src/chrome/browser/policy/url_blacklist_manager_unittest.cc

   1 // Copyright (c) 2012 The Chromium Authors. All rights reserved.
   2 // Use of this source code is governed by a BSD-style license that can be
   3 // found in the LICENSE file.
   4
   5 #include "components/policy/core/browser/url_blacklist_manager.h"
   6
   7 #include <ostream>
   8
   9 #include "base/basictypes.h"
  10 #include "base/callback.h"
  11 #include "base/message_loop/message_loop.h"
  12 #include "base/message_loop/message_loop_proxy.h"
  13 #include "base/prefs/pref_registry_simple.h"
  14 #include "base/prefs/testing_pref_service.h"
  15 #include "chrome/browser/policy/policy_helpers.h"
  16 #include "components/policy/core/common/policy_pref_names.h"
  17 #include "components/url_fixer/url_fixer.h"
  18 #include "google_apis/gaia/gaia_urls.h"
  19 #include "net/base/load_flags.h"
  20 #include "net/base/net_errors.h"
  21 #include "net/base/request_priority.h"
  22 #include "net/url_request/url_request.h"
  23 #include "net/url_request/url_request_context.h"
  24 #include "net/url_request/url_request_test_util.h"
  25 #include "testing/gtest/include/gtest/gtest.h"
  26 #include "url/gurl.h"
  27
  28 // TODO(joaodasilva): this file should be moved next to
  29 // components/policy/core/browser/url_blacklist_manager.(cc|h).
  30 // However, url_fixer_upper.h can't be included from the component. Rather
  31 // than having it mocked out, the actual url_fixer::SegmentURL call is used
  32 // to make sure that the parsing of URL filters is correct.
  33
  34 namespace policy {
  35
  36 namespace {
  37
  38 // Helper to get the disambiguated SegmentURL() function.
  39 URLBlacklist::SegmentURLCallback GetSegmentURLCallback() {
  40   return url_fixer::SegmentURL;
  41 }
  42
  43 class TestingURLBlacklistManager : public URLBlacklistManager {
  44  public:
  45   explicit TestingURLBlacklistManager(PrefService* pref_service)
  46       : URLBlacklistManager(pref_service,
  47                             base::MessageLoopProxy::current(),
  48                             base::MessageLoopProxy::current(),
  49                             GetSegmentURLCallback(),
  50                             base::Bind(OverrideBlacklistForURL)),
  51         update_called_(0),
  52         set_blacklist_called_(false) {}
  53
  54   virtual ~TestingURLBlacklistManager() {
  55   }
  56
  57   // Make this method public for testing.
  58   using URLBlacklistManager::ScheduleUpdate;
  59
  60   // Makes a direct call to UpdateOnIO during tests.
  61   void UpdateOnIOForTesting() {
  62     scoped_ptr<base::ListValue> block(new base::ListValue);
  63     block->Append(new base::StringValue("example.com"));
  64     scoped_ptr<base::ListValue> allow(new base::ListValue);
  65     URLBlacklistManager::UpdateOnIO(block.Pass(), allow.Pass());
  66   }
  67
  68   // URLBlacklistManager overrides:
  69   virtual void SetBlacklist(scoped_ptr<URLBlacklist> blacklist) OVERRIDE {
  70     set_blacklist_called_ = true;
  71     URLBlacklistManager::SetBlacklist(blacklist.Pass());
  72   }
  73
  74   virtual void Update() OVERRIDE {
  75     update_called_++;
  76     URLBlacklistManager::Update();
  77   }
  78
  79   int update_called() const { return update_called_; }
  80   bool set_blacklist_called() const { return set_blacklist_called_; }
  81
  82  private:
  83   int update_called_;
  84   bool set_blacklist_called_;
  85
  86   DISALLOW_COPY_AND_ASSIGN(TestingURLBlacklistManager);
  87 };
  88
  89 class URLBlacklistManagerTest : public testing::Test {
  90  protected:
  91   URLBlacklistManagerTest() {}
  92
  93   virtual void SetUp() OVERRIDE {
  94     pref_service_.registry()->RegisterListPref(policy_prefs::kUrlBlacklist);
  95     pref_service_.registry()->RegisterListPref(policy_prefs::kUrlWhitelist);
  96     blacklist_manager_.reset(new TestingURLBlacklistManager(&pref_service_));
  97     loop_.RunUntilIdle();
  98   }
  99
 100   virtual void TearDown() OVERRIDE {
 101     if (blacklist_manager_.get())
 102       blacklist_manager_->ShutdownOnUIThread();
 103     loop_.RunUntilIdle();
 104     // Delete |blacklist_manager_| while |io_thread_| is mapping IO to
 105     // |loop_|.
