chrome/browser/safe_browsing/safe_browsing_service_browsertest.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4 //
   5 // This test creates a safebrowsing service using test safebrowsing database
   6 // and a test protocol manager. It is used to test logics in safebrowsing
   7 // service.
   8
   9 #include <algorithm>
  10
  11 #include "base/bind.h"
  12 #include "base/command_line.h"
  13 #include "base/files/file_path.h"
  14 #include "base/files/scoped_temp_dir.h"
  15 #include "base/memory/ref_counted.h"
  16 #include "base/metrics/field_trial.h"
  17 #include "base/path_service.h"
  18 #include "base/prefs/pref_service.h"
  19 #include "base/strings/string_split.h"
  20 #include "base/strings/string_util.h"
  21 #include "base/test/thread_test_helper.h"
  22 #include "base/time/time.h"
  23 #include "chrome/browser/bookmarks/startup_task_runner_service_factory.h"
  24 #include "chrome/browser/browser_process.h"
  25 #include "chrome/browser/chrome_notification_types.h"
  26 #include "chrome/browser/prerender/prerender_manager.h"
  27 #include "chrome/browser/profiles/profile.h"
  28 #include "chrome/browser/profiles/profile_manager.h"
  29 #include "chrome/browser/safe_browsing/client_side_detection_service.h"
  30 #include "chrome/browser/safe_browsing/database_manager.h"
  31 #include "chrome/browser/safe_browsing/local_database_manager.h"
  32 #include "chrome/browser/safe_browsing/metadata.pb.h"
  33 #include "chrome/browser/safe_browsing/protocol_manager.h"
  34 #include "chrome/browser/safe_browsing/safe_browsing_database.h"
  35 #include "chrome/browser/safe_browsing/safe_browsing_service.h"
  36 #include "chrome/browser/safe_browsing/safe_browsing_util.h"
  37 #include "chrome/browser/safe_browsing/ui_manager.h"
  38 #include "chrome/browser/ui/browser.h"
  39 #include "chrome/browser/ui/tabs/tab_strip_model.h"
  40 #include "chrome/common/chrome_paths.h"
  41 #include "chrome/common/chrome_switches.h"
  42 #include "chrome/common/pref_names.h"
  43 #include "chrome/test/base/in_process_browser_test.h"
  44 #include "chrome/test/base/ui_test_utils.h"
  45 #include "components/bookmarks/browser/startup_task_runner_service.h"
  46 #include "content/public/browser/web_contents.h"
  47 #include "net/cookies/cookie_store.h"
  48 #include "net/cookies/cookie_util.h"
  49 #include "net/test/embedded_test_server/embedded_test_server.h"
  50 #include "net/test/embedded_test_server/http_request.h"
  51 #include "net/test/embedded_test_server/http_response.h"
  52 #include "sql/connection.h"
  53 #include "sql/statement.h"
  54 #include "testing/gmock/include/gmock/gmock.h"
  55 #include "url/gurl.h"
  56
  57 #if defined(OS_CHROMEOS)
  58 #include "chrome/browser/chromeos/profiles/profile_helper.h"
  59 #include "chromeos/chromeos_switches.h"
  60 #endif
  61
  62 #if !defined(SAFE_BROWSING_DB_LOCAL)
  63 #error This test requires SAFE_BROWSING_DB_LOCAL.
  64 #endif
  65
  66 using content::BrowserThread;
  67 using content::InterstitialPage;
  68 using content::WebContents;
  69 using ::testing::_;
  70 using ::testing::Mock;
  71 using ::testing::StrictMock;
  72
  73 namespace {
  74
  75 void InvokeFullHashCallback(
  76     SafeBrowsingProtocolManager::FullHashCallback callback,
  77     const std::vector<SBFullHashResult>& result) {
  78   callback.Run(result, base::TimeDelta::FromMinutes(45));
  79 }
  80
  81 class FakeSafeBrowsingService : public SafeBrowsingService {
  82  public:
  83   explicit FakeSafeBrowsingService(const std::string& url_prefix)
  84       : url_prefix_(url_prefix) {}
  85
  86   SafeBrowsingProtocolConfig GetProtocolConfig() const override {
  87     SafeBrowsingProtocolConfig config;
  88     config.url_prefix = url_prefix_;
  89     // Makes sure the auto update is not triggered. The tests will force the
  90     // update when needed.
  91     config.disable_auto_update = true;
  92 #if defined(OS_ANDROID)
  93     config.disable_connection_check = true;
  94 #endif
  95     config.client_name = "browser_tests";
  96     return config;
  97   }
  98
  99  private:
 100   ~FakeSafeBrowsingService() override {}
 101
 102   std::string url_prefix_;
 103
 104   DISALLOW_COPY_AND_ASSIGN(FakeSafeBrowsingService);
 105 };
 106
 107 // Factory that creates FakeSafeBrowsingService instances.
 108 class TestSafeBrowsingServiceFactory : public SafeBrowsingServiceFactory {
 109  public:
 110   explicit TestSafeBrowsingServiceFactory(const std::string& url_prefix)
 111       : url_prefix_(url_prefix) {}
 112
 113   SafeBrowsingService* CreateSafeBrowsingService() override {
 114     return new FakeSafeBrowsingService(url_prefix_);
 115   }
 116
 117  private:
 118   std::string url_prefix_;
 119 };
 120
 121 // A SafeBrowingDatabase class that allows us to inject the malicious URLs.
 122 class TestSafeBrowsingDatabase :  public SafeBrowsingDatabase {
 123  public:
 124   TestSafeBrowsingDatabase() {}
 125
 126   ~TestSafeBrowsingDatabase() override {}
 127
 128   // Initializes the database with the given filename.
 129   void Init(const base::FilePath& filename) override {}
 130
 131   // Deletes the current database and creates a new one.
 132   bool ResetDatabase() override {
 133     badurls_.clear();
 134     return true;
 135   }
 136
 137   // Called on the IO thread to check if the given URL is safe or not.  If we
 138   // can synchronously determine that the URL is safe, CheckUrl returns true,
 139   // otherwise it returns false.
 140   bool ContainsBrowseUrl(const GURL& url,
 141                          std::vector<SBPrefix>* prefix_hits,
 142                          std::vector<SBFullHashResult>* cache_hits) override {
 143     cache_hits->clear();
 144     return ContainsUrl(safe_browsing_util::MALWARE,
 145                        safe_browsing_util::PHISH,
 146                        std::vector<GURL>(1, url),
 147                        prefix_hits);
 148   }
 149   bool ContainsUnwantedSoftwareUrl(
 150       const GURL& url,
 151       std::vector<SBPrefix>* prefix_hits,
 152       std::vector<SBFullHashResult>* cache_hits) override {
 153     cache_hits->clear();
 154     return ContainsUrl(safe_browsing_util::UNWANTEDURL,
 155                        safe_browsing_util::UNWANTEDURL,
 156                        std::vector<GURL>(1, url),
 157                        prefix_hits);
 158   }
 159   bool ContainsDownloadUrlPrefixes(
 160       const std::vector<SBPrefix>& prefixes,
 161       std::vector<SBPrefix>* prefix_hits) override {
 162     bool found =
 163         ContainsUrlPrefixes(safe_browsing_util::BINURL,
 164                             safe_browsing_util::BINURL, prefixes, prefix_hits);
 165     if (!found)
 166       return false;
 167     DCHECK_LE(1U, prefix_hits->size());
 168     return true;
 169   }
 170   bool ContainsCsdWhitelistedUrl(const GURL& url) override { return true; }
 171   bool ContainsDownloadWhitelistedString(const std::string& str) override {
 172     return true;
 173   }
 174   bool ContainsDownloadWhitelistedUrl(const GURL& url) override { return true; }
 175   bool ContainsInclusionWhitelistedUrl(const GURL& url) override {
 176     return true;
 177   }
 178   bool ContainsExtensionPrefixes(const std::vector<SBPrefix>& prefixes,
 179                                  std::vector<SBPrefix>* prefix_hits) override {
 180     return false;
 181   }
 182   bool ContainsMalwareIP(const std::string& ip_address) override {
 183     return true;
 184   }
 185   bool UpdateStarted(std::vector<SBListChunkRanges>* lists) override {
 186     ADD_FAILURE() << "Not implemented.";
 187     return false;
 188   }
 189   void InsertChunks(const std::string& list_name,
 190                     const std::vector<SBChunkData*>& chunks) override {
 191     ADD_FAILURE() << "Not implemented.";
 192   }
 193   void DeleteChunks(const std::vector<SBChunkDelete>& chunk_deletes) override {
 194     ADD_FAILURE() << "Not implemented.";
 195   }
 196   void UpdateFinished(bool update_succeeded) override {
 197     ADD_FAILURE() << "Not implemented.";
 198   }
 199   void CacheHashResults(const std::vector<SBPrefix>& prefixes,
 200                         const std::vector<SBFullHashResult>& cache_hits,
 201                         const base::TimeDelta& cache_lifetime) override {
 202     // Do nothing for the cache.
