OVERRIDE {
  91     if (badurls[gurl.spec()] == SB_THREAT_TYPE_SAFE)
  92       return true;
  93
  94     BrowserThread::PostTask(
  95         BrowserThread::IO, FROM_HERE,
  96         base::Bind(&FakeSafeBrowsingDatabaseManager::OnCheckBrowseURLDone,
  97                    this, gurl, client));
  98     return false;
  99   }
 100
 101   void OnCheckBrowseURLDone(const GURL& gurl, Client* client) {
 102     std::vector<SBThreatType> expected_threats;
 103     expected_threats.push_back(SB_THREAT_TYPE_URL_MALWARE);
 104     expected_threats.push_back(SB_THREAT_TYPE_URL_PHISHING);
 105     SafeBrowsingDatabaseManager::SafeBrowsingCheck sb_check(
 106         std::vector<GURL>(1, gurl),
 107         std::vector<SBFullHash>(),
 108         client,
 109         safe_browsing_util::MALWARE,
 110         expected_threats);
 111     sb_check.url_results[0] = badurls[gurl.spec()];
 112     client->OnSafeBrowsingResult(sb_check);
 113   }
 114
 115   void SetURLThreatType(const GURL& url, SBThreatType threat_type) {
 116     badurls[url.spec()] = threat_type;
 117   }
 118
 119  private:
 120   virtual ~FakeSafeBrowsingDatabaseManager() {}
 121
 122   base::hash_map<std::string, SBThreatType> badurls;
 123   DISALLOW_COPY_AND_ASSIGN(FakeSafeBrowsingDatabaseManager);
 124 };
 125
 126 // A SafeBrowingUIManager class that allows intercepting malware details.
 127 class FakeSafeBrowsingUIManager :  public SafeBrowsingUIManager {
 128  public:
 129   explicit FakeSafeBrowsingUIManager(SafeBrowsingService* service) :
 130       SafeBrowsingUIManager(service) { }
 131
 132   // Overrides SafeBrowsingUIManager
 133   virtual void SendSerializedMalwareDetails(
 134       const std::string& serialized) OVERRIDE {
 135     // Notify the UI thread that we got a report.
 136     BrowserThread::PostTask(
 137         BrowserThread::UI,
 138         FROM_HERE,
 139         base::Bind(&FakeSafeBrowsingUIManager::OnMalwareDetailsDone,
 140                    this,
 141                    serialized));
 142   }
 143
 144   void OnMalwareDetailsDone(const std::string& serialized) {
 145     EXPECT_TRUE(BrowserThread::CurrentlyOn(BrowserThread::UI));
 146     report_ = serialized;
 147
 148     EXPECT_FALSE(malware_details_done_callback_.is_null());
 149     if (!malware_details_done_callback_.is_null()) {
 150       malware_details_done_callback_.Run();
 151       malware_details_done_callback_ = base::Closure();
 152     }
 153   }
 154
 155   void set_malware_details_done_callback(const base::Closure& callback) {
 156     EXPECT_TRUE(BrowserThread::CurrentlyOn(BrowserThread::UI));
 157     EXPECT_TRUE(malware_details_done_callback_.is_null());
 158     malware_details_done_callback_ = callback;
 159   }
 160
 161   std::string GetReport() {
 162     EXPECT_TRUE(BrowserThread::CurrentlyOn(BrowserThread::UI));
 163     return report_;
 164   }
 165
 166  protected:
 167   virtual ~FakeSafeBrowsingUIManager() { }
 168
 169  private:
 170   std::string report_;
 171   base::Closure malware_details_done_callback_;
 172
 173   DISALLOW_COPY_AND_ASSIGN(FakeSafeBrowsingUIManager);
 174 };
 175
 176 class FakeSafeBrowsingService : public SafeBrowsingService {
 177  public:
 178   FakeSafeBrowsingService()
 179       : fake_database_manager_(),
 180         fake_ui_manager_() { }
 181
 182   // Returned pointer has the same lifespan as the database_manager_ refcounted
 183   // object.
 184   FakeSafeBrowsingDatabaseManager* fake_database_manager() {
 185     return fake_database_manager_;
 186   }
 187   // Returned pointer has the same lifespan as the ui_manager_ refcounted
 188   // object.
 189   FakeSafeBrowsingUIManager* fake_ui_manager() {
 190     return fake_ui_manager_;
 191   }
 192
 193  protected:
 194   virtual ~FakeSafeBrowsingService() { }
 195
 196   virtual SafeBrowsingDatabaseManager* CreateDatabaseManager() OVERRIDE {
 197     fake_database_manager_ = new FakeSafeBrowsingDatabaseManager(this);
 198     return fake_database_manager_;
 199   }
 200
 201   virtual SafeBrowsingUIManager* CreateUIManager() OVERRIDE {
 202     fake_ui_manager_ = new FakeSafeBrowsingUIManager(this);
 203     return fake_ui_manager_;
 204   }
 205
 206  private:
 207   FakeSafeBrowsingDatabaseManager* fake_database_manager_;
 208   FakeSafeBrowsingUIManager* fake_ui_manager_;
 209
 210   DISALLOW_COPY_AND_ASSIGN(FakeSafeBrowsingService);
 211 };
 212
 213 // Factory that creates FakeSafeBrowsingService instances.
