// Copyright (c) 2012 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include <stdint.h>

#include "base/base64.h"
#include "base/stl_util.h"
#include "base/strings/string_piece.h"
#include "crypto/sha2.h"
#include "net/base/host_port_pair.h"
#include "net/base/test_completion_callback.h"
#include "net/http/http_security_headers.h"
#include "net/http/http_util.h"
#include "net/http/transport_security_state.h"
#include "net/ssl/ssl_info.h"
#include "testing/gtest/include/gtest/gtest.h"

namespace net {

namespace {

namespace test_default {
#include "net/http/transport_security_state_static_unittest_default.h"
}

}  // anonymous namespace

class HttpSecurityHeadersTest : public testing::Test {
 public:
  ~HttpSecurityHeadersTest() override {
    SetTransportSecurityStateSourceForTesting(nullptr);
  }
};


TEST_F(HttpSecurityHeadersTest, BogusHeaders) {
  base::TimeDelta max_age;
  bool include_subdomains = false;

  EXPECT_FALSE(
      ParseHSTSHeader(std::string(), &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("    ", &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("abc", &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("  abc", &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("  abc   ", &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age", &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("  max-age", &max_age,
                               &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("  max-age  ", &max_age,
                               &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age=", &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("   max-age=", &max_age,
                               &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("   max-age  =", &max_age,
                               &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("   max-age=   ", &max_age,
                               &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("   max-age  =     ", &max_age,
                               &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("   max-age  =     xy", &max_age,
                               &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("   max-age  =     3488a923", &max_age,
                               &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age=3488a923  ", &max_age,
                               &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-ag=3488923", &max_age,
                               &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-aged=3488923", &max_age,
                               &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age==3488923", &max_age,
                               &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("amax-age=3488923", &max_age,
                               &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age=-3488923", &max_age,
                               &include_subdomains));
  EXPECT_FALSE(
      ParseHSTSHeader("max-age=+3488923", &max_age, &include_subdomains));
  EXPECT_FALSE(
      ParseHSTSHeader("max-age=13####", &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age=9223372036854775807#####", &max_age,
                               &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age=18446744073709551615####", &max_age,
                               &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age=999999999999999999999999$.&#!",
                               &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age=3488923     e", &max_age,
                               &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age=3488923     includesubdomain",
                               &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age=3488923includesubdomains",
                               &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age=3488923=includesubdomains",
                               &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 includesubdomainx",
                               &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 includesubdomain=",
                               &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 includesubdomain=true",
                               &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 includesubdomainsx",
                               &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age=3488923 includesubdomains x",
                               &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age=34889.23 includesubdomains",
                               &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age=34889 includesubdomains",
                               &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader(";;;; ;;;",
                               &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader(";;;; includeSubDomains;;;",
                               &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("   includeSubDomains;  ",
                               &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader(";",
                               &max_age, &include_subdomains));
  EXPECT_FALSE(ParseHSTSHeader("max-age; ;",
                               &max_age, &include_subdomains));

  // Check the out args were not updated by checking the default
  // values for its predictable fields.
  EXPECT_EQ(0, max_age.InSeconds());
  EXPECT_FALSE(include_subdomains);
}

TEST_F(HttpSecurityHeadersTest, ValidSTSHeaders) {
  base::TimeDelta max_age;
  base::TimeDelta expect_max_age;
  bool include_subdomains = false;

  EXPECT_TRUE(ParseHSTSHeader("max-age=243", &max_age,
                              &include_subdomains));
  expect_max_age = base::TimeDelta::FromSeconds(243);
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_FALSE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader("max-age=3488923;", &max_age,
                              &include_subdomains));

