Adding upstream version 124.0.1.upstream/124.0.1

Signed-off-by: Daniel Baumann <daniel.baumann@progress-linux.org>

10 files changed, 1953 insertions, 0 deletions

diff --git a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
new file mode 100644
index 0000000000..c5fadb62e0
--- /dev/null
+++ b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp
@@ -0,0 +1,385 @@
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/3.0/ */
+
+#include "gtest/gtest.h"
+#include "mozilla/ArrayUtils.h"
+#include "nsLocalFileCommon.h"
+#include "ApplicationReputation.h"
+
+// clang-format off
+// PLEASE read the comment in ApplicationReputation.cpp before modifying this
+// list.
+static const char* const kTestFileExtensions[] = {
+    ".accda",   // MS Access database
+    ".accdb",   // MS Access database
+    ".accde",   // MS Access database
+    ".accdr",   // MS Access database
+    ".action",  // Nac script
+    ".ad",      // Windows (ignored for app rep)
+    ".ade",     // MS Access
+    ".adp",     // MS Access
+    ".afploc",  // Apple Filing Protocol Location (ignored for app rep)
+    ".air",     // Adobe Air (ignored for app rep)
+    ".apk",     // Android package
+    ".app",     // Executable application
+    ".applescript",
+    ".application",  // MS ClickOnce
+    ".appref-ms",    // MS ClickOnce
+    ".appx",
+    ".appxbundle",
+    ".as",           // Mac archive
+    ".asp",          // Windows Server script
+    ".asx",          // Windows Media Player
+    ".atloc",        // Appletalk Location (ignored for app rep)
+    ".bas",          // Basic script
+    ".bash",         // Linux shell
+    ".bat",          // Windows shell
+    ".bin",
+    ".btapp",          // uTorrent and Transmission
+    ".btinstall",      // uTorrent and Transmission
+    ".btkey",          // uTorrent and Transmission
+    ".btsearch",       // uTorrent and Transmission
+    ".btskin",         // uTorrent and Transmission
+    ".bz",             // Linux archive (bzip)
+    ".bz2",            // Linux archive (bzip2)
+    ".bzip2",          // Linux archive (bzip2)
+    ".cab",            // Windows archive
+    ".caction",        // Automator action
+    ".cdr",            // Mac disk image
+    ".cer",            // Signed certificate file
+    ".cfg",            // Windows
+    ".chi",            // Windows Help
+    ".chm",            // Windows Help
+    ".class",          // Java
+    ".cmd",            // Windows executable
+    ".com",            // Windows executable
+    ".command",        // Mac script
+    ".configprofile",  // Configuration file for Apple systems
+    ".cpgz",           // Mac archive
+    ".cpi",            // Control Panel Item. Executable used for adding icons
+                       // to Control Panel
+    ".cpl",            // Windows executable
+    ".crt",            // Windows signed certificate
+    ".crx",            // Chrome extensions
+    ".csh",            // Linux shell
+    ".dart",           // Mac disk image
+    ".dc42",           // Apple DiskCopy Image
+    ".deb",            // Linux package
+    ".definition",     // Automator action
+    ".der",            // Signed certificate file
+    ".desktop",        // A shortcut that runs other files
+    ".dex",            // Android
+    ".dht",            // HTML
+    ".dhtm",           // HTML
+    ".dhtml",          // HTML
+    ".diagcab",        // Windows archive
+    ".diskcopy42",     // Apple DiskCopy Image
+    ".dll",            // Windows executable
+    ".dmg",            // Mac disk image
+    ".dmgpart",        // Mac disk image
+    ".doc",            // MS Office
+    ".docb",           // MS Office
+    ".docm",           // MS Word
+    ".docx",           // MS Word
+    ".dot",            // MS Word
+    ".dotm",           // MS Word
+    ".dott",           // MS Office
+    ".dotx",           // MS Word
+    ".drv",            // Windows driver
+    ".dvdr",           // Mac Disk image
+    ".dylib",          // Mach object dynamic library file
+    ".efi",            // Firmware
+    ".eml",            // MS Outlook
+    ".exe",            // Windows executable
+    ".fileloc",        // Apple finder internet location data file
+    ".fon",            // Windows font
+    ".ftploc",         // Apple FTP Location (ignored for app rep)
+    ".fxp",            // MS FoxPro
+    ".gadget",         // Windows
+    ".grp",            // Windows
+    ".gz",             // Linux archive (gzip)
+    ".gzip",           // Linux archive (gzip)
+    ".hfs",            // Mac disk image
+    ".hlp",            // Windows Help
+    ".hqx",            // Mac archive
+    ".hta",            // HTML trusted application
+    ".htm", ".html",
+    ".htt",                // MS HTML template
+    ".img",                // Mac disk image
+    ".imgpart",            // Mac disk image
+    ".inetloc",            // Apple finder internet location data file
+    ".inf",                // Windows installer
+    ".ini",                // Generic config file
+    ".ins",                // IIS config
+    ".internetconnect",    // Configuration file for Apple system
+    ".iso",                // CD image
+    ".isp",                // IIS config
+    ".jar",                // Java
+#ifndef MOZ_ESR
+    ".jnlp",               // Java
+#endif
+    ".js",                 // JavaScript script
+    ".jse",                // JScript
+    ".ksh",                // Linux shell
+    ".lnk",                // Windows
+    ".local",              // Windows
+    ".mad",                // MS Access
+    ".maf",                // MS Access
+    ".mag",                // MS Access
+    ".mam",                // MS Access
+    ".manifest",           // Windows
+    ".maq",                // MS Access
+    ".mar",                // MS Access
+    ".mas",                // MS Access
+    ".mat",                // MS Access
+    ".mau",                // Media attachment
+    ".mav",                // MS Access
+    ".maw",                // MS Access
+    ".mda",                // MS Access
+    ".mdb",                // MS Access
+    ".mde",                // MS Access
+    ".mdt",                // MS Access
+    ".mdw",                // MS Access
+    ".mdz",                // MS Access
+    ".mht",                // MS HTML
+    ".mhtml",              // MS HTML
+    ".mim",                // MS Mail
+    ".mmc",                // MS Office
+    ".mobileconfig",       // Configuration file for Apple systems
+    ".mof",                // Windows
+    ".mpkg",               // Mac installer
+    ".msc",                // Windows executable
+    ".msg",                // MS Outlook
+    ".msh",                // Windows shell
+    ".msh1",               // Windows shell
+    ".msh1xml",            // Windows shell
+    ".msh2",               // Windows shell
+    ".msh2xml",            // Windows shell
