chrome/browser/safe_browsing/safe_browsing_service_browsertest.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4 //
   5 // This test creates a safebrowsing service using test safebrowsing database
   6 // and a test protocol manager. It is used to test logics in safebrowsing
   7 // service.
   8
   9 #include <algorithm>
  10
  11 #include "base/bind.h"
  12 #include "base/command_line.h"
  13 #include "base/files/file_path.h"
  14 #include "base/files/scoped_temp_dir.h"
  15 #include "base/memory/ref_counted.h"
  16 #include "base/metrics/field_trial.h"
  17 #include "base/path_service.h"
  18 #include "base/prefs/pref_service.h"
  19 #include "base/strings/string_split.h"
  20 #include "base/test/thread_test_helper.h"
  21 #include "base/time/time.h"
  22 #include "chrome/browser/browser_process.h"
  23 #include "chrome/browser/chrome_notification_types.h"
  24 #include "chrome/browser/prerender/prerender_manager.h"
  25 #include "chrome/browser/profiles/profile.h"
  26 #include "chrome/browser/profiles/profile_manager.h"
  27 #include "chrome/browser/profiles/startup_task_runner_service.h"
  28 #include "chrome/browser/profiles/startup_task_runner_service_factory.h"
  29 #include "chrome/browser/safe_browsing/client_side_detection_service.h"
  30 #include "chrome/browser/safe_browsing/database_manager.h"
  31 #include "chrome/browser/safe_browsing/protocol_manager.h"
  32 #include "chrome/browser/safe_browsing/safe_browsing_database.h"
  33 #include "chrome/browser/safe_browsing/safe_browsing_service.h"
  34 #include "chrome/browser/safe_browsing/safe_browsing_util.h"
  35 #include "chrome/browser/safe_browsing/ui_manager.h"
  36 #include "chrome/browser/ui/browser.h"
  37 #include "chrome/browser/ui/tabs/tab_strip_model.h"
  38 #include "chrome/common/chrome_paths.h"
  39 #include "chrome/common/chrome_switches.h"
  40 #include "chrome/common/pref_names.h"
  41 #include "chrome/test/base/in_process_browser_test.h"
  42 #include "chrome/test/base/ui_test_utils.h"
  43 #include "content/public/browser/web_contents.h"
  44 #include "content/public/browser/web_contents_view.h"
  45 #include "crypto/sha2.h"
  46 #include "net/cookies/cookie_store.h"
  47 #include "sql/connection.h"
  48 #include "sql/statement.h"
  49 #include "testing/gmock/include/gmock/gmock.h"
  50
  51 using content::BrowserThread;
  52 using content::InterstitialPage;
  53 using content::WebContents;
  54 using ::testing::_;
  55 using ::testing::Mock;
  56 using ::testing::StrictMock;
  57
  58 namespace {
  59
  60 void InvokeFullHashCallback(
  61     SafeBrowsingProtocolManager::FullHashCallback callback,
  62     const std::vector<SBFullHashResult>& result) {
  63   callback.Run(result, true);
  64 }
  65
  66 }  // namespace
  67
  68 // A SafeBrowingDatabase class that allows us to inject the malicious URLs.
  69 class TestSafeBrowsingDatabase :  public SafeBrowsingDatabase {
  70  public:
  71   TestSafeBrowsingDatabase() {}
  72
  73   virtual ~TestSafeBrowsingDatabase() {}
  74
  75   // Initializes the database with the given filename.
  76   virtual void Init(const base::FilePath& filename) OVERRIDE {}
  77
  78   // Deletes the current database and creates a new one.
  79   virtual bool ResetDatabase() OVERRIDE {
  80     badurls_.clear();
  81     return true;
  82   }
  83
  84   // Called on the IO thread to check if the given URL is safe or not.  If we
  85   // can synchronously determine that the URL is safe, CheckUrl returns true,
  86   // otherwise it returns false.
  87   virtual bool ContainsBrowseUrl(const GURL& url,
  88                                  std::string* matching_list,
  89                                  std::vector<SBPrefix>* prefix_hits,
  90                                  std::vector<SBFullHashResult>* full_hits,
  91                                  base::Time last_update) OVERRIDE {
  92     std::vector<GURL> urls(1, url);
  93     return ContainsUrl(safe_browsing_util::kMalwareList,
  94                        safe_browsing_util::kPhishingList,
  95                        urls, prefix_hits, full_hits);
  96   }
  97   virtual bool ContainsDownloadUrl(
  98       const std::vector<GURL>& urls,
  99       std::vector<SBPrefix>* prefix_hits) OVERRIDE {
 100     std::vector<SBFullHashResult> full_hits;
 101     bool found = ContainsUrl(safe_browsing_util::kBinUrlList,
 102                              safe_browsing_util::kBinHashList,
 103                              urls, prefix_hits, &full_hits);
 104     if (!found)
 105       return false;
 106     DCHECK_LE(1U, prefix_hits->size());
 107     return true;
 108   }
 109   virtual bool ContainsDownloadHashPrefix(const SBPrefix& prefix) OVERRIDE {
 110     return download_digest_prefix_.count(prefix) > 0;
 111   }
 112   virtual bool ContainsCsdWhitelistedUrl(const GURL& url) OVERRIDE {
 113     return true;
 114   }
 115   virtual bool ContainsDownloadWhitelistedString(
 116       const std::string& str) OVERRIDE {
 117     return true;
 118   }
 119   virtual bool ContainsDownloadWhitelistedUrl(const GURL& url) OVERRIDE {
 120     return true;
 121   }
 122   virtual bool ContainsExtensionPrefixes(
 123       const std::vector<SBPrefix>& prefixes,
 124       std::vector<SBPrefix>* prefix_hits) OVERRIDE {
 125     return true;
 126   }
 127   virtual bool ContainsSideEffectFreeWhitelistUrl(const GURL& url) OVERRIDE {
 128     return true;
 129   }
 130   virtual bool ContainsMalwareIP(const std::string& ip_address) OVERRIDE {
 131     return true;
 132   }
 133   virtual bool UpdateStarted(std::vector<SBListChunkRanges>* lists) OVERRIDE {
 134     ADD_FAILURE() << "Not implemented.";
 135     return false;
 136   }
 137   virtual void InsertChunks(const std::string& list_name,
 138                             const SBChunkList& chunks) OVERRIDE {
 139     ADD_FAILURE() << "Not implemented.";
 140   }
 141   virtual void DeleteChunks(
 142       const std::vector<SBChunkDelete>& chunk_deletes) OVERRIDE {
 143     ADD_FAILURE() << "Not implemented.";
 144   }
 145   virtual void UpdateFinished(bool update_succeeded) OVERRIDE {
 146     ADD_FAILURE() << "Not implemented.";
 147   }
 148   virtual void CacheHashResults(const std::vector<SBPrefix>& prefixes,
 149       const std::vector<SBFullHashResult>& full_hits) OVERRIDE {
 150     // Do nothing for the cache.