  EXPECT_TRUE(ParseHSTSHeader("  Max-agE    = 567", &max_age,
                              &include_subdomains));
  expect_max_age = base::TimeDelta::FromSeconds(567);
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_FALSE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader("  mAx-aGe    = 890      ", &max_age,
                              &include_subdomains));
  expect_max_age = base::TimeDelta::FromSeconds(890);
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_FALSE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader("max-age=123;incLudesUbdOmains", &max_age,
                              &include_subdomains));
  expect_max_age = base::TimeDelta::FromSeconds(123);
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_TRUE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader("incLudesUbdOmains; max-age=123", &max_age,
                              &include_subdomains));
  expect_max_age = base::TimeDelta::FromSeconds(123);
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_TRUE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader("   incLudesUbdOmains; max-age=123",
                              &max_age, &include_subdomains));
  expect_max_age = base::TimeDelta::FromSeconds(123);
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_TRUE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader(
      "   incLudesUbdOmains; max-age=123; pumpkin=kitten", &max_age,
                                   &include_subdomains));
  expect_max_age = base::TimeDelta::FromSeconds(123);
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_TRUE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader(
      "   pumpkin=894; incLudesUbdOmains; max-age=123  ", &max_age,
                                   &include_subdomains));
  expect_max_age = base::TimeDelta::FromSeconds(123);
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_TRUE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader(
      "   pumpkin; incLudesUbdOmains; max-age=123  ", &max_age,
                                   &include_subdomains));
  expect_max_age = base::TimeDelta::FromSeconds(123);
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_TRUE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader(
      "   pumpkin; incLudesUbdOmains; max-age=\"123\"  ", &max_age,
                                   &include_subdomains));
  expect_max_age = base::TimeDelta::FromSeconds(123);
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_TRUE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader(
      "animal=\"squirrel; distinguished\"; incLudesUbdOmains; max-age=123",
                                   &max_age, &include_subdomains));
  expect_max_age = base::TimeDelta::FromSeconds(123);
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_TRUE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader("max-age=394082;  incLudesUbdOmains",
                              &max_age, &include_subdomains));
  expect_max_age = base::TimeDelta::FromSeconds(394082);
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_TRUE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader(
      "max-age=39408299  ;incLudesUbdOmains", &max_age,
      &include_subdomains));
  expect_max_age =
      base::TimeDelta::FromSeconds(std::min(kMaxHSTSAgeSecs, 39408299u));
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_TRUE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader(
      "max-age=394082038  ; incLudesUbdOmains", &max_age,
      &include_subdomains));
  expect_max_age =
      base::TimeDelta::FromSeconds(std::min(kMaxHSTSAgeSecs, 394082038u));
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_TRUE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader(
      "max-age=394082038  ; incLudesUbdOmains;", &max_age,
      &include_subdomains));
  expect_max_age =
      base::TimeDelta::FromSeconds(std::min(kMaxHSTSAgeSecs, 394082038u));
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_TRUE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader(
      ";; max-age=394082038  ; incLudesUbdOmains; ;", &max_age,
      &include_subdomains));
  expect_max_age =
      base::TimeDelta::FromSeconds(std::min(kMaxHSTSAgeSecs, 394082038u));
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_TRUE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader(
      ";; max-age=394082038  ;", &max_age,
      &include_subdomains));
  expect_max_age =
      base::TimeDelta::FromSeconds(std::min(kMaxHSTSAgeSecs, 394082038u));
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_FALSE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader(
      ";;    ; ; max-age=394082038;;; includeSubdomains     ;;  ;", &max_age,
      &include_subdomains));
  expect_max_age =
      base::TimeDelta::FromSeconds(std::min(kMaxHSTSAgeSecs, 394082038u));
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_TRUE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader(
      "incLudesUbdOmains   ; max-age=394082038 ;;", &max_age,
      &include_subdomains));
  expect_max_age =
      base::TimeDelta::FromSeconds(std::min(kMaxHSTSAgeSecs, 394082038u));
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_TRUE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader(
      "  max-age=0  ;  incLudesUbdOmains   ", &max_age,
      &include_subdomains));
  expect_max_age = base::TimeDelta::FromSeconds(0);
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_TRUE(include_subdomains);

  EXPECT_TRUE(ParseHSTSHeader(
      "  max-age=999999999999999999999999999999999999999999999  ;"
      "  incLudesUbdOmains   ", &max_age, &include_subdomains));
  expect_max_age = base::TimeDelta::FromSeconds(
      kMaxHSTSAgeSecs);
  EXPECT_EQ(expect_max_age, max_age);
  EXPECT_TRUE(include_subdomains);
}

