// Copyright 2016 The Chromium Authors. All rights reserved.
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "core/frame/csp/CSPDirectiveList.h"

#include "core/frame/SubresourceIntegrity.h"
#include "core/frame/csp/ContentSecurityPolicy.h"
#include "core/frame/csp/SourceListDirective.h"
#include "platform/loader/fetch/ResourceRequest.h"
#include "platform/network/ContentSecurityPolicyParsers.h"
#include "testing/gtest/include/gtest/gtest.h"
#include "wtf/text/StringOperators.h"
#include "wtf/text/WTFString.h"

namespace blink {

class CSPDirectiveListTest : public ::testing::Test {
 public:
  CSPDirectiveListTest() : csp(ContentSecurityPolicy::create()) {}

  virtual void SetUp() {
    csp->setupSelf(
        *SecurityOrigin::createFromString("https://example.test/image.png"));
  }

  CSPDirectiveList* createList(const String& list,
                               ContentSecurityPolicyHeaderType type) {
    Vector<UChar> characters;
    list.appendTo(characters);
    const UChar* begin = characters.data();
    const UChar* end = begin + characters.size();

    return CSPDirectiveList::create(csp, begin, end, type,
                                    ContentSecurityPolicyHeaderSourceHTTP);
  }

 protected:
  Persistent<ContentSecurityPolicy> csp;
};

TEST_F(CSPDirectiveListTest, Header) {
  struct TestCase {
    const char* list;
    const char* expected;
  } cases[] = {{"script-src 'self'", "script-src 'self'"},
               {"  script-src 'self'  ", "script-src 'self'"},
               {"\t\tscript-src 'self'", "script-src 'self'"},
               {"script-src 'self' \t", "script-src 'self'"}};

  for (const auto& test : cases) {
    Member<CSPDirectiveList> directiveList =
        createList(test.list, ContentSecurityPolicyHeaderTypeReport);
    EXPECT_EQ(test.expected, directiveList->header());
    directiveList =
        createList(test.list, ContentSecurityPolicyHeaderTypeEnforce);
    EXPECT_EQ(test.expected, directiveList->header());
  }
}

TEST_F(CSPDirectiveListTest, IsMatchingNoncePresent) {
  struct TestCase {
    const char* list;
    const char* nonce;
    bool expected;
  } cases[] = {
      {"script-src 'self'", "yay", false},
      {"script-src 'self'", "boo", false},
      {"script-src 'nonce-yay'", "yay", true},
      {"script-src 'nonce-yay'", "boo", false},
      {"script-src 'nonce-yay' 'nonce-boo'", "yay", true},
      {"script-src 'nonce-yay' 'nonce-boo'", "boo", true},

      // Falls back to 'default-src'
      {"default-src 'nonce-yay'", "yay", true},
      {"default-src 'nonce-yay'", "boo", false},
      {"default-src 'nonce-boo'; script-src 'nonce-yay'", "yay", true},
      {"default-src 'nonce-boo'; script-src 'nonce-yay'", "boo", false},

      // Unrelated directives do not affect result
      {"style-src 'nonce-yay'", "yay", false},
      {"style-src 'nonce-yay'", "boo", false},
  };

  for (const auto& test : cases) {
    // Report-only
    Member<CSPDirectiveList> directiveList =
        createList(test.list, ContentSecurityPolicyHeaderTypeReport);
    Member<SourceListDirective> scriptSrc =
        directiveList->operativeDirective(directiveList->m_scriptSrc.get());
    EXPECT_EQ(test.expected,
              directiveList->isMatchingNoncePresent(scriptSrc, test.nonce));
    // Empty/null strings are always not present, regardless of the policy.
    EXPECT_FALSE(directiveList->isMatchingNoncePresent(scriptSrc, ""));
    EXPECT_FALSE(directiveList->isMatchingNoncePresent(scriptSrc, String()));

    // Enforce
    directiveList =
        createList(test.list, ContentSecurityPolicyHeaderTypeEnforce);
    scriptSrc =
        directiveList->operativeDirective(directiveList->m_scriptSrc.get());
    EXPECT_EQ(test.expected,
              directiveList->isMatchingNoncePresent(scriptSrc, test.nonce));
    // Empty/null strings are always not present, regardless of the policy.
    EXPECT_FALSE(directiveList->isMatchingNoncePresent(scriptSrc, ""));
    EXPECT_FALSE(directiveList->isMatchingNoncePresent(scriptSrc, String()));
  }
}

TEST_F(CSPDirectiveListTest, AllowScriptFromSourceNoNonce) {
  struct TestCase {
    const char* list;
    const char* url;
    bool expected;
  } cases[] = {
      {"script-src https://example.com", "https://example.com/script.js", true},
      {"script-src https://example.com/", "https://example.com/script.js",
       true},
      {"script-src https://example.com/",
       "https://example.com/script/script.js", true},
      {"script-src https://example.com/script", "https://example.com/script.js",
       false},
      {"script-src https://example.com/script",
       "https://example.com/script/script.js", false},
      {"script-src https://example.com/script/",
       "https://example.com/script.js", false},
      {"script-src https://example.com/script/",
       "https://example.com/script/script.js", true},
      {"script-src https://example.com", "https://not.example.com/script.js",
       false},
      {"script-src https://*.example.com", "https://not.example.com/script.js",
       true},
      {"script-src https://*.example.com", "https://example.com/script.js",
       false},

      // Falls back to default-src:
      {"default-src https://example.com", "https://example.com/script.js",
       true},
      {"default-src https://example.com/", "https://example.com/script.js",
       true},
      {"default-src https://example.com/",
       "https://example.com/script/script.js", true},
      {"default-src https://example.com/script",
       "https://example.com/script.js", false},
      {"default-src https://example.com/script",
       "https://example.com/script/script.js", false},
      {"default-src https://example.com/script/",
       "https://example.com/script.js", false},
      {"default-src https://example.com/script/",
       "https://example.com/script/script.js", true},
      {"default-src https://example.com", "https://not.example.com/script.js",
       false},
      {"default-src https://*.example.com", "https://not.example.com/script.js",
       true},
      {"default-src https://*.example.com", "https://example.com/script.js",
       false},
  };

  for (const auto& test : cases) {
    SCOPED_TRACE(testing::Message() << "List: `" << test.list << "`, URL: `"
                                    << test.url << "`");
    KURL scriptSrc = KURL(KURL(), test.url);