 203   }
 204   bool IsMalwareIPMatchKillSwitchOn() override { return false; }
 205   bool IsCsdWhitelistKillSwitchOn() override { return false; }
 206
 207   // Fill up the database with test URL.
 208   void AddUrl(const GURL& url,
 209               const SBFullHashResult& full_hash,
 210               const std::vector<SBPrefix>& prefix_hits) {
 211     Hits* hits_for_url = &badurls_[url.spec()];
 212     hits_for_url->list_ids.push_back(full_hash.list_id);
 213     hits_for_url->prefix_hits.insert(hits_for_url->prefix_hits.end(),
 214                                      prefix_hits.begin(),
 215                                      prefix_hits.end());
 216     bad_prefixes_.insert(
 217         std::make_pair(full_hash.list_id, full_hash.hash.prefix));
 218   }
 219
 220  private:
 221   // Stores |list_ids| of safe browsing lists that match some |prefix_hits|.
 222   struct Hits {
 223     std::vector<int> list_ids;
 224     std::vector<SBPrefix> prefix_hits;
 225   };
 226
 227   bool ContainsUrl(int list_id0,
 228                    int list_id1,
 229                    const std::vector<GURL>& urls,
 230                    std::vector<SBPrefix>* prefix_hits) {
 231     bool hit = false;
 232     for (const GURL& url : urls) {
 233       base::hash_map<std::string, Hits>::const_iterator
 234           badurls_it = badurls_.find(url.spec());
 235
 236       if (badurls_it == badurls_.end())
 237         continue;
 238
 239       std::vector<int> list_ids_for_url = badurls_it->second.list_ids;
 240       if (std::find(list_ids_for_url.begin(), list_ids_for_url.end(), list_id0)
 241               != list_ids_for_url.end() ||
 242           std::find(list_ids_for_url.begin(), list_ids_for_url.end(), list_id1)
 243               != list_ids_for_url.end()) {
 244         prefix_hits->insert(prefix_hits->end(),
 245                             badurls_it->second.prefix_hits.begin(),
 246                             badurls_it->second.prefix_hits.end());
 247         hit = true;
 248       }
 249     }
 250     return hit;
 251   }
 252
 253   bool ContainsUrlPrefixes(int list_id0,
 254                            int list_id1,
 255                            const std::vector<SBPrefix>& prefixes,
 256                            std::vector<SBPrefix>* prefix_hits) {
 257     bool hit = false;
 258     for (const SBPrefix& prefix : prefixes) {
 259       for (const std::pair<int, SBPrefix>& entry : bad_prefixes_) {
 260         if (entry.second == prefix &&
 261             (entry.first == list_id0 || entry.first == list_id1)) {
 262           prefix_hits->push_back(prefix);
 263           hit = true;
 264         }
 265       }
 266     }
 267     return hit;
 268   }
 269
 270   base::hash_map<std::string, Hits> badurls_;
 271   base::hash_set<std::pair<int, SBPrefix>> bad_prefixes_;
 272
 273   DISALLOW_COPY_AND_ASSIGN(TestSafeBrowsingDatabase);
 274 };
 275
 276 // Factory that creates TestSafeBrowsingDatabase instances.
 277 class TestSafeBrowsingDatabaseFactory : public SafeBrowsingDatabaseFactory {
 278  public:
 279   TestSafeBrowsingDatabaseFactory() : db_(NULL) {}
 280   ~TestSafeBrowsingDatabaseFactory() override {}
 281
 282   SafeBrowsingDatabase* CreateSafeBrowsingDatabase(
 283       const scoped_refptr<base::SequencedTaskRunner>& db_task_runner,
 284       bool enable_download_protection,
 285       bool enable_client_side_whitelist,
 286       bool enable_download_whitelist,
 287       bool enable_extension_blacklist,
 288       bool enable_ip_blacklist,
 289       bool enabled_unwanted_software_list) override {
 290     db_ = new TestSafeBrowsingDatabase();
 291     return db_;
 292   }
 293   TestSafeBrowsingDatabase* GetDb() {
 294     return db_;
 295   }
 296  private:
 297   // Owned by the SafebrowsingService.
 298   TestSafeBrowsingDatabase* db_;
 299 };
 300
 301 // A TestProtocolManager that could return fixed responses from
 302 // safebrowsing server for testing purpose.
 303 class TestProtocolManager :  public SafeBrowsingProtocolManager {
 304  public:
 305   TestProtocolManager(SafeBrowsingProtocolManagerDelegate* delegate,
 306                       net::URLRequestContextGetter* request_context_getter,
 307                       const SafeBrowsingProtocolConfig& config)
 308       : SafeBrowsingProtocolManager(delegate, request_context_getter, config) {
 309     create_count_++;
 310   }
 311
 312   ~TestProtocolManager() override { delete_count_++; }
 313
 314   // This function is called when there is a prefix hit in local safebrowsing
 315   // database and safebrowsing service issues a get hash request to backends.
 316   // We return a result from the prefilled full_hashes_ hash_map to simulate
 317   // server's response. At the same time, latency is added to simulate real
 318   // life network issues.
 319   void GetFullHash(const std::vector<SBPrefix>& prefixes,
 320                    SafeBrowsingProtocolManager::FullHashCallback callback,
 321                    bool is_download,
 322                    bool is_extended_reporting) override {
 323     BrowserThread::PostDelayedTask(
 324         BrowserThread::IO, FROM_HERE,
 325         base::Bind(InvokeFullHashCallback, callback, full_hashes_),
 326         delay_);
 327   }
 328
 329   // Prepare the GetFullHash results for the next request.
 330   void AddGetFullHashResponse(const SBFullHashResult& full_hash_result) {
 331     full_hashes_.push_back(full_hash_result);
 332   }
 333
 334   void IntroduceDelay(const base::TimeDelta& delay) {
 335     delay_ = delay;
 336   }
 337
 338   static int create_count() {
 339     return create_count_;
 340   }
 341
 342   static int delete_count() {
 343     return delete_count_;
 344   }
 345
 346  private:
 347   std::vector<SBFullHashResult> full_hashes_;
 348   base::TimeDelta delay_;
 349   static int create_count_;
 350   static int delete_count_;
 351 };
 352
 353 // static
 354 int TestProtocolManager::create_count_ = 0;
 355 // static
 356 int TestProtocolManager::delete_count_ = 0;
 357
 358 // Factory that creates TestProtocolManager instances.