TEST_F(HttpSecurityHeadersTest, BogusExpectCTHeaders) {
  base::TimeDelta max_age;
  bool enforce = false;
  GURL report_uri;
  EXPECT_FALSE(
      ParseExpectCTHeader(std::string(), &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("    ", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("abc", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("  abc", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(
      ParseExpectCTHeader("  abc   ", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("max-age", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(
      ParseExpectCTHeader("  max-age", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(
      ParseExpectCTHeader("  max-age  ", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(
      ParseExpectCTHeader("max-age=", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(
      ParseExpectCTHeader("   max-age=", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(
      ParseExpectCTHeader("   max-age  =", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(
      ParseExpectCTHeader("   max-age=   ", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("   max-age  =     ", &max_age, &enforce,
                                   &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("   max-age  =     xy", &max_age, &enforce,
                                   &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("   max-age  =     3488a923", &max_age,
                                   &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("max-age=3488a923  ", &max_age, &enforce,
                                   &report_uri));
  EXPECT_FALSE(
      ParseExpectCTHeader("max-ag=3488923", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(
      ParseExpectCTHeader("max-aged=3488923", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(
      ParseExpectCTHeader("max-age==3488923", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(
      ParseExpectCTHeader("amax-age=3488923", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(
      ParseExpectCTHeader("max-age=-3488923", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(
      ParseExpectCTHeader("max-age=+3488923", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(
      ParseExpectCTHeader("max-age=13####", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("max-age=9223372036854775807#####", &max_age,
                                   &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("max-age=18446744073709551615####", &max_age,
                                   &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("max-age=999999999999999999999999$.&#!",
                                   &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923     e", &max_age, &enforce,
                                   &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923     includesubdomain",
                                   &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923includesubdomains", &max_age,
                                   &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923=includesubdomains",
                                   &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomainx",
                                   &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader(
      "max-age=3488923 includesubdomain=", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomain=true",
                                   &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomainsx",
                                   &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("max-age=3488923 includesubdomains x",
                                   &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("max-age=34889.23 includesubdomains",
                                   &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("max-age=34889 includesubdomains", &max_age,
                                   &enforce, &report_uri));
  EXPECT_FALSE(
      ParseExpectCTHeader(",,,, ,,,", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader(",,,, includeSubDomains,,,", &max_age,
                                   &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("   includeSubDomains,  ", &max_age,
                                   &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader(",", &max_age, &enforce, &report_uri));
  EXPECT_FALSE(
      ParseExpectCTHeader("max-age, ,", &max_age, &enforce, &report_uri));

  // Test that the parser rejects misquoted or invalid report-uris.
  EXPECT_FALSE(ParseExpectCTHeader("max-age=999, report-uri=\"http://foo;bar\'",
                                   &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("max-age=999, report-uri=\"foo;bar\"",
                                   &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("max-age=999, report-uri=\"\"", &max_age,
                                   &enforce, &report_uri));

  // Test that the parser does not fix up misquoted values.
  EXPECT_FALSE(
      ParseExpectCTHeader("max-age=\"999", &max_age, &enforce, &report_uri));

  // Test that the parser rejects headers that contain duplicate directives.
  EXPECT_FALSE(ParseExpectCTHeader("max-age=999, enforce, max-age=99999",
                                   &max_age, &enforce, &report_uri));
  EXPECT_FALSE(ParseExpectCTHeader("enforce, max-age=999, enforce", &max_age,
                                   &enforce, &report_uri));
  EXPECT_FALSE(
      ParseExpectCTHeader("report-uri=\"http://foo\", max-age=999, enforce, "
                          "report-uri=\"http://foo\"",
                          &max_age, &enforce, &report_uri));

  // Test that the parser rejects headers with values for the valueless
  // 'enforce' directive.
  EXPECT_FALSE(ParseExpectCTHeader("max-age=999, enforce=true", &max_age,
                                   &enforce, &report_uri));

  // Check the out args were not updated by checking the default
  // values for its predictable fields.
  EXPECT_EQ(0, max_age.InSeconds());
  EXPECT_FALSE(enforce);
  EXPECT_TRUE(report_uri.is_empty());
}

TEST_F(HttpSecurityHeadersTest, ValidExpectCTHeaders) {
  base::TimeDelta max_age;
  bool enforce = false;
  GURL report_uri;

  EXPECT_TRUE(
      ParseExpectCTHeader("max-age=243", &max_age, &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(243), max_age);
  EXPECT_FALSE(enforce);
  EXPECT_TRUE(report_uri.is_empty());

  EXPECT_TRUE(ParseExpectCTHeader("  Max-agE    = 567", &max_age, &enforce,
                                  &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(567), max_age);
  EXPECT_FALSE(enforce);
  EXPECT_TRUE(report_uri.is_empty());

  EXPECT_TRUE(ParseExpectCTHeader("  mAx-aGe    = 890      ", &max_age,
                                  &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(890), max_age);
  EXPECT_FALSE(enforce);
  EXPECT_TRUE(report_uri.is_empty());