 214 class TestSafeBrowsingServiceFactory : public SafeBrowsingServiceFactory {
 215  public:
 216   TestSafeBrowsingServiceFactory() :
 217       most_recent_service_(NULL) { }
 218   virtual ~TestSafeBrowsingServiceFactory() { }
 219
 220   virtual SafeBrowsingService* CreateSafeBrowsingService() OVERRIDE {
 221     most_recent_service_ =  new FakeSafeBrowsingService();
 222     return most_recent_service_;
 223   }
 224
 225   FakeSafeBrowsingService* most_recent_service() const {
 226     return most_recent_service_;
 227   }
 228
 229  private:
 230   FakeSafeBrowsingService* most_recent_service_;
 231 };
 232
 233 // A MalwareDetails class lets us intercept calls from the renderer.
 234 class FakeMalwareDetails : public MalwareDetails {
 235  public:
 236   FakeMalwareDetails(
 237       SafeBrowsingUIManager* delegate,
 238       WebContents* web_contents,
 239       const SafeBrowsingUIManager::UnsafeResource& unsafe_resource)
 240       : MalwareDetails(delegate, web_contents, unsafe_resource),
 241         got_dom_(false),
 242         waiting_(false) { }
 243
 244   virtual void AddDOMDetails(
 245       const std::vector<SafeBrowsingHostMsg_MalwareDOMDetails_Node>& params)
 246           OVERRIDE {
 247     EXPECT_TRUE(BrowserThread::CurrentlyOn(BrowserThread::IO));
 248     MalwareDetails::AddDOMDetails(params);
 249
 250     // Notify the UI thread that we got the dom details.
 251     BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
 252                             base::Bind(&FakeMalwareDetails::OnDOMDetailsDone,
 253                                        this));
 254   }
 255
 256   void WaitForDOM() {
 257     if (got_dom_) {
 258       LOG(INFO) << "Already got the dom details.";
 259       return;
 260     }
 261     // This condition might not trigger normally, but if you add a
 262     // sleep(1) in malware_dom_details it triggers :).
 263     waiting_ = true;
 264     LOG(INFO) << "Waiting for dom details.";
 265     content::RunMessageLoop();
 266     EXPECT_TRUE(got_dom_);
 267   }
 268
 269  private:
 270   virtual ~FakeMalwareDetails() {}
 271
 272   void OnDOMDetailsDone() {
 273     got_dom_ = true;
 274     if (waiting_) {
 275       base::MessageLoopForUI::current()->Quit();
 276     }
 277   }
 278
 279   // Some logic to figure out if we should wait for the dom details or not.
 280   // These variables should only be accessed in the UI thread.
 281   bool got_dom_;
 282   bool waiting_;
 283 };
 284
 285 class TestMalwareDetailsFactory : public MalwareDetailsFactory {
 286  public:
 287   TestMalwareDetailsFactory() : details_() { }
 288   virtual ~TestMalwareDetailsFactory() { }
 289
 290   virtual MalwareDetails* CreateMalwareDetails(
 291       SafeBrowsingUIManager* delegate,
 292       WebContents* web_contents,
 293       const SafeBrowsingUIManager::UnsafeResource& unsafe_resource) OVERRIDE {
 294     details_ = new FakeMalwareDetails(delegate, web_contents,
 295                                       unsafe_resource);
 296     return details_;
 297   }
 298
 299   FakeMalwareDetails* get_details() {
 300     return details_;
 301   }
 302
 303  private:
 304   FakeMalwareDetails* details_;
 305 };
 306
 307 // A SafeBrowingBlockingPage class that lets us wait until it's hidden.
 308 class TestSafeBrowsingBlockingPage : public SafeBrowsingBlockingPageV2 {
 309  public:
 310   TestSafeBrowsingBlockingPage(SafeBrowsingUIManager* manager,
 311                                WebContents* web_contents,
 312                                const UnsafeResourceList& unsafe_resources)
 313       : SafeBrowsingBlockingPageV2(manager, web_contents, unsafe_resources),
 314         wait_for_delete_(false) {
 315     // Don't wait the whole 3 seconds for the browser test.