+    ".mshxml",             // Windows
+    ".msi",                // Windows installer
+    ".msix",               // Windows installer
+    ".msixbundle",         // Windows installer
+    ".msp",                // Windows installer
+    ".mst",                // Windows installer
+    ".ndif",               // Mac disk image
+    ".networkconnect",     // Configuration file for Apple system
+    ".ocx",                // ActiveX
+    ".ops",                // MS Office
+    ".osas",               // AppleScript
+    ".osax",               // AppleScript
+    ".oxt",                // OpenOffice extension, can execute arbitrary code
+    ".partial",            // Downloads
+    ".pax",                // Mac archive
+    ".pcd",                // Microsoft Visual Test
+    ".pdf",                // Adobe Acrobat
+    ".pet",                // Linux package
+    ".pif",                // Windows
+    ".pkg",                // Mac installer
+    ".pl",                 // Perl script
+    ".plg",                // MS Visual Studio
+    ".pot",                // MS PowerPoint
+    ".potm",               // MS PowerPoint
+    ".potx",               // MS PowerPoint
+    ".ppam",               // MS PowerPoint
+    ".pps",                // MS PowerPoint
+    ".ppsm",               // MS PowerPoint
+    ".ppsx",               // MS PowerPoint
+    ".ppt",                // MS PowerPoint
+    ".pptm",               // MS PowerPoint
+    ".pptx",               // MS PowerPoint
+    ".prf",                // MS Outlook
+    ".prg",                // Windows
+    ".ps1",                // Windows shell
+    ".ps1xml",             // Windows shell
+    ".ps2",                // Windows shell
+    ".ps2xml",             // Windows shell
+    ".psc1",               // Windows shell
+    ".psc2",               // Windows shell
+    ".pst",                // MS Outlook
+    ".pup",                // Linux package
+    ".py",                 // Python script
+    ".pyc",                // Python binary
+    ".pyd",                // Equivalent of a DLL, for python libraries
+    ".pyo",                // Compiled python code
+    ".pyw",                // Python GUI
+    ".rb",                 // Ruby script
+    ".reg",                // Windows Registry
+    ".rels",               // MS Office
+    ".rpm",                // Linux package
+    ".rtf",                // MS Office
+    ".scf",                // Windows shell
+    ".scpt",               // AppleScript
+    ".scptd",              // AppleScript
+    ".scr",                // Windows
+    ".sct",                // Windows shell
+    ".search-ms",          // Windows
+    ".seplugin",           // AppleScript
+    ".service",            // Systemd service unit file
+    ".settingcontent-ms",  // Windows settings
+    ".sh",                 // Linux shell
+    ".shar",               // Linux shell
+    ".shb",                // Windows
+    ".shs",                // Windows shell
+    ".sht",                // HTML
+    ".shtm",               // HTML
+    ".shtml",              // HTML
+    ".sldm",               // MS PowerPoint
+    ".sldx",               // MS PowerPoint
+    ".slk",                // MS Excel
+    ".slp",                // Linux package
+    ".smi",                // Mac disk image
+    ".sparsebundle",       // Mac disk image
+    ".sparseimage",        // Mac disk image
+    ".spl",                // Adobe Flash
+    ".svg",
+    ".swf",       // Adobe Flash
+    ".swm",       // Windows Imaging
+    ".sys",       // Windows
+    ".tar",       // Linux archive
+    ".taz",       // Linux archive (bzip2)
+    ".tbz",       // Linux archive (bzip2)
+    ".tbz2",      // Linux archive (bzip2)
+    ".tcsh",      // Linux shell
+    ".tgz",       // Linux archive (gzip)
+    ".torrent",   // Bittorrent
+    ".tpz",       // Linux archive (gzip)
+    ".txz",       // Linux archive (xz)
+    ".tz",        // Linux archive (gzip)
+    ".udf",       // MS Excel
+    ".udif",      // Mac disk image
+    ".url",       // Windows
+    ".vb",        // Visual Basic script
+    ".vbe",       // Visual Basic script
+    ".vbs",       // Visual Basic script
+    ".vdx",       // MS Visio
+    ".vhd",       // Windows virtual hard drive
+    ".vhdx",      // Windows virtual hard drive
+    ".vmdk",      // VMware virtual disk
+    ".vsd",       // MS Visio
+    ".vsdm",      // MS Visio
+    ".vsdx",      // MS Visio
+    ".vsmacros",  // MS Visual Studio
+    ".vss",       // MS Visio
+    ".vssm",      // MS Visio
+    ".vssx",      // MS Visio
+    ".vst",       // MS Visio
+    ".vstm",      // MS Visio
+    ".vstx",      // MS Visio
+    ".vsw",       // MS Visio
+    ".vsx",       // MS Visio
+    ".vtx",       // MS Visio
+    ".webloc",    // MacOS website location file
+    ".website",   // Windows
+    ".wflow",     // Automator action
+    ".wim",       // Windows Imaging
+    ".workflow",  // Mac Automator
+    ".ws",        // Windows script
+    ".wsc",       // Windows script
+    ".wsf",       // Windows script
+    ".wsh",       // Windows script
+    ".xar",       // MS Excel
+    ".xbap",      // XAML Browser Application
+    ".xht", ".xhtm", ".xhtml",
+    ".xip",     // Mac archive
+    ".xla",     // MS Excel
+    ".xlam",    // MS Excel
+    ".xldm",    // MS Excel
+    ".xll",     // MS Excel
+    ".xlm",     // MS Excel
+    ".xls",     // MS Excel
+    ".xlsb",    // MS Excel
+    ".xlsm",    // MS Excel
+    ".xlsx",    // MS Excel
+    ".xlt",     // MS Excel
+    ".xltm",    // MS Excel
+    ".xltx",    // MS Excel
+    ".xlw",     // MS Excel
+    ".xml",     // MS Excel
+    ".xnk",     // MS Exchange
+    ".xrm-ms",  // Windows
+    ".xsd",     // XML schema definition
+    ".xsl",     // XML Stylesheet
+    ".xz",      // Linux archive (xz)
+    ".z",       // InstallShield
+#ifdef XP_WIN   // disable on Mac/Linux, see 1167493
+    ".zip",     // Generic archive
+#endif
+    ".zipx",  // WinZip
+};
+// clang-format on
+
+#define CheckListSorted(_list)                                   \
+  {                                                              \
+    for (size_t i = 1; i < mozilla::ArrayLength(_list); ++i) {   \
+      nsDependentCString str1((_list)[i - 1]);                   \
+      nsDependentCString str2((_list)[i]);                       \
+      EXPECT_LE(Compare(str1, str2), -1)                         \
+          << "Expected " << str1.get() << " to be sorted after " \
+          << str2.get();                                         \
+    }                                                            \
+  }
+
+// First, verify that the 2 lists are both sorted. This helps when checking for
+// duplicates manually, ensures we could start doing more efficient lookups if
+// we felt that was necessary (e.g. if the lists get much bigger), and that it's
+// easy for humans to find things...