 359 class TestSBProtocolManagerFactory : public SBProtocolManagerFactory {
 360  public:
 361   TestSBProtocolManagerFactory() : pm_(NULL) {}
 362   ~TestSBProtocolManagerFactory() override {}
 363
 364   SafeBrowsingProtocolManager* CreateProtocolManager(
 365       SafeBrowsingProtocolManagerDelegate* delegate,
 366       net::URLRequestContextGetter* request_context_getter,
 367       const SafeBrowsingProtocolConfig& config) override {
 368     pm_ = new TestProtocolManager(delegate, request_context_getter, config);
 369     return pm_;
 370   }
 371
 372   TestProtocolManager* GetProtocolManager() {
 373     return pm_;
 374   }
 375
 376  private:
 377   // Owned by the SafebrowsingService.
 378   TestProtocolManager* pm_;
 379 };
 380
 381 class MockObserver : public SafeBrowsingUIManager::Observer {
 382  public:
 383   MockObserver() {}
 384   virtual ~MockObserver() {}
 385   MOCK_METHOD1(OnSafeBrowsingHit,
 386                void(const SafeBrowsingUIManager::UnsafeResource&));
 387   MOCK_METHOD1(OnSafeBrowsingMatch,
 388                void(const SafeBrowsingUIManager::UnsafeResource&));
 389 };
 390
 391 MATCHER_P(IsUnsafeResourceFor, url, "") {
 392   return (arg.url.spec() == url.spec() &&
 393           arg.threat_type != SB_THREAT_TYPE_SAFE);
 394 }
 395
 396 class ServiceEnabledHelper : public base::ThreadTestHelper {
 397  public:
 398   ServiceEnabledHelper(
 399       SafeBrowsingService* service,
 400       bool enabled,
 401       scoped_refptr<base::SingleThreadTaskRunner> target_thread)
 402       : base::ThreadTestHelper(target_thread),
 403         service_(service),
 404         expected_enabled_(enabled) {}
 405
 406   void RunTest() override {
 407     set_test_result(service_->enabled() == expected_enabled_);
 408   }
 409
 410  private:
 411   ~ServiceEnabledHelper() override {}
 412
 413   scoped_refptr<SafeBrowsingService> service_;
 414   const bool expected_enabled_;
 415 };
 416
 417 }  // namespace
 418
 419 // Tests the safe browsing blocking page in a browser.
 420 class SafeBrowsingServiceTest : public InProcessBrowserTest {
 421  public:
 422   SafeBrowsingServiceTest() {
 423   }
 424
 425   static void GenUrlFullhashResult(const GURL& url,
 426                                    int list_id,
 427                                    SBFullHashResult* full_hash) {
 428     std::string host;
 429     std::string path;
 430     safe_browsing_util::CanonicalizeUrl(url, &host, &path, NULL);
 431     full_hash->hash = SBFullHashForString(host + path);
 432     full_hash->list_id = list_id;
 433   }
 434
 435   void SetUp() override {
 436     // InProcessBrowserTest::SetUp() instantiates SafebrowsingService and
 437     // RegisterFactory has to be called before SafeBrowsingService is created.
 438     sb_factory_.reset(new TestSafeBrowsingServiceFactory(
 439         "https://definatelynotarealdomain/safebrowsing"));
 440     SafeBrowsingService::RegisterFactory(sb_factory_.get());
 441     SafeBrowsingDatabase::RegisterFactory(&db_factory_);
 442     SafeBrowsingProtocolManager::RegisterFactory(&pm_factory_);
 443     InProcessBrowserTest::SetUp();
 444   }
 445
 446   void TearDown() override {
 447     InProcessBrowserTest::TearDown();
 448
 449     // Unregister test factories after InProcessBrowserTest::TearDown
 450     // (which destructs SafeBrowsingService).
 451     SafeBrowsingDatabase::RegisterFactory(NULL);
 452     SafeBrowsingProtocolManager::RegisterFactory(NULL);
 453     SafeBrowsingService::RegisterFactory(NULL);
 454   }
 455
 456   void SetUpCommandLine(base::CommandLine* command_line) override {
 457     // Makes sure the auto update is not triggered during the test.
 458     // This test will fill up the database using testing prefixes
 459     // and urls.
 460     command_line->AppendSwitch(switches::kSbDisableAutoUpdate);
 461 #if defined(OS_CHROMEOS)
 462     command_line->AppendSwitch(
 463         chromeos::switches::kIgnoreUserProfileMappingForTests);
 464 #endif
 465   }
 466
 467   void SetUpOnMainThread() override {
 468     InProcessBrowserTest::SetUpOnMainThread();
 469     g_browser_process->safe_browsing_service()->ui_manager()->AddObserver(
 470         &observer_);
 471   }
 472
 473   void TearDownOnMainThread() override {
 474     g_browser_process->safe_browsing_service()->ui_manager()->RemoveObserver(
 475         &observer_);
 476     InProcessBrowserTest::TearDownOnMainThread();
 477   }
 478
 479   void SetUpInProcessBrowserTestFixture() override {
 480     base::FilePath test_data_dir;
 481     PathService::Get(chrome::DIR_TEST_DATA, &test_data_dir);
 482     embedded_test_server()->ServeFilesFromDirectory(test_data_dir);
 483     ASSERT_TRUE(embedded_test_server()->InitializeAndWaitUntilReady());
 484   }
 485
 486   // This will setup the "url" prefix in database and prepare protocol manager
 487   // to respond with |full_hash|, as well as other |full_hash|es previously set
 488   // via this call, on GetFullHash requests.
 489   void SetupResponseForUrl(const GURL& url, const SBFullHashResult& full_hash) {
 490     std::vector<SBPrefix> prefix_hits;
 491     prefix_hits.push_back(full_hash.hash.prefix);
 492
 493     // Make sure the full hits is empty unless we need to test the
 494     // full hash is hit in database's local cache.
 495     TestSafeBrowsingDatabase* db = db_factory_.GetDb();
 496     db->AddUrl(url, full_hash, prefix_hits);
 497
 498     TestProtocolManager* pm = pm_factory_.GetProtocolManager();
 499     pm->AddGetFullHashResponse(full_hash);
 500   }
 501
 502   bool ShowingInterstitialPage() {
 503     WebContents* contents =
 504         browser()->tab_strip_model()->GetActiveWebContents();
 505     InterstitialPage* interstitial_page = contents->GetInterstitialPage();
 506     return interstitial_page != NULL;
 507   }
 508
 509   void IntroduceGetHashDelay(const base::TimeDelta& delay) {
 510     pm_factory_.GetProtocolManager()->IntroduceDelay(delay);
 511   }
 512
 513   // TODO(nparker): Remove the need for this by wiring in our own
 514   // SafeBrowsingDatabaseManager factory and keep a ptr to the subclass.
 515   // Or add a Get/SetTimeout to sbdbmgr.
 516   static LocalSafeBrowsingDatabaseManager* LocalDatabaseManagerForService(
 517       SafeBrowsingService* sb_service) {
 518     return static_cast<LocalSafeBrowsingDatabaseManager*>(
 519         sb_service->database_manager().get());
 520   }
 521
 522   static base::TimeDelta GetCheckTimeout(SafeBrowsingService* sb_service) {
 523     return LocalDatabaseManagerForService(sb_service)->check_timeout_;
 524   }
 525
 526   static void SetCheckTimeout(SafeBrowsingService* sb_service,
 527                               const base::TimeDelta& delay) {
 528     LocalDatabaseManagerForService(sb_service)->check_timeout_ = delay;
 529   }
 530
 531   void CreateCSDService() {
 532 #if defined(SAFE_BROWSING_CSD)
 533     safe_browsing::ClientSideDetectionService* csd_service =
 534         safe_browsing::ClientSideDetectionService::Create(NULL);
 535     SafeBrowsingService* sb_service =
 536         g_browser_process->safe_browsing_service();
 537
 538     // A CSD service should already exist.