 151   }
 152   virtual bool IsMalwareIPMatchKillSwitchOn() OVERRIDE {
 153     return false;
 154   }
 155
 156   // Fill up the database with test URL.
 157   void AddUrl(const GURL& url,
 158               const std::string& list_name,
 159               const std::vector<SBPrefix>& prefix_hits,
 160               const std::vector<SBFullHashResult>& full_hits) {
 161     badurls_[url.spec()].list_name = list_name;
 162     badurls_[url.spec()].prefix_hits = prefix_hits;
 163     badurls_[url.spec()].full_hits = full_hits;
 164   }
 165
 166   // Fill up the database with test hash digest.
 167   void AddDownloadPrefix(SBPrefix prefix) {
 168     download_digest_prefix_.insert(prefix);
 169   }
 170
 171  private:
 172   struct Hits {
 173     std::string list_name;
 174     std::vector<SBPrefix> prefix_hits;
 175     std::vector<SBFullHashResult> full_hits;
 176   };
 177
 178   bool ContainsUrl(const std::string& list_name0,
 179                    const std::string& list_name1,
 180                    const std::vector<GURL>& urls,
 181                    std::vector<SBPrefix>* prefix_hits,
 182                    std::vector<SBFullHashResult>* full_hits) {
 183     bool hit = false;
 184     for (size_t i = 0; i < urls.size(); ++i) {
 185       const GURL& url = urls[i];
 186       base::hash_map<std::string, Hits>::const_iterator
 187           badurls_it = badurls_.find(url.spec());
 188
 189       if (badurls_it == badurls_.end())
 190         continue;
 191
 192       if (badurls_it->second.list_name == list_name0 ||
 193           badurls_it->second.list_name == list_name1) {
 194         prefix_hits->insert(prefix_hits->end(),
 195                             badurls_it->second.prefix_hits.begin(),
 196                             badurls_it->second.prefix_hits.end());
 197         full_hits->insert(full_hits->end(),
 198                           badurls_it->second.full_hits.begin(),
 199                           badurls_it->second.full_hits.end());
 200         hit = true;
 201       }
 202
 203     }
 204     return hit;
 205   }
 206
 207   base::hash_map<std::string, Hits> badurls_;
 208   base::hash_set<SBPrefix> download_digest_prefix_;
 209 };
 210
 211 // Factory that creates TestSafeBrowsingDatabase instances.
 212 class TestSafeBrowsingDatabaseFactory : public SafeBrowsingDatabaseFactory {
 213  public:
 214   TestSafeBrowsingDatabaseFactory() : db_(NULL) {}
 215   virtual ~TestSafeBrowsingDatabaseFactory() {}
 216
 217   virtual SafeBrowsingDatabase* CreateSafeBrowsingDatabase(
 218       bool enable_download_protection,
 219       bool enable_client_side_whitelist,
 220       bool enable_download_whitelist,
 221       bool enable_extension_blacklist,
 222       bool enable_side_effect_free_whitelist,
 223       bool enable_ip_blacklist) OVERRIDE {
 224     db_ = new TestSafeBrowsingDatabase();
 225     return db_;
 226   }
 227   TestSafeBrowsingDatabase* GetDb() {
 228     return db_;
 229   }
 230  private:
 231   // Owned by the SafebrowsingService.
 232   TestSafeBrowsingDatabase* db_;
 233 };
 234
 235 // A TestProtocolManager that could return fixed responses from
 236 // safebrowsing server for testing purpose.
 237 class TestProtocolManager :  public SafeBrowsingProtocolManager {
 238  public:
 239   TestProtocolManager(SafeBrowsingProtocolManagerDelegate* delegate,
 240                       net::URLRequestContextGetter* request_context_getter,
 241                       const SafeBrowsingProtocolConfig& config)
 242       : SafeBrowsingProtocolManager(delegate, request_context_getter, config) {
 243     create_count_++;
 244   }
 245
 246   virtual ~TestProtocolManager() {
 247     delete_count_++;
 248   }
 249
 250   // This function is called when there is a prefix hit in local safebrowsing
 251   // database and safebrowsing service issues a get hash request to backends.
 252   // We return a result from the prefilled full_hashes_ hash_map to simulate
 253   // server's response. At the same time, latency is added to simulate real
 254   // life network issues.
 255   virtual void GetFullHash(
 256       const std::vector<SBPrefix>& prefixes,
 257       SafeBrowsingProtocolManager::FullHashCallback callback,
 258       bool is_download) OVERRIDE {
 259     BrowserThread::PostDelayedTask(
 260         BrowserThread::IO, FROM_HERE,
 261         base::Bind(InvokeFullHashCallback, callback, full_hashes_),
 262         delay_);
 263   }
 264
 265   // Prepare the GetFullHash results for the next request.