    // Report-only
    Member<CSPDirectiveList> directiveList =
        createList(test.list, ContentSecurityPolicyHeaderTypeReport);
    EXPECT_EQ(test.expected,
              directiveList->allowScriptFromSource(
                  scriptSrc, String(), IntegrityMetadataSet(), ParserInserted,
                  ResourceRequest::RedirectStatus::NoRedirect,
                  SecurityViolationReportingPolicy::SuppressReporting));

    // Enforce
    directiveList =
        createList(test.list, ContentSecurityPolicyHeaderTypeEnforce);
    EXPECT_EQ(test.expected,
              directiveList->allowScriptFromSource(
                  scriptSrc, String(), IntegrityMetadataSet(), ParserInserted,
                  ResourceRequest::RedirectStatus::NoRedirect,
                  SecurityViolationReportingPolicy::SuppressReporting));
  }
}

TEST_F(CSPDirectiveListTest, AllowFromSourceWithNonce) {
  struct TestCase {
    const char* list;
    const char* url;
    const char* nonce;
    bool expected;
  } cases[] = {
      // Doesn't affect lists without nonces:
      {"https://example.com", "https://example.com/file", "yay", true},
      {"https://example.com", "https://example.com/file", "boo", true},
      {"https://example.com", "https://example.com/file", "", true},
      {"https://example.com", "https://not.example.com/file", "yay", false},
      {"https://example.com", "https://not.example.com/file", "boo", false},
      {"https://example.com", "https://not.example.com/file", "", false},

      // Doesn't affect URLs that match the whitelist.
      {"https://example.com 'nonce-yay'", "https://example.com/file", "yay",
       true},
      {"https://example.com 'nonce-yay'", "https://example.com/file", "boo",
       true},
      {"https://example.com 'nonce-yay'", "https://example.com/file", "", true},

      // Does affect URLs that don't.
      {"https://example.com 'nonce-yay'", "https://not.example.com/file", "yay",
       true},
      {"https://example.com 'nonce-yay'", "https://not.example.com/file", "boo",
       false},
      {"https://example.com 'nonce-yay'", "https://not.example.com/file", "",
       false},
  };

  for (const auto& test : cases) {
    SCOPED_TRACE(testing::Message() << "List: `" << test.list << "`, URL: `"
                                    << test.url << "`");
    KURL resource = KURL(KURL(), test.url);

    // Report-only 'script-src'
    Member<CSPDirectiveList> directiveList =
        createList(String("script-src ") + test.list,
                   ContentSecurityPolicyHeaderTypeReport);
    EXPECT_EQ(test.expected,
              directiveList->allowScriptFromSource(
                  resource, String(test.nonce), IntegrityMetadataSet(),
                  ParserInserted, ResourceRequest::RedirectStatus::NoRedirect,
                  SecurityViolationReportingPolicy::SuppressReporting));

    // Enforce 'script-src'
    directiveList = createList(String("script-src ") + test.list,
                               ContentSecurityPolicyHeaderTypeEnforce);
    EXPECT_EQ(test.expected,
              directiveList->allowScriptFromSource(
                  resource, String(test.nonce), IntegrityMetadataSet(),
                  ParserInserted, ResourceRequest::RedirectStatus::NoRedirect,
                  SecurityViolationReportingPolicy::SuppressReporting));

    // Report-only 'style-src'
    directiveList = createList(String("style-src ") + test.list,
                               ContentSecurityPolicyHeaderTypeReport);
    EXPECT_EQ(test.expected,
              directiveList->allowStyleFromSource(
                  resource, String(test.nonce),
                  ResourceRequest::RedirectStatus::NoRedirect,
                  SecurityViolationReportingPolicy::SuppressReporting));

    // Enforce 'style-src'
    directiveList = createList(String("style-src ") + test.list,
                               ContentSecurityPolicyHeaderTypeEnforce);
    EXPECT_EQ(test.expected,
              directiveList->allowStyleFromSource(
                  resource, String(test.nonce),
                  ResourceRequest::RedirectStatus::NoRedirect,
                  SecurityViolationReportingPolicy::SuppressReporting));

    // Report-only 'style-src'
    directiveList = createList(String("default-src ") + test.list,
                               ContentSecurityPolicyHeaderTypeReport);
    EXPECT_EQ(test.expected,
              directiveList->allowScriptFromSource(
                  resource, String(test.nonce), IntegrityMetadataSet(),
                  ParserInserted, ResourceRequest::RedirectStatus::NoRedirect,
                  SecurityViolationReportingPolicy::SuppressReporting));
    EXPECT_EQ(test.expected,
              directiveList->allowStyleFromSource(
                  resource, String(test.nonce),
                  ResourceRequest::RedirectStatus::NoRedirect,
                  SecurityViolationReportingPolicy::SuppressReporting));

    // Enforce 'style-src'
    directiveList = createList(String("default-src ") + test.list,
                               ContentSecurityPolicyHeaderTypeEnforce);
    EXPECT_EQ(test.expected,
              directiveList->allowScriptFromSource(
                  resource, String(test.nonce), IntegrityMetadataSet(),
                  ParserInserted, ResourceRequest::RedirectStatus::NoRedirect,
                  SecurityViolationReportingPolicy::SuppressReporting));
    EXPECT_EQ(test.expected,
              directiveList->allowStyleFromSource(
                  resource, String(test.nonce),
                  ResourceRequest::RedirectStatus::NoRedirect,
                  SecurityViolationReportingPolicy::SuppressReporting));
  }
}