 106     blacklist_manager_.reset();
 107   }
 108
 109   base::MessageLoopForIO loop_;
 110   TestingPrefServiceSimple pref_service_;
 111   scoped_ptr<TestingURLBlacklistManager> blacklist_manager_;
 112 };
 113
 114 // Parameters for the FilterToComponents test.
 115 struct FilterTestParams {
 116  public:
 117   FilterTestParams(const std::string& filter, const std::string& scheme,
 118                    const std::string& host, bool match_subdomains, uint16 port,
 119                    const std::string& path)
 120       : filter_(filter), scheme_(scheme), host_(host),
 121         match_subdomains_(match_subdomains), port_(port), path_(path) {}
 122
 123   FilterTestParams(const FilterTestParams& params)
 124       : filter_(params.filter_), scheme_(params.scheme_), host_(params.host_),
 125         match_subdomains_(params.match_subdomains_), port_(params.port_),
 126         path_(params.path_) {}
 127
 128   const FilterTestParams& operator=(const FilterTestParams& params) {
 129     filter_ = params.filter_;
 130     scheme_ = params.scheme_;
 131     host_ = params.host_;
 132     match_subdomains_ = params.match_subdomains_;
 133     port_ = params.port_;
 134     path_ = params.path_;
 135     return *this;
 136   }
 137
 138   const std::string& filter() const { return filter_; }
 139   const std::string& scheme() const { return scheme_; }
 140   const std::string& host() const { return host_; }
 141   bool match_subdomains() const { return match_subdomains_; }
 142   uint16 port() const { return port_; }
 143   const std::string& path() const { return path_; }
 144
 145  private:
 146   std::string filter_;
 147   std::string scheme_;
 148   std::string host_;
 149   bool match_subdomains_;
 150   uint16 port_;
 151   std::string path_;
 152 };
 153
 154 // Make Valgrind happy. Without this function, a generic one will print the
 155 // raw bytes in FilterTestParams, which due to some likely padding will access
 156 // uninitialized memory.
 157 void PrintTo(const FilterTestParams& params, std::ostream* os) {
 158   *os << params.filter();
 159 }
 160
 161 class URLBlacklistFilterToComponentsTest
 162     : public testing::TestWithParam<FilterTestParams> {
 163  public:
 164   URLBlacklistFilterToComponentsTest() {}
 165
 166  private:
 167   DISALLOW_COPY_AND_ASSIGN(URLBlacklistFilterToComponentsTest);
 168 };
 169
 170 }  // namespace
 171
 172 TEST_P(URLBlacklistFilterToComponentsTest, FilterToComponents) {
 173   std::string scheme;
 174   std::string host;
 175   bool match_subdomains = true;
 176   uint16 port = 42;
 177   std::string path;
 178
 179   URLBlacklist::FilterToComponents(GetSegmentURLCallback(),
 180                                    GetParam().filter(),
 181                                    &scheme,
 182                                    &host,
 183                                    &match_subdomains,
 184                                    &port,
 185                                    &path,
 186                                    NULL);
 187   EXPECT_EQ(GetParam().scheme(), scheme);
 188   EXPECT_EQ(GetParam().host(), host);
 189   EXPECT_EQ(GetParam().match_subdomains(), match_subdomains);
 190   EXPECT_EQ(GetParam().port(), port);
 191   EXPECT_EQ(GetParam().path(), path);
 192 }
 193
 194 TEST_F(URLBlacklistManagerTest, SingleUpdateForTwoPrefChanges) {
 195   base::ListValue* blacklist = new base::ListValue;
 196   blacklist->Append(new base::StringValue("*.google.com"));
 197   base::ListValue* whitelist = new base::ListValue;
 198   whitelist->Append(new base::StringValue("mail.google.com"));
 199   pref_service_.SetManagedPref(policy_prefs::kUrlBlacklist, blacklist);
 200   pref_service_.SetManagedPref(policy_prefs::kUrlBlacklist, whitelist);
 201   loop_.RunUntilIdle();
 202
 203   EXPECT_EQ(1, blacklist_manager_->update_called());
 204 }
 205
 206 TEST_F(URLBlacklistManagerTest, ShutdownWithPendingTask0) {
 207   // Post an update task to the UI thread.