 266   void SetGetFullHashResponse(const SBFullHashResult& full_hash_result) {
 267     full_hashes_.clear();
 268     full_hashes_.push_back(full_hash_result);
 269   }
 270
 271   void IntroduceDelay(const base::TimeDelta& delay) {
 272     delay_ = delay;
 273   }
 274
 275   static int create_count() {
 276     return create_count_;
 277   }
 278
 279   static int delete_count() {
 280     return delete_count_;
 281   }
 282
 283  private:
 284   std::vector<SBFullHashResult> full_hashes_;
 285   base::TimeDelta delay_;
 286   static int create_count_;
 287   static int delete_count_;
 288 };
 289
 290 // static
 291 int TestProtocolManager::create_count_ = 0;
 292 // static
 293 int TestProtocolManager::delete_count_ = 0;
 294
 295 // Factory that creates TestProtocolManager instances.
 296 class TestSBProtocolManagerFactory : public SBProtocolManagerFactory {
 297  public:
 298   TestSBProtocolManagerFactory() : pm_(NULL) {}
 299   virtual ~TestSBProtocolManagerFactory() {}
 300
 301   virtual SafeBrowsingProtocolManager* CreateProtocolManager(
 302       SafeBrowsingProtocolManagerDelegate* delegate,
 303       net::URLRequestContextGetter* request_context_getter,
 304       const SafeBrowsingProtocolConfig& config) OVERRIDE {
 305     pm_ = new TestProtocolManager(delegate, request_context_getter, config);
 306     return pm_;
 307   }
 308
 309   TestProtocolManager* GetProtocolManager() {
 310     return pm_;
 311   }
 312
 313  private:
 314   // Owned by the SafebrowsingService.
 315   TestProtocolManager* pm_;
 316 };
 317
 318 class MockObserver : public SafeBrowsingUIManager::Observer {
 319  public:
 320   MockObserver() {}
 321   virtual ~MockObserver() {}
 322   MOCK_METHOD1(OnSafeBrowsingHit,
 323                void(const SafeBrowsingUIManager::UnsafeResource&));
 324   MOCK_METHOD1(OnSafeBrowsingMatch,
 325                void(const SafeBrowsingUIManager::UnsafeResource&));
 326 };
 327
 328 MATCHER_P(IsUnsafeResourceFor, url, "") {
 329   return (arg.url.spec() == url.spec() &&
 330           arg.threat_type != SB_THREAT_TYPE_SAFE);
 331 }
 332
 333 // Tests the safe browsing blocking page in a browser.
 334 class SafeBrowsingServiceTest : public InProcessBrowserTest {
 335  public:
 336   SafeBrowsingServiceTest() {
 337   }
 338
 339   static void GenUrlFullhashResult(const GURL& url,
 340                                    const std::string& list_name,
 341                                    int add_chunk_id,
 342                                    SBFullHashResult* full_hash) {
 343     std::string host;
 344     std::string path;
 345     safe_browsing_util::CanonicalizeUrl(url, &host, &path, NULL);
 346     crypto::SHA256HashString(host + path, &full_hash->hash,
 347                              sizeof(SBFullHash));
 348     full_hash->list_name = list_name;
 349     full_hash->add_chunk_id = add_chunk_id;
 350   }
 351
 352   static void GenDigestFullhashResult(const std::string& full_digest,
 353                                       const std::string& list_name,
 354                                       int add_chunk_id,
 355                                       SBFullHashResult* full_hash) {
 356     full_hash->hash = safe_browsing_util::StringToSBFullHash(full_digest);
 357     full_hash->list_name = list_name;
 358     full_hash->add_chunk_id = add_chunk_id;
 359   }
 360
 361   virtual void SetUp() {
 362     // InProcessBrowserTest::SetUp() instantiates SafebrowsingService and
 363     // RegisterFactory has to be called before SafeBrowsingService is created.
 364     SafeBrowsingDatabase::RegisterFactory(&db_factory_);
 365     SafeBrowsingProtocolManager::RegisterFactory(&pm_factory_);
 366     InProcessBrowserTest::SetUp();
 367   }
 368
 369   virtual void TearDown() {
 370     InProcessBrowserTest::TearDown();
 371
 372     // Unregister test factories after InProcessBrowserTest::TearDown
 373     // (which destructs SafeBrowsingService).
 374     SafeBrowsingDatabase::RegisterFactory(NULL);
 375     SafeBrowsingProtocolManager::RegisterFactory(NULL);
 376   }
 377
 378   virtual void SetUpCommandLine(CommandLine* command_line) {
 379     // Makes sure the auto update is not triggered during the test.
 380     // This test will fill up the database using testing prefixes
 381     // and urls.
 382     command_line->AppendSwitch(switches::kSbDisableAutoUpdate);
 383   }
 384
 385   virtual void SetUpInProcessBrowserTestFixture() {
 386     ASSERT_TRUE(test_server()->Start());
 387   }
 388
 389   // This will setup the "url" prefix in database and prepare protocol manager
 390   // to response with |full_hash| for get full hash request.
 391   void SetupResponseForUrl(const GURL& url, const SBFullHashResult& full_hash) {
 392     std::vector<SBPrefix> prefix_hits;
 393     prefix_hits.push_back(full_hash.hash.prefix);
 394
 395     // Make sure the full hits is empty unless we need to test the
 396     // full hash is hit in database's local cache.
 397     std::vector<SBFullHashResult> empty_full_hits;
 398     TestSafeBrowsingDatabase* db = db_factory_.GetDb();
 399     db->AddUrl(url, full_hash.list_name, prefix_hits, empty_full_hits);
 400
 401     TestProtocolManager* pm = pm_factory_.GetProtocolManager();
 402     pm->SetGetFullHashResponse(full_hash);
 403   }
 404
 405   // This will setup the binary digest prefix in database and prepare protocol
 406   // manager to respond with the result hash.