TEST_F(CSPDirectiveListTest, AllowScriptFromSourceWithHash) {
  struct TestCase {
    const char* list;
    const char* url;
    const char* integrity;
    bool expected;
  } cases[] = {
      // Doesn't affect lists without hashes.
      {"https://example.com", "https://example.com/file", "sha256-yay", true},
      {"https://example.com", "https://example.com/file", "sha256-boo", true},
      {"https://example.com", "https://example.com/file", "", true},
      {"https://example.com", "https://not.example.com/file", "sha256-yay",
       false},
      {"https://example.com", "https://not.example.com/file", "sha256-boo",
       false},
      {"https://example.com", "https://not.example.com/file", "", false},

      // Doesn't affect URLs that match the whitelist.
      {"https://example.com 'sha256-yay'", "https://example.com/file",
       "sha256-yay", true},
      {"https://example.com 'sha256-yay'", "https://example.com/file",
       "sha256-boo", true},
      {"https://example.com 'sha256-yay'", "https://example.com/file", "",
       true},

      // Does affect URLs that don't match the whitelist.
      {"https://example.com 'sha256-yay'", "https://not.example.com/file",
       "sha256-yay", true},
      {"https://example.com 'sha256-yay'", "https://not.example.com/file",
       "sha256-boo", false},
      {"https://example.com 'sha256-yay'", "https://not.example.com/file", "",
       false},

      // Both algorithm and digest must match.
      {"'sha256-yay'", "https://a.com/file", "sha384-yay", false},

      // Sha-1 is not supported, but -384 and -512 are.
      {"'sha1-yay'", "https://a.com/file", "sha1-yay", false},
      {"'sha384-yay'", "https://a.com/file", "sha384-yay", true},
      {"'sha512-yay'", "https://a.com/file", "sha512-yay", true},

      // Unknown (or future) hash algorithms don't work.
      {"'asdf256-yay'", "https://a.com/file", "asdf256-yay", false},

      // But they also don't interfere.
      {"'sha256-yay'", "https://a.com/file", "sha256-yay asdf256-boo", true},

      // Additional whitelisted hashes in the CSP don't interfere.
      {"'sha256-yay' 'sha384-boo'", "https://a.com/file", "sha256-yay", true},
      {"'sha256-yay' 'sha384-boo'", "https://a.com/file", "sha384-boo", true},

      // All integrity hashes must appear in the CSP (and match).
      {"'sha256-yay'", "https://a.com/file", "sha256-yay sha384-boo", false},
      {"'sha384-boo'", "https://a.com/file", "sha256-yay sha384-boo", false},
      {"'sha256-yay' 'sha384-boo'", "https://a.com/file",
       "sha256-yay sha384-yay", false},
      {"'sha256-yay' 'sha384-boo'", "https://a.com/file",
       "sha256-boo sha384-boo", false},
      {"'sha256-yay' 'sha384-boo'", "https://a.com/file",
       "sha256-yay sha384-boo", true},

      // At least one integrity hash must be present.
      {"'sha256-yay'", "https://a.com/file", "", false},
  };

  for (const auto& test : cases) {
    SCOPED_TRACE(testing::Message()
                 << "List: `" << test.list << "`, URL: `" << test.url
                 << "`, Integrity: `" << test.integrity << "`");
    KURL resource = KURL(KURL(), test.url);

    IntegrityMetadataSet integrityMetadata;
    ASSERT_EQ(SubresourceIntegrity::IntegrityParseValidResult,
              SubresourceIntegrity::parseIntegrityAttribute(test.integrity,
                                                            integrityMetadata));

    // Report-only 'script-src'
    Member<CSPDirectiveList> directiveList =
        createList(String("script-src ") + test.list,
                   ContentSecurityPolicyHeaderTypeReport);
    EXPECT_EQ(test.expected,
              directiveList->allowScriptFromSource(
                  resource, String(), integrityMetadata, ParserInserted,
                  ResourceRequest::RedirectStatus::NoRedirect,
                  SecurityViolationReportingPolicy::SuppressReporting));

    // Enforce 'script-src'
    directiveList = createList(String("script-src ") + test.list,
                               ContentSecurityPolicyHeaderTypeEnforce);
    EXPECT_EQ(test.expected,
              directiveList->allowScriptFromSource(
                  resource, String(), integrityMetadata, ParserInserted,
                  ResourceRequest::RedirectStatus::NoRedirect,
                  SecurityViolationReportingPolicy::SuppressReporting));
  }
}

TEST_F(CSPDirectiveListTest, allowRequestWithoutIntegrity) {
  struct TestCase {
    const char* list;
    const char* url;
    const WebURLRequest::RequestContext context;
    bool expected;
  } cases[] = {

      {"require-sri-for script", "https://example.com/file",
       WebURLRequest::RequestContextScript, false},

      // Extra WSP
      {"require-sri-for  script     script  ", "https://example.com/file",
       WebURLRequest::RequestContextScript, false},
      {"require-sri-for      style    script", "https://example.com/file",
       WebURLRequest::RequestContextStyle, false},

      {"require-sri-for style script", "https://example.com/file",
       WebURLRequest::RequestContextScript, false},
      {"require-sri-for style script", "https://example.com/file",
       WebURLRequest::RequestContextImport, false},
      {"require-sri-for style script", "https://example.com/file",
       WebURLRequest::RequestContextImage, true},

      {"require-sri-for script", "https://example.com/file",
       WebURLRequest::RequestContextAudio, true},
      {"require-sri-for script", "https://example.com/file",
       WebURLRequest::RequestContextScript, false},
      {"require-sri-for script", "https://example.com/file",
       WebURLRequest::RequestContextImport, false},
      {"require-sri-for script", "https://example.com/file",
       WebURLRequest::RequestContextServiceWorker, false},
      {"require-sri-for script", "https://example.com/file",
       WebURLRequest::RequestContextSharedWorker, false},
      {"require-sri-for script", "https://example.com/file",
       WebURLRequest::RequestContextWorker, false},
      {"require-sri-for script", "https://example.com/file",
       WebURLRequest::RequestContextStyle, true},