 208   blacklist_manager_->ScheduleUpdate();
 209   // Shutdown comes before the task is executed.
 210   blacklist_manager_->ShutdownOnUIThread();
 211   blacklist_manager_.reset();
 212   // Run the task after shutdown and deletion.
 213   loop_.RunUntilIdle();
 214 }
 215
 216 TEST_F(URLBlacklistManagerTest, ShutdownWithPendingTask1) {
 217   // Post an update task.
 218   blacklist_manager_->ScheduleUpdate();
 219   // Shutdown comes before the task is executed.
 220   blacklist_manager_->ShutdownOnUIThread();
 221   // Run the task after shutdown, but before deletion.
 222   loop_.RunUntilIdle();
 223
 224   EXPECT_EQ(0, blacklist_manager_->update_called());
 225   blacklist_manager_.reset();
 226   loop_.RunUntilIdle();
 227 }
 228
 229 TEST_F(URLBlacklistManagerTest, ShutdownWithPendingTask2) {
 230   // This posts a task to the FILE thread.
 231   blacklist_manager_->UpdateOnIOForTesting();
 232   // But shutdown happens before it is done.
 233   blacklist_manager_->ShutdownOnUIThread();
 234
 235   EXPECT_FALSE(blacklist_manager_->set_blacklist_called());
 236   blacklist_manager_.reset();
 237   loop_.RunUntilIdle();
 238 }
 239
 240 INSTANTIATE_TEST_CASE_P(
 241     URLBlacklistFilterToComponentsTestInstance,
 242     URLBlacklistFilterToComponentsTest,
 243     testing::Values(
 244         FilterTestParams("google.com",
 245                          std::string(),
 246                          ".google.com",
 247                          true,
 248                          0u,
 249                          std::string()),
 250         FilterTestParams(".google.com",
 251                          std::string(),
 252                          "google.com",
 253                          false,
 254                          0u,
 255                          std::string()),
 256         FilterTestParams("http://google.com",
 257                          "http",
 258                          ".google.com",
 259                          true,
 260                          0u,
 261                          std::string()),
 262         FilterTestParams("google.com/",
 263                          std::string(),
 264                          ".google.com",
 265                          true,
 266                          0u,
 267                          "/"),
 268         FilterTestParams("http://google.com:8080/whatever",
 269                          "http",
 270                          ".google.com",
 271                          true,
 272                          8080u,
 273                          "/whatever"),
 274         FilterTestParams("http://user:pass@google.com:8080/whatever",
 275                          "http",
 276                          ".google.com",
 277                          true,
 278                          8080u,
 279                          "/whatever"),
 280         FilterTestParams("123.123.123.123",
 281                          std::string(),
 282                          "123.123.123.123",
 283                          false,
 284                          0u,
 285                          std::string()),
 286         FilterTestParams("https://123.123.123.123",
 287                          "https",
 288                          "123.123.123.123",
 289                          false,
 290                          0u,
 291                          std::string()),
 292         FilterTestParams("123.123.123.123/",
 293                          std::string(),
 294                          "123.123.123.123",
 295                          false,
 296                          0u,
 297                          "/"),
 298         FilterTestParams("http://123.123.123.123:123/whatever",
 299                          "http",
 300                          "123.123.123.123",
 301                          false,
 302                          123u,
 303                          "/whatever"),
 304         FilterTestParams("*",
 305                          std::string(),
 306                          std::string(),
 307                          true,
 308                          0u,
 309                          std::string()),
 310         FilterTestParams("ftp://*",
 311                          "ftp",
 312                          std::string(),
 313                          true,
 314                          0u,
 315                          std::string()),
 316         FilterTestParams("http://*/whatever",
 317                          "http",
 318                          std::string(),
 319                          true,
 320                          0u,
 321                          "/whatever")));
 322
 323 TEST_F(URLBlacklistManagerTest, Filtering) {
 324   URLBlacklist blacklist(GetSegmentURLCallback());
 325
 326   // Block domain and all subdomains, for any filtered scheme.