+TEST(TestExecutableLists, ListsAreSorted)
+{
+  CheckListSorted(sExecutableExts);
+  CheckListSorted(ApplicationReputationService::kBinaryFileExtensions);
+  CheckListSorted(ApplicationReputationService::kNonBinaryExecutables);
+  CheckListSorted(kTestFileExtensions);
+}
+
+bool _IsInList(const char* ext, const char* const _list[], const size_t len) {
+  nsDependentCString extStr(ext);
+  for (size_t i = 0; i < len; ++i) {
+    if (extStr.EqualsASCII(_list[i])) {
+      return true;
+    }
+  }
+  return false;
+}
+
+#define IsInList(_ext, _list) \
+  _IsInList(_ext, _list, mozilla::ArrayLength(_list))
+
+TEST(TestExecutableLists, NonBinariesInExecutablesList)
+{
+  for (auto nonBinary : ApplicationReputationService::kNonBinaryExecutables) {
+    EXPECT_TRUE(IsInList(nonBinary, sExecutableExts))
+        << "Expected " << nonBinary << " to be part of sExecutableExts list";
+  }
+}
+
+TEST(TestExecutableLists, AllExtensionsInTestList)
+{
+  for (auto ext : ApplicationReputationService::kBinaryFileExtensions) {
+    EXPECT_TRUE(IsInList(ext, kTestFileExtensions))
+        << "Expected binary extension " << ext
+        << " to be listed in the test extension list";
+  }
+
+  for (auto ext : sExecutableExts) {
+    EXPECT_TRUE(IsInList(ext, kTestFileExtensions))
+        << "Expected executable extension " << ext
+        << " to be listed in the test extension list";
+  }
+
+  for (auto ext : ApplicationReputationService::kNonBinaryExecutables) {
+    EXPECT_TRUE(IsInList(ext, kTestFileExtensions))
+        << "Expected non-binary executable extension " << ext
+        << " to be listed in the test extension list";
+  }
+}
+
+TEST(TestExecutableLists, TestListExtensionsExistSomewhere)
+{
+  for (auto ext : kTestFileExtensions) {
+    EXPECT_TRUE(
+        IsInList(ext, ApplicationReputationService::kBinaryFileExtensions) !=
+        IsInList(ext, sExecutableExts))
+        << "Expected test extension " << ext
+        << " to be in exactly one of the other lists.";
+  }
+}
diff --git a/toolkit/components/reputationservice/test/gtest/moz.build b/toolkit/components/reputationservice/test/gtest/moz.build
new file mode 100644
index 0000000000..5ba7445f4a
--- /dev/null
+++ b/toolkit/components/reputationservice/test/gtest/moz.build
@@ -0,0 +1,16 @@
+# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*-
+# vim: set filetype=python:
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0. If a copy of the MPL was not distributed with this
+# file, You can obtain one at http://mozilla.org/MPL/2.0/.
+
+LOCAL_INCLUDES += [
+    "../..",
+]
+
+DEFINES["GOOGLE_PROTOBUF_NO_RTTI"] = True
+DEFINES["GOOGLE_PROTOBUF_NO_STATIC_INITIALIZER"] = True
+
+UNIFIED_SOURCES += ["TestExecutableLists.cpp"]
+
+FINAL_LIBRARY = "xul-gtest"
diff --git a/toolkit/components/reputationservice/test/unit/data/block_digest.chunk b/toolkit/components/reputationservice/test/unit/data/block_digest.chunk
new file mode 100644
index 0000000000..34c47c4bb5
--- /dev/null
+++ b/toolkit/components/reputationservice/test/unit/data/block_digest.chunk
@@ -0,0 +1,2 @@
+a:5:32:37
+,A�J
,A�J��8�W��bb��_e�;O�τCV��
\ No newline at end of file
diff --git a/toolkit/components/reputationservice/test/unit/data/digest.chunk b/toolkit/components/reputationservice/test/unit/data/digest.chunk
new file mode 100644
index 0000000000..b1fbb46673
--- /dev/null
+++ b/toolkit/components/reputationservice/test/unit/data/digest.chunk
@@ -0,0 +1,3 @@
+a:5:32:64
+��_H�^�a�7��]�=#�nm����n��o��Q����
+��@.R0�D�7Y4���ퟆ�S$��8
\ No newline at end of file
diff --git a/toolkit/components/reputationservice/test/unit/data/signed_win.exe b/toolkit/components/reputationservice/test/unit/data/signed_win.exe
new file mode 100644
index 0000000000..de3bb40e84
--- /dev/null
+++ b/toolkit/components/reputationservice/test/unit/data/signed_win.exe
diff --git a/toolkit/components/reputationservice/test/unit/head_download_manager.js b/toolkit/components/reputationservice/test/unit/head_download_manager.js
new file mode 100644
index 0000000000..5c415fb7f4
--- /dev/null
+++ b/toolkit/components/reputationservice/test/unit/head_download_manager.js
@@ -0,0 +1,134 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+// This file tests the download manager backend
+
+do_get_profile();
+
+var { XPCOMUtils } = ChromeUtils.importESModule(
+  "resource://gre/modules/XPCOMUtils.sys.mjs"
+);
+var {
+  HTTP_400,
+  HTTP_401,
+  HTTP_402,
+  HTTP_403,
+  HTTP_404,
+  HTTP_405,
+  HTTP_406,
+  HTTP_407,
+  HTTP_408,
+  HTTP_409,
+  HTTP_410,
+  HTTP_411,
+  HTTP_412,
+  HTTP_413,
+  HTTP_414,
+  HTTP_415,
+  HTTP_417,
+  HTTP_500,
+  HTTP_501,
+  HTTP_502,
+  HTTP_503,
+  HTTP_504,
+  HTTP_505,
+  HttpError,
+  HttpServer,
+} = ChromeUtils.importESModule("resource://testing-common/httpd.sys.mjs");
+
+// List types, this should sync with |enum LIST_TYPES| defined in PendingLookup.