      {"require-sri-for style", "https://example.com/file",
       WebURLRequest::RequestContextAudio, true},
      {"require-sri-for style", "https://example.com/file",
       WebURLRequest::RequestContextScript, true},
      {"require-sri-for style", "https://example.com/file",
       WebURLRequest::RequestContextImport, true},
      {"require-sri-for style", "https://example.com/file",
       WebURLRequest::RequestContextServiceWorker, true},
      {"require-sri-for style", "https://example.com/file",
       WebURLRequest::RequestContextSharedWorker, true},
      {"require-sri-for style", "https://example.com/file",
       WebURLRequest::RequestContextWorker, true},
      {"require-sri-for style", "https://example.com/file",
       WebURLRequest::RequestContextStyle, false},

      // Multiple tokens
      {"require-sri-for script style", "https://example.com/file",
       WebURLRequest::RequestContextStyle, false},
      {"require-sri-for script style", "https://example.com/file",
       WebURLRequest::RequestContextScript, false},
      {"require-sri-for script style", "https://example.com/file",
       WebURLRequest::RequestContextImport, false},
      {"require-sri-for script style", "https://example.com/file",
       WebURLRequest::RequestContextImage, true},

      // Matching is case-insensitive
      {"require-sri-for Script", "https://example.com/file",
       WebURLRequest::RequestContextScript, false},

      // Unknown tokens do not affect result
      {"require-sri-for blabla12 as", "https://example.com/file",
       WebURLRequest::RequestContextScript, true},
      {"require-sri-for blabla12 as  script", "https://example.com/file",
       WebURLRequest::RequestContextScript, false},
      {"require-sri-for script style img", "https://example.com/file",
       WebURLRequest::RequestContextScript, false},
      {"require-sri-for script style img", "https://example.com/file",
       WebURLRequest::RequestContextImport, false},
      {"require-sri-for script style img", "https://example.com/file",
       WebURLRequest::RequestContextStyle, false},
      {"require-sri-for script style img", "https://example.com/file",
       WebURLRequest::RequestContextImage, true},

      // Empty token list has no effect
      {"require-sri-for      ", "https://example.com/file",
       WebURLRequest::RequestContextScript, true},
      {"require-sri-for      ", "https://example.com/file",
       WebURLRequest::RequestContextImport, true},
      {"require-sri-for      ", "https://example.com/file",
       WebURLRequest::RequestContextStyle, true},
      {"require-sri-for      ", "https://example.com/file",
       WebURLRequest::RequestContextServiceWorker, true},
      {"require-sri-for      ", "https://example.com/file",
       WebURLRequest::RequestContextSharedWorker, true},
      {"require-sri-for      ", "https://example.com/file",
       WebURLRequest::RequestContextWorker, true},

      // Order does not matter
      {"require-sri-for a b script", "https://example.com/file",
       WebURLRequest::RequestContextScript, false},
      {"require-sri-for a script b", "https://example.com/file",
       WebURLRequest::RequestContextScript, false},
  };

  for (const auto& test : cases) {
    KURL resource = KURL(KURL(), test.url);
    // Report-only
    Member<CSPDirectiveList> directiveList =
        createList(test.list, ContentSecurityPolicyHeaderTypeReport);
    EXPECT_EQ(true, directiveList->allowRequestWithoutIntegrity(
                        test.context, resource,
                        ResourceRequest::RedirectStatus::NoRedirect,
                        SecurityViolationReportingPolicy::SuppressReporting));

    // Enforce
    directiveList =
        createList(test.list, ContentSecurityPolicyHeaderTypeEnforce);
    EXPECT_EQ(
        test.expected,
        directiveList->allowRequestWithoutIntegrity(
            test.context, resource, ResourceRequest::RedirectStatus::NoRedirect,
            SecurityViolationReportingPolicy::SuppressReporting));
  }
}

TEST_F(CSPDirectiveListTest, WorkerSrc) {
  struct TestCase {
    const char* list;
    bool allowed;
  } cases[] = {
      {"worker-src 'none'", false},
      {"worker-src http://not.example.test", false},
      {"worker-src https://example.test", true},
      {"default-src *; worker-src 'none'", false},
      {"default-src *; worker-src http://not.example.test", false},
      {"default-src *; worker-src https://example.test", true},
      {"script-src *; worker-src 'none'", false},
      {"script-src *; worker-src http://not.example.test", false},
      {"script-src *; worker-src https://example.test", true},
      {"default-src *; script-src *; worker-src 'none'", false},
      {"default-src *; script-src *; worker-src http://not.example.test",
       false},
      {"default-src *; script-src *; worker-src https://example.test", true},

      // Fallback to script-src.
      {"script-src 'none'", false},
      {"script-src http://not.example.test", false},
      {"script-src https://example.test", true},
      {"default-src *; script-src 'none'", false},
      {"default-src *; script-src http://not.example.test", false},
      {"default-src *; script-src https://example.test", true},

      // Fallback to default-src.
      {"default-src 'none'", false},
      {"default-src http://not.example.test", false},
      {"default-src https://example.test", true},
  };

  for (const auto& test : cases) {
    SCOPED_TRACE(test.list);
    KURL resource = KURL(KURL(), "https://example.test/worker.js");
    Member<CSPDirectiveList> directiveList =
        createList(test.list, ContentSecurityPolicyHeaderTypeEnforce);
    EXPECT_EQ(test.allowed,
              directiveList->allowWorkerFromSource(
                  resource, ResourceRequest::RedirectStatus::NoRedirect,
                  SecurityViolationReportingPolicy::SuppressReporting));
  }
}

TEST_F(CSPDirectiveListTest, WorkerSrcChildSrcFallback) {
  // TODO(mkwst): Remove this test once we remove the temporary fallback
  // behavior. https://crbug.com/662930
  struct TestCase {
    const char* list;
    bool allowed;
  } cases[] = {
      // When 'worker-src' is not present, 'child-src' can allow a worker when
      // present.
      {"child-src https://example.test", true},
      {"child-src https://not-example.test", true},
      {"script-src https://example.test", true},
      {"script-src https://not-example.test", false},
      {"child-src https://example.test; script-src https://example.test", true},
      {"child-src https://example.test; script-src https://not-example.test",
       true},
      {"child-src https://not-example.test; script-src https://example.test",
       true},
      {"child-src https://not-example.test; script-src "
       "https://not-example.test",
       false},