 316     malware_details_proceed_delay_ms_ = 100;
 317   }
 318
 319   virtual ~TestSafeBrowsingBlockingPage() {
 320     LOG(INFO) << __FUNCTION__;
 321     if (!wait_for_delete_)
 322       return;
 323
 324     // Notify that we are gone
 325     base::MessageLoopForUI::current()->Quit();
 326     wait_for_delete_ = false;
 327   }
 328
 329   void WaitForDelete() {
 330     LOG(INFO) << __FUNCTION__;
 331     wait_for_delete_ = true;
 332     content::RunMessageLoop();
 333   }
 334
 335   // InterstitialPageDelegate methods:
 336   virtual void CommandReceived(const std::string& command) OVERRIDE {
 337     LOG(INFO) << __FUNCTION__ << " " << command;
 338     SafeBrowsingBlockingPageV2::CommandReceived(command);
 339   }
 340   virtual void OnProceed() OVERRIDE {
 341     LOG(INFO) << __FUNCTION__;
 342     SafeBrowsingBlockingPageV2::OnProceed();
 343   }
 344   virtual void OnDontProceed() OVERRIDE {
 345     LOG(INFO) << __FUNCTION__;
 346     SafeBrowsingBlockingPageV2::OnDontProceed();
 347   }
 348
 349  private:
 350   bool wait_for_delete_;
 351 };
 352
 353 class TestSafeBrowsingBlockingPageFactory
 354     : public SafeBrowsingBlockingPageFactory {
 355  public:
 356   TestSafeBrowsingBlockingPageFactory() { }
 357   virtual ~TestSafeBrowsingBlockingPageFactory() { }
 358
 359   virtual SafeBrowsingBlockingPage* CreateSafeBrowsingPage(
 360       SafeBrowsingUIManager* delegate,
 361       WebContents* web_contents,
 362       const SafeBrowsingBlockingPage::UnsafeResourceList& unsafe_resources)
 363           OVERRIDE {
 364     return new TestSafeBrowsingBlockingPage(delegate, web_contents,
 365                                             unsafe_resources);
 366   }
 367 };
 368
 369 }  // namespace
 370
 371 // Tests the safe browsing blocking page in a browser.
 372 class SafeBrowsingBlockingPageTest : public InProcessBrowserTest {
 373  public:
 374   enum Visibility {
 375     VISIBILITY_ERROR = -1,
 376     HIDDEN = 0,
 377     VISIBLE = 1,
 378   };
 379
 380   SafeBrowsingBlockingPageTest() {
 381   }
 382
 383   virtual void SetUp() OVERRIDE {
 384     SafeBrowsingService::RegisterFactory(&factory_);
 385     SafeBrowsingBlockingPage::RegisterFactory(&blocking_page_factory_);
 386     MalwareDetails::RegisterFactory(&details_factory_);
 387     InProcessBrowserTest::SetUp();
 388   }
 389
 390   virtual void TearDown() OVERRIDE {
 391     InProcessBrowserTest::TearDown();
 392     SafeBrowsingBlockingPage::RegisterFactory(NULL);
 393     SafeBrowsingService::RegisterFactory(NULL);
 394     MalwareDetails::RegisterFactory(NULL);
 395   }
 396
 397   virtual void SetUpInProcessBrowserTestFixture() OVERRIDE {
 398     ASSERT_TRUE(test_server()->Start());
 399   }
 400
 401   void SetURLThreatType(const GURL& url, SBThreatType threat_type) {
 402     FakeSafeBrowsingService* service =
 403         static_cast<FakeSafeBrowsingService*>(
 404             g_browser_process->safe_browsing_service());
 405
 406     ASSERT_TRUE(service);
 407     service->fake_database_manager()->SetURLThreatType(url, threat_type);
 408   }
 409
 410   // Adds a safebrowsing result of type |threat_type| to the fake safebrowsing
 411   // service, navigates to that page, and returns the url.
 412   GURL SetupWarningAndNavigate(SBThreatType threat_type) {
 413     GURL url = test_server()->GetURL(kEmptyPage);
 414     SetURLThreatType(url, threat_type);
 415
 416     ui_test_utils::NavigateToURL(browser(), url);
 417     EXPECT_TRUE(WaitForReady());
 418     return url;
 419   }
 420
 421   // Adds a safebrowsing malware result to the fake safebrowsing service,
 422   // navigates to a page with an iframe containing the malware site, and
 423   // returns the url of the parent page.
 424   GURL SetupMalwareIframeWarningAndNavigate() {
 425     GURL url = test_server()->GetURL(kMalwarePage);
 426     GURL iframe_url = test_server()->GetURL(kMalwareIframe);
 427     SetURLThreatType(iframe_url, SB_THREAT_TYPE_URL_MALWARE);
 428
 429     LOG(INFO) << "navigating... " << url.spec();
 430     ui_test_utils::NavigateToURL(browser(), url);
 431     EXPECT_TRUE(WaitForReady());
 432     return url;
 433   }
 434
 435   void SendCommand(const std::string& command) {
 436     WebContents* contents =
 437         browser()->tab_strip_model()->GetActiveWebContents();
 438     // We use InterstitialPage::GetInterstitialPage(tab) instead of
 439     // tab->GetInterstitialPage() because the tab doesn't have a pointer
 440     // to its interstital page until it gets a command from the renderer
 441     // that it has indeed displayed it -- and this sometimes happens after
 442     // NavigateToURL returns.
