| // Copyright 2023 The Chromium Authors |
| // Use of this source code is governed by a BSD-style license that can be |
| // found in the LICENSE file. |
| |
| #include "content/browser/btm/btm_test_utils.h" |
| |
| #include <string_view> |
| |
| #include "base/strings/stringprintf.h" |
| #include "base/test/bind.h" |
| #include "components/content_settings/core/common/content_settings.h" |
| #include "components/content_settings/core/common/content_settings_pattern.h" |
| #include "components/content_settings/core/common/content_settings_utils.h" |
| #include "content/browser/btm/btm_service_impl.h" |
| #include "content/browser/renderer_host/navigation_request.h" |
| #include "content/public/browser/browsing_data_remover.h" |
| #include "content/public/browser/btm_service.h" |
| #include "content/public/browser/web_contents.h" |
| #include "content/public/common/content_features.h" |
| #include "content/public/test/browser_test_utils.h" |
| #include "content/public/test/hit_test_region_observer.h" |
| #include "content/public/test/test_frame_navigation_observer.h" |
| #include "content/public/test/test_utils.h" |
| #include "net/base/schemeful_site.h" |
| #include "net/cookies/cookie_setting_override.h" |
| #include "net/cookies/site_for_cookies.h" |
| #include "net/test/embedded_test_server/embedded_test_server.h" |
| #include "services/metrics/public/cpp/ukm_source_id.h" |
| #include "testing/gmock/include/gmock/gmock.h" |
| #include "third_party/blink/public/mojom/frame/frame.mojom-shared.h" |
| |
| namespace content { |
| |
| void CloseTab(WebContents* web_contents) { |
| WebContentsDestroyedWatcher destruction_watcher(web_contents); |
| web_contents->Close(); |
| destruction_watcher.Wait(); |
| } |
| |
| base::expected<WebContents*, std::string> OpenInNewTab( |
| WebContents* original_tab, |
| const GURL& url) { |
| OpenedWindowObserver tab_observer(original_tab, |
| WindowOpenDisposition::NEW_FOREGROUND_TAB); |
| if (!ExecJs(original_tab, JsReplace("window.open($1, '_blank');", url))) { |
| return base::unexpected("window.open failed"); |
| } |
| tab_observer.Wait(); |
| |
| // Wait for the new tab to finish navigating. |
| WaitForLoadStop(tab_observer.window()); |
| |
| return tab_observer.window(); |
| } |
| |
| [[nodiscard]] testing::AssertionResult AccessStorage( |
| RenderFrameHost* frame, |
| blink::mojom::StorageTypeAccessed type) { |
| // We drop the first character of ToString(type) because it's just the |
| // constant-indicating 'k'. |
| return ExecJs(frame, |
| base::StringPrintf(kStorageAccessScript, |
| base::ToString(type).substr(1).c_str()), |
| EXECUTE_SCRIPT_NO_USER_GESTURE, |
| /*world_id=*/1); |
| } |
| |
| void AccessCookieViaJSIn(WebContents* web_contents, RenderFrameHost* frame) { |
| FrameCookieAccessObserver observer(web_contents, frame, |
| CookieOperation::kChange); |
| ASSERT_TRUE(ExecJs(frame, "document.cookie = 'foo=bar';", |
| EXECUTE_SCRIPT_NO_USER_GESTURE)); |
| observer.Wait(); |
| } |
| |
| [[nodiscard]] testing::AssertionResult ClientSideRedirectViaMetaTag( |
| WebContents* web_contents, |
| RenderFrameHost* frame, |
| const GURL& target_url, |
| const std::optional<const GURL>& expected_commit_url) { |
| TestFrameNavigationObserver nav_observer(frame); |
| bool js_succeeded = ExecJs(frame, |
| JsReplace( |
| R"( |
| function redirectViaMetaTag() { |
| var element = document.createElement('meta'); |