 539     EXPECT_TRUE(sb_service->csd_service_);
 540
 541     sb_service->csd_service_.reset(csd_service);
 542     sb_service->RefreshState();
 543 #endif
 544   }
 545
 546   void ProceedAndWhitelist(
 547       const SafeBrowsingUIManager::UnsafeResource& resource) {
 548     std::vector<SafeBrowsingUIManager::UnsafeResource> resources;
 549     resources.push_back(resource);
 550     BrowserThread::PostTask(
 551         BrowserThread::IO, FROM_HERE,
 552         base::Bind(&SafeBrowsingUIManager::OnBlockingPageDone,
 553                    g_browser_process->safe_browsing_service()->ui_manager(),
 554                    resources, true));
 555     WaitForIOThread();
 556   }
 557
 558  protected:
 559   StrictMock<MockObserver> observer_;
 560
 561   // Temporary profile dir for test cases that create a second profile.  This is
 562   // owned by the SafeBrowsingServiceTest object so that it will not get
 563   // destructed until after the test Browser has been torn down, since the
 564   // ImportantFileWriter may still be modifying it after the Profile object has
 565   // been destroyed.
 566   base::ScopedTempDir temp_profile_dir_;
 567
 568   // Waits for pending tasks on the IO thread to complete. This is useful
 569   // to wait for the SafeBrowsingService to finish loading/stopping.
 570   void WaitForIOThread() {
 571     scoped_refptr<base::ThreadTestHelper> io_helper(new base::ThreadTestHelper(
 572         BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO).get()));
 573     ASSERT_TRUE(io_helper->Run());
 574   }
 575
 576   // Waits for pending tasks on the IO thread to complete and check if the
 577   // SafeBrowsingService enabled state matches |enabled|.
 578   void WaitForIOAndCheckEnabled(SafeBrowsingService* service, bool enabled) {
 579     scoped_refptr<ServiceEnabledHelper> enabled_helper(new ServiceEnabledHelper(
 580         service, enabled,
 581         BrowserThread::GetMessageLoopProxyForThread(BrowserThread::IO).get()));
 582     ASSERT_TRUE(enabled_helper->Run());
 583   }
 584
 585  private:
 586   scoped_ptr<TestSafeBrowsingServiceFactory> sb_factory_;
 587   TestSafeBrowsingDatabaseFactory db_factory_;
 588   TestSBProtocolManagerFactory pm_factory_;
 589
 590   DISALLOW_COPY_AND_ASSIGN(SafeBrowsingServiceTest);
 591 };
 592
 593 enum MalwareMetadataTestType {
 594   METADATA_NONE,
 595   METADATA_LANDING,
 596   METADATA_DISTRIBUTION,
 597 };
 598
 599 class SafeBrowsingServiceMetadataTest
 600     : public SafeBrowsingServiceTest,
 601       public ::testing::WithParamInterface<MalwareMetadataTestType> {
 602  public:
 603   SafeBrowsingServiceMetadataTest() {}
 604
 605   void GenUrlFullhashResultWithMetadata(const GURL& url,
 606                                         SBFullHashResult* full_hash) {
 607     GenUrlFullhashResult(url, safe_browsing_util::MALWARE, full_hash);
 608
 609     safe_browsing::MalwarePatternType proto;
 610     switch (GetParam()) {
 611       case METADATA_NONE:
 612         full_hash->metadata = std::string();
 613         break;
 614       case METADATA_LANDING:
 615         proto.set_pattern_type(safe_browsing::MalwarePatternType::LANDING);
 616         full_hash->metadata = proto.SerializeAsString();
 617         break;
 618       case METADATA_DISTRIBUTION:
 619         proto.set_pattern_type(safe_browsing::MalwarePatternType::DISTRIBUTION);
 620         full_hash->metadata = proto.SerializeAsString();
 621         break;
 622     }
 623   }
 624
 625  private:
 626   DISALLOW_COPY_AND_ASSIGN(SafeBrowsingServiceMetadataTest);
 627 };
 628
 629 namespace {
 630
 631 const char kEmptyPage[] = "/empty.html";
 632 const char kMalwareFile[] = "/downloads/dangerous/dangerous.exe";
 633 const char kMalwarePage[] = "/safe_browsing/malware.html";
 634 const char kMalwareIFrame[] = "/safe_browsing/malware_iframe.html";
 635 const char kMalwareImg[] = "/safe_browsing/malware_image.png";
 636
 637 // This test goes through DownloadResourceHandler.
 638 IN_PROC_BROWSER_TEST_P(SafeBrowsingServiceMetadataTest, MalwareMainFrame) {
 639   GURL url = embedded_test_server()->GetURL(kEmptyPage);
 640
 641   // After adding the url to safebrowsing database and getfullhash result,
 642   // we should see the interstitial page.
 643   SBFullHashResult malware_full_hash;
 644   GenUrlFullhashResultWithMetadata(url, &malware_full_hash);
 645   EXPECT_CALL(observer_,
 646               OnSafeBrowsingMatch(IsUnsafeResourceFor(url))).Times(1);
 647   EXPECT_CALL(observer_, OnSafeBrowsingHit(IsUnsafeResourceFor(url))).Times(1);
 648   SetupResponseForUrl(url, malware_full_hash);
 649   ui_test_utils::NavigateToURL(browser(), url);
 650   // All types should show the interstitial.
 651   EXPECT_TRUE(ShowingInterstitialPage());
 652 }
 653
 654 IN_PROC_BROWSER_TEST_P(SafeBrowsingServiceMetadataTest, MalwareIFrame) {
 655   GURL main_url = embedded_test_server()->GetURL(kMalwarePage);
 656   GURL iframe_url = embedded_test_server()->GetURL(kMalwareIFrame);
 657
 658   // Add the iframe url as malware and then load the parent page.
 659   SBFullHashResult malware_full_hash;
 660   GenUrlFullhashResultWithMetadata(iframe_url, &malware_full_hash);
 661   EXPECT_CALL(observer_, OnSafeBrowsingMatch(IsUnsafeResourceFor(iframe_url)))
 662       .Times(1);
 663   EXPECT_CALL(observer_, OnSafeBrowsingHit(IsUnsafeResourceFor(iframe_url)))
 664       .Times(1);
 665   SetupResponseForUrl(iframe_url, malware_full_hash);
 666   ui_test_utils::NavigateToURL(browser(), main_url);
 667   // All types should show the interstitial.
 668   EXPECT_TRUE(ShowingInterstitialPage());
 669 }
 670
 671 IN_PROC_BROWSER_TEST_P(SafeBrowsingServiceMetadataTest, MalwareImg) {
 672   GURL main_url = embedded_test_server()->GetURL(kMalwarePage);
 673   GURL img_url = embedded_test_server()->GetURL(kMalwareImg);
 674
 675   // Add the img url as malware and then load the parent page.
 676   SBFullHashResult malware_full_hash;
 677   GenUrlFullhashResultWithMetadata(img_url, &malware_full_hash);
 678   switch (GetParam()) {
 679     case METADATA_NONE:  // Falls through.
 680     case METADATA_DISTRIBUTION:
 681       EXPECT_CALL(observer_, OnSafeBrowsingMatch(IsUnsafeResourceFor(img_url)))
 682           .Times(1);
 683       EXPECT_CALL(observer_, OnSafeBrowsingHit(IsUnsafeResourceFor(img_url)))
 684           .Times(1);
 685       break;
 686     case METADATA_LANDING:
 687       // No interstitial shown, so no notifications expected.
 688       break;
 689   }
 690   SetupResponseForUrl(img_url, malware_full_hash);
 691   ui_test_utils::NavigateToURL(browser(), main_url);
 692   // Subresource which is tagged as a landing page should not show an
 693   // interstitial, the other types should.