 443     SafeBrowsingBlockingPage* interstitial_page =
 444         static_cast<SafeBrowsingBlockingPage*>(
 445             InterstitialPage::GetInterstitialPage(contents)->
 446                 GetDelegateForTesting());
 447     ASSERT_TRUE(interstitial_page);
 448     interstitial_page->CommandReceived(command);
 449   }
 450
 451   void DontProceedThroughInterstitial() {
 452     WebContents* contents =
 453         browser()->tab_strip_model()->GetActiveWebContents();
 454     InterstitialPage* interstitial_page = InterstitialPage::GetInterstitialPage(
 455         contents);
 456     ASSERT_TRUE(interstitial_page);
 457     interstitial_page->DontProceed();
 458   }
 459
 460   void ProceedThroughInterstitial() {
 461     WebContents* contents =
 462         browser()->tab_strip_model()->GetActiveWebContents();
 463     InterstitialPage* interstitial_page = InterstitialPage::GetInterstitialPage(
 464         contents);
 465     ASSERT_TRUE(interstitial_page);
 466     interstitial_page->Proceed();
 467   }
 468
 469   void AssertNoInterstitial(bool wait_for_delete) {
 470     WebContents* contents =
 471         browser()->tab_strip_model()->GetActiveWebContents();
 472
 473     if (contents->ShowingInterstitialPage() && wait_for_delete) {
 474       // We'll get notified when the interstitial is deleted.
 475       TestSafeBrowsingBlockingPage* page =
 476           static_cast<TestSafeBrowsingBlockingPage*>(
 477               contents->GetInterstitialPage()->GetDelegateForTesting());
 478       page->WaitForDelete();
 479     }
 480
 481     // Can't use InterstitialPage::GetInterstitialPage() because that
 482     // gets updated after the TestSafeBrowsingBlockingPage destructor
 483     ASSERT_FALSE(contents->ShowingInterstitialPage());
 484   }
 485
 486   bool YesInterstitial() {
 487     WebContents* contents =
 488         browser()->tab_strip_model()->GetActiveWebContents();
 489     InterstitialPage* interstitial_page = InterstitialPage::GetInterstitialPage(
 490         contents);
 491     return interstitial_page != NULL;
 492   }
 493
 494   void WaitForInterstitial() {
 495     WebContents* contents =
 496         browser()->tab_strip_model()->GetActiveWebContents();
 497     scoped_refptr<content::MessageLoopRunner> loop_runner(
 498         new content::MessageLoopRunner);
 499     InterstitialObserver observer(contents,
 500                                   loop_runner->QuitClosure(),
 501                                   base::Closure());
 502     if (!InterstitialPage::GetInterstitialPage(contents))
 503       loop_runner->Run();
 504   }
 505
 506   void SetReportSentCallback(const base::Closure& callback) {
 507     LOG(INFO) << __FUNCTION__;
 508     factory_.most_recent_service()
 509         ->fake_ui_manager()
 510         ->set_malware_details_done_callback(callback);
 511   }
 512
 513   std::string GetReportSent() {
 514     LOG(INFO) << __FUNCTION__;
 515     return factory_.most_recent_service()->fake_ui_manager()->GetReport();
 516   }
 517
 518   void MalwareRedirectCancelAndProceed(const std::string& open_function) {
 519     GURL load_url = test_server()->GetURL(
 520         "files/safe_browsing/interstitial_cancel.html");
 521     GURL malware_url("http://localhost/files/safe_browsing/malware.html");
 522     SetURLThreatType(malware_url, SB_THREAT_TYPE_URL_MALWARE);
 523
 524     // Load the test page.
 525     ui_test_utils::NavigateToURL(browser(), load_url);
 526     // Trigger the safe browsing interstitial page via a redirect in
 527     // "openWin()".
 528     ui_test_utils::NavigateToURLWithDisposition(
 529         browser(),
 530         GURL("javascript:" + open_function + "()"),
 531         CURRENT_TAB,
 532         ui_test_utils::BROWSER_TEST_WAIT_FOR_TAB);
 533     WaitForInterstitial();
 534     // Cancel the redirect request while interstitial page is open.
 535     browser()->tab_strip_model()->ActivateTabAt(0, true);
 536     ui_test_utils::NavigateToURLWithDisposition(
 537         browser(),
 538         GURL("javascript:stopWin()"),
 539         CURRENT_TAB,
 540         ui_test_utils::BROWSER_TEST_WAIT_FOR_NAVIGATION);
 541     browser()->tab_strip_model()->ActivateTabAt(1, true);
 542     // Simulate the user clicking "proceed", there should be no crash.  Since
 543     // clicking proceed may do nothing (see comment in MalwareRedirectCanceled
 544     // below, and crbug.com/76460), we use SendCommand to trigger the callback
 545     // directly rather than using ClickAndWaitForDetach since there might not
 546     // be a notification to wait for.
 547     SendCommand("\"proceed\"");
 548   }
 549
 550   content::RenderViewHost* GetRenderViewHost() {
 551     InterstitialPage* interstitial = InterstitialPage::GetInterstitialPage(
 552         browser()->tab_strip_model()->GetActiveWebContents());
 553     if (!interstitial)
 554       return NULL;
 555     return interstitial->GetRenderViewHostForTesting();
 556   }
 557
 558   bool WaitForReady() {
 559     LOG(INFO) << __FUNCTION__;
 560     content::RenderViewHost* rvh = GetRenderViewHost();
 561     if (!rvh)
 562       return false;
 563     // Wait until all <script> tags have executed, including jstemplate.
 564     // TODO(joaodasilva): it would be nice to avoid the busy loop, though in
 565     // practice it spins at most once or twice.