+var ALLOW_LIST = 0;
+var BLOCK_LIST = 1;
+var NO_LIST = 2;
+
+// Allow or block reason, this should sync with |enum Reason| in ApplicationReputation.cpp
+var NotSet = 0;
+var LocalWhitelist = 1;
+var LocalBlocklist = 2;
+var NonBinaryFile = 3;
+var VerdictSafe = 4;
+var VerdictUnknown = 5;
+var VerdictDangerous = 6;
+var VerdictDangerousHost = 7;
+var VerdictUnwanted = 8;
+var VerdictUncommon = 9;
+var VerdictUnrecognized = 10;
+var DangerousPrefOff = 11;
+var DangerousHostPrefOff = 12;
+var UnwantedPrefOff = 13;
+var UncommonPrefOff = 14;
+var NetworkError = 15;
+var RemoteLookupDisabled = 16;
+var InternalError = 17;
+var DPDisabled = 18;
+var MAX_REASON = 19;
+
+function createURI(aObj) {
+  return aObj instanceof Ci.nsIFile
+    ? Services.io.newFileURI(aObj)
+    : Services.io.newURI(aObj);
+}
+
+function add_telemetry_count(telemetry, index, count) {
+  let val = telemetry[index] || 0;
+  telemetry[index] = val + count;
+}
+
+function check_telemetry(aExpectedTelemetry) {
+  // SHOULD_BLOCK = true
+  let shouldBlock = Services.telemetry
+    .getHistogramById("APPLICATION_REPUTATION_SHOULD_BLOCK")
+    .snapshot();
+  let expectedShouldBlock = aExpectedTelemetry.shouldBlock;
+  Assert.equal(shouldBlock.values[1] || 0, expectedShouldBlock);
+
+  let local = Services.telemetry
+    .getHistogramById("APPLICATION_REPUTATION_LOCAL")
+    .snapshot();
+
+  let expectedLocal = aExpectedTelemetry.local;
+  Assert.equal(
+    local.values[ALLOW_LIST] || 0,
+    expectedLocal[ALLOW_LIST] || 0,
+    "Allow list.values don't match"
+  );
+  Assert.equal(
+    local.values[BLOCK_LIST] || 0,
+    expectedLocal[BLOCK_LIST] || 0,
+    "Block list.values don't match"
+  );
+  Assert.equal(
+    local.values[NO_LIST] || 0,
+    expectedLocal[NO_LIST] || 0,
+    "No list.values don't match"
+  );
+
+  let reason = Services.telemetry
+    .getHistogramById("APPLICATION_REPUTATION_REASON")
+    .snapshot();
+  let expectedReason = aExpectedTelemetry.reason;
+
+  for (let i = 0; i < MAX_REASON; i++) {
+    if ((reason.values[i] || 0) != (expectedReason[i] || 0)) {
+      Assert.ok(false, "Allow or Block reason(" + i + ") doesn't match");
+    }
+  }
+}
+
+function get_telemetry_snapshot() {
+  let local = Services.telemetry
+    .getHistogramById("APPLICATION_REPUTATION_LOCAL")
+    .snapshot();
+  let shouldBlock = Services.telemetry
+    .getHistogramById("APPLICATION_REPUTATION_SHOULD_BLOCK")
+    .snapshot();
+  let reason = Services.telemetry
+    .getHistogramById("APPLICATION_REPUTATION_REASON")
+    .snapshot();
+  return {
+    shouldBlock: shouldBlock.values[1] || 0,
+    local: local.values,
+    reason: reason.values,
+  };
+}
diff --git a/toolkit/components/reputationservice/test/unit/test_app_rep.js b/toolkit/components/reputationservice/test/unit/test_app_rep.js
new file mode 100644
index 0000000000..9c381a7beb
--- /dev/null
+++ b/toolkit/components/reputationservice/test/unit/test_app_rep.js
@@ -0,0 +1,571 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
+
+const { NetUtil } = ChromeUtils.importESModule(
+  "resource://gre/modules/NetUtil.sys.mjs"
+);
+
+const gAppRep = Cc[
+  "@mozilla.org/reputationservice/application-reputation-service;1"
+].getService(Ci.nsIApplicationReputationService);
+
+const ReferrerInfo = Components.Constructor(
+  "@mozilla.org/referrer-info;1",
+  "nsIReferrerInfo",
+  "init"
+);
+
+var gHttpServ = null;
+var gTables = {};
+var gExpectedRemote = false;
+var gExpectedRemoteRequestBody = "";
+
+var whitelistedURI = createURI("http://foo:bar@whitelisted.com/index.htm#junk");
+var exampleURI = createURI("http://user:password@example.com/i.html?foo=bar");
+var exampleReferrerURI = createURI(
+  "http://user:password@example.referrer.com/i.html?foo=bar"
+);
+var exampleRedirectURI = createURI(
+  "http://user:password@example.redirect.com/i.html?foo=bar"
+);
+var blocklistedURI = createURI("http://baz:qux@blocklisted.com?xyzzy");
+
+var binaryFile = "binaryFile.exe";
+var nonBinaryFile = "nonBinaryFile.txt";
+
+const appRepURLPref = "browser.safebrowsing.downloads.remote.url";
+
+function createReferrerInfo(
+  aURI,
+  aRefererPolicy = Ci.nsIReferrerInfo.NO_REFERRER
+) {
+  return new ReferrerInfo(aRefererPolicy, true, aURI);
+}
+
+function readFileToString(aFilename) {
+  let f = do_get_file(aFilename);
+  let stream = Cc["@mozilla.org/network/file-input-stream;1"].createInstance(
+    Ci.nsIFileInputStream
+  );
+  stream.init(f, -1, 0, 0);
+  let buf = NetUtil.readInputStreamToString(stream, stream.available());
+  return buf;
+}
+
+// Registers a table for which to serve update chunks. Returns a promise that
+// resolves when that chunk has been downloaded.
+function registerTableUpdate(aTable, aFilename) {
+  // If we haven't been given an update for this table yet, add it to the map
+  if (!(aTable in gTables)) {
+    gTables[aTable] = [];
+  }
+
+  // The number of chunks associated with this table.
+  let numChunks = gTables[aTable].length + 1;
+  let redirectPath = "/" + aTable + "-" + numChunks;
+  let redirectUrl = "localhost:4444" + redirectPath;
+
+  // Store redirect url for that table so we can return it later when we
+  // process an update request.