 327   scoped_ptr<base::ListValue> blocked(new base::ListValue);
 328   blocked->Append(new base::StringValue("google.com"));
 329   blacklist.Block(blocked.get());
 330   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://google.com")));
 331   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://google.com/")));
 332   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://google.com/whatever")));
 333   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("https://google.com/")));
 334   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("bogus://google.com/")));
 335   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://notgoogle.com/")));
 336   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://mail.google.com")));
 337   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://x.mail.google.com")));
 338   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("https://x.mail.google.com/")));
 339   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://x.y.google.com/a/b")));
 340   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://youtube.com/")));
 341
 342   // Filter only http, ftp and ws schemes.
 343   blocked.reset(new base::ListValue);
 344   blocked->Append(new base::StringValue("http://secure.com"));
 345   blocked->Append(new base::StringValue("ftp://secure.com"));
 346   blocked->Append(new base::StringValue("ws://secure.com"));
 347   blacklist.Block(blocked.get());
 348   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://secure.com")));
 349   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://secure.com/whatever")));
 350   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("ftp://secure.com/")));
 351   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("ws://secure.com")));
 352   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("https://secure.com/")));
 353   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("wss://secure.com")));
 354   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://www.secure.com")));
 355   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("https://www.secure.com")));
 356   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("wss://www.secure.com")));
 357
 358   // Filter only a certain path prefix.
 359   blocked.reset(new base::ListValue);
 360   blocked->Append(new base::StringValue("path.to/ruin"));
 361   blacklist.Block(blocked.get());
 362   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://path.to/ruin")));
 363   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("https://path.to/ruin")));
 364   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://path.to/ruins")));
 365   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://path.to/ruin/signup")));
 366   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://www.path.to/ruin")));
 367   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://path.to/fortune")));
 368
 369   // Filter only a certain path prefix and scheme.
 370   blocked.reset(new base::ListValue);
 371   blocked->Append(new base::StringValue("https://s.aaa.com/path"));
 372   blacklist.Block(blocked.get());
 373   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("https://s.aaa.com/path")));
 374   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("https://s.aaa.com/path/bbb")));
 375   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://s.aaa.com/path")));
 376   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("https://aaa.com/path")));
 377   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("https://x.aaa.com/path")));
 378   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("https://s.aaa.com/bbb")));
 379   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("https://s.aaa.com/")));
 380
 381   // Filter only ws and wss schemes.
 382   blocked.reset(new base::ListValue);
 383   blocked->Append(new base::StringValue("ws://ws.aaa.com"));
 384   blocked->Append(new base::StringValue("wss://ws.aaa.com"));
 385   blacklist.Block(blocked.get());
 386   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("ws://ws.aaa.com")));
 387   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("wss://ws.aaa.com")));
 388   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://ws.aaa.com")));
 389   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("https://ws.aaa.com")));
 390   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("ftp://ws.aaa.com")));
 391
 392   // Test exceptions to path prefixes, and most specific matches.