 694   switch (GetParam()) {
 695     case METADATA_NONE:
 696     case METADATA_DISTRIBUTION:
 697       EXPECT_TRUE(ShowingInterstitialPage());
 698       break;
 699     case METADATA_LANDING:
 700       EXPECT_FALSE(ShowingInterstitialPage());
 701       break;
 702   }
 703 }
 704
 705 INSTANTIATE_TEST_CASE_P(MaybeSetMetadata,
 706                         SafeBrowsingServiceMetadataTest,
 707                         testing::Values(METADATA_NONE,
 708                                         METADATA_LANDING,
 709                                         METADATA_DISTRIBUTION));
 710
 711 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, UnwantedImgIgnored) {
 712   GURL main_url = embedded_test_server()->GetURL(kMalwarePage);
 713   GURL img_url = embedded_test_server()->GetURL(kMalwareImg);
 714
 715   // Add the img url as coming from a site serving UwS and then load the parent
 716   // page.
 717   SBFullHashResult uws_full_hash;
 718   GenUrlFullhashResult(img_url, safe_browsing_util::UNWANTEDURL,
 719                        &uws_full_hash);
 720   SetupResponseForUrl(img_url, uws_full_hash);
 721
 722   ui_test_utils::NavigateToURL(browser(), main_url);
 723
 724   EXPECT_FALSE(ShowingInterstitialPage());
 725 }
 726
 727 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, DISABLED_MalwareWithWhitelist) {
 728   GURL url = embedded_test_server()->GetURL(kEmptyPage);
 729
 730   // After adding the url to safebrowsing database and getfullhash result,
 731   // we should see the interstitial page.
 732   SBFullHashResult malware_full_hash;
 733   GenUrlFullhashResult(url, safe_browsing_util::MALWARE, &malware_full_hash);
 734   EXPECT_CALL(observer_,
 735               OnSafeBrowsingMatch(IsUnsafeResourceFor(url))).Times(1);
 736   EXPECT_CALL(observer_, OnSafeBrowsingHit(IsUnsafeResourceFor(url))).Times(1)
 737       .WillOnce(testing::Invoke(
 738           this, &SafeBrowsingServiceTest::ProceedAndWhitelist));
 739   SetupResponseForUrl(url, malware_full_hash);
 740
 741   ui_test_utils::NavigateToURL(browser(), url);
 742   // Mock calls OnBlockingPageDone set to proceed, so the interstitial
 743   // is removed.
 744   EXPECT_FALSE(ShowingInterstitialPage());
 745   Mock::VerifyAndClearExpectations(&observer_);
 746
 747   // Navigate back to kEmptyPage -- should hit the whitelist, and send a match
 748   // call, but no hit call.
 749   EXPECT_CALL(observer_,
 750               OnSafeBrowsingMatch(IsUnsafeResourceFor(url))).Times(1);
 751   EXPECT_CALL(observer_, OnSafeBrowsingHit(IsUnsafeResourceFor(url))).Times(0);
 752   ui_test_utils::NavigateToURL(browser(), url);
 753   EXPECT_FALSE(ShowingInterstitialPage());
 754 }
 755
 756 const char kPrefetchMalwarePage[] = "/safe_browsing/prefetch_malware.html";
 757
 758 // This test confirms that prefetches don't themselves get the
 759 // interstitial treatment.
 760 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, Prefetch) {
 761   GURL url = embedded_test_server()->GetURL(kPrefetchMalwarePage);
 762   GURL malware_url = embedded_test_server()->GetURL(kMalwarePage);
 763
 764   class SetPrefetchForTest {
 765    public:
 766     explicit SetPrefetchForTest(bool prefetch)
 767         : old_prerender_mode_(prerender::PrerenderManager::GetMode()) {
 768       std::string exp_group = prefetch ? "ExperimentYes" : "ExperimentNo";
 769       base::FieldTrialList::CreateFieldTrial("Prefetch", exp_group);
 770
 771       prerender::PrerenderManager::SetMode(
 772           prerender::PrerenderManager::PRERENDER_MODE_DISABLED);
 773     }
 774
 775     ~SetPrefetchForTest() {
 776       prerender::PrerenderManager::SetMode(old_prerender_mode_);
 777     }
 778
 779    private:
 780     prerender::PrerenderManager::PrerenderManagerMode old_prerender_mode_;
 781   } set_prefetch_for_test(true);
 782
 783   // Even though we have added this uri to the safebrowsing database and
 784   // getfullhash result, we should not see the interstitial page since the
 785   // only malware was a prefetch target.
 786   SBFullHashResult malware_full_hash;
 787   GenUrlFullhashResult(malware_url, safe_browsing_util::MALWARE,
 788                        &malware_full_hash);
 789   SetupResponseForUrl(malware_url, malware_full_hash);
 790   ui_test_utils::NavigateToURL(browser(), url);
 791   EXPECT_FALSE(ShowingInterstitialPage());
 792   Mock::VerifyAndClear(&observer_);
 793
 794   // However, when we navigate to the malware page, we should still get
 795   // the interstitial.
 796   EXPECT_CALL(observer_, OnSafeBrowsingMatch(IsUnsafeResourceFor(malware_url)))
 797       .Times(1);
 798   EXPECT_CALL(observer_, OnSafeBrowsingHit(IsUnsafeResourceFor(malware_url)))
 799       .Times(1);
 800   ui_test_utils::NavigateToURL(browser(), malware_url);
 801   EXPECT_TRUE(ShowingInterstitialPage());
 802   Mock::VerifyAndClear(&observer_);
 803 }
 804
 805 }  // namespace
 806
 807 class TestSBClient
 808     : public base::RefCountedThreadSafe<TestSBClient>,
 809       public SafeBrowsingDatabaseManager::Client {
 810  public:
 811   TestSBClient()
 812     : threat_type_(SB_THREAT_TYPE_SAFE),
 813       safe_browsing_service_(g_browser_process->safe_browsing_service()) {
 814   }
 815
 816   SBThreatType GetThreatType() const {
 817     return threat_type_;
 818   }
 819
 820   void CheckDownloadUrl(const std::vector<GURL>& url_chain) {
 821     BrowserThread::PostTask(
 822         BrowserThread::IO, FROM_HERE,
 823         base::Bind(&TestSBClient::CheckDownloadUrlOnIOThread,
 824                    this, url_chain));
 825     content::RunMessageLoop();  // Will stop in OnCheckDownloadUrlResult.
 826   }
 827
 828   void CheckBrowseUrl(const GURL& url) {
 829     BrowserThread::PostTask(
 830         BrowserThread::IO, FROM_HERE,
 831         base::Bind(&TestSBClient::CheckBrowseUrlOnIOThread, this, url));
 832     content::RunMessageLoop();  // Will stop in OnCheckBrowseUrlResult.
 833   }
 834
 835  private:
 836   friend class base::RefCountedThreadSafe<TestSBClient>;
 837   ~TestSBClient() override {}
 838
 839   void CheckDownloadUrlOnIOThread(const std::vector<GURL>& url_chain) {
 840     bool synchronous_safe_signal =
 841         safe_browsing_service_->database_manager()->CheckDownloadUrl(url_chain,
 842                                                                      this);
 843     if (synchronous_safe_signal) {
 844       threat_type_ = SB_THREAT_TYPE_SAFE;
 845       BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
 846                               base::Bind(&TestSBClient::CheckDone, this));
 847     }
 848   }
 849
 850   void CheckBrowseUrlOnIOThread(const GURL& url) {
 851     // The async CheckDone() hook will not be called when we have a synchronous
 852     // safe signal, handle it right away.
 853     bool synchronous_safe_signal =
 854         safe_browsing_service_->database_manager()->CheckBrowseUrl(url, this);
 855     if (synchronous_safe_signal) {
 856       threat_type_ = SB_THREAT_TYPE_SAFE;
 857       BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
 858                               base::Bind(&TestSBClient::CheckDone, this));
 859     }
 860   }
 861
 862   // Called when the result of checking a download URL is known.
 863   void OnCheckDownloadUrlResult(const std::vector<GURL>& /* url_chain */,
 864                                 SBThreatType threat_type) override {
 865     threat_type_ = threat_type;
 866     BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
 867                             base::Bind(&TestSBClient::CheckDone, this));
 868   }
 869
 870   // Called when the result of checking a browse URL is known.