 566     std::string ready_state;
 567     do {
 568       scoped_ptr<base::Value> value = content::ExecuteScriptAndGetValue(
 569           rvh->GetMainFrame(), "document.readyState");
 570       if (!value.get() || !value->GetAsString(&ready_state))
 571         return false;
 572     } while (ready_state != "complete");
 573     LOG(INFO) << "done waiting";
 574     return true;
 575   }
 576
 577   Visibility GetVisibility(const std::string& node_id) {
 578     content::RenderViewHost* rvh = GetRenderViewHost();
 579     if (!rvh)
 580       return VISIBILITY_ERROR;
 581     scoped_ptr<base::Value> value = content::ExecuteScriptAndGetValue(
 582         rvh->GetMainFrame(),
 583         "var node = document.getElementById('" + node_id + "');\n"
 584         "if (node)\n"
 585         "   node.offsetWidth > 0 && node.offsetHeight > 0;"
 586         "else\n"
 587         "  'node not found';\n");
 588     if (!value.get())
 589       return VISIBILITY_ERROR;
 590     bool result = false;
 591     if (!value->GetAsBoolean(&result))
 592       return VISIBILITY_ERROR;
 593     return result ? VISIBLE : HIDDEN;
 594   }
 595
 596   bool Click(const std::string& node_id) {
 597     LOG(INFO) << "Click " << node_id;
 598     content::RenderViewHost* rvh = GetRenderViewHost();
 599     if (!rvh)
 600       return false;
 601     // We don't use ExecuteScriptAndGetValue for this one, since clicking
 602     // the button/link may navigate away before the injected javascript can
 603     // reply, hanging the test.
 604     rvh->GetMainFrame()->ExecuteJavaScript(
 605         base::ASCIIToUTF16(
 606             "document.getElementById('" + node_id + "').click();\n"));
 607     return true;
 608   }
 609
 610   bool ClickAndWaitForDetach(const std::string& node_id) {
 611     // We wait for interstitial_detached rather than nav_entry_committed, as
 612     // going back from a main-frame malware interstitial page will not cause a
 613     // nav entry committed event.
 614     scoped_refptr<content::MessageLoopRunner> loop_runner(
 615         new content::MessageLoopRunner);
 616     InterstitialObserver observer(
 617         browser()->tab_strip_model()->GetActiveWebContents(),
 618         base::Closure(),
 619         loop_runner->QuitClosure());
 620     if (!Click(node_id))
 621       return false;
 622     loop_runner->Run();
 623     return true;
 624   }
 625
 626  protected:
 627   TestMalwareDetailsFactory details_factory_;
 628
 629  private:
 630   TestSafeBrowsingServiceFactory factory_;
 631   TestSafeBrowsingBlockingPageFactory blocking_page_factory_;
 632
 633   DISALLOW_COPY_AND_ASSIGN(SafeBrowsingBlockingPageTest);
 634 };
 635
 636 // TODO(linux_aura) http://crbug.com/163931
 637 // TODO(win_aura) http://crbug.com/154081
 638 #if defined(USE_AURA) && !defined(OS_CHROMEOS)
 639 #define MAYBE_MalwareRedirectInIFrameCanceled DISABLED_MalwareRedirectInIFrameCanceled
 640 #else
 641 #define MAYBE_MalwareRedirectInIFrameCanceled MalwareRedirectInIFrameCanceled
 642 #endif
 643 IN_PROC_BROWSER_TEST_F(SafeBrowsingBlockingPageTest,
 644                        MAYBE_MalwareRedirectInIFrameCanceled) {
 645   // 1. Test the case that redirect is a subresource.
 646   MalwareRedirectCancelAndProceed("openWinIFrame");
 647   // If the redirect was from subresource but canceled, "proceed" will continue
 648   // with the rest of resources.
 649   AssertNoInterstitial(true);
 650 }
 651
 652 IN_PROC_BROWSER_TEST_F(SafeBrowsingBlockingPageTest,
 653                        MalwareRedirectCanceled) {
 654   // 2. Test the case that redirect is the only resource.
 655   MalwareRedirectCancelAndProceed("openWin");
 656   // Clicking proceed won't do anything if the main request is cancelled
 657   // already.  See crbug.com/76460.
 658   EXPECT_TRUE(YesInterstitial());
 659 }
 660
 661 IN_PROC_BROWSER_TEST_F(SafeBrowsingBlockingPageTest, MalwareDontProceed) {
 662 #if defined(OS_WIN) && defined(USE_ASH)
 663   // Disable this test in Metro+Ash for now (http://crbug.com/262796).