      // If 'worker-src' is present, 'child-src' will not allow a worker.
      {"worker-src https://example.test; child-src https://example.test", true},
      {"worker-src https://example.test; child-src https://not-example.test",
       true},
      {"worker-src https://not-example.test; child-src https://example.test",
       false},
      {"worker-src https://not-example.test; child-src "
       "https://not-example.test",
       false},
  };

  for (const auto& test : cases) {
    SCOPED_TRACE(test.list);
    KURL resource = KURL(KURL(), "https://example.test/worker.js");
    Member<CSPDirectiveList> directiveList =
        createList(test.list, ContentSecurityPolicyHeaderTypeEnforce);
    EXPECT_EQ(test.allowed,
              directiveList->allowWorkerFromSource(
                  resource, ResourceRequest::RedirectStatus::NoRedirect,
                  SecurityViolationReportingPolicy::SuppressReporting));
  }
}

TEST_F(CSPDirectiveListTest, SubsumesBasedOnCSPSourcesOnly) {
  CSPDirectiveList* A = createList(
      "script-src http://*.one.com; img-src https://one.com "
      "http://two.com/imgs/",
      ContentSecurityPolicyHeaderTypeEnforce);

  struct TestCase {
    const std::vector<const char*> policies;
    bool expected;
    bool expectedFirstPolicyOpposite;
  } cases[] = {
      // `listB`, which is not as restrictive as `A`, is not subsumed.
      {{""}, false, true},
      {{"script-src http://example.com"}, false, false},
      {{"img-src http://example.com"}, false, false},
      {{"script-src http://*.one.com"}, false, true},
      {{"img-src https://one.com http://two.com/imgs/"}, false, true},
      {{"default-src http://example.com"}, false, false},
      {{"default-src https://one.com http://two.com/imgs/"}, false, false},
      {{"default-src http://one.com"}, false, false},
      {{"script-src http://*.one.com; img-src http://two.com/"}, false, false},
      {{"script-src http://*.one.com", "img-src http://one.com"}, false, true},
      {{"script-src http://*.one.com", "script-src https://two.com"},
       false,
       true},
      {{"script-src http://*.random.com", "script-src https://random.com"},
       false,
       false},
      {{"script-src http://one.com", "script-src https://random.com"},
       false,
       false},
      {{"script-src http://*.random.com; default-src http://one.com "
        "http://two.com/imgs/",
        "default-src https://random.com"},
       false,
       false},
      // `listB`, which is as restrictive as `A`, is subsumed.
      {{"default-src https://one.com"}, true, false},
      {{"default-src http://random.com",
        "default-src https://non-random.com:*"},
       true,
       false},
      {{"script-src http://*.one.com; img-src https://one.com"}, true, false},
      {{"script-src http://*.one.com; img-src https://one.com "
        "http://two.com/imgs/"},
       true,
       true},
      {{"script-src http://*.one.com",
        "img-src https://one.com http://two.com/imgs/"},
       true,
       true},
      {{"script-src http://*.random.com; default-src https://one.com "
        "http://two.com/imgs/",
        "default-src https://else.com"},
       true,
       false},
      {{"script-src http://*.random.com; default-src https://one.com "
        "http://two.com/imgs/",
        "default-src https://one.com"},
       true,
       false},
  };

  CSPDirectiveList* emptyA =
      createList("", ContentSecurityPolicyHeaderTypeEnforce);

  for (const auto& test : cases) {
    HeapVector<Member<CSPDirectiveList>> listB;
    for (const auto& policy : test.policies) {
      listB.push_back(
          createList(policy, ContentSecurityPolicyHeaderTypeEnforce));
    }

    EXPECT_EQ(test.expected, A->subsumes(listB));
    // Empty CSPDirective subsumes any list.
    EXPECT_TRUE(emptyA->subsumes(listB));
    // Check if first policy of `listB` subsumes `A`.
    EXPECT_EQ(test.expectedFirstPolicyOpposite,
              listB[0]->subsumes(HeapVector<Member<CSPDirectiveList>>(1, A)));
  }
}