| element.setAttribute('http-equiv', 'refresh'); |
| element.setAttribute('content', '0; url=$1'); |
| document.getElementsByTagName('head')[0].appendChild(element); |
| } |
| if (document.readyState === "loading") { |
| document.addEventListener("DOMContentLoaded", redirectViaMetaTag); |
| } else { |
| redirectViaMetaTag(); |
| } |
| )", |
| target_url), |
| EXECUTE_SCRIPT_NO_USER_GESTURE); |
| if (!js_succeeded) { |
| return testing::AssertionFailure() |
| << "Failed to execute script to client-side redirect to URL " |
| << target_url; |
| } |
| nav_observer.Wait(); |
| if (nav_observer.last_committed_url() == |
| expected_commit_url.value_or(target_url)) { |
| return testing::AssertionSuccess(); |
| } else { |
| return testing::AssertionFailure() |
| << "Expected to arrive at " |
| << expected_commit_url.value_or(target_url) |
| << " but URL was actually " << nav_observer.last_committed_url(); |
| } |
| } |
| |
| [[nodiscard]] testing::AssertionResult ClientSideRedirectViaJS( |
| WebContents* web_contents, |
| RenderFrameHost* frame, |
| const GURL& target_url, |
| const std::optional<const GURL>& expected_commit_url) { |
| TestFrameNavigationObserver nav_observer(frame); |
| bool js_succeeded = |
| ExecJs(frame, JsReplace(R"(window.location.replace($1);)", target_url), |
| EXECUTE_SCRIPT_NO_USER_GESTURE); |
| if (!js_succeeded) { |
| return testing::AssertionFailure() |
| << "Failed to execute script to client-side redirect to URL " |
| << target_url; |
| } |
| nav_observer.Wait(); |
| if (nav_observer.last_committed_url() == |
| expected_commit_url.value_or(target_url)) { |
| return testing::AssertionSuccess(); |
| } else { |
| return testing::AssertionFailure() |
| << "Expected to arrive at " |
| << expected_commit_url.value_or(target_url) |
| << " but URL was actually " << nav_observer.last_committed_url(); |
| } |
| } |
| |
| std::string StringifyBtmClientRedirectMethod( |
| BtmClientRedirectMethod client_redirect_method) { |
| switch (client_redirect_method) { |
| case BtmClientRedirectMethod::kMetaTag: |
| return "MetaTag"; |
| case BtmClientRedirectMethod::kJsWindowLocationReplace: |
| return "JsWindowLocationReplace"; |
| case BtmClientRedirectMethod::kRedirectLikeNavigation: |
| return "RedirectLikeNavigation"; |
| } |
| } |
| |
| [[nodiscard]] testing::AssertionResult PerformClientRedirect( |
| BtmClientRedirectMethod redirect_method, |
| WebContents* web_contents, |
| const GURL& redirect_url, |
| const std::optional<const GURL>& expected_commit_url) { |
| const GURL& commit_url = expected_commit_url.value_or(redirect_url); |
| switch (redirect_method) { |
| case BtmClientRedirectMethod::kMetaTag: |
| return ClientSideRedirectViaMetaTag(web_contents, |
| web_contents->GetPrimaryMainFrame(), |
| redirect_url, commit_url); |
| case BtmClientRedirectMethod::kJsWindowLocationReplace: |
| return ClientSideRedirectViaJS(web_contents, |
| web_contents->GetPrimaryMainFrame(), |
| redirect_url, commit_url); |
| case BtmClientRedirectMethod::kRedirectLikeNavigation: |
| return testing::AssertionResult( |
| NavigateToURLFromRendererWithoutUserGesture( |
| web_contents, redirect_url, commit_url)); |
| } |
| } |
| |
| bool NavigateToSetCookie(WebContents* web_contents, |
| const net::EmbeddedTestServer* server, |
| std::string_view host, |
| bool is_secure_cookie_set, |
| bool is_ad_tagged) { |
| std::string relative_url = "/set-cookie?name=value"; |
| if (is_secure_cookie_set) { |