  EXPECT_TRUE(ParseExpectCTHeader("max-age=123,enFoRce", &max_age, &enforce,
                                  &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_TRUE(report_uri.is_empty());

  enforce = false;
  EXPECT_TRUE(ParseExpectCTHeader("enFoRCE, max-age=123", &max_age, &enforce,
                                  &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_TRUE(report_uri.is_empty());

  enforce = false;
  EXPECT_TRUE(ParseExpectCTHeader("   enFORce, max-age=123", &max_age, &enforce,
                                  &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_TRUE(report_uri.is_empty());

  enforce = false;
  EXPECT_TRUE(ParseExpectCTHeader(
      "report-uri=\"https://foo.test\",   enFORce, max-age=123", &max_age,
      &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_EQ(GURL("https://foo.test"), report_uri);

  enforce = false;
  report_uri = GURL();
  EXPECT_TRUE(
      ParseExpectCTHeader("enforce,report-uri=\"https://foo.test\",max-age=123",
                          &max_age, &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_EQ(GURL("https://foo.test"), report_uri);

  enforce = false;
  report_uri = GURL();
  EXPECT_TRUE(
      ParseExpectCTHeader("enforce,report-uri=https://foo.test,max-age=123",
                          &max_age, &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_EQ(GURL("https://foo.test"), report_uri);

  report_uri = GURL();
  enforce = false;
  EXPECT_TRUE(ParseExpectCTHeader("report-uri=\"https://foo.test\",max-age=123",
                                  &max_age, &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
  EXPECT_FALSE(enforce);
  EXPECT_EQ(GURL("https://foo.test"), report_uri);

  report_uri = GURL();
  EXPECT_TRUE(ParseExpectCTHeader("   enFORcE, max-age=123, pumpkin=kitten",
                                  &max_age, &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_TRUE(report_uri.is_empty());

  enforce = false;
  EXPECT_TRUE(ParseExpectCTHeader(
      "   pumpkin=894, report-uri=     \"https://bar\", enFORce, max-age=123  ",
      &max_age, &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_EQ(GURL("https://bar"), report_uri);

  enforce = false;
  report_uri = GURL();
  EXPECT_TRUE(ParseExpectCTHeader("   pumpkin, enFoRcE, max-age=123  ",
                                  &max_age, &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_TRUE(report_uri.is_empty());

  enforce = false;
  EXPECT_TRUE(ParseExpectCTHeader("   pumpkin, enforce, max-age=\"123\"  ",
                                  &max_age, &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_TRUE(report_uri.is_empty());

  enforce = false;
  EXPECT_TRUE(ParseExpectCTHeader(
      "animal=\"squirrel, distinguished\", enFoRce, max-age=123", &max_age,
      &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(123), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_TRUE(report_uri.is_empty());

  enforce = false;
  EXPECT_TRUE(ParseExpectCTHeader("max-age=394082,  enforce", &max_age,
                                  &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(394082), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_TRUE(report_uri.is_empty());

  enforce = false;
  EXPECT_TRUE(ParseExpectCTHeader("max-age=39408299  ,enforce", &max_age,
                                  &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_TRUE(report_uri.is_empty());

  // Per RFC 7230, "a recipient MUST parse and ignore a reasonable number of
  // empty list elements".
  enforce = false;
  EXPECT_TRUE(ParseExpectCTHeader(",, max-age=394082038  , enfoRce, ,",
                                  &max_age, &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_TRUE(report_uri.is_empty());

  enforce = false;
  EXPECT_TRUE(ParseExpectCTHeader(",, max-age=394082038  ,", &max_age, &enforce,
                                  &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
  EXPECT_FALSE(enforce);
  EXPECT_TRUE(report_uri.is_empty());

  EXPECT_TRUE(
      ParseExpectCTHeader(",,    , , max-age=394082038,,, enforce     ,,  ,",
                          &max_age, &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_TRUE(report_uri.is_empty());

  enforce = false;
  EXPECT_TRUE(ParseExpectCTHeader("enfORce   , max-age=394082038 ,,", &max_age,
                                  &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_TRUE(report_uri.is_empty());

  enforce = false;
  EXPECT_TRUE(ParseExpectCTHeader("  max-age=0  ,  enforce   ", &max_age,
                                  &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(0), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_TRUE(report_uri.is_empty());

  enforce = false;
  EXPECT_TRUE(ParseExpectCTHeader(
      "  max-age=999999999999999999999999999999999999999999999  ,"
      "  enforce   ",
      &max_age, &enforce, &report_uri));
  EXPECT_EQ(base::TimeDelta::FromSeconds(kMaxExpectCTAgeSecs), max_age);
  EXPECT_TRUE(enforce);
  EXPECT_TRUE(report_uri.is_empty());
}

}  // namespace net