TEST_F(CSPDirectiveListTest, SubsumesIfNoneIsPresent) {
  struct TestCase {
    const char* policyA;
    const std::vector<const char*> policiesB;
    bool expected;
  } cases[] = {
      // `policyA` subsumes any vector of policies.
      {"", {""}, true},
      {"", {"script-src http://example.com"}, true},
      {"", {"script-src 'none'"}, true},
      {"", {"script-src http://*.one.com", "script-src https://two.com"}, true},
      // `policyA` is 'none', but no policy in `policiesB` is.
      {"script-src ", {""}, false},
      {"script-src 'none'", {""}, false},
      {"script-src ", {"script-src http://example.com"}, false},
      {"script-src 'none'", {"script-src http://example.com"}, false},
      {"script-src ", {"img-src 'none'"}, false},
      {"script-src 'none'", {"img-src 'none'"}, false},
      {"script-src ",
       {"script-src http://*.one.com", "img-src https://two.com"},
       false},
      {"script-src 'none'",
       {"script-src http://*.one.com", "img-src https://two.com"},
       false},
      {"script-src 'none'",
       {"script-src http://*.one.com", "script-src https://two.com"},
       true},
      {"script-src 'none'",
       {"script-src http://*.one.com", "script-src 'self'"},
       true},
      // `policyA` is not 'none', but at least effective result of `policiesB`
      // is.
      {"script-src http://example.com 'none'", {"script-src 'none'"}, true},
      {"script-src http://example.com", {"script-src 'none'"}, true},
      {"script-src http://example.com 'none'",
       {"script-src http://*.one.com", "script-src http://one.com",
        "script-src 'none'"},
       true},
      {"script-src http://example.com",
       {"script-src http://*.one.com", "script-src http://one.com",
        "script-src 'none'"},
       true},
      {"script-src http://one.com 'none'",
       {"script-src http://*.one.com", "script-src http://one.com",
        "script-src https://one.com"},
       true},
      // `policyA` is `none` and at least effective result of `policiesB` is
      // too.
      {"script-src ", {"script-src ", "script-src "}, true},
      {"script-src 'none'", {"script-src", "script-src 'none'"}, true},
      {"script-src ", {"script-src 'none'", "script-src 'none'"}, true},
      {"script-src ",
       {"script-src 'none' http://example.com",
        "script-src 'none' http://example.com"},
       false},
      {"script-src 'none'", {"script-src 'none'", "script-src 'none'"}, true},
      {"script-src 'none'",
       {"script-src 'none'", "script-src 'none'", "script-src 'none'"},
       true},
      {"script-src 'none'",
       {"script-src http://*.one.com", "script-src http://one.com",
        "script-src 'none'"},
       true},
      {"script-src 'none'",
       {"script-src http://*.one.com", "script-src http://two.com",
        "script-src http://three.com"},
       true},
      // Policies contain special keywords.
      {"script-src ", {"script-src ", "script-src 'unsafe-eval'"}, true},
      {"script-src 'none'",
       {"script-src 'unsafe-inline'", "script-src 'none'"},
       true},
      {"script-src ",
       {"script-src 'none' 'unsafe-inline'",
        "script-src 'none' 'unsafe-inline'"},
       false},
      {"script-src ",
       {"script-src 'none' 'unsafe-inline'",
        "script-src 'unsafe-inline' 'strict-dynamic'"},
       false},
      {"script-src 'unsafe-eval'",
       {"script-src 'unsafe-eval'", "script 'unsafe-inline'"},
       true},
      {"script-src 'unsafe-inline'",
       {"script-src  ", "script http://example.com"},
       true},
  };

  for (const auto& test : cases) {
    CSPDirectiveList* A =
        createList(test.policyA, ContentSecurityPolicyHeaderTypeEnforce);

    HeapVector<Member<CSPDirectiveList>> listB;
    for (const auto& policyB : test.policiesB)
      listB.push_back(
          createList(policyB, ContentSecurityPolicyHeaderTypeEnforce));

    EXPECT_EQ(test.expected, A->subsumes(listB));
  }
}

TEST_F(CSPDirectiveListTest, SubsumesPluginTypes) {
  struct TestCase {
    const char* policyA;
    const std::vector<const char*> policiesB;
    bool expected;
  } cases[] = {
      // `policyA` subsumes `policiesB`.
      {"script-src 'unsafe-inline'",
       {"script-src  ", "script-src http://example.com",
        "plugin-types text/plain"},
       true},
      {"script-src http://example.com",
       {"script-src http://example.com; plugin-types "},
       true},
      {"script-src http://example.com",
       {"script-src http://example.com; plugin-types text/plain"},
       true},
      {"script-src http://example.com; plugin-types text/plain",
       {"script-src http://example.com; plugin-types text/plain"},
       true},
      {"script-src http://example.com; plugin-types text/plain",
       {"script-src http://example.com; plugin-types "},
       true},
      {"script-src http://example.com; plugin-types text/plain",
       {"script-src http://example.com; plugin-types ", "plugin-types "},
       true},
      {"plugin-types application/pdf text/plain",
       {"plugin-types application/pdf text/plain",
        "plugin-types application/x-blink-test-plugin"},
       true},
      {"plugin-types application/pdf text/plain",
       {"plugin-types application/pdf text/plain",
        "plugin-types application/pdf text/plain "
        "application/x-blink-test-plugin"},
       true},
      {"plugin-types application/x-shockwave-flash application/pdf text/plain",
       {"plugin-types application/x-shockwave-flash application/pdf text/plain",
        "plugin-types application/x-shockwave-flash"},
       true},
      {"plugin-types application/x-shockwave-flash",
       {"plugin-types application/x-shockwave-flash application/pdf text/plain",
        "plugin-types application/x-shockwave-flash"},
       true},
      // `policyA` does not subsume `policiesB`.
      {"script-src http://example.com; plugin-types text/plain",
       {"script-src http://example.com"},
       false},
      {"plugin-types random-value",
       {"script-src 'unsafe-inline'", "plugin-types text/plain"},
       false},
      {"plugin-types random-value",
       {"script-src http://example.com", "script-src http://example.com"},
       false},
      {"plugin-types random-value",
       {"plugin-types  text/plain", "plugin-types text/plain"},
       false},
      {"script-src http://example.com; plugin-types text/plain",
       {"plugin-types ", "plugin-types "},
       false},
      {"plugin-types application/pdf text/plain",
       {"plugin-types application/x-blink-test-plugin",
        "plugin-types application/x-blink-test-plugin"},
       false},
      {"plugin-types application/pdf text/plain",
       {"plugin-types application/pdf application/x-blink-test-plugin",
        "plugin-types application/x-blink-test-plugin"},
       false},
  };

  for (const auto& test : cases) {
    CSPDirectiveList* A =
        createList(test.policyA, ContentSecurityPolicyHeaderTypeEnforce);

    HeapVector<Member<CSPDirectiveList>> listB;
    for (const auto& policyB : test.policiesB)
      listB.push_back(
          createList(policyB, ContentSecurityPolicyHeaderTypeEnforce));