| relative_url += ";Secure;SameSite=None"; |
| } |
| if (is_ad_tagged) { |
| relative_url += "&isad=1"; |
| } |
| const auto url = server->GetURL(host, relative_url); |
| |
| URLCookieAccessObserver observer(web_contents, url, CookieOperation::kChange); |
| bool success = NavigateToURL(web_contents, url); |
| if (success) { |
| observer.Wait(); |
| } |
| return success; |
| } |
| |
| void CreateImageAndWaitForCookieAccess(WebContents* web_contents, |
| const GURL& image_url) { |
| URLCookieAccessObserver observer(web_contents, image_url, |
| CookieOperation::kRead); |
| ASSERT_TRUE(ExecJs(web_contents, |
| JsReplace( |
| R"( |
| let img = document.createElement('img'); |
| img.src = $1; |
| document.body.appendChild(img);)", |
| image_url), |
| EXECUTE_SCRIPT_NO_USER_GESTURE)); |
| // The image must cause a cookie access, or else this will hang. |
| observer.Wait(); |
| } |
| |
| std::optional<StateValue> GetBtmState(BtmServiceImpl* btm_service, |
| const GURL& url) { |
| std::optional<StateValue> state; |
| |
| auto* storage = btm_service->storage(); |
| DCHECK(storage); |
| storage->AsyncCall(&BtmStorage::Read) |
| .WithArgs(url) |
| .Then(base::BindLambdaForTesting([&](const BtmState& loaded_state) { |
| if (loaded_state.was_loaded()) { |
| state = loaded_state.ToStateValue(); |
| } |
| })); |
| WaitOnStorage(btm_service); |
| |
| return state; |
| } |
| |
| URLCookieAccessObserver::URLCookieAccessObserver(WebContents* web_contents, |
| const GURL& url, |
| CookieOperation access_type) |
| : WebContentsObserver(web_contents), url_(url), access_type_(access_type) {} |
| |
| void URLCookieAccessObserver::Wait() { |
| run_loop_.Run(); |
| } |
| |
| void URLCookieAccessObserver::OnCookiesAccessed( |
| RenderFrameHost* render_frame_host, |
| const CookieAccessDetails& details) { |
| cookie_accessed_in_primary_page_ = IsInPrimaryPage(*render_frame_host); |
| |
| if (details.type == access_type_ && details.url == url_) { |
| run_loop_.Quit(); |
| } |
| } |
| |
| void URLCookieAccessObserver::OnCookiesAccessed( |
| NavigationHandle* navigation_handle, |
| const CookieAccessDetails& details) { |
| cookie_accessed_in_primary_page_ = IsInPrimaryPage(*navigation_handle); |
| |
| if (details.type == access_type_ && details.url == url_) { |
| run_loop_.Quit(); |
| } |
| } |
| |
| bool URLCookieAccessObserver::CookieAccessedInPrimaryPage() const { |
| return cookie_accessed_in_primary_page_; |
| } |
| |
| FrameCookieAccessObserver::FrameCookieAccessObserver( |
| WebContents* web_contents, |
| RenderFrameHost* render_frame_host, |
| CookieOperation access_type) |
| : WebContentsObserver(web_contents), |
| render_frame_host_(render_frame_host), |
| access_type_(access_type) {} |
| |
| void FrameCookieAccessObserver::Wait() { |
| run_loop_.Run(); |
| } |
| |
| void FrameCookieAccessObserver::OnCookiesAccessed( |
| RenderFrameHost* render_frame_host, |
| const CookieAccessDetails& details) { |
| if (details.type == access_type_ && render_frame_host_ == render_frame_host) { |
| run_loop_.Quit(); |
| } |
| } |
| |
| UserActivationObserver::UserActivationObserver( |
| WebContents* web_contents, |
| RenderFrameHost* render_frame_host) |
| : WebContentsObserver(web_contents), |
| render_frame_host_(render_frame_host) {} |
| |
| void UserActivationObserver::Wait() { |
| run_loop_.Run(); |
| } |
| |
| void UserActivationObserver::FrameReceivedUserActivation( |