 393   blocked.reset(new base::ListValue);
 394   scoped_ptr<base::ListValue> allowed(new base::ListValue);
 395   blocked->Append(new base::StringValue("s.xxx.com/a"));
 396   allowed->Append(new base::StringValue("s.xxx.com/a/b"));
 397   blocked->Append(new base::StringValue("https://s.xxx.com/a/b/c"));
 398   allowed->Append(new base::StringValue("https://s.xxx.com/a/b/c/d"));
 399   blacklist.Block(blocked.get());
 400   blacklist.Allow(allowed.get());
 401   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://s.xxx.com/a")));
 402   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://s.xxx.com/a/x")));
 403   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("https://s.xxx.com/a/x")));
 404   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://s.xxx.com/a/b")));
 405   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("https://s.xxx.com/a/b")));
 406   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://s.xxx.com/a/b/x")));
 407   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://s.xxx.com/a/b/c")));
 408   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("https://s.xxx.com/a/b/c")));
 409   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("https://s.xxx.com/a/b/c/x")));
 410   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("https://s.xxx.com/a/b/c/d")));
 411   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://s.xxx.com/a/b/c/d")));
 412   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("https://s.xxx.com/a/b/c/d/x")));
 413   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://s.xxx.com/a/b/c/d/x")));
 414   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://xxx.com/a")));
 415   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://xxx.com/a/b")));
 416
 417   // Block an ip address.
 418   blocked.reset(new base::ListValue);
 419   blocked->Append(new base::StringValue("123.123.123.123"));
 420   blacklist.Block(blocked.get());
 421   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://123.123.123.123/")));
 422   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://123.123.123.124/")));
 423
 424   // Open an exception.
 425   allowed.reset(new base::ListValue);
 426   allowed->Append(new base::StringValue("plus.google.com"));
 427   blacklist.Allow(allowed.get());
 428   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://google.com/")));
 429   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://www.google.com/")));
 430   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://plus.google.com/")));
 431
 432   // Open an exception only when using https for mail.
 433   allowed.reset(new base::ListValue);
 434   allowed->Append(new base::StringValue("https://mail.google.com"));
 435   blacklist.Allow(allowed.get());
 436   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://google.com/")));
 437   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://mail.google.com/")));
 438   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://www.google.com/")));
 439   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("https://www.google.com/")));
 440   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("https://mail.google.com/")));
 441
 442   // Match exactly "google.com", only for http. Subdomains without exceptions
 443   // are still blocked.
 444   allowed.reset(new base::ListValue);
 445   allowed->Append(new base::StringValue("http://.google.com"));
 446   blacklist.Allow(allowed.get());
 447   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://google.com/")));
 448   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("https://google.com/")));
 449   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://www.google.com/")));
 450
 451   // A smaller path match in an exact host overrides a longer path for hosts
 452   // that also match subdomains.
 453   blocked.reset(new base::ListValue);
 454   blocked->Append(new base::StringValue("yyy.com/aaa"));
 455   blacklist.Block(blocked.get());
 456   allowed.reset(new base::ListValue);
 457   allowed->Append(new base::StringValue(".yyy.com/a"));
 458   blacklist.Allow(allowed.get());
 459   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://yyy.com")));
 460   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://yyy.com/aaa")));
 461   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://yyy.com/aaa2")));
 462   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://www.yyy.com")));
 463   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://www.yyy.com/aaa")));
 464   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://www.yyy.com/aaa2")));
 465
 466   // If the exact entry is both allowed and blocked, allowing takes precedence.
 467   blocked.reset(new base::ListValue);
 468   blocked->Append(new base::StringValue("example.com"));
 469   blacklist.Block(blocked.get());
 470   allowed.reset(new base::ListValue);
 471   allowed->Append(new base::StringValue("example.com"));
 472   blacklist.Allow(allowed.get());
 473   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://example.com")));
 474 }
 475
 476 TEST_F(URLBlacklistManagerTest, QueryParameters) {
 477   URLBlacklist blacklist(GetSegmentURLCallback());
 478   scoped_ptr<base::ListValue> blocked(new base::ListValue);
 479   scoped_ptr<base::ListValue> allowed(new base::ListValue);
 480
 481   // Block domain and all subdomains, for any filtered scheme.