 664   if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kAshBrowserTests))
 665     return;
 666 #endif
 667
 668   SetupWarningAndNavigate(SB_THREAT_TYPE_URL_MALWARE);
 669
 670   EXPECT_EQ(VISIBLE, GetVisibility("malware-icon"));
 671   EXPECT_EQ(HIDDEN, GetVisibility("subresource-icon"));
 672   EXPECT_EQ(HIDDEN, GetVisibility("phishing-icon"));
 673   EXPECT_EQ(VISIBLE, GetVisibility("check-report"));
 674   EXPECT_EQ(HIDDEN, GetVisibility("show-diagnostic-link"));
 675   EXPECT_EQ(HIDDEN, GetVisibility("report-error-link"));
 676   EXPECT_EQ(HIDDEN, GetVisibility("proceed"));
 677   EXPECT_TRUE(Click("see-more-link"));
 678   EXPECT_EQ(VISIBLE, GetVisibility("show-diagnostic-link"));
 679   EXPECT_EQ(HIDDEN, GetVisibility("report-error-link"));
 680   EXPECT_EQ(VISIBLE, GetVisibility("proceed"));
 681
 682   EXPECT_TRUE(ClickAndWaitForDetach("back"));
 683   AssertNoInterstitial(false);   // Assert the interstitial is gone
 684   EXPECT_EQ(
 685       GURL(content::kAboutBlankURL),  // Back to "about:blank"
 686       browser()->tab_strip_model()->GetActiveWebContents()->GetURL());
 687 }
 688
 689 IN_PROC_BROWSER_TEST_F(SafeBrowsingBlockingPageTest, MalwareProceed) {
 690   GURL url = SetupWarningAndNavigate(SB_THREAT_TYPE_URL_MALWARE);
 691
 692   EXPECT_TRUE(ClickAndWaitForDetach("proceed"));
 693   AssertNoInterstitial(true);  // Assert the interstitial is gone.
 694   EXPECT_EQ(url,
 695             browser()->tab_strip_model()->GetActiveWebContents()->GetURL());
 696 }
 697
 698 IN_PROC_BROWSER_TEST_F(SafeBrowsingBlockingPageTest,
 699                        MalwareLearnMore) {
 700   SetupWarningAndNavigate(SB_THREAT_TYPE_URL_MALWARE);
 701
 702   EXPECT_TRUE(ClickAndWaitForDetach("learn-more-link"));
 703   AssertNoInterstitial(false);  // Assert the interstitial is gone
 704
 705   // We are in the help page.
 706   EXPECT_EQ(
 707       "/transparencyreport/safebrowsing/",
 708        browser()->tab_strip_model()->GetActiveWebContents()->GetURL().path());
 709 }
 710
 711 IN_PROC_BROWSER_TEST_F(SafeBrowsingBlockingPageTest,
 712                        MalwareIframeDontProceed) {
 713 #if defined(OS_WIN) && defined(USE_ASH)
 714   // Disable this test in Metro+Ash for now (http://crbug.com/262796).
 715   if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kAshBrowserTests))
 716     return;
 717 #endif
 718
 719   SetupMalwareIframeWarningAndNavigate();
 720
 721   EXPECT_EQ(HIDDEN, GetVisibility("malware-icon"));
 722   EXPECT_EQ(VISIBLE, GetVisibility("subresource-icon"));
 723   EXPECT_EQ(HIDDEN, GetVisibility("phishing-icon"));
 724   EXPECT_EQ(VISIBLE, GetVisibility("check-report"));
 725   EXPECT_EQ(HIDDEN, GetVisibility("show-diagnostic-link"));
 726   EXPECT_EQ(HIDDEN, GetVisibility("report-error-link"));
 727   EXPECT_EQ(HIDDEN, GetVisibility("proceed"));
 728   EXPECT_TRUE(Click("see-more-link"));
 729   EXPECT_EQ(VISIBLE, GetVisibility("show-diagnostic-link"));
 730   EXPECT_EQ(HIDDEN, GetVisibility("report-error-link"));
 731   EXPECT_EQ(VISIBLE, GetVisibility("proceed"));
 732
 733   EXPECT_TRUE(ClickAndWaitForDetach("back"));
 734   AssertNoInterstitial(false);  // Assert the interstitial is gone
 735
 736   EXPECT_EQ(
 737       GURL(content::kAboutBlankURL),  // Back to "about:blank"
 738       browser()->tab_strip_model()->GetActiveWebContents()->GetURL());
 739 }
 740
 741 IN_PROC_BROWSER_TEST_F(SafeBrowsingBlockingPageTest, MalwareIframeProceed) {
 742   GURL url = SetupMalwareIframeWarningAndNavigate();
 743
 744   EXPECT_TRUE(ClickAndWaitForDetach("proceed"));
 745   AssertNoInterstitial(true);  // Assert the interstitial is gone
 746
 747   EXPECT_EQ(url,
 748             browser()->tab_strip_model()->GetActiveWebContents()->GetURL());
 749 }
 750
 751 // http://crbug.com/273302
 752 #if defined(OS_WIN)
 753 // Temporarily re-enabled to get some logs.
 754 #define MAYBE_MalwareIframeReportDetails MalwareIframeReportDetails
 755 #else
 756 #define MAYBE_MalwareIframeReportDetails MalwareIframeReportDetails
 757 #endif
 758 IN_PROC_BROWSER_TEST_F(SafeBrowsingBlockingPageTest,
 759                        MAYBE_MalwareIframeReportDetails) {
 760   scoped_refptr<content::MessageLoopRunner> malware_report_sent_runner(
 761       new content::MessageLoopRunner);
 762   SetReportSentCallback(malware_report_sent_runner->QuitClosure());
 763
 764   GURL url = SetupMalwareIframeWarningAndNavigate();
 765
 766   LOG(INFO) << "1";
 767
 768   // If the DOM details from renderer did not already return, wait for them.