 407   void SetupResponseForDigest(const std::string& digest,
 408                               const SBFullHashResult& hash_result) {
 409     TestSafeBrowsingDatabase* db = db_factory_.GetDb();
 410     db->AddDownloadPrefix(
 411         safe_browsing_util::StringToSBFullHash(digest).prefix);
 412
 413     TestProtocolManager* pm = pm_factory_.GetProtocolManager();
 414     pm->SetGetFullHashResponse(hash_result);
 415   }
 416
 417   bool ShowingInterstitialPage() {
 418     WebContents* contents =
 419         browser()->tab_strip_model()->GetActiveWebContents();
 420     InterstitialPage* interstitial_page = contents->GetInterstitialPage();
 421     return interstitial_page != NULL;
 422   }
 423
 424   void IntroduceGetHashDelay(const base::TimeDelta& delay) {
 425     pm_factory_.GetProtocolManager()->IntroduceDelay(delay);
 426   }
 427
 428   base::TimeDelta GetCheckTimeout(SafeBrowsingService* sb_service) {
 429     return sb_service->database_manager()->check_timeout_;
 430   }
 431
 432   void SetCheckTimeout(SafeBrowsingService* sb_service,
 433                        const base::TimeDelta& delay) {
 434     sb_service->database_manager()->check_timeout_ = delay;
 435   }
 436
 437   void CreateCSDService() {
 438     safe_browsing::ClientSideDetectionService* csd_service =
 439         safe_browsing::ClientSideDetectionService::Create(NULL);
 440     SafeBrowsingService* sb_service =
 441         g_browser_process->safe_browsing_service();
 442     sb_service->csd_service_.reset(csd_service);
 443     sb_service->RefreshState();
 444   }
 445
 446   void ProceedAndWhitelist(
 447       const SafeBrowsingUIManager::UnsafeResource& resource) {
 448     std::vector<SafeBrowsingUIManager::UnsafeResource> resources;
 449     resources.push_back(resource);
 450     BrowserThread::PostTask(
 451         BrowserThread::IO, FROM_HERE,
 452         base::Bind(&SafeBrowsingUIManager::OnBlockingPageDone,
 453                    g_browser_process->safe_browsing_service()->ui_manager(),
 454                    resources, true));
 455     WaitForIOThread();
 456   }
 457
 458  protected:
 459   StrictMock<MockObserver> observer_;
 460
 461   // Temporary profile dir for test cases that create a second profile.  This is
 462   // owned by the SafeBrowsingServiceTest object so that it will not get
 463   // destructed until after the test Browser has been torn down, since the
 464   // ImportantFileWriter may still be modifying it after the Profile object has
 465   // been destroyed.
 466   base::ScopedTempDir temp_profile_dir_;
 467
 468   // Waits for pending tasks on the IO thread to complete. This is useful
 469   // to wait for the SafeBrowsingService to finish loading/stopping.
 470   void WaitForIOThread() {
 471     scoped_refptr<base::ThreadTestHelper> io_helper(new base::ThreadTestHelper(
 472         BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO).get()));
 473     ASSERT_TRUE(io_helper->Run());
 474   }
 475
 476  private:
 477   TestSafeBrowsingDatabaseFactory db_factory_;
 478   TestSBProtocolManagerFactory pm_factory_;
 479
 480   DISALLOW_COPY_AND_ASSIGN(SafeBrowsingServiceTest);
 481 };
 482
 483 namespace {
 484
 485 const char kEmptyPage[] = "files/empty.html";
 486 const char kMalwareFile[] = "files/downloads/dangerous/dangerous.exe";
 487 const char kMalwarePage[] = "files/safe_browsing/malware.html";
 488
 489 // This test goes through DownloadResourceHandler.
 490 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, Malware) {
 491   GURL url = test_server()->GetURL(kEmptyPage);
 492   g_browser_process->safe_browsing_service()->
 493       ui_manager()->AddObserver(&observer_);
 494
 495   // After adding the url to safebrowsing database and getfullhash result,
 496   // we should see the interstitial page.
 497   SBFullHashResult malware_full_hash;
 498   int chunk_id = 0;
 499   GenUrlFullhashResult(url, safe_browsing_util::kMalwareList, chunk_id,
 500                        &malware_full_hash);
 501   EXPECT_CALL(observer_,
 502               OnSafeBrowsingMatch(IsUnsafeResourceFor(url))).Times(1);
 503   EXPECT_CALL(observer_, OnSafeBrowsingHit(IsUnsafeResourceFor(url))).Times(1);
 504   SetupResponseForUrl(url, malware_full_hash);
 505   ui_test_utils::NavigateToURL(browser(), url);
 506   EXPECT_TRUE(ShowingInterstitialPage());
 507   g_browser_process->safe_browsing_service()->
 508       ui_manager()->RemoveObserver(&observer_);
 509 }
 510
 511 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, DISABLED_MalwareWithWhitelist) {
 512   GURL url = test_server()->GetURL(kEmptyPage);
 513   g_browser_process->safe_browsing_service()->
 514       ui_manager()->AddObserver(&observer_);
 515
 516   // After adding the url to safebrowsing database and getfullhash result,
 517   // we should see the interstitial page.
 518   SBFullHashResult malware_full_hash;
 519   int chunk_id = 0;
 520   GenUrlFullhashResult(url, safe_browsing_util::kMalwareList, chunk_id,
 521                        &malware_full_hash);
 522   EXPECT_CALL(observer_,
 523               OnSafeBrowsingMatch(IsUnsafeResourceFor(url))).Times(1);
 524   EXPECT_CALL(observer_, OnSafeBrowsingHit(IsUnsafeResourceFor(url))).Times(1)
 525       .WillOnce(testing::Invoke(
 526           this, &SafeBrowsingServiceTest::ProceedAndWhitelist));
 527   SetupResponseForUrl(url, malware_full_hash);
 528
 529   ui_test_utils::NavigateToURL(browser(), url);
 530   // Mock calls OnBlockingPageDone set to proceed, so the interstitial
 531   // is removed.
 532   EXPECT_FALSE(ShowingInterstitialPage());
 533   Mock::VerifyAndClearExpectations(&observer_);
 534
 535   // Navigate back to kEmptyPage -- should hit the whitelist, and send a match
 536   // call, but no hit call.
 537   EXPECT_CALL(observer_,
 538               OnSafeBrowsingMatch(IsUnsafeResourceFor(url))).Times(1);
 539   EXPECT_CALL(observer_, OnSafeBrowsingHit(IsUnsafeResourceFor(url))).Times(0);
 540   ui_test_utils::NavigateToURL(browser(), url);
 541   EXPECT_FALSE(ShowingInterstitialPage());
 542
 543   g_browser_process->safe_browsing_service()->
 544       ui_manager()->RemoveObserver(&observer_);
 545 }
 546
 547 const char kPrefetchMalwarePage[] = "files/safe_browsing/prefetch_malware.html";
 548
 549 // This test confirms that prefetches don't themselves get the
 550 // interstitial treatment.