 871   void OnCheckBrowseUrlResult(const GURL& /* url */,
 872                               SBThreatType threat_type,
 873                               const std::string& /* metadata */) override {
 874     threat_type_ = threat_type;
 875     BrowserThread::PostTask(BrowserThread::UI, FROM_HERE,
 876                             base::Bind(&TestSBClient::CheckDone, this));
 877   }
 878
 879   void CheckDone() {
 880     base::MessageLoopForUI::current()->Quit();
 881   }
 882
 883   SBThreatType threat_type_;
 884   SafeBrowsingService* safe_browsing_service_;
 885
 886   DISALLOW_COPY_AND_ASSIGN(TestSBClient);
 887 };
 888
 889 // These tests use SafeBrowsingService::Client to directly interact with
 890 // SafeBrowsingService.
 891 namespace {
 892
 893 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, CheckDownloadUrl) {
 894   GURL badbin_url = embedded_test_server()->GetURL(kMalwareFile);
 895   std::vector<GURL> badbin_urls(1, badbin_url);
 896
 897   scoped_refptr<TestSBClient> client(new TestSBClient);
 898   client->CheckDownloadUrl(badbin_urls);
 899
 900   // Since badbin_url is not in database, it is considered to be safe.
 901   EXPECT_EQ(SB_THREAT_TYPE_SAFE, client->GetThreatType());
 902
 903   SBFullHashResult full_hash_result;
 904   GenUrlFullhashResult(badbin_url, safe_browsing_util::BINURL,
 905                        &full_hash_result);
 906   SetupResponseForUrl(badbin_url, full_hash_result);
 907
 908   client->CheckDownloadUrl(badbin_urls);
 909
 910   // Now, the badbin_url is not safe since it is added to download database.
 911   EXPECT_EQ(SB_THREAT_TYPE_BINARY_MALWARE_URL, client->GetThreatType());
 912 }
 913
 914 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, CheckUnwantedSoftwareUrl) {
 915   const GURL bad_url = embedded_test_server()->GetURL(kMalwareFile);
 916   {
 917     scoped_refptr<TestSBClient> client(new TestSBClient);
 918
 919     // Since bad_url is not in database, it is considered to be
 920     // safe.
 921     client->CheckBrowseUrl(bad_url);
 922     EXPECT_EQ(SB_THREAT_TYPE_SAFE, client->GetThreatType());
 923
 924     SBFullHashResult full_hash_result;
 925     GenUrlFullhashResult(
 926         bad_url, safe_browsing_util::UNWANTEDURL, &full_hash_result);
 927     SetupResponseForUrl(bad_url, full_hash_result);
 928
 929     // Now, the bad_url is not safe since it is added to download
 930     // database.
 931     client->CheckBrowseUrl(bad_url);
 932     EXPECT_EQ(SB_THREAT_TYPE_URL_UNWANTED, client->GetThreatType());
 933   }
 934
 935   // The unwantedness should survive across multiple clients.
 936   {
 937     scoped_refptr<TestSBClient> client(new TestSBClient);
 938     client->CheckBrowseUrl(bad_url);
 939     EXPECT_EQ(SB_THREAT_TYPE_URL_UNWANTED, client->GetThreatType());
 940   }
 941
 942   // An unwanted URL also marked as malware should be flagged as malware.
 943   {
 944     scoped_refptr<TestSBClient> client(new TestSBClient);
 945
 946     SBFullHashResult full_hash_result;
 947     GenUrlFullhashResult(
 948         bad_url, safe_browsing_util::MALWARE, &full_hash_result);
 949     SetupResponseForUrl(bad_url, full_hash_result);
 950
 951     client->CheckBrowseUrl(bad_url);
 952     EXPECT_EQ(SB_THREAT_TYPE_URL_MALWARE, client->GetThreatType());
 953   }
 954 }
 955
 956 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, CheckBrowseUrl) {
 957   const GURL bad_url = embedded_test_server()->GetURL(kMalwareFile);
 958   {
 959     scoped_refptr<TestSBClient> client(new TestSBClient);
 960
 961     // Since bad_url is not in database, it is considered to be
 962     // safe.
 963     client->CheckBrowseUrl(bad_url);
 964     EXPECT_EQ(SB_THREAT_TYPE_SAFE, client->GetThreatType());
 965
 966     SBFullHashResult full_hash_result;
 967     GenUrlFullhashResult(
 968         bad_url, safe_browsing_util::MALWARE, &full_hash_result);
 969     SetupResponseForUrl(bad_url, full_hash_result);
 970
 971     // Now, the bad_url is not safe since it is added to download
 972     // database.
 973     client->CheckBrowseUrl(bad_url);
 974     EXPECT_EQ(SB_THREAT_TYPE_URL_MALWARE, client->GetThreatType());
 975   }
 976
 977   // The unwantedness should survive across multiple clients.
 978   {
 979     scoped_refptr<TestSBClient> client(new TestSBClient);
 980     client->CheckBrowseUrl(bad_url);
 981     EXPECT_EQ(SB_THREAT_TYPE_URL_MALWARE, client->GetThreatType());
 982   }
 983
 984   // Adding the unwanted state to an existing malware URL should have no impact
 985   // (i.e. a malware hit should still prevail).
 986   {
 987     scoped_refptr<TestSBClient> client(new TestSBClient);
 988
 989     SBFullHashResult full_hash_result;
 990     GenUrlFullhashResult(
 991         bad_url, safe_browsing_util::UNWANTEDURL, &full_hash_result);
 992     SetupResponseForUrl(bad_url, full_hash_result);
 993
 994     client->CheckBrowseUrl(bad_url);
 995     EXPECT_EQ(SB_THREAT_TYPE_URL_MALWARE, client->GetThreatType());
 996   }
 997 }
 998
 999 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, CheckDownloadUrlRedirects) {
1000   GURL original_url = embedded_test_server()->GetURL(kEmptyPage);
1001   GURL badbin_url = embedded_test_server()->GetURL(kMalwareFile);
1002   GURL final_url = embedded_test_server()->GetURL(kEmptyPage);
1003   std::vector<GURL> badbin_urls;
1004   badbin_urls.push_back(original_url);
1005   badbin_urls.push_back(badbin_url);
1006   badbin_urls.push_back(final_url);
1007
1008   scoped_refptr<TestSBClient> client(new TestSBClient);
1009   client->CheckDownloadUrl(badbin_urls);
1010
1011   // Since badbin_url is not in database, it is considered to be safe.
1012   EXPECT_EQ(SB_THREAT_TYPE_SAFE, client->GetThreatType());
1013
1014   SBFullHashResult full_hash_result;
1015   GenUrlFullhashResult(badbin_url, safe_browsing_util::BINURL,
1016                        &full_hash_result);
1017   SetupResponseForUrl(badbin_url, full_hash_result);
1018
1019   client->CheckDownloadUrl(badbin_urls);
1020
1021   // Now, the badbin_url is not safe since it is added to download database.
1022   EXPECT_EQ(SB_THREAT_TYPE_BINARY_MALWARE_URL, client->GetThreatType());
1023 }
1024
1025 #if defined(OS_WIN)
1026 // http://crbug.com/396409
1027 #define MAYBE_CheckDownloadUrlTimedOut DISABLED_CheckDownloadUrlTimedOut
1028 #else
1029 #define MAYBE_CheckDownloadUrlTimedOut CheckDownloadUrlTimedOut
1030 #endif
1031 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest,
1032                        MAYBE_CheckDownloadUrlTimedOut) {
1033   GURL badbin_url = embedded_test_server()->GetURL(kMalwareFile);
1034   std::vector<GURL> badbin_urls(1, badbin_url);
1035
1036   scoped_refptr<TestSBClient> client(new TestSBClient);
1037   SBFullHashResult full_hash_result;
1038   GenUrlFullhashResult(badbin_url, safe_browsing_util::BINURL,
1039                        &full_hash_result);
1040   SetupResponseForUrl(badbin_url, full_hash_result);
1041   client->CheckDownloadUrl(badbin_urls);
1042
1043   // badbin_url is not safe since it is added to download database.