 769   details_factory_.get_details()->WaitForDOM();
 770   LOG(INFO) << "2";
 771
 772   EXPECT_TRUE(Click("check-report"));
 773   LOG(INFO) << "3";
 774
 775   EXPECT_TRUE(ClickAndWaitForDetach("proceed"));
 776   LOG(INFO) << "4";
 777   AssertNoInterstitial(true);  // Assert the interstitial is gone
 778   LOG(INFO) << "5";
 779
 780   ASSERT_TRUE(browser()->profile()->GetPrefs()->GetBoolean(
 781       prefs::kSafeBrowsingReportingEnabled));
 782   LOG(INFO) << "6";
 783
 784   EXPECT_EQ(url,
 785             browser()->tab_strip_model()->GetActiveWebContents()->GetURL());
 786   LOG(INFO) << "7";
 787
 788   malware_report_sent_runner->Run();
 789   std::string serialized = GetReportSent();
 790   safe_browsing::ClientMalwareReportRequest report;
 791   ASSERT_TRUE(report.ParseFromString(serialized));
 792   // Verify the report is complete.
 793   EXPECT_TRUE(report.complete());
 794   LOG(INFO) << "8";
 795 }
 796
 797 // Verifies that the "proceed anyway" link isn't available when it is disabled
 798 // by the corresponding policy. Also verifies that sending the "proceed"
 799 // command anyway doesn't advance to the malware site.
 800 IN_PROC_BROWSER_TEST_F(SafeBrowsingBlockingPageTest, ProceedDisabled) {
 801 #if defined(OS_WIN) && defined(USE_ASH)
 802   // Disable this test in Metro+Ash for now (http://crbug.com/262796).
 803   if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kAshBrowserTests))
 804     return;
 805 #endif
 806
 807   // Simulate a policy disabling the "proceed anyway" link.
 808   browser()->profile()->GetPrefs()->SetBoolean(
 809       prefs::kSafeBrowsingProceedAnywayDisabled, true);
 810
 811   SetupWarningAndNavigate(SB_THREAT_TYPE_URL_MALWARE);
 812
 813   EXPECT_EQ(VISIBLE, GetVisibility("check-report"));
 814   EXPECT_EQ(HIDDEN, GetVisibility("show-diagnostic-link"));
 815   EXPECT_EQ(HIDDEN, GetVisibility("proceed"));
 816   EXPECT_EQ(HIDDEN, GetVisibility("proceed-span"));
 817   EXPECT_TRUE(Click("see-more-link"));
 818   EXPECT_EQ(VISIBLE, GetVisibility("show-diagnostic-link"));
 819   EXPECT_EQ(HIDDEN, GetVisibility("proceed"));
 820   EXPECT_EQ(HIDDEN, GetVisibility("proceed-span"));
 821
 822   // The "proceed" command should go back instead, if proceeding is disabled.
 823   EXPECT_TRUE(ClickAndWaitForDetach("proceed"));
 824   AssertNoInterstitial(true);
 825   EXPECT_EQ(
 826       GURL(content::kAboutBlankURL),  // Back to "about:blank"
 827       browser()->tab_strip_model()->GetActiveWebContents()->GetURL());
 828 }
 829
 830 // Verifies that the reporting checkbox is hidden on non-HTTP pages.
 831 // TODO(mattm): Should also verify that no report is sent, but there isn't a
 832 // good way to do that in the current design.
 833 IN_PROC_BROWSER_TEST_F(SafeBrowsingBlockingPageTest, ReportingDisabled) {
 834 #if defined(OS_WIN) && defined(USE_ASH)
 835   // Disable this test in Metro+Ash for now (http://crbug.com/262796).
 836   if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kAshBrowserTests))
 837     return;
 838 #endif
 839
 840   browser()->profile()->GetPrefs()->SetBoolean(
 841       prefs::kSafeBrowsingReportingEnabled, true);
 842
 843   net::SpawnedTestServer https_server(
 844       net::SpawnedTestServer::TYPE_HTTPS, net::SpawnedTestServer::kLocalhost,
 845       base::FilePath(FILE_PATH_LITERAL("chrome/test/data")));
 846   ASSERT_TRUE(https_server.Start());
 847   GURL url = https_server.GetURL(kEmptyPage);
 848   SetURLThreatType(url, SB_THREAT_TYPE_URL_MALWARE);
 849   ui_test_utils::NavigateToURL(browser(), url);
 850   ASSERT_TRUE(WaitForReady());
 851
 852   EXPECT_EQ(HIDDEN, GetVisibility("check-report"));
 853   EXPECT_EQ(HIDDEN, GetVisibility("show-diagnostic-link"));
 854   EXPECT_EQ(HIDDEN, GetVisibility("proceed"));
 855   EXPECT_TRUE(Click("see-more-link"));
 856   EXPECT_EQ(VISIBLE, GetVisibility("show-diagnostic-link"));
 857   EXPECT_EQ(VISIBLE, GetVisibility("proceed"));
 858
 859   EXPECT_TRUE(ClickAndWaitForDetach("back"));
 860   AssertNoInterstitial(false);   // Assert the interstitial is gone
 861   EXPECT_EQ(
 862       GURL(content::kAboutBlankURL),  // Back to "about:blank"
 863       browser()->tab_strip_model()->GetActiveWebContents()->GetURL());
 864 }
 865
 866 IN_PROC_BROWSER_TEST_F(SafeBrowsingBlockingPageTest, PhishingDontProceed) {
 867 #if defined(OS_WIN) && defined(USE_ASH)
 868   // Disable this test in Metro+Ash for now (http://crbug.com/262796).