 551 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, Prefetch) {
 552   GURL url = test_server()->GetURL(kPrefetchMalwarePage);
 553   GURL malware_url = test_server()->GetURL(kMalwarePage);
 554   g_browser_process->safe_browsing_service()->
 555       ui_manager()->AddObserver(&observer_);
 556
 557   class SetPrefetchForTest {
 558    public:
 559     explicit SetPrefetchForTest(bool prefetch)
 560         : old_prerender_mode_(prerender::PrerenderManager::GetMode()) {
 561       std::string exp_group = prefetch ? "ExperimentYes" : "ExperimentNo";
 562       base::FieldTrialList::CreateFieldTrial("Prefetch", exp_group);
 563
 564       prerender::PrerenderManager::SetMode(
 565           prerender::PrerenderManager::PRERENDER_MODE_DISABLED);
 566     }
 567
 568     ~SetPrefetchForTest() {
 569       prerender::PrerenderManager::SetMode(old_prerender_mode_);
 570     }
 571
 572    private:
 573     prerender::PrerenderManager::PrerenderManagerMode old_prerender_mode_;
 574   } set_prefetch_for_test(true);
 575
 576   // Even though we have added this uri to the safebrowsing database and
 577   // getfullhash result, we should not see the interstitial page since the
 578   // only malware was a prefetch target.
 579   SBFullHashResult malware_full_hash;
 580   int chunk_id = 0;
 581   GenUrlFullhashResult(malware_url, safe_browsing_util::kMalwareList,
 582                        chunk_id, &malware_full_hash);
 583   SetupResponseForUrl(malware_url, malware_full_hash);
 584   ui_test_utils::NavigateToURL(browser(), url);
 585   EXPECT_FALSE(ShowingInterstitialPage());
 586   Mock::VerifyAndClear(&observer_);
 587
 588   // However, when we navigate to the malware page, we should still get
 589   // the interstitial.
 590   EXPECT_CALL(observer_, OnSafeBrowsingMatch(IsUnsafeResourceFor(malware_url)))
 591       .Times(1);
 592   EXPECT_CALL(observer_, OnSafeBrowsingHit(IsUnsafeResourceFor(malware_url)))
 593       .Times(1);
 594   ui_test_utils::NavigateToURL(browser(), malware_url);
 595   EXPECT_TRUE(ShowingInterstitialPage());
 596   Mock::VerifyAndClear(&observer_);
 597   g_browser_process->safe_browsing_service()->
 598       ui_manager()->RemoveObserver(&observer_);
 599 }
 600
 601 }  // namespace
 602
 603 class TestSBClient
 604     : public base::RefCountedThreadSafe<TestSBClient>,
 605       public SafeBrowsingDatabaseManager::Client {
 606  public:
 607   TestSBClient()
 608     : threat_type_(SB_THREAT_TYPE_SAFE),
 609       safe_browsing_service_(g_browser_process->safe_browsing_service()) {
 610   }
 611
 612   SBThreatType GetThreatType() const {
 613     return threat_type_;
 614   }
 615
 616   void CheckDownloadUrl(const std::vector<GURL>& url_chain) {
 617     BrowserThread::PostTask(
 618         BrowserThread::IO, FROM_HERE,
 619         base::Bind(&TestSBClient::CheckDownloadUrlOnIOThread,
 620                    this, url_chain));
 621     content::RunMessageLoop();  // Will stop in OnCheckDownloadUrlResult.
 622   }
 623
 624   void CheckDownloadHash(const std::string& full_hash) {
 625     BrowserThread::PostTask(
 626         BrowserThread::IO, FROM_HERE,
 627         base::Bind(&TestSBClient::CheckDownloadHashOnIOThread,
 628                    this, full_hash));
 629     content::RunMessageLoop();  // Will stop in OnCheckDownloadHashResult.
 630   }
 631
 632  private:
 633   friend class base::RefCountedThreadSafe<TestSBClient>;
 634   virtual ~TestSBClient() {}
 635
 636   void CheckDownloadUrlOnIOThread(const std::vector<GURL>& url_chain) {
 637     safe_browsing_service_->database_manager()->
 638         CheckDownloadUrl(url_chain, this);
 639   }
 640
 641   void CheckDownloadHashOnIOThread(const std::string& full_hash) {
 642     safe_browsing_service_->database_manager()->
 643         CheckDownloadHash(full_hash, this);
 644   }
 645
 646   // Called when the result of checking a download URL is known.
 647   virtual void OnCheckDownloadUrlResult(const std::vector<GURL>& url_chain,
 648                                         SBThreatType threat_type) OVERRIDE {
 649     threat_type_ = threat_type;
 650     BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
 651                             base::Bind(&TestSBClient::DownloadCheckDone, this));
 652   }
 653
 654   // Called when the result of checking a download hash is known.
 655   virtual void OnCheckDownloadHashResult(const std::string& hash,
 656                                          SBThreatType threat_type) OVERRIDE {
 657     threat_type_ = threat_type;
 658     BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
 659                             base::Bind(&TestSBClient::DownloadCheckDone, this));
 660   }
 661
 662   void DownloadCheckDone() {
 663     base::MessageLoopForUI::current()->Quit();
 664   }
 665
 666   SBThreatType threat_type_;
 667   SafeBrowsingService* safe_browsing_service_;
 668
 669   DISALLOW_COPY_AND_ASSIGN(TestSBClient);
 670 };
 671
 672 // These tests use SafeBrowsingService::Client to directly interact with
 673 // SafeBrowsingService.
 674 namespace {
 675
 676 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, CheckDownloadUrl) {
 677   GURL badbin_url = test_server()->GetURL(kMalwareFile);
 678   std::vector<GURL> badbin_urls(1, badbin_url);
 679
 680   scoped_refptr<TestSBClient> client(new TestSBClient);
 681   client->CheckDownloadUrl(badbin_urls);
 682
 683   // Since badbin_url is not in database, it is considered to be safe.