    EXPECT_EQ(test.expected, A->subsumes(listB));
  }
}

TEST_F(CSPDirectiveListTest, OperativeDirectiveGivenType) {
  enum DefaultBehaviour {
    Default,
    NoDefault,
    ChildAndDefault,
    ScriptAndDefault
  };

  struct TestCase {
    ContentSecurityPolicy::DirectiveType directive;
    const DefaultBehaviour type;
  } cases[] = {
      // Directives with default directive.
      {ContentSecurityPolicy::DirectiveType::ChildSrc, Default},
      {ContentSecurityPolicy::DirectiveType::ConnectSrc, Default},
      {ContentSecurityPolicy::DirectiveType::FontSrc, Default},
      {ContentSecurityPolicy::DirectiveType::ImgSrc, Default},
      {ContentSecurityPolicy::DirectiveType::ManifestSrc, Default},
      {ContentSecurityPolicy::DirectiveType::MediaSrc, Default},
      {ContentSecurityPolicy::DirectiveType::ObjectSrc, Default},
      {ContentSecurityPolicy::DirectiveType::ScriptSrc, Default},
      {ContentSecurityPolicy::DirectiveType::StyleSrc, Default},
      // Directives with no default directive.
      {ContentSecurityPolicy::DirectiveType::BaseURI, NoDefault},
      {ContentSecurityPolicy::DirectiveType::DefaultSrc, NoDefault},
      {ContentSecurityPolicy::DirectiveType::FrameAncestors, NoDefault},
      {ContentSecurityPolicy::DirectiveType::FormAction, NoDefault},
      // Directive with multiple default directives.
      {ContentSecurityPolicy::DirectiveType::FrameSrc, ChildAndDefault},
      {ContentSecurityPolicy::DirectiveType::WorkerSrc, ScriptAndDefault},
  };

  // Initial set-up.
  std::stringstream allDirectives;
  for (const auto& test : cases) {
    const char* name = ContentSecurityPolicy::getDirectiveName(test.directive);
    allDirectives << name << " http://" << name << ".com; ";
  }
  CSPDirectiveList* allDirectivesList = createList(
      allDirectives.str().c_str(), ContentSecurityPolicyHeaderTypeEnforce);
  CSPDirectiveList* empty =
      createList("", ContentSecurityPolicyHeaderTypeEnforce);

  for (const auto& test : cases) {
    const char* name = ContentSecurityPolicy::getDirectiveName(test.directive);
    // When CSPDirectiveList is empty, then `null` should be returned for any
    // type.
    EXPECT_FALSE(empty->operativeDirective(test.directive));

    // When all directives present, then given a type that directive value
    // should be returned.
    HeapVector<Member<CSPSource>> sources =
        allDirectivesList->operativeDirective(test.directive)->m_list;
    EXPECT_EQ(sources.size(), 1u);
    EXPECT_TRUE(sources[0]->m_host.startsWith(name));

    std::stringstream allExceptThis;
    std::stringstream allExceptChildSrcAndThis;
    std::stringstream allExceptScriptSrcAndThis;
    for (const auto& subtest : cases) {
      if (subtest.directive == test.directive)
        continue;
      const char* directiveName =
          ContentSecurityPolicy::getDirectiveName(subtest.directive);
      allExceptThis << directiveName << " http://" << directiveName << ".com; ";
      if (subtest.directive != ContentSecurityPolicy::DirectiveType::ChildSrc) {
        allExceptChildSrcAndThis << directiveName << " http://" << directiveName
                                 << ".com; ";
      }
      if (subtest.directive !=
          ContentSecurityPolicy::DirectiveType::ScriptSrc) {
        allExceptScriptSrcAndThis << directiveName << " http://"
                                  << directiveName << ".com; ";
      }
    }
    CSPDirectiveList* allExceptThisList = createList(
        allExceptThis.str().c_str(), ContentSecurityPolicyHeaderTypeEnforce);
    CSPDirectiveList* allExceptChildSrcAndThisList =
        createList(allExceptChildSrcAndThis.str().c_str(),
                   ContentSecurityPolicyHeaderTypeEnforce);
    CSPDirectiveList* allExceptScriptSrcAndThisList =
        createList(allExceptScriptSrcAndThis.str().c_str(),
                   ContentSecurityPolicyHeaderTypeEnforce);

    switch (test.type) {
      case Default:
        sources = allExceptThisList->operativeDirective(test.directive)->m_list;
        EXPECT_EQ(sources.size(), 1u);
        EXPECT_EQ(sources[0]->m_host, "default-src.com");
        break;
      case NoDefault:
        EXPECT_FALSE(allExceptThisList->operativeDirective(test.directive));
        break;
      case ChildAndDefault:
        sources = allExceptThisList->operativeDirective(test.directive)->m_list;
        EXPECT_EQ(sources.size(), 1u);
        EXPECT_EQ(sources[0]->m_host, "child-src.com");
        sources =
            allExceptChildSrcAndThisList->operativeDirective(test.directive)
                ->m_list;
        EXPECT_EQ(sources.size(), 1u);
        EXPECT_EQ(sources[0]->m_host, "default-src.com");
        break;
      case ScriptAndDefault:
        sources = allExceptThisList->operativeDirective(test.directive)->m_list;
        EXPECT_EQ(sources.size(), 1u);
        EXPECT_EQ(sources[0]->m_host, "script-src.com");
        sources =
            allExceptScriptSrcAndThisList->operativeDirective(test.directive)
                ->m_list;
        EXPECT_EQ(sources.size(), 1u);
        EXPECT_EQ(sources[0]->m_host, "default-src.com");
        break;
    }
  }
}

TEST_F(CSPDirectiveListTest, GetSourceVector) {
  const std::vector<const char*> policies = {
      // Policy 1
      "default-src https://default-src.com",
      // Policy 2
      "child-src http://child-src.com",
      // Policy 3
      "child-src http://child-src.com; default-src https://default-src.com",
      // Policy 4
      "base-uri http://base-uri.com",
      // Policy 5
      "frame-src http://frame-src.com"};