 869   if (CommandLine::ForCurrentProcess()->HasSwitch(switches::kAshBrowserTests))
 870     return;
 871 #endif
 872
 873   SetupWarningAndNavigate(SB_THREAT_TYPE_URL_PHISHING);
 874
 875   EXPECT_EQ(HIDDEN, GetVisibility("malware-icon"));
 876   EXPECT_EQ(HIDDEN, GetVisibility("subresource-icon"));
 877   EXPECT_EQ(VISIBLE, GetVisibility("phishing-icon"));
 878   EXPECT_EQ(HIDDEN, GetVisibility("check-report"));
 879   EXPECT_EQ(HIDDEN, GetVisibility("show-diagnostic-link"));
 880   EXPECT_EQ(HIDDEN, GetVisibility("report-error-link"));
 881   EXPECT_EQ(HIDDEN, GetVisibility("proceed"));
 882   EXPECT_TRUE(Click("see-more-link"));
 883   EXPECT_EQ(HIDDEN, GetVisibility("show-diagnostic-link"));
 884   EXPECT_EQ(VISIBLE, GetVisibility("report-error-link"));
 885   EXPECT_EQ(VISIBLE, GetVisibility("proceed"));
 886
 887   EXPECT_TRUE(ClickAndWaitForDetach("back"));
 888   AssertNoInterstitial(false);  // Assert the interstitial is gone
 889   EXPECT_EQ(
 890       GURL(content::kAboutBlankURL),  // We are back to "about:blank".
 891       browser()->tab_strip_model()->GetActiveWebContents()->GetURL());
 892 }
 893
 894 // http://crbug.com/247763
 895 #if defined(OS_WIN)
 896 // Temporarily re-enabled to get some logs.
 897 #define MAYBE_PhishingProceed PhishingProceed
 898 #else
 899 #define MAYBE_PhishingProceed PhishingProceed
 900 #endif
 901
 902 IN_PROC_BROWSER_TEST_F(SafeBrowsingBlockingPageTest, MAYBE_PhishingProceed) {
 903   GURL url = SetupWarningAndNavigate(SB_THREAT_TYPE_URL_PHISHING);
 904   LOG(INFO) << "1";
 905
 906   EXPECT_TRUE(ClickAndWaitForDetach("proceed"));
 907   LOG(INFO) << "2";
 908   AssertNoInterstitial(true);  // Assert the interstitial is gone
 909   LOG(INFO) << "3";
 910   EXPECT_EQ(url,
 911             browser()->tab_strip_model()->GetActiveWebContents()->GetURL());
 912   LOG(INFO) << "4";
 913 }
 914
 915 IN_PROC_BROWSER_TEST_F(SafeBrowsingBlockingPageTest, PhishingReportError) {
 916   SetupWarningAndNavigate(SB_THREAT_TYPE_URL_PHISHING);
 917
 918   EXPECT_TRUE(ClickAndWaitForDetach("report-error-link"));
 919   AssertNoInterstitial(false);  // Assert the interstitial is gone
 920
 921   // We are in the error reporting page.
 922   EXPECT_EQ(
 923       "/safebrowsing/report_error/",
 924       browser()->tab_strip_model()->GetActiveWebContents()->GetURL().path());
 925 }
 926
 927 // See crbug.com/248447
 928 #if defined(OS_WIN)
 929 // Temporarily re-enabled to get some logs.
 930 #define MAYBE_PhishingLearnMore PhishingLearnMore
 931 #else
 932 #define MAYBE_PhishingLearnMore PhishingLearnMore
 933 #endif
 934
 935 IN_PROC_BROWSER_TEST_F(SafeBrowsingBlockingPageTest, MAYBE_PhishingLearnMore) {
 936   SetupWarningAndNavigate(SB_THREAT_TYPE_URL_PHISHING);
 937   LOG(INFO) << "1";
 938
 939   EXPECT_TRUE(ClickAndWaitForDetach("learn-more-link"));
 940   LOG(INFO) << "2";
 941   AssertNoInterstitial(false);  // Assert the interstitial is gone
 942
 943   LOG(INFO) << "3";
 944   // We are in the help page.
 945   EXPECT_EQ(
 946       "/transparencyreport/safebrowsing/",
 947        browser()->tab_strip_model()->GetActiveWebContents()->GetURL().path());
 948   LOG(INFO) << "4";
 949 }