 684   EXPECT_EQ(SB_THREAT_TYPE_SAFE, client->GetThreatType());
 685
 686   SBFullHashResult full_hash_result;
 687   int chunk_id = 0;
 688   GenUrlFullhashResult(badbin_url, safe_browsing_util::kBinUrlList,
 689                        chunk_id, &full_hash_result);
 690   SetupResponseForUrl(badbin_url, full_hash_result);
 691
 692   client->CheckDownloadUrl(badbin_urls);
 693
 694   // Now, the badbin_url is not safe since it is added to download database.
 695   EXPECT_EQ(SB_THREAT_TYPE_BINARY_MALWARE_URL, client->GetThreatType());
 696 }
 697
 698 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, CheckDownloadUrlRedirects) {
 699   GURL original_url = test_server()->GetURL(kEmptyPage);
 700   GURL badbin_url = test_server()->GetURL(kMalwareFile);
 701   GURL final_url = test_server()->GetURL(kEmptyPage);
 702   std::vector<GURL> badbin_urls;
 703   badbin_urls.push_back(original_url);
 704   badbin_urls.push_back(badbin_url);
 705   badbin_urls.push_back(final_url);
 706
 707   scoped_refptr<TestSBClient> client(new TestSBClient);
 708   client->CheckDownloadUrl(badbin_urls);
 709
 710   // Since badbin_url is not in database, it is considered to be safe.
 711   EXPECT_EQ(SB_THREAT_TYPE_SAFE, client->GetThreatType());
 712
 713   SBFullHashResult full_hash_result;
 714   int chunk_id = 0;
 715   GenUrlFullhashResult(badbin_url, safe_browsing_util::kBinUrlList,
 716                        chunk_id, &full_hash_result);
 717   SetupResponseForUrl(badbin_url, full_hash_result);
 718
 719   client->CheckDownloadUrl(badbin_urls);
 720
 721   // Now, the badbin_url is not safe since it is added to download database.
 722   EXPECT_EQ(SB_THREAT_TYPE_BINARY_MALWARE_URL, client->GetThreatType());
 723 }
 724
 725 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, CheckDownloadHash) {
 726   const std::string full_hash = "12345678902234567890323456789012";
 727
 728   scoped_refptr<TestSBClient> client(new TestSBClient);
 729   client->CheckDownloadHash(full_hash);
 730
 731   // Since badbin_url is not in database, it is considered to be safe.
 732   EXPECT_EQ(SB_THREAT_TYPE_SAFE, client->GetThreatType());
 733
 734   SBFullHashResult full_hash_result;
 735   int chunk_id = 0;
 736   GenDigestFullhashResult(full_hash, safe_browsing_util::kBinHashList,
 737                           chunk_id, &full_hash_result);
 738   SetupResponseForDigest(full_hash, full_hash_result);
 739
 740   client->CheckDownloadHash(full_hash);
 741
 742   // Now, the badbin_url is not safe since it is added to download database.
 743   EXPECT_EQ(SB_THREAT_TYPE_BINARY_MALWARE_HASH, client->GetThreatType());
 744 }
 745
 746 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, CheckDownloadUrlTimedOut) {
 747   GURL badbin_url = test_server()->GetURL(kMalwareFile);
 748   std::vector<GURL> badbin_urls(1, badbin_url);
 749
 750   scoped_refptr<TestSBClient> client(new TestSBClient);
 751   SBFullHashResult full_hash_result;
 752   int chunk_id = 0;
 753   GenUrlFullhashResult(badbin_url, safe_browsing_util::kBinUrlList,
 754                        chunk_id, &full_hash_result);
 755   SetupResponseForUrl(badbin_url, full_hash_result);
 756   client->CheckDownloadUrl(badbin_urls);
 757
 758   // badbin_url is not safe since it is added to download database.
 759   EXPECT_EQ(SB_THREAT_TYPE_BINARY_MALWARE_URL, client->GetThreatType());
 760
 761   //
 762   // Now introducing delays and we should hit timeout.
 763   //
 764   SafeBrowsingService* sb_service = g_browser_process->safe_browsing_service();
 765   base::TimeDelta default_urlcheck_timeout =
 766       GetCheckTimeout(sb_service);
 767   IntroduceGetHashDelay(base::TimeDelta::FromSeconds(1));
 768   SetCheckTimeout(sb_service, base::TimeDelta::FromMilliseconds(1));
 769   client->CheckDownloadUrl(badbin_urls);
 770
 771   // There should be a timeout and the hash would be considered as safe.
 772   EXPECT_EQ(SB_THREAT_TYPE_SAFE, client->GetThreatType());
 773
 774   // Need to set the timeout back to the default value.
 775   SetCheckTimeout(sb_service, default_urlcheck_timeout);
 776 }
 777
 778 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, CheckDownloadHashTimedOut) {
 779   const std::string full_hash = "12345678902234567890323456789012";
 780
 781   scoped_refptr<TestSBClient> client(new TestSBClient);
 782   SBFullHashResult full_hash_result;
 783   int chunk_id = 0;
 784   GenDigestFullhashResult(full_hash, safe_browsing_util::kBinHashList,
 785                           chunk_id, &full_hash_result);
 786   SetupResponseForDigest(full_hash, full_hash_result);
 787   client->CheckDownloadHash(full_hash);
 788
 789   // The badbin_url is not safe since it is added to download database.
 790   EXPECT_EQ(SB_THREAT_TYPE_BINARY_MALWARE_HASH, client->GetThreatType());
 791
 792   //
 793   // Now introducing delays and we should hit timeout.
 794   //
 795   SafeBrowsingService* sb_service = g_browser_process->safe_browsing_service();
 796   base::TimeDelta default_hashcheck_timeout =
 797       GetCheckTimeout(sb_service);
 798   IntroduceGetHashDelay(base::TimeDelta::FromSeconds(1));
 799   SetCheckTimeout(sb_service, base::TimeDelta::FromMilliseconds(1));
 800   client->CheckDownloadHash(full_hash);
 801
 802   // There should be a timeout and the hash would be considered as safe.