| RenderFrameHost* render_frame_host) { |
| if (render_frame_host_ == render_frame_host) { |
| run_loop_.Quit(); |
| } |
| } |
| |
| EntryUrlsAre::EntryUrlsAre(std::string entry_name, |
| std::vector<std::string> urls) |
| : entry_name_(std::move(entry_name)), expected_urls_(std::move(urls)) { |
| // Sort the URLs before comparing, so order doesn't matter. (BtmDatabase |
| // currently sorts its results, but that could change and these tests |
| // shouldn't care.) |
| std::sort(expected_urls_.begin(), expected_urls_.end()); |
| } |
| |
| EntryUrlsAre::EntryUrlsAre(const EntryUrlsAre&) = default; |
| EntryUrlsAre::EntryUrlsAre(EntryUrlsAre&&) = default; |
| EntryUrlsAre::~EntryUrlsAre() = default; |
| |
| bool EntryUrlsAre::MatchAndExplain( |
| const ukm::TestUkmRecorder& ukm_recorder, |
| testing::MatchResultListener* result_listener) const { |
| std::vector<std::string> actual_urls; |
| for (const ukm::mojom::UkmEntry* entry : |
| ukm_recorder.GetEntriesByName(entry_name_)) { |
| GURL url = ukm_recorder.GetSourceForSourceId(entry->source_id)->url(); |
| actual_urls.push_back(url.spec()); |
| } |
| std::sort(actual_urls.begin(), actual_urls.end()); |
| |
| // ExplainMatchResult() won't print out the full contents of `actual_urls`, |
| // so for more helpful error messages, we do it ourselves. |
| *result_listener << "whose entries for '" << entry_name_ |
| << "' contain the URLs " |
| << testing::PrintToString(actual_urls) << ", "; |
| |
| // Use ContainerEq() instead of e.g. ElementsAreArray() because the error |
| // messages are much more useful. |
| return ExplainMatchResult(testing::ContainerEq(expected_urls_), actual_urls, |
| result_listener); |
| } |
| |
| void EntryUrlsAre::DescribeTo(std::ostream* os) const { |
| *os << "has entries for '" << entry_name_ << "' whose URLs are " |
| << testing::PrintToString(expected_urls_); |
| } |
| |
| void EntryUrlsAre::DescribeNegationTo(std::ostream* os) const { |
| *os << "does not have entries for '" << entry_name_ << "' whose URLs are " |
| << testing::PrintToString(expected_urls_); |
| } |
| |
| ScopedInitFeature::ScopedInitFeature(const base::Feature& feature, |
| bool enable, |
| const base::FieldTrialParams& params) { |
| if (enable) { |
| feature_list_.InitAndEnableFeatureWithParameters(feature, params); |
| } else { |
| feature_list_.InitAndDisableFeature(feature); |
| } |
| } |
| |
| ScopedInitBtmFeature::ScopedInitBtmFeature(bool enable, |
| const base::FieldTrialParams& params) |
| : init_feature_(features::kBtm, enable, params) {} |
| |
| OpenedWindowObserver::OpenedWindowObserver( |
| WebContents* web_contents, |
| WindowOpenDisposition open_disposition) |
| : WebContentsObserver(web_contents), open_disposition_(open_disposition) {} |
| |
| void OpenedWindowObserver::DidOpenRequestedURL( |
| WebContents* new_contents, |
| RenderFrameHost* source_render_frame_host, |
| const GURL& url, |
| const Referrer& referrer, |
| WindowOpenDisposition disposition, |
| ui::PageTransition transition, |
| bool started_from_context_menu, |
| bool renderer_initiated) { |
| if (!window_ && disposition == open_disposition_) { |
| window_ = new_contents; |
| run_loop_.Quit(); |
| } |
| } |
| |
| // TODO - crbug.com/40247129: Remove this method in favor of directly using |
| // SimulateMouseClickAndWait() once mouse clicks / taps reliably trigger user |
| // activation on Android |
| void SimulateUserActivation(WebContents* web_contents) { |