+  gTables[aTable].push(redirectUrl);
+
+  gHttpServ.registerPathHandler(redirectPath, function (request, response) {
+    info("Mock safebrowsing server handling request for " + redirectPath);
+    let contents = readFileToString(aFilename);
+    info("Length of " + aFilename + ": " + contents.length);
+    response.setHeader(
+      "Content-Type",
+      "application/vnd.google.safebrowsing-update",
+      false
+    );
+    response.setStatusLine(request.httpVersion, 200, "OK");
+    response.bodyOutputStream.write(contents, contents.length);
+  });
+}
+
+add_task(async function test_setup() {
+  // Set up a local HTTP server to return bad verdicts.
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+  // Ensure safebrowsing is enabled for this test, even if the app
+  // doesn't have it enabled.
+  Services.prefs.setBoolPref("browser.safebrowsing.malware.enabled", true);
+  Services.prefs.setBoolPref("browser.safebrowsing.downloads.enabled", true);
+  registerCleanupFunction(function () {
+    Services.prefs.clearUserPref("browser.safebrowsing.malware.enabled");
+    Services.prefs.clearUserPref("browser.safebrowsing.downloads.enabled");
+  });
+
+  // Set block and allow tables explicitly, since the allowlist is normally
+  // disabled on non-Windows platforms.
+  Services.prefs.setCharPref(
+    "urlclassifier.downloadBlockTable",
+    "goog-badbinurl-shavar"
+  );
+  Services.prefs.setCharPref(
+    "urlclassifier.downloadAllowTable",
+    "goog-downloadwhite-digest256"
+  );
+  registerCleanupFunction(function () {
+    Services.prefs.clearUserPref("urlclassifier.downloadBlockTable");
+    Services.prefs.clearUserPref("urlclassifier.downloadAllowTable");
+  });
+
+  gHttpServ = new HttpServer();
+  gHttpServ.registerDirectory("/", do_get_cwd());
+  gHttpServ.registerPathHandler("/download", function (request, response) {
+    if (gExpectedRemote) {
+      let body = NetUtil.readInputStreamToString(
+        request.bodyInputStream,
+        request.bodyInputStream.available()
+      );
+      Assert.equal(gExpectedRemoteRequestBody, body);
+    } else {
+      do_throw("This test should never make a remote lookup");
+    }
+  });
+  gHttpServ.start(4444);
+
+  registerCleanupFunction(function () {
+    return (async function () {
+      await new Promise(resolve => {
+        gHttpServ.stop(resolve);
+      });
+    })();
+  });
+});
+
+add_test(function test_nullSourceURI() {
+  let expected = get_telemetry_snapshot();
+  add_telemetry_count(expected.reason, InternalError, 1);
+
+  gAppRep.queryReputation(
+    {
+      // No source URI
+      fileSize: 12,
+    },
+    function onComplete(aShouldBlock, aStatus) {
+      Assert.equal(Cr.NS_ERROR_UNEXPECTED, aStatus);
+      Assert.ok(!aShouldBlock);
+      check_telemetry(expected);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function test_nullCallback() {
+  let expected = get_telemetry_snapshot();
+
+  try {
+    gAppRep.queryReputation(
+      {
+        sourceURI: createURI("http://example.com"),
+        fileSize: 12,
+      },
+      null
+    );
+    do_throw("Callback cannot be null");
+  } catch (ex) {
+    if (ex.result != Cr.NS_ERROR_INVALID_POINTER) {
+      throw ex;
+    }
+    // We don't even increment the count here, because there's no callback.
+    check_telemetry(expected);
+    run_next_test();
+  }
+});
+
+// Set up the local whitelist.
+add_test(function test_local_list() {
+  // Construct a response with redirect urls.
+  function processUpdateRequest() {
+    let response = "n:1000\n";
+    for (let table in gTables) {
+      response += "i:" + table + "\n";
+      for (let i = 0; i < gTables[table].length; ++i) {
+        response += "u:" + gTables[table][i] + "\n";
+      }
+    }
+    info("Returning update response: " + response);
+    return response;
+  }
+  gHttpServ.registerPathHandler("/downloads", function (request, response) {
+    let blob = processUpdateRequest();
+    response.setHeader(
+      "Content-Type",
+      "application/vnd.google.safebrowsing-update",
+      false
+    );
+    response.setStatusLine(request.httpVersion, 200, "OK");
+    response.bodyOutputStream.write(blob, blob.length);
+  });
+
+  let streamUpdater = Cc[
+    "@mozilla.org/url-classifier/streamupdater;1"
+  ].getService(Ci.nsIUrlClassifierStreamUpdater);
+
+  // Load up some update chunks for the safebrowsing server to serve.
+  // This chunk contains the hash of blocklisted.com/.
+  registerTableUpdate("goog-badbinurl-shavar", "data/block_digest.chunk");
+  // This chunk contains the hash of whitelisted.com/.
+  registerTableUpdate("goog-downloadwhite-digest256", "data/digest.chunk");
+
+  // Download some updates, and don't continue until the downloads are done.
+  function updateSuccess(aEvent) {
+    // Timeout of n:1000 is constructed in processUpdateRequest above and
+    // passed back in the callback in nsIUrlClassifierStreamUpdater on success.
+    Assert.equal("1000", aEvent);
+    info("All data processed");
+    run_next_test();
+  }
+  // Just throw if we ever get an update or download error.
+  function handleError(aEvent) {
+    do_throw("We didn't download or update correctly: " + aEvent);
+  }
+  streamUpdater.downloadUpdates(
+    "goog-downloadwhite-digest256,goog-badbinurl-shavar",
+    "goog-downloadwhite-digest256,goog-badbinurl-shavar;\n",
+    true, // isPostRequest.