 803   EXPECT_EQ(SB_THREAT_TYPE_SAFE, client->GetThreatType());
 804
 805   // Need to set the timeout back to the default value.
 806   SetCheckTimeout(sb_service, default_hashcheck_timeout);
 807 }
 808
 809 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, StartAndStop) {
 810   CreateCSDService();
 811   SafeBrowsingService* sb_service = g_browser_process->safe_browsing_service();
 812   safe_browsing::ClientSideDetectionService* csd_service =
 813       sb_service->safe_browsing_detection_service();
 814   PrefService* pref_service = browser()->profile()->GetPrefs();
 815
 816   ASSERT_TRUE(sb_service != NULL);
 817   ASSERT_TRUE(csd_service != NULL);
 818   ASSERT_TRUE(pref_service != NULL);
 819
 820   EXPECT_TRUE(pref_service->GetBoolean(prefs::kSafeBrowsingEnabled));
 821
 822   // SBS might still be starting, make sure this doesn't flake.
 823   WaitForIOThread();
 824   EXPECT_TRUE(sb_service->enabled());
 825   EXPECT_TRUE(csd_service->enabled());
 826
 827   // Add a new Profile. SBS should keep running.
 828   ASSERT_TRUE(temp_profile_dir_.CreateUniqueTempDir());
 829   scoped_ptr<Profile> profile2(Profile::CreateProfile(
 830       temp_profile_dir_.path(), NULL, Profile::CREATE_MODE_SYNCHRONOUS));
 831   ASSERT_TRUE(profile2.get() != NULL);
 832   StartupTaskRunnerServiceFactory::GetForProfile(profile2.get())->
 833               StartDeferredTaskRunners();
 834   PrefService* pref_service2 = profile2->GetPrefs();
 835   EXPECT_TRUE(pref_service2->GetBoolean(prefs::kSafeBrowsingEnabled));
 836   // We don't expect the state to have changed, but if it did, wait for it.
 837   WaitForIOThread();
 838   EXPECT_TRUE(sb_service->enabled());
 839   EXPECT_TRUE(csd_service->enabled());
 840
 841   // Change one of the prefs. SBS should keep running.
 842   pref_service->SetBoolean(prefs::kSafeBrowsingEnabled, false);
 843   WaitForIOThread();
 844   EXPECT_TRUE(sb_service->enabled());
 845   EXPECT_TRUE(csd_service->enabled());
 846
 847   // Change the other pref. SBS should stop now.
 848   pref_service2->SetBoolean(prefs::kSafeBrowsingEnabled, false);
 849   WaitForIOThread();
 850   EXPECT_FALSE(sb_service->enabled());
 851   EXPECT_FALSE(csd_service->enabled());
 852
 853   // Turn it back on. SBS comes back.
 854   pref_service2->SetBoolean(prefs::kSafeBrowsingEnabled, true);
 855   WaitForIOThread();
 856   EXPECT_TRUE(sb_service->enabled());
 857   EXPECT_TRUE(csd_service->enabled());
 858
 859   // Delete the Profile. SBS stops again.
 860   pref_service2 = NULL;
 861   profile2.reset();
 862   WaitForIOThread();
 863   EXPECT_FALSE(sb_service->enabled());
 864   EXPECT_FALSE(csd_service->enabled());
 865 }
 866
 867 }  // namespace
 868
 869 class SafeBrowsingServiceShutdownTest : public SafeBrowsingServiceTest {
 870  public:
 871   virtual void TearDown() OVERRIDE {
 872     // Browser should be fully torn down by now, so we can safely check these
 873     // counters.
 874     EXPECT_EQ(1, TestProtocolManager::create_count());
 875     EXPECT_EQ(1, TestProtocolManager::delete_count());
 876
 877     SafeBrowsingServiceTest::TearDown();
 878   }
 879
 880   // An observer that returns back to test code after a new profile is
 881   // initialized.
 882   void OnUnblockOnProfileCreation(Profile* profile,
 883                                   Profile::CreateStatus status) {
 884     if (status == Profile::CREATE_STATUS_INITIALIZED) {
 885       profile2_ = profile;
 886       base::MessageLoop::current()->Quit();
 887     }
 888   }
 889
 890  protected:
 891   Profile* profile2_;
 892 };
 893
 894 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceShutdownTest,
 895                        DontStartAfterShutdown) {
 896   CreateCSDService();
 897   SafeBrowsingService* sb_service = g_browser_process->safe_browsing_service();
 898   safe_browsing::ClientSideDetectionService* csd_service =
 899       sb_service->safe_browsing_detection_service();
 900   PrefService* pref_service = browser()->profile()->GetPrefs();
 901
 902   ASSERT_TRUE(sb_service != NULL);
 903   ASSERT_TRUE(csd_service != NULL);
 904   ASSERT_TRUE(pref_service != NULL);
 905
 906   EXPECT_TRUE(pref_service->GetBoolean(prefs::kSafeBrowsingEnabled));
 907
 908   // SBS might still be starting, make sure this doesn't flake.
 909   WaitForIOThread();
 910   EXPECT_EQ(1, TestProtocolManager::create_count());
 911   EXPECT_EQ(0, TestProtocolManager::delete_count());
 912
 913   // Create an additional profile.  We need to use the ProfileManager so that
 914   // the profile will get destroyed in the normal browser shutdown process.
 915   ProfileManager* profile_manager = g_browser_process->profile_manager();
 916   ASSERT_TRUE(temp_profile_dir_.CreateUniqueTempDir());
 917   profile_manager->CreateProfileAsync(
 918       temp_profile_dir_.path(),
 919       base::Bind(&SafeBrowsingServiceShutdownTest::OnUnblockOnProfileCreation,
 920                  this),
 921       base::string16(), base::string16(), std::string());
 922
 923   // Spin to allow profile creation to take place, loop is terminated
 924   // by OnUnblockOnProfileCreation when the profile is created.