| #if BUILDFLAG(IS_ANDROID) |
| ASSERT_TRUE(ExecJs(web_contents, "")); |
| #else |
| SimulateMouseClickAndWait(web_contents); |
| #endif |
| } |
| |
| void SimulateMouseClickAndWait(WebContents* web_contents) { |
| WaitForHitTestData(web_contents->GetPrimaryMainFrame()); |
| UserActivationObserver observer(web_contents, |
| web_contents->GetPrimaryMainFrame()); |
| SimulateMouseClick(web_contents, 0, blink::WebMouseEvent::Button::kLeft); |
| observer.Wait(); |
| } |
| |
| TpcBlockingBrowserClient::TpcBlockingBrowserClient() = default; |
| TpcBlockingBrowserClient::~TpcBlockingBrowserClient() = default; |
| |
| bool TpcBlockingBrowserClient::IsFullCookieAccessAllowed( |
| BrowserContext* browser_context, |
| WebContents* web_contents, |
| const GURL& url, |
| const blink::StorageKey& storage_key, |
| net::CookieSettingOverrides overrides) { |
| return IsFullCookieAccessAllowed(url, storage_key.ToNetSiteForCookies(), |
| storage_key.origin(), overrides, |
| storage_key.ToCookiePartitionKey()); |
| } |
| |
| void TpcBlockingBrowserClient::GrantCookieAccessDueToHeuristic( |
| BrowserContext* browser_context, |
| const net::SchemefulSite& top_frame_site, |
| const net::SchemefulSite& accessing_site, |
| base::TimeDelta ttl, |
| bool ignore_schemes) { |
| ContentSettingsPattern primary_pattern = |
| ContentSettingsPattern::FromURLToSchemefulSitePattern( |
| accessing_site.GetURL()); |
| ContentSettingsPattern secondary_pattern = |
| ContentSettingsPattern::FromURLToSchemefulSitePattern( |
| top_frame_site.GetURL()); |
| if (ignore_schemes) { |
| primary_pattern = |
| ContentSettingsPattern::ToHostOnlyPattern(primary_pattern); |
| secondary_pattern = |
| ContentSettingsPattern::ToHostOnlyPattern(secondary_pattern); |
| } |
| tpc_content_settings_.SetValue(primary_pattern, secondary_pattern, |
| base::Value(CONTENT_SETTING_ALLOW), |
| /*metadata=*/{}); |
| } |
| |
| bool TpcBlockingBrowserClient::AreThirdPartyCookiesGenerallyAllowed( |
| BrowserContext* browser_context, |
| WebContents* web_contents) { |
| return !block_3pcs_; |
| } |
| |
| bool TpcBlockingBrowserClient::ShouldBtmDeleteInteractionRecords( |
| uint64_t remove_mask) { |
| return remove_mask & TpcBlockingBrowserClient::DATA_TYPE_HISTORY; |
| } |
| |
| void TpcBlockingBrowserClient::AllowThirdPartyCookiesOnSite(const GURL& url) { |
| tpc_content_settings_.SetValue( |
| ContentSettingsPattern::Wildcard(), |
| ContentSettingsPattern::FromURLToSchemefulSitePattern(url), |
| base::Value(CONTENT_SETTING_ALLOW), /*metadata=*/{}); |
| } |
| |
| void TpcBlockingBrowserClient::GrantCookieAccessTo3pSite(const GURL& url) { |
| tpc_content_settings_.SetValue( |
| ContentSettingsPattern::FromURLToSchemefulSitePattern(url), |
| ContentSettingsPattern::Wildcard(), base::Value(CONTENT_SETTING_ALLOW), |
| /*metadata=*/{}); |
| } |
| |
| void TpcBlockingBrowserClient::BlockThirdPartyCookiesOnSite(const GURL& url) { |
| tpc_content_settings_.SetValue( |
| ContentSettingsPattern::Wildcard(), |
| ContentSettingsPattern::FromURLToSchemefulSitePattern(url), |
| base::Value(CONTENT_SETTING_BLOCK), /*metadata=*/{}); |
| } |
| |
| void TpcBlockingBrowserClient::BlockThirdPartyCookies( |
| const GURL& url, |
| const GURL& first_party_url) { |
| tpc_content_settings_.SetValue( |
| ContentSettingsPattern::FromURLToSchemefulSitePattern(url), |
| ContentSettingsPattern::FromURLToSchemefulSitePattern(first_party_url), |