+    "http://localhost:4444/downloads",
+    updateSuccess,
+    handleError,
+    handleError
+  );
+});
+
+add_test(function test_unlisted() {
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+  let expected = get_telemetry_snapshot();
+  add_telemetry_count(expected.local, NO_LIST, 1);
+  add_telemetry_count(expected.reason, NonBinaryFile, 1);
+
+  gAppRep.queryReputation(
+    {
+      sourceURI: exampleURI,
+      fileSize: 12,
+    },
+    function onComplete(aShouldBlock, aStatus) {
+      Assert.equal(Cr.NS_OK, aStatus);
+      Assert.ok(!aShouldBlock);
+      check_telemetry(expected);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function test_non_uri() {
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+  let expected = get_telemetry_snapshot();
+  add_telemetry_count(expected.reason, NonBinaryFile, 1);
+
+  // No listcount is incremented, since the sourceURI is not an nsIURL
+  let source = NetUtil.newURI("data:application/octet-stream,ABC");
+  Assert.equal(false, source instanceof Ci.nsIURL);
+  gAppRep.queryReputation(
+    {
+      sourceURI: source,
+      fileSize: 12,
+    },
+    function onComplete(aShouldBlock, aStatus) {
+      Assert.equal(Cr.NS_OK, aStatus);
+      Assert.ok(!aShouldBlock);
+      check_telemetry(expected);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function test_local_blacklist() {
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+  let expected = get_telemetry_snapshot();
+  expected.shouldBlock++;
+  add_telemetry_count(expected.local, BLOCK_LIST, 1);
+  add_telemetry_count(expected.reason, LocalBlocklist, 1);
+
+  gAppRep.queryReputation(
+    {
+      sourceURI: blocklistedURI,
+      fileSize: 12,
+    },
+    function onComplete(aShouldBlock, aStatus) {
+      Assert.equal(Cr.NS_OK, aStatus);
+      Assert.ok(aShouldBlock);
+      check_telemetry(expected);
+
+      run_next_test();
+    }
+  );
+});
+
+add_test(async function test_referer_blacklist() {
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+  let testReferrerPolicies = [
+    Ci.nsIReferrerInfo.EMPTY,
+    Ci.nsIReferrerInfo.NO_REFERRER,
+    Ci.nsIReferrerInfo.NO_REFERRER_WHEN_DOWNGRADE,
+    Ci.nsIReferrerInfo.ORIGIN,
+    Ci.nsIReferrerInfo.ORIGIN_WHEN_CROSS_ORIGIN,
+    Ci.nsIReferrerInfo.UNSAFE_URL,
+    Ci.nsIReferrerInfo.SAME_ORIGIN,
+    Ci.nsIReferrerInfo.STRICT_ORIGIN,
+    Ci.nsIReferrerInfo.STRICT_ORIGIN_WHEN_CROSS_ORIGIN,
+  ];
+
+  function runReferrerPolicyTest(referrerPolicy) {
+    return new Promise(resolve => {
+      let expected = get_telemetry_snapshot();
+      expected.shouldBlock++;
+      add_telemetry_count(expected.local, BLOCK_LIST, 1);
+      add_telemetry_count(expected.local, NO_LIST, 1);
+      add_telemetry_count(expected.reason, LocalBlocklist, 1);
+
+      gAppRep.queryReputation(
+        {
+          sourceURI: exampleURI,
+          referrerInfo: createReferrerInfo(blocklistedURI, referrerPolicy),
+          fileSize: 12,
+        },
+        function onComplete(aShouldBlock, aStatus) {
+          Assert.equal(Cr.NS_OK, aStatus);
+          Assert.ok(aShouldBlock);
+          check_telemetry(expected);
+          resolve();
+        }
+      );
+    });
+  }
+
+  // We run tests with referrer policies but download protection should use
+  // "full URL" original referrer to block the download
+  for (let i = 0; i < testReferrerPolicies.length; ++i) {
+    await runReferrerPolicyTest(testReferrerPolicies[i]);
+  }
+
+  run_next_test();
+});
+
+add_test(function test_blocklist_trumps_allowlist() {
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+  let expected = get_telemetry_snapshot();
+  expected.shouldBlock++;
+  add_telemetry_count(expected.local, BLOCK_LIST, 1);
+  add_telemetry_count(expected.local, ALLOW_LIST, 1);
+  add_telemetry_count(expected.reason, LocalBlocklist, 1);
+
+  gAppRep.queryReputation(
+    {
+      sourceURI: whitelistedURI,
+      referrerInfo: createReferrerInfo(blocklistedURI),
+      suggestedFileName: binaryFile,
+      fileSize: 12,
+      signatureInfo: [],
+    },
+    function onComplete(aShouldBlock, aStatus) {
+      Assert.equal(Cr.NS_OK, aStatus);
+      Assert.ok(aShouldBlock);
+      check_telemetry(expected);
+
+      run_next_test();
+    }
+  );
+});
+
+add_test(function test_redirect_on_blocklist() {
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+  let expected = get_telemetry_snapshot();
+  expected.shouldBlock++;
+  add_telemetry_count(expected.local, BLOCK_LIST, 1);
+  add_telemetry_count(expected.local, ALLOW_LIST, 1);
+  add_telemetry_count(expected.local, NO_LIST, 1);
+  add_telemetry_count(expected.reason, LocalBlocklist, 1);
+  let secman = Services.scriptSecurityManager;
+  let badRedirects = Cc["@mozilla.org/array;1"].createInstance(
+    Ci.nsIMutableArray
+  );
+
+  let redirect1 = {
+    QueryInterface: ChromeUtils.generateQI(["nsIRedirectHistoryEntry"]),
+    principal: secman.createContentPrincipal(exampleURI, {}),
+  };
+  badRedirects.appendElement(redirect1);
+
+  let redirect2 = {
+    QueryInterface: ChromeUtils.generateQI(["nsIRedirectHistoryEntry"]),
+    principal: secman.createContentPrincipal(blocklistedURI, {}),
+  };
+  badRedirects.appendElement(redirect2);
+
+  // Add a whitelisted URI that will not be looked up against the
+  // whitelist (i.e. it will match NO_LIST).