 482   blocked->AppendString("youtube.com");
 483   allowed->AppendString("youtube.com/watch?v=XYZ");
 484   blacklist.Block(blocked.get());
 485   blacklist.Allow(allowed.get());
 486
 487   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://youtube.com")));
 488   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://youtube.com/watch?v=123")));
 489   EXPECT_TRUE(
 490       blacklist.IsURLBlocked(GURL("http://youtube.com/watch?v=123&v=XYZ")));
 491   EXPECT_TRUE(
 492       blacklist.IsURLBlocked(GURL("http://youtube.com/watch?v=XYZ&v=123")));
 493   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://youtube.com/watch?v=XYZ")));
 494   EXPECT_FALSE(
 495       blacklist.IsURLBlocked(GURL("http://youtube.com/watch?v=XYZ&foo=bar")));
 496   EXPECT_FALSE(
 497       blacklist.IsURLBlocked(GURL("http://youtube.com/watch?foo=bar&v=XYZ")));
 498
 499   allowed.reset(new base::ListValue);
 500   allowed->AppendString("youtube.com/watch?av=XYZ&ag=123");
 501   blacklist.Allow(allowed.get());
 502   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://youtube.com")));
 503   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://youtube.com/watch?av=123")));
 504   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://youtube.com/watch?av=XYZ")));
 505   EXPECT_TRUE(
 506       blacklist.IsURLBlocked(GURL("http://youtube.com/watch?av=123&ag=XYZ")));
 507   EXPECT_TRUE(
 508       blacklist.IsURLBlocked(GURL("http://youtube.com/watch?ag=XYZ&av=123")));
 509   EXPECT_FALSE(
 510       blacklist.IsURLBlocked(GURL("http://youtube.com/watch?av=XYZ&ag=123")));
 511   EXPECT_FALSE(
 512       blacklist.IsURLBlocked(GURL("http://youtube.com/watch?ag=123&av=XYZ")));
 513   EXPECT_TRUE(blacklist.IsURLBlocked(
 514       GURL("http://youtube.com/watch?av=XYZ&ag=123&av=123")));
 515   EXPECT_TRUE(blacklist.IsURLBlocked(
 516       GURL("http://youtube.com/watch?av=XYZ&ag=123&ag=1234")));
 517
 518   allowed.reset(new base::ListValue);
 519   allowed->AppendString("youtube.com/watch?foo=bar*&vid=2*");
 520   blacklist.Allow(allowed.get());
 521   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://youtube.com")));
 522   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://youtube.com/watch?vid=2")));
 523   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://youtube.com/watch?foo=bar")));
 524   EXPECT_FALSE(
 525       blacklist.IsURLBlocked(GURL("http://youtube.com/watch?vid=2&foo=bar")));
 526   EXPECT_FALSE(
 527       blacklist.IsURLBlocked(GURL("http://youtube.com/watch?vid=2&foo=bar1")));
 528   EXPECT_FALSE(
 529       blacklist.IsURLBlocked(GURL("http://youtube.com/watch?vid=234&foo=bar")));
 530   EXPECT_FALSE(blacklist.IsURLBlocked(
 531       GURL("http://youtube.com/watch?vid=234&foo=bar23")));
 532
 533   blocked.reset(new base::ListValue);
 534   blocked->AppendString("youtube1.com/disallow?v=44678");
 535   blacklist.Block(blocked.get());
 536   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://youtube1.com")));
 537   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://youtube1.com?v=123")));
 538   // Path does not match
 539   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://youtube1.com?v=44678")));
 540   EXPECT_TRUE(
 541       blacklist.IsURLBlocked(GURL("http://youtube1.com/disallow?v=44678")));
 542   EXPECT_FALSE(
 543       blacklist.IsURLBlocked(GURL("http://youtube1.com/disallow?v=4467")));
 544   EXPECT_FALSE(blacklist.IsURLBlocked(
 545       GURL("http://youtube1.com/disallow?v=4467&v=123")));
 546   EXPECT_TRUE(blacklist.IsURLBlocked(
 547       GURL("http://youtube1.com/disallow?v=4467&v=123&v=44678")));
 548
 549   blocked.reset(new base::ListValue);
 550   blocked->AppendString("youtube1.com/disallow?g=*");
 551   blacklist.Block(blocked.get());
 552   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://youtube1.com")));
 553   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://youtube1.com?ag=123")));
 554   EXPECT_TRUE(
 555       blacklist.IsURLBlocked(GURL("http://youtube1.com/disallow?g=123")));
 556   EXPECT_TRUE(
 557       blacklist.IsURLBlocked(GURL("http://youtube1.com/disallow?ag=13&g=123")));
 558
 559   blocked.reset(new base::ListValue);
 560   blocked->AppendString("youtube2.com/disallow?a*");
 561   blacklist.Block(blocked.get());
 562   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://youtube2.com")));
 563   EXPECT_TRUE(blacklist.IsURLBlocked(
 564       GURL("http://youtube2.com/disallow?b=123&a21=467")));
 565   EXPECT_TRUE(
 566       blacklist.IsURLBlocked(GURL("http://youtube2.com/disallow?abba=true")));
 567   EXPECT_FALSE(