  // Check expectations on the initial set-up.
  HeapVector<Member<CSPDirectiveList>> policyVector;
  for (const auto& policy : policies) {
    policyVector.push_back(
        createList(policy, ContentSecurityPolicyHeaderTypeEnforce));
  }
  HeapVector<Member<SourceListDirective>> result =
      CSPDirectiveList::getSourceVector(
          ContentSecurityPolicy::DirectiveType::DefaultSrc, policyVector);
  EXPECT_EQ(result.size(), 2u);
  result = CSPDirectiveList::getSourceVector(
      ContentSecurityPolicy::DirectiveType::ChildSrc, policyVector);
  EXPECT_EQ(result.size(), 3u);
  result = CSPDirectiveList::getSourceVector(
      ContentSecurityPolicy::DirectiveType::BaseURI, policyVector);
  EXPECT_EQ(result.size(), 1u);
  result = CSPDirectiveList::getSourceVector(
      ContentSecurityPolicy::DirectiveType::FrameSrc, policyVector);
  EXPECT_EQ(result.size(), 4u);

  enum DefaultBehaviour { Default, NoDefault, ChildAndDefault };

  struct TestCase {
    ContentSecurityPolicy::DirectiveType directive;
    const DefaultBehaviour type;
    size_t expectedTotal;
    int expectedCurrent;
    int expectedDefaultSrc;
    int expectedChildSrc;
  } cases[] = {
      // Directives with default directive.
      {ContentSecurityPolicy::DirectiveType::ChildSrc, Default, 4u, 3, 1, 3},
      {ContentSecurityPolicy::DirectiveType::ConnectSrc, Default, 3u, 1, 2, 0},
      {ContentSecurityPolicy::DirectiveType::FontSrc, Default, 3u, 1, 2, 0},
      {ContentSecurityPolicy::DirectiveType::ImgSrc, Default, 3u, 1, 2, 0},
      {ContentSecurityPolicy::DirectiveType::ManifestSrc, Default, 3u, 1, 2, 0},
      {ContentSecurityPolicy::DirectiveType::MediaSrc, Default, 3u, 1, 2, 0},
      {ContentSecurityPolicy::DirectiveType::ObjectSrc, Default, 3u, 1, 2, 0},
      {ContentSecurityPolicy::DirectiveType::ScriptSrc, Default, 3u, 1, 2, 0},
      {ContentSecurityPolicy::DirectiveType::StyleSrc, Default, 3u, 1, 2, 0},
      // Directives with no default directive.
      {ContentSecurityPolicy::DirectiveType::BaseURI, NoDefault, 2u, 2, 0, 0},
      {ContentSecurityPolicy::DirectiveType::FrameAncestors, NoDefault, 1u, 1,
       0, 0},
      {ContentSecurityPolicy::DirectiveType::FormAction, NoDefault, 1u, 1, 0,
       0},
      // Directive with multiple default directives.
      {ContentSecurityPolicy::DirectiveType::FrameSrc, ChildAndDefault, 5u, 2,
       1, 2},
  };

  for (const auto& test : cases) {
    // Initial set-up.
    HeapVector<Member<CSPDirectiveList>> policyVector;
    for (const auto& policy : policies) {
      policyVector.push_back(
          createList(policy, ContentSecurityPolicyHeaderTypeEnforce));
    }
    // Append current test's policy.
    std::stringstream currentDirective;
    const char* name = ContentSecurityPolicy::getDirectiveName(test.directive);
    currentDirective << name << " http://" << name << ".com;";
    policyVector.push_back(createList(currentDirective.str().c_str(),
                                      ContentSecurityPolicyHeaderTypeEnforce));

    HeapVector<Member<SourceListDirective>> result =
        CSPDirectiveList::getSourceVector(test.directive, policyVector);

    EXPECT_EQ(result.size(), test.expectedTotal);

    int actualCurrent = 0, actualDefault = 0, actualChild = 0;
    for (const auto& srcList : result) {
      HeapVector<Member<CSPSource>> sources = srcList->m_list;
      for (const auto& source : sources) {
        if (source->m_host.startsWith(name))
          actualCurrent += 1;
        else if (source->m_host == "default-src.com")
          actualDefault += 1;

        if (source->m_host == "child-src.com")
          actualChild += 1;
      }
    }

    EXPECT_EQ(actualDefault, test.expectedDefaultSrc);
    EXPECT_EQ(actualCurrent, test.expectedCurrent);
    EXPECT_EQ(actualChild, test.expectedChildSrc);

    // If another default-src is added that should only impact Fetch Directives
    policyVector.push_back(createList("default-src https://default-src.com;",
                                      ContentSecurityPolicyHeaderTypeEnforce));
    size_t udpatedTotal =
        test.type != NoDefault ? test.expectedTotal + 1 : test.expectedTotal;
    EXPECT_EQ(
        CSPDirectiveList::getSourceVector(test.directive, policyVector).size(),
        udpatedTotal);
    size_t expectedChildSrc =
        test.directive == ContentSecurityPolicy::DirectiveType::ChildSrc ? 5u
                                                                         : 4u;
    EXPECT_EQ(CSPDirectiveList::getSourceVector(
                  ContentSecurityPolicy::DirectiveType::ChildSrc, policyVector)
                  .size(),
              expectedChildSrc);

    // If another child-src is added that should only impact frame-src and
    // child-src
    policyVector.push_back(createList("child-src http://child-src.com;",
                                      ContentSecurityPolicyHeaderTypeEnforce));
    udpatedTotal =
        test.type == ChildAndDefault ||
                test.directive == ContentSecurityPolicy::DirectiveType::ChildSrc
            ? udpatedTotal + 1
            : udpatedTotal;
    EXPECT_EQ(
        CSPDirectiveList::getSourceVector(test.directive, policyVector).size(),
        udpatedTotal);
    expectedChildSrc = expectedChildSrc + 1u;
    EXPECT_EQ(CSPDirectiveList::getSourceVector(
                  ContentSecurityPolicy::DirectiveType::ChildSrc, policyVector)
                  .size(),
              expectedChildSrc);

    // If we add sandbox, nothing should change since it is currenly not
    // considered.
    policyVector.push_back(createList("sandbox http://sandbox.com;",
                                      ContentSecurityPolicyHeaderTypeEnforce));
    EXPECT_EQ(
        CSPDirectiveList::getSourceVector(test.directive, policyVector).size(),
        udpatedTotal);
    EXPECT_EQ(CSPDirectiveList::getSourceVector(
                  ContentSecurityPolicy::DirectiveType::ChildSrc, policyVector)
                  .size(),
              expectedChildSrc);
  }
}

}  // namespace blink