+  let redirect3 = {
+    QueryInterface: ChromeUtils.generateQI(["nsIRedirectHistoryEntry"]),
+    principal: secman.createContentPrincipal(whitelistedURI, {}),
+  };
+  badRedirects.appendElement(redirect3);
+
+  gAppRep.queryReputation(
+    {
+      sourceURI: whitelistedURI,
+      referrerInfo: createReferrerInfo(exampleURI),
+      redirects: badRedirects,
+      suggestedFileName: binaryFile,
+      fileSize: 12,
+      signatureInfo: [],
+    },
+    function onComplete(aShouldBlock, aStatus) {
+      Assert.equal(Cr.NS_OK, aStatus);
+      Assert.ok(aShouldBlock);
+      check_telemetry(expected);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function test_whitelisted_source() {
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+  let expected = get_telemetry_snapshot();
+  add_telemetry_count(expected.local, ALLOW_LIST, 1);
+  add_telemetry_count(expected.reason, LocalWhitelist, 1);
+  gAppRep.queryReputation(
+    {
+      sourceURI: whitelistedURI,
+      suggestedFileName: binaryFile,
+      fileSize: 12,
+      signatureInfo: [],
+    },
+    function onComplete(aShouldBlock, aStatus) {
+      Assert.equal(Cr.NS_OK, aStatus);
+      Assert.ok(!aShouldBlock);
+      check_telemetry(expected);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function test_whitelisted_non_binary_source() {
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+  let expected = get_telemetry_snapshot();
+  add_telemetry_count(expected.local, NO_LIST, 1);
+  add_telemetry_count(expected.reason, NonBinaryFile, 1);
+  gAppRep.queryReputation(
+    {
+      sourceURI: whitelistedURI,
+      suggestedFileName: nonBinaryFile,
+      fileSize: 12,
+    },
+    function onComplete(aShouldBlock, aStatus) {
+      Assert.equal(Cr.NS_OK, aStatus);
+      Assert.ok(!aShouldBlock);
+      check_telemetry(expected);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function test_whitelisted_referrer() {
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+  let expected = get_telemetry_snapshot();
+  add_telemetry_count(expected.local, NO_LIST, 2);
+  add_telemetry_count(expected.reason, NonBinaryFile, 1);
+
+  gAppRep.queryReputation(
+    {
+      sourceURI: exampleURI,
+      referrerInfo: createReferrerInfo(exampleURI),
+      fileSize: 12,
+    },
+    function onComplete(aShouldBlock, aStatus) {
+      Assert.equal(Cr.NS_OK, aStatus);
+      Assert.ok(!aShouldBlock);
+      check_telemetry(expected);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function test_whitelisted_redirect() {
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+  let expected = get_telemetry_snapshot();
+  add_telemetry_count(expected.local, NO_LIST, 3);
+  add_telemetry_count(expected.reason, NonBinaryFile, 1);
+  let secman = Services.scriptSecurityManager;
+  let okayRedirects = Cc["@mozilla.org/array;1"].createInstance(
+    Ci.nsIMutableArray
+  );
+
+  let redirect1 = {
+    QueryInterface: ChromeUtils.generateQI(["nsIRedirectHistoryEntry"]),
+    principal: secman.createContentPrincipal(exampleURI, {}),
+  };
+  okayRedirects.appendElement(redirect1);
+
+  // Add a whitelisted URI that will not be looked up against the
+  // whitelist (i.e. it will match NO_LIST).
+  let redirect2 = {
+    QueryInterface: ChromeUtils.generateQI(["nsIRedirectHistoryEntry"]),
+    principal: secman.createContentPrincipal(whitelistedURI, {}),
+  };
+  okayRedirects.appendElement(redirect2);
+
+  gAppRep.queryReputation(
+    {
+      sourceURI: exampleURI,
+      redirects: okayRedirects,
+      fileSize: 12,
+    },
+    function onComplete(aShouldBlock, aStatus) {
+      Assert.equal(Cr.NS_OK, aStatus);
+      Assert.ok(!aShouldBlock);
+      check_telemetry(expected);
+      run_next_test();
+    }
+  );
+});
+
+add_test(function test_remote_lookup_protocolbuf() {
+  // This long hard-coded string is the contents of the request generated by
+  // the Application Reputation component, converted to the binary protobuf format.
+  // If this test is changed, or we add anything to the remote lookup requests
+  // in ApplicationReputation.cpp, then we'll need to update this hard-coded string.
+  gExpectedRemote = true;
+  gExpectedRemoteRequestBody =
+    "\x0A\x19\x68\x74\x74\x70\x3A\x2F\x2F\x65\x78\x61\x6D\x70\x6C\x65\x2E\x63\x6F\x6D\x2F\x69\x2E\x68\x74\x6D\x6C\x12\x22\x0A\x20\x61\x62\x63\x00\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x18\x0C\x22\x41\x0A\x19\x68\x74\x74\x70\x3A\x2F\x2F\x65\x78\x61\x6D\x70\x6C\x65\x2E\x63\x6F\x6D\x2F\x69\x2E\x68\x74\x6D\x6C\x10\x00\x22\x22\x68\x74\x74\x70\x3A\x2F\x2F\x65\x78\x61\x6D\x70\x6C\x65\x2E\x72\x65\x66\x65\x72\x72\x65\x72\x2E\x63\x6F\x6D\x2F\x69\x2E\x68\x74\x6D\x6C\x22\x26\x0A\x22\x68\x74\x74\x70\x3A\x2F\x2F\x65\x78\x61\x6D\x70\x6C\x65\x2E\x72\x65\x64\x69\x72\x65\x63\x74\x2E\x63\x6F\x6D\x2F\x69\x2E\x68\x74\x6D\x6C\x10\x01\x30\x01\x4A\x0E\x62\x69\x6E\x61\x72\x79\x46\x69\x6C\x65\x2E\x65\x78\x65\x50\x00\x5A\x05\x65\x6E\x2D\x55\x53";
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+  let secman = Services.scriptSecurityManager;
+  let expected = get_telemetry_snapshot();
+  add_telemetry_count(expected.local, NO_LIST, 3);
+  add_telemetry_count(expected.reason, VerdictSafe, 1);
+
+  // Redirects
+  let redirects = Cc["@mozilla.org/array;1"].createInstance(Ci.nsIMutableArray);
+  let redirect1 = {
+    QueryInterface: ChromeUtils.generateQI(["nsIRedirectHistoryEntry"]),
+    principal: secman.createContentPrincipal(exampleRedirectURI, {}),
+  };
+  redirects.appendElement(redirect1);
+
+  // Insert null(\x00) in the middle of the hash to test we won't truncate it.