 568       blacklist.IsURLBlocked(GURL("http://youtube2.com/disallow?baba=true")));
 569
 570   allowed.reset(new base::ListValue);
 571   blocked.reset(new base::ListValue);
 572   blocked->AppendString("youtube3.com");
 573   allowed->AppendString("youtube3.com/watch?fo*");
 574   blacklist.Block(blocked.get());
 575   blacklist.Allow(allowed.get());
 576   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://youtube3.com")));
 577   EXPECT_TRUE(
 578       blacklist.IsURLBlocked(GURL("http://youtube3.com/watch?b=123&a21=467")));
 579   EXPECT_FALSE(blacklist.IsURLBlocked(
 580       GURL("http://youtube3.com/watch?b=123&a21=467&foo1")));
 581   EXPECT_FALSE(blacklist.IsURLBlocked(
 582       GURL("http://youtube3.com/watch?b=123&a21=467&foo=bar")));
 583   EXPECT_FALSE(blacklist.IsURLBlocked(
 584       GURL("http://youtube3.com/watch?b=123&a21=467&fo=ba")));
 585   EXPECT_FALSE(
 586       blacklist.IsURLBlocked(GURL("http://youtube3.com/watch?foriegn=true")));
 587   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://youtube3.com/watch?fold")));
 588
 589   allowed.reset(new base::ListValue);
 590   blocked.reset(new base::ListValue);
 591   blocked->AppendString("youtube4.com");
 592   allowed->AppendString("youtube4.com?*");
 593   blacklist.Block(blocked.get());
 594   blacklist.Allow(allowed.get());
 595   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://youtube4.com")));
 596   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://youtube4.com/?hello")));
 597   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://youtube4.com/?foo")));
 598
 599   allowed.reset(new base::ListValue);
 600   blocked.reset(new base::ListValue);
 601   blocked->AppendString("youtube5.com?foo=bar");
 602   allowed->AppendString("youtube5.com?foo1=bar1&foo2=bar2&");
 603   blacklist.Block(blocked.get());
 604   blacklist.Allow(allowed.get());
 605   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://youtube5.com")));
 606   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://youtube5.com/?foo=bar&a=b")));
 607   // More specific filter is given precedence.
 608   EXPECT_FALSE(blacklist.IsURLBlocked(
 609       GURL("http://youtube5.com/?a=b&foo=bar&foo1=bar1&foo2=bar2")));
 610 }
 611
 612 TEST_F(URLBlacklistManagerTest, BlockAllWithExceptions) {
 613   URLBlacklist blacklist(GetSegmentURLCallback());
 614
 615   scoped_ptr<base::ListValue> blocked(new base::ListValue);
 616   scoped_ptr<base::ListValue> allowed(new base::ListValue);
 617   blocked->Append(new base::StringValue("*"));
 618   allowed->Append(new base::StringValue(".www.google.com"));
 619   allowed->Append(new base::StringValue("plus.google.com"));
 620   allowed->Append(new base::StringValue("https://mail.google.com"));
 621   allowed->Append(new base::StringValue("https://very.safe/path"));
 622   blacklist.Block(blocked.get());
 623   blacklist.Allow(allowed.get());
 624   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://random.com")));
 625   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://google.com")));
 626   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://s.www.google.com")));
 627   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://www.google.com")));
 628   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://plus.google.com")));
 629   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("http://s.plus.google.com")));
 630   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://mail.google.com")));
 631   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("https://mail.google.com")));
 632   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("https://s.mail.google.com")));
 633   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("https://very.safe/")));
 634   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://very.safe/path")));
 635   EXPECT_FALSE(blacklist.IsURLBlocked(GURL("https://very.safe/path")));
 636 }
 637
 638 TEST_F(URLBlacklistManagerTest, DontBlockResources) {
 639   scoped_ptr<URLBlacklist> blacklist(new URLBlacklist(GetSegmentURLCallback()));
 640   scoped_ptr<base::ListValue> blocked(new base::ListValue);
 641   blocked->Append(new base::StringValue("google.com"));
 642   blacklist->Block(blocked.get());
 643   blacklist_manager_->SetBlacklist(blacklist.Pass());
 644   EXPECT_TRUE(blacklist_manager_->IsURLBlocked(GURL("http://google.com")));
 645
 646   net::TestURLRequestContext context;
 647   scoped_ptr<net::URLRequest> request(context.CreateRequest(
 648       GURL("http://google.com"), net::DEFAULT_PRIORITY, NULL, NULL));
 649
 650   int reason = net::ERR_UNEXPECTED;
 651   // Background requests aren't filtered.