| base::Value(CONTENT_SETTING_BLOCK), /*metadata=*/{}); |
| } |
| |
| // Overrides for content_settings::CookieSettingsBase |
| |
| bool TpcBlockingBrowserClient::ShouldIgnoreSameSiteRestrictions( |
| const GURL& url, |
| const net::SiteForCookies& site_for_cookies) const { |
| return false; |
| } |
| |
| ContentSetting TpcBlockingBrowserClient::GetContentSetting( |
| const GURL& primary_url, |
| const GURL& secondary_url, |
| ContentSettingsType content_type, |
| content_settings::SettingInfo* info) const { |
| if (content_type != ContentSettingsType::COOKIES) { |
| return CONTENT_SETTING_DEFAULT; |
| } |
| |
| const content_settings::RuleEntry* rule_entry = |
| tpc_content_settings_.Find(primary_url, secondary_url); |
| if (rule_entry == nullptr) { |
| if (info) { |
| info->primary_pattern = ContentSettingsPattern::Wildcard(); |
| info->secondary_pattern = ContentSettingsPattern::Wildcard(); |
| } |
| // By default we'll allow cookies. Blocking by default will override any 3PC |
| // exemption settings. |
| return CONTENT_SETTING_ALLOW; |
| } |
| if (info) { |
| info->primary_pattern = rule_entry->first.primary_pattern; |
| info->secondary_pattern = rule_entry->first.secondary_pattern; |
| } |
| return content_settings::ValueToContentSetting(rule_entry->second.value); |
| } |
| |
| bool TpcBlockingBrowserClient::ShouldAlwaysAllowCookies( |
| const GURL& url, |
| const GURL& first_party_url) const { |
| return false; |
| } |
| |
| bool TpcBlockingBrowserClient::ShouldBlockThirdPartyCookies( |
| base::optional_ref<const url::Origin> top_frame_origin, |
| net::CookieSettingOverrides overrides) const { |
| return block_3pcs_; |
| } |
| |
| bool TpcBlockingBrowserClient::MitigationsEnabledFor3pcd() const { |
| return false; |
| } |
| |
| bool TpcBlockingBrowserClient::IsThirdPartyCookiesAllowedScheme( |
| std::string_view scheme) const { |
| return false; |
| } |
| |
| PausedCookieAccessObservers::PausedCookieAccessObservers( |
| NotifyCookiesAccessedCallback callback, |
| PendingObserversWithContext observers) |
| : CookieAccessObservers(std::move(callback)), |
| pending_receivers_(std::move(observers)) {} |
| |
| PausedCookieAccessObservers::~PausedCookieAccessObservers() = default; |
| |
| void PausedCookieAccessObservers::Add( |
| mojo::PendingReceiver<network::mojom::CookieAccessObserver> receiver, |
| CookieAccessDetails::Source source) { |
| pending_receivers_.emplace_back(std::move(receiver), source); |
| } |
| |
| PausedCookieAccessObservers::PendingObserversWithContext |
| PausedCookieAccessObservers::TakeReceiversWithContext() { |
| return std::exchange(pending_receivers_, {}); |
| } |
| |
| CookieAccessInterceptor::CookieAccessInterceptor(WebContents& web_contents) |
| : WebContentsObserver(&web_contents) {} |
| |
| CookieAccessInterceptor::~CookieAccessInterceptor() = default; |
| |
| void CookieAccessInterceptor::DidStartNavigation( |
| NavigationHandle* navigation_handle) { |
| auto& request = *NavigationRequest::From(navigation_handle); |
| |
| auto observers = std::make_unique<PausedCookieAccessObservers>( |
| base::BindRepeating(&NavigationRequest::NotifyCookiesAccessed, |
| // Unretained is safe here because ownership of the |
| // observers is passed to the request below. |
| base::Unretained(&request)), |
| request.TakeCookieObservers()); |
| request.SetCookieAccessObserversForTesting(std::move(observers)); |
| } |
| |
| } // namespace content |