 925   content::RunMessageLoop();
 926
 927   PrefService* pref_service2 = profile2_->GetPrefs();
 928   EXPECT_TRUE(pref_service2->GetBoolean(prefs::kSafeBrowsingEnabled));
 929
 930   // We don't expect the state to have changed, but if it did, wait for it.
 931   WaitForIOThread();
 932   EXPECT_EQ(1, TestProtocolManager::create_count());
 933   EXPECT_EQ(0, TestProtocolManager::delete_count());
 934
 935   // End the test, shutting down the browser.
 936   // SafeBrowsingServiceShutdownTest::TearDown will check the create_count and
 937   // delete_count again.
 938 }
 939
 940 class SafeBrowsingDatabaseManagerCookieTest : public InProcessBrowserTest {
 941  public:
 942   SafeBrowsingDatabaseManagerCookieTest() {}
 943
 944   virtual void SetUpCommandLine(CommandLine* command_line) OVERRIDE {
 945     // We need to start the test server to get the host&port in the url.
 946     ASSERT_TRUE(test_server()->Start());
 947
 948     // Makes sure the auto update is not triggered. This test will force the
 949     // update when needed.
 950     command_line->AppendSwitch(switches::kSbDisableAutoUpdate);
 951
 952     // Point to the testing server for all SafeBrowsing requests.
 953     GURL url_prefix = test_server()->GetURL(
 954         "expect-and-set-cookie?expect=a%3db"
 955         "&set=c%3dd%3b%20Expires=Fri,%2001%20Jan%202038%2001:01:01%20GMT"
 956         "&data=foo#");
 957     command_line->AppendSwitchASCII(switches::kSbURLPrefix, url_prefix.spec());
 958   }
 959
 960   virtual bool SetUpUserDataDirectory() OVERRIDE {
 961     base::FilePath cookie_path(
 962         SafeBrowsingService::GetCookieFilePathForTesting());
 963     EXPECT_FALSE(base::PathExists(cookie_path));
 964
 965     base::FilePath test_dir;
 966     if (!PathService::Get(chrome::DIR_TEST_DATA, &test_dir)) {
 967       EXPECT_TRUE(false);
 968       return false;
 969     }
 970
 971     // Initialize the SafeBrowsing cookies with a pre-created cookie store.  It
 972     // contains a single cookie, for domain 127.0.0.1, with value a=b, and
 973     // expires in 2038.
 974     base::FilePath initial_cookies = test_dir.AppendASCII("safe_browsing")
 975         .AppendASCII("Safe Browsing Cookies");
 976     if (!base::CopyFile(initial_cookies, cookie_path)) {
 977       EXPECT_TRUE(false);
 978       return false;
 979     }
 980
 981     sql::Connection db;
 982     if (!db.Open(cookie_path)) {
 983       EXPECT_TRUE(false);
 984       return false;
 985     }
 986     // Ensure the host value in the cookie file matches the test server we will
 987     // be connecting to.
 988     sql::Statement smt(db.GetUniqueStatement(
 989         "UPDATE cookies SET host_key = ?"));
 990     if (!smt.is_valid()) {
 991       EXPECT_TRUE(false);
 992       return false;
 993     }
 994     if (!smt.BindString(0, test_server()->host_port_pair().host())) {
 995       EXPECT_TRUE(false);
 996       return false;
 997     }
 998     if (!smt.Run()) {
 999       EXPECT_TRUE(false);
1000       return false;
1001     }
1002
1003     return InProcessBrowserTest::SetUpUserDataDirectory();
1004   }
1005
1006   virtual void TearDownInProcessBrowserTestFixture() OVERRIDE {
1007     InProcessBrowserTest::TearDownInProcessBrowserTestFixture();
1008
1009     sql::Connection db;
1010     base::FilePath cookie_path(
1011         SafeBrowsingService::GetCookieFilePathForTesting());
1012     ASSERT_TRUE(db.Open(cookie_path));
1013
1014     sql::Statement smt(db.GetUniqueStatement(
1015         "SELECT name, value FROM cookies ORDER BY name"));
1016     ASSERT_TRUE(smt.is_valid());
1017
1018     ASSERT_TRUE(smt.Step());
1019     ASSERT_EQ("a", smt.ColumnString(0));
1020     ASSERT_EQ("b", smt.ColumnString(1));
1021     ASSERT_TRUE(smt.Step());
1022     ASSERT_EQ("c", smt.ColumnString(0));
1023     ASSERT_EQ("d", smt.ColumnString(1));
1024     EXPECT_FALSE(smt.Step());
1025   }
1026
1027   virtual void SetUpOnMainThread() OVERRIDE {
1028     sb_service_ = g_browser_process->safe_browsing_service();
1029     ASSERT_TRUE(sb_service_.get() != NULL);
1030   }
1031
1032   virtual void CleanUpOnMainThread() OVERRIDE {
1033     sb_service_ = NULL;
1034   }
1035
1036   void ForceUpdate() {
1037     sb_service_->protocol_manager()->ForceScheduleNextUpdate(
1038         base::TimeDelta::FromSeconds(0));
1039   }
1040
1041   scoped_refptr<SafeBrowsingService> sb_service_;
1042
1043  private:
1044   DISALLOW_COPY_AND_ASSIGN(SafeBrowsingDatabaseManagerCookieTest);
1045 };
1046
1047 // Test that a Safe Browsing database update request both sends cookies and can
1048 // save cookies.
1049 IN_PROC_BROWSER_TEST_F(SafeBrowsingDatabaseManagerCookieTest,
1050                        TestSBUpdateCookies) {
1051   content::WindowedNotificationObserver observer(
1052       chrome::NOTIFICATION_SAFE_BROWSING_UPDATE_COMPLETE,
1053       content::Source<SafeBrowsingDatabaseManager>(
1054           sb_service_->database_manager().get()));
1055   BrowserThread::PostTask(
1056       BrowserThread::IO,
1057       FROM_HERE,
1058       base::Bind(&SafeBrowsingDatabaseManagerCookieTest::ForceUpdate, this));
1059   observer.Wait();
1060 }