 652   EXPECT_FALSE(blacklist_manager_->IsRequestBlocked(*request.get(), &reason));
 653
 654   // Main frames are filtered.
 655   request->SetLoadFlags(net::LOAD_MAIN_FRAME);
 656   EXPECT_TRUE(blacklist_manager_->IsRequestBlocked(*request.get(), &reason));
 657   EXPECT_EQ(net::ERR_BLOCKED_BY_ADMINISTRATOR, reason);
 658
 659   // On most platforms, sync gets a free pass due to signin flows.
 660   bool block_signin_urls = false;
 661 #if defined(OS_CHROMEOS)
 662   // There are no sync specific signin flows on Chrome OS, so no special
 663   // treatment.
 664   block_signin_urls = true;
 665 #endif
 666
 667   GURL sync_url(GaiaUrls::GetInstance()->service_login_url().Resolve(
 668       "?service=chromiumsync"));
 669   scoped_ptr<net::URLRequest> sync_request(context.CreateRequest(
 670       sync_url, net::DEFAULT_PRIORITY, NULL, NULL));
 671   sync_request->SetLoadFlags(net::LOAD_MAIN_FRAME);
 672   EXPECT_EQ(block_signin_urls,
 673             blacklist_manager_->IsRequestBlocked(*sync_request.get(), &reason));
 674 }
 675
 676 TEST_F(URLBlacklistManagerTest, DefaultBlacklistExceptions) {
 677   URLBlacklist blacklist(GetSegmentURLCallback());
 678   scoped_ptr<base::ListValue> blocked(new base::ListValue);
 679
 680   // Blacklist everything:
 681   blocked->Append(new base::StringValue("*"));
 682   blacklist.Block(blocked.get());
 683
 684   // Internal NTP and extension URLs are not blocked by the "*":
 685   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://www.google.com")));
 686   EXPECT_FALSE((blacklist.IsURLBlocked(GURL("chrome-extension://xyz"))));
 687   EXPECT_FALSE((blacklist.IsURLBlocked(GURL("chrome-search://local-ntp"))));
 688   EXPECT_FALSE((blacklist.IsURLBlocked(GURL("chrome-native://ntp"))));
 689
 690   // Unless they are explicitly blacklisted:
 691   blocked->Append(new base::StringValue("chrome-extension://*"));
 692   scoped_ptr<base::ListValue> allowed(new base::ListValue);
 693   allowed->Append(new base::StringValue("chrome-extension://abc"));
 694   blacklist.Block(blocked.get());
 695   blacklist.Allow(allowed.get());
 696
 697   EXPECT_TRUE(blacklist.IsURLBlocked(GURL("http://www.google.com")));
 698   EXPECT_TRUE((blacklist.IsURLBlocked(GURL("chrome-extension://xyz"))));
 699   EXPECT_FALSE((blacklist.IsURLBlocked(GURL("chrome-extension://abc"))));
 700   EXPECT_FALSE((blacklist.IsURLBlocked(GURL("chrome-search://local-ntp"))));
 701   EXPECT_FALSE((blacklist.IsURLBlocked(GURL("chrome-native://ntp"))));
 702 }
 703
 704 }  // namespace policy