1044   EXPECT_EQ(SB_THREAT_TYPE_BINARY_MALWARE_URL, client->GetThreatType());
1045
1046   //
1047   // Now introducing delays and we should hit timeout.
1048   //
1049   SafeBrowsingService* sb_service = g_browser_process->safe_browsing_service();
1050   base::TimeDelta default_urlcheck_timeout = GetCheckTimeout(sb_service);
1051   IntroduceGetHashDelay(base::TimeDelta::FromSeconds(1));
1052   SetCheckTimeout(sb_service, base::TimeDelta::FromMilliseconds(1));
1053   client->CheckDownloadUrl(badbin_urls);
1054
1055   // There should be a timeout and the hash would be considered as safe.
1056   EXPECT_EQ(SB_THREAT_TYPE_SAFE, client->GetThreatType());
1057
1058   // Need to set the timeout back to the default value.
1059   SetCheckTimeout(sb_service, default_urlcheck_timeout);
1060 }
1061
1062 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceTest, StartAndStop) {
1063   CreateCSDService();
1064   SafeBrowsingService* sb_service = g_browser_process->safe_browsing_service();
1065   safe_browsing::ClientSideDetectionService* csd_service =
1066       sb_service->safe_browsing_detection_service();
1067   PrefService* pref_service = browser()->profile()->GetPrefs();
1068
1069   ASSERT_TRUE(sb_service != NULL);
1070   ASSERT_TRUE(csd_service != NULL);
1071   ASSERT_TRUE(pref_service != NULL);
1072
1073   EXPECT_TRUE(pref_service->GetBoolean(prefs::kSafeBrowsingEnabled));
1074
1075   // SBS might still be starting, make sure this doesn't flake.
1076   EXPECT_TRUE(sb_service->enabled_by_prefs());
1077   WaitForIOAndCheckEnabled(sb_service, true);
1078   EXPECT_TRUE(csd_service->enabled());
1079
1080   // Add a new Profile. SBS should keep running.
1081   ASSERT_TRUE(temp_profile_dir_.CreateUniqueTempDir());
1082   scoped_ptr<Profile> profile2(Profile::CreateProfile(
1083       temp_profile_dir_.path(), NULL, Profile::CREATE_MODE_SYNCHRONOUS));
1084   ASSERT_TRUE(profile2.get() != NULL);
1085   StartupTaskRunnerServiceFactory::GetForProfile(profile2.get())->
1086               StartDeferredTaskRunners();
1087   PrefService* pref_service2 = profile2->GetPrefs();
1088   EXPECT_TRUE(pref_service2->GetBoolean(prefs::kSafeBrowsingEnabled));
1089   // We don't expect the state to have changed, but if it did, wait for it.
1090   EXPECT_TRUE(sb_service->enabled_by_prefs());
1091   WaitForIOAndCheckEnabled(sb_service, true);
1092   EXPECT_TRUE(csd_service->enabled());
1093
1094   // Change one of the prefs. SBS should keep running.
1095   pref_service->SetBoolean(prefs::kSafeBrowsingEnabled, false);
1096   EXPECT_TRUE(sb_service->enabled_by_prefs());
1097   WaitForIOAndCheckEnabled(sb_service, true);
1098   EXPECT_TRUE(csd_service->enabled());
1099
1100   // Change the other pref. SBS should stop now.
1101   pref_service2->SetBoolean(prefs::kSafeBrowsingEnabled, false);
1102
1103 // TODO(mattm): Remove this when crbug.com/461493 is fixed.
1104 #if defined(OS_CHROMEOS)
1105   // On Chrome OS we should disable safe browsing for signin profile.
1106   EXPECT_TRUE(sb_service->enabled_by_prefs());
1107   WaitForIOAndCheckEnabled(sb_service, true);
1108   EXPECT_TRUE(csd_service->enabled());
1109   chromeos::ProfileHelper::GetSigninProfile()
1110       ->GetOriginalProfile()
1111       ->GetPrefs()
1112       ->SetBoolean(prefs::kSafeBrowsingEnabled, false);
1113   WaitForIOThread();
1114 #endif
1115   EXPECT_FALSE(sb_service->enabled_by_prefs());
1116   WaitForIOAndCheckEnabled(sb_service, false);
1117   EXPECT_FALSE(csd_service->enabled());
1118
1119   // Turn it back on. SBS comes back.
1120   pref_service2->SetBoolean(prefs::kSafeBrowsingEnabled, true);
1121   EXPECT_TRUE(sb_service->enabled_by_prefs());
1122   WaitForIOAndCheckEnabled(sb_service, true);
1123   EXPECT_TRUE(csd_service->enabled());
1124
1125   // Delete the Profile. SBS stops again.
1126   pref_service2 = NULL;
1127   profile2.reset();
1128   EXPECT_FALSE(sb_service->enabled_by_prefs());
1129   WaitForIOAndCheckEnabled(sb_service, false);
1130   EXPECT_FALSE(csd_service->enabled());
1131 }
1132
1133 }  // namespace
1134
1135 class SafeBrowsingServiceShutdownTest : public SafeBrowsingServiceTest {
1136  public:
1137   void TearDown() override {
1138     // Browser should be fully torn down by now, so we can safely check these
1139     // counters.
1140     EXPECT_EQ(1, TestProtocolManager::create_count());
1141     EXPECT_EQ(1, TestProtocolManager::delete_count());
1142
1143     SafeBrowsingServiceTest::TearDown();
1144   }
1145
1146   // An observer that returns back to test code after a new profile is
1147   // initialized.
1148   void OnUnblockOnProfileCreation(Profile* profile,
1149                                   Profile::CreateStatus status) {
1150     if (status == Profile::CREATE_STATUS_INITIALIZED) {
1151       profile2_ = profile;
1152       base::MessageLoop::current()->Quit();
1153     }
1154   }
1155
1156  protected:
1157   Profile* profile2_;
1158 };
1159
1160 IN_PROC_BROWSER_TEST_F(SafeBrowsingServiceShutdownTest,
1161                        DontStartAfterShutdown) {
1162   CreateCSDService();
1163   SafeBrowsingService* sb_service = g_browser_process->safe_browsing_service();
1164   safe_browsing::ClientSideDetectionService* csd_service =
1165       sb_service->safe_browsing_detection_service();
1166   PrefService* pref_service = browser()->profile()->GetPrefs();
1167
1168   ASSERT_TRUE(sb_service != NULL);
1169   ASSERT_TRUE(csd_service != NULL);
1170   ASSERT_TRUE(pref_service != NULL);
1171
1172   EXPECT_TRUE(pref_service->GetBoolean(prefs::kSafeBrowsingEnabled));
1173
1174   // SBS might still be starting, make sure this doesn't flake.
1175   WaitForIOThread();
1176   EXPECT_EQ(1, TestProtocolManager::create_count());
1177   EXPECT_EQ(0, TestProtocolManager::delete_count());
1178
1179   // Create an additional profile.  We need to use the ProfileManager so that
1180   // the profile will get destroyed in the normal browser shutdown process.
1181   ProfileManager* profile_manager = g_browser_process->profile_manager();
1182   ASSERT_TRUE(temp_profile_dir_.CreateUniqueTempDir());
1183   profile_manager->CreateProfileAsync(
1184       temp_profile_dir_.path(),
1185       base::Bind(&SafeBrowsingServiceShutdownTest::OnUnblockOnProfileCreation,
1186                  this),
1187       base::string16(), base::string16(), std::string());
1188
1189   // Spin to allow profile creation to take place, loop is terminated
1190   // by OnUnblockOnProfileCreation when the profile is created.
1191   content::RunMessageLoop();
1192
1193   PrefService* pref_service2 = profile2_->GetPrefs();
1194   EXPECT_TRUE(pref_service2->GetBoolean(prefs::kSafeBrowsingEnabled));
1195
1196   // We don't expect the state to have changed, but if it did, wait for it.
1197   WaitForIOThread();
1198   EXPECT_EQ(1, TestProtocolManager::create_count());
1199   EXPECT_EQ(0, TestProtocolManager::delete_count());
1200
1201   // End the test, shutting down the browser.
1202   // SafeBrowsingServiceShutdownTest::TearDown will check the create_count and
1203   // delete_count again.
1204 }
1205
1206 class SafeBrowsingDatabaseManagerCookieTest : public InProcessBrowserTest {
1207  public:
1208   SafeBrowsingDatabaseManagerCookieTest() {}
1209
1210   void SetUp() override {
1211     // We need to start the test server to get the host&port in the url.
1212     ASSERT_TRUE(embedded_test_server()->InitializeAndWaitUntilReady());
1213     embedded_test_server()->RegisterRequestHandler(
1214         base::Bind(&SafeBrowsingDatabaseManagerCookieTest::HandleRequest));
1215
1216     // Point to the testing server for all SafeBrowsing requests.
1217     GURL url_prefix = embedded_test_server()->GetURL("/testpath");
1218     sb_factory_.reset(new TestSafeBrowsingServiceFactory(url_prefix.spec()));
1219     SafeBrowsingService::RegisterFactory(sb_factory_.get());
1220
1221     InProcessBrowserTest::SetUp();
1222   }
1223
1224   void TearDown() override {
1225     InProcessBrowserTest::TearDown();
1226
1227     SafeBrowsingService::RegisterFactory(NULL);
1228   }
1229
1230   bool SetUpUserDataDirectory() override {
1231     base::FilePath cookie_path(
1232         SafeBrowsingService::GetCookieFilePathForTesting());
1233     EXPECT_FALSE(base::PathExists(cookie_path));
1234
1235     base::FilePath test_dir;
1236     if (!PathService::Get(chrome::DIR_TEST_DATA, &test_dir)) {
1237       EXPECT_TRUE(false);
1238       return false;
1239     }
1240
1241     // Initialize the SafeBrowsing cookies with a pre-created cookie store.  It
1242     // contains a single cookie, for domain 127.0.0.1, with value a=b, and
1243     // expires in 2038.
1244     base::FilePath initial_cookies = test_dir.AppendASCII("safe_browsing")
1245         .AppendASCII("Safe Browsing Cookies");
1246     if (!base::CopyFile(initial_cookies, cookie_path)) {
1247       EXPECT_TRUE(false);
1248       return false;
1249     }
1250
1251     sql::Connection db;
1252     if (!db.Open(cookie_path)) {
1253       EXPECT_TRUE(false);
1254       return false;
1255     }
1256     // Ensure the host value in the cookie file matches the test server we will
1257     // be connecting to.
1258     sql::Statement smt(db.GetUniqueStatement(
1259         "UPDATE cookies SET host_key = ?"));
1260     if (!smt.is_valid()) {
1261       EXPECT_TRUE(false);
1262       return false;
1263     }
1264     if (!smt.BindString(0, embedded_test_server()->base_url().host())) {
1265       EXPECT_TRUE(false);
1266       return false;
1267     }
1268     if (!smt.Run()) {
1269       EXPECT_TRUE(false);
1270       return false;
1271     }
1272
1273     return InProcessBrowserTest::SetUpUserDataDirectory();
1274   }
1275
1276   void TearDownInProcessBrowserTestFixture() override {
1277     InProcessBrowserTest::TearDownInProcessBrowserTestFixture();
1278
1279     sql::Connection db;
1280     base::FilePath cookie_path(
1281         SafeBrowsingService::GetCookieFilePathForTesting());
1282     ASSERT_TRUE(db.Open(cookie_path));
1283
1284     sql::Statement smt(db.GetUniqueStatement(
1285         "SELECT name, value FROM cookies ORDER BY name"));
1286     ASSERT_TRUE(smt.is_valid());
1287
1288     ASSERT_TRUE(smt.Step());
1289     ASSERT_EQ("a", smt.ColumnString(0));
1290     ASSERT_EQ("b", smt.ColumnString(1));
1291     ASSERT_TRUE(smt.Step());
1292     ASSERT_EQ("c", smt.ColumnString(0));
1293     ASSERT_EQ("d", smt.ColumnString(1));
1294     EXPECT_FALSE(smt.Step());
1295   }
1296
1297   void SetUpOnMainThread() override {
1298     sb_service_ = g_browser_process->safe_browsing_service();
1299     ASSERT_TRUE(sb_service_.get() != NULL);
1300   }
1301
1302   void TearDownOnMainThread() override { sb_service_ = NULL; }
1303
1304   void ForceUpdate() {
1305     sb_service_->protocol_manager()->ForceScheduleNextUpdate(
1306         base::TimeDelta::FromSeconds(0));
1307   }
1308
1309   scoped_refptr<SafeBrowsingService> sb_service_;
1310
1311  private:
1312   static scoped_ptr<net::test_server::HttpResponse> HandleRequest(
1313       const net::test_server::HttpRequest& request) {
1314     if (!base::StartsWith(request.relative_url, "/testpath/",
1315                           base::CompareCase::SENSITIVE)) {
1316       ADD_FAILURE() << "bad path";
1317       return nullptr;
1318     }
1319
1320     auto cookie_it = request.headers.find("Cookie");
1321     if (cookie_it == request.headers.end()) {
1322       ADD_FAILURE() << "no cookie header";
1323       return nullptr;
1324     }
1325
1326     net::cookie_util::ParsedRequestCookies req_cookies;
1327     net::cookie_util::ParseRequestCookieLine(cookie_it->second, &req_cookies);
1328     if (req_cookies.size() != 1) {
1329       ADD_FAILURE() << "req_cookies.size() = " << req_cookies.size();
1330       return nullptr;
1331     }
1332     const net::cookie_util::ParsedRequestCookie expected_cookie(
1333         std::make_pair("a", "b"));
1334     const net::cookie_util::ParsedRequestCookie& cookie = req_cookies.front();
1335     if (cookie != expected_cookie) {
1336       ADD_FAILURE() << "bad cookie " << cookie.first << "=" << cookie.second;
1337       return nullptr;
1338     }
1339
1340     scoped_ptr<net::test_server::BasicHttpResponse> http_response(
1341         new net::test_server::BasicHttpResponse());
1342     http_response->set_content("foo");
1343     http_response->set_content_type("text/plain");
1344     http_response->AddCustomHeader(
1345         "Set-Cookie", "c=d; Expires=Fri, 01 Jan 2038 01:01:01 GMT");
1346     return http_response.Pass();
1347   }
1348
1349   scoped_ptr<TestSafeBrowsingServiceFactory> sb_factory_;
1350
1351   DISALLOW_COPY_AND_ASSIGN(SafeBrowsingDatabaseManagerCookieTest);
1352 };
1353
1354 // Test that a Local Safe Browsing database update request both sends cookies
1355 // and can save cookies.
1356 IN_PROC_BROWSER_TEST_F(SafeBrowsingDatabaseManagerCookieTest,
1357                        TestSBUpdateCookies) {
1358   content::WindowedNotificationObserver observer(
1359       chrome::NOTIFICATION_SAFE_BROWSING_UPDATE_COMPLETE,
1360       content::Source<SafeBrowsingDatabaseManager>(
1361           sb_service_->database_manager().get()));
1362   BrowserThread::PostTask(
1363       BrowserThread::IO,
1364       FROM_HERE,
1365       base::Bind(&SafeBrowsingDatabaseManagerCookieTest::ForceUpdate, this));
1366   observer.Wait();
1367 }