+  let sha256Hash = "abc\x00" + "de".repeat(14);
+
+  gAppRep.queryReputation(
+    {
+      sourceURI: exampleURI,
+      referrerInfo: createReferrerInfo(exampleReferrerURI),
+      suggestedFileName: binaryFile,
+      sha256Hash,
+      redirects,
+      fileSize: 12,
+      signatureInfo: [],
+    },
+    function onComplete(aShouldBlock, aStatus) {
+      Assert.equal(Cr.NS_OK, aStatus);
+      Assert.ok(!aShouldBlock);
+      check_telemetry(expected);
+
+      gExpectedRemote = false;
+      run_next_test();
+    }
+  );
+});
diff --git a/toolkit/components/reputationservice/test/unit/test_app_rep_maclinux.js b/toolkit/components/reputationservice/test/unit/test_app_rep_maclinux.js
new file mode 100644
index 0000000000..a89197e8ec
--- /dev/null
+++ b/toolkit/components/reputationservice/test/unit/test_app_rep_maclinux.js
@@ -0,0 +1,340 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+// Globals
+
+ChromeUtils.defineESModuleGetters(this, {
+  NetUtil: "resource://gre/modules/NetUtil.sys.mjs",
+});
+
+const gAppRep = Cc[
+  "@mozilla.org/reputationservice/application-reputation-service;1"
+].getService(Ci.nsIApplicationReputationService);
+var gStillRunning = true;
+var gTables = {};
+var gHttpServer = null;
+
+const appRepURLPref = "browser.safebrowsing.downloads.remote.url";
+const remoteEnabledPref = "browser.safebrowsing.downloads.remote.enabled";
+
+function readFileToString(aFilename) {
+  let f = do_get_file(aFilename);
+  let stream = Cc["@mozilla.org/network/file-input-stream;1"].createInstance(
+    Ci.nsIFileInputStream
+  );
+  stream.init(f, -1, 0, 0);
+  let buf = NetUtil.readInputStreamToString(stream, stream.available());
+  return buf;
+}
+
+function registerTableUpdate(aTable, aFilename) {
+  // If we haven't been given an update for this table yet, add it to the map
+  if (!(aTable in gTables)) {
+    gTables[aTable] = [];
+  }
+
+  // The number of chunks associated with this table.
+  let numChunks = gTables[aTable].length + 1;
+  let redirectPath = "/" + aTable + "-" + numChunks;
+  let redirectUrl = "localhost:4444" + redirectPath;
+
+  // Store redirect url for that table so we can return it later when we
+  // process an update request.
+  gTables[aTable].push(redirectUrl);
+
+  gHttpServer.registerPathHandler(redirectPath, function (request, response) {
+    info("Mock safebrowsing server handling request for " + redirectPath);
+    let contents = readFileToString(aFilename);
+    info("Length of " + aFilename + ": " + contents.length);
+    response.setHeader(
+      "Content-Type",
+      "application/vnd.google.safebrowsing-update",
+      false
+    );
+    response.setStatusLine(request.httpVersion, 200, "OK");
+    response.bodyOutputStream.write(contents, contents.length);
+  });
+}
+
+// Tests
+
+add_task(function test_setup() {
+  // Wait 10 minutes, that is half of the external xpcshell timeout.
+  do_timeout(10 * 60 * 1000, function () {
+    if (gStillRunning) {
+      do_throw("Test timed out.");
+    }
+  });
+  // Set up a local HTTP server to return bad verdicts.
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+  // Ensure safebrowsing is enabled for this test, even if the app
+  // doesn't have it enabled.
+  Services.prefs.setBoolPref("browser.safebrowsing.malware.enabled", true);
+  Services.prefs.setBoolPref("browser.safebrowsing.downloads.enabled", true);
+  // Set block table explicitly, no need for the allow table though
+  Services.prefs.setCharPref(
+    "urlclassifier.downloadBlockTable",
+    "goog-badbinurl-shavar"
+  );
+  // SendRemoteQueryInternal needs locale preference.
+  let originalReqLocales = Services.locale.requestedLocales;
+  Services.locale.requestedLocales = ["en-US"];
+
+  registerCleanupFunction(function () {
+    Services.prefs.clearUserPref("browser.safebrowsing.malware.enabled");
+    Services.prefs.clearUserPref("browser.safebrowsing.downloads.enabled");
+    Services.prefs.clearUserPref("urlclassifier.downloadBlockTable");
+    Services.locale.requestedLocales = originalReqLocales;
+  });
+
+  gHttpServer = new HttpServer();
+  gHttpServer.registerDirectory("/", do_get_cwd());
+
+  function createVerdict(aShouldBlock) {
+    // We can't programmatically create a protocol buffer here, so just
+    // hardcode some already serialized ones.
+    let blob = String.fromCharCode(parseInt(0x08, 16));
+    if (aShouldBlock) {
+      // A safe_browsing::ClientDownloadRequest with a DANGEROUS verdict
+      blob += String.fromCharCode(parseInt(0x01, 16));
+    } else {
+      // A safe_browsing::ClientDownloadRequest with a SAFE verdict
+      blob += String.fromCharCode(parseInt(0x00, 16));
+    }
+    return blob;
+  }
+
+  gHttpServer.registerPathHandler("/throw", function (request, response) {
+    do_throw("We shouldn't be getting here");
+  });
+
+  gHttpServer.registerPathHandler("/download", function (request, response) {
+    info("Querying remote server for verdict");
+    response.setHeader("Content-Type", "application/octet-stream", false);
+    let buf = NetUtil.readInputStreamToString(
+      request.bodyInputStream,
+      request.bodyInputStream.available()
+    );
+    info("Request length: " + buf.length);
+    // A garbage response. By default this produces NS_CANNOT_CONVERT_DATA as
+    // the callback status.
+    let blob =
+      "this is not a serialized protocol buffer (the length doesn't match our hard-coded values)";
+    // We can't actually parse the protocol buffer here, so just switch on the
+    // length instead of inspecting the contents.
+    if (buf.length == 67) {
+      // evil.com
+      blob = createVerdict(true);
+    } else if (buf.length == 73) {
+      // mozilla.com
+      blob = createVerdict(false);
+    }
+    response.bodyOutputStream.write(blob, blob.length);
+  });
+
+  gHttpServer.start(4444);
+
+  registerCleanupFunction(function () {
+    return (async function () {
+      await new Promise(resolve => {
+        gHttpServer.stop(resolve);
+      });
+    })();
+  });
+});
+
+// Construct a response with redirect urls.
+function processUpdateRequest() {
+  let response = "n:1000\n";
+  for (let table in gTables) {
+    response += "i:" + table + "\n";
+    for (let i = 0; i < gTables[table].length; ++i) {
+      response += "u:" + gTables[table][i] + "\n";
+    }
+  }
+  info("Returning update response: " + response);
+  return response;
+}
+
+// Set up the local whitelist.
+function waitForUpdates() {
+  return new Promise((resolve, reject) => {
+    gHttpServer.registerPathHandler("/downloads", function (request, response) {
+      let blob = processUpdateRequest();
+      response.setHeader(
+        "Content-Type",
+        "application/vnd.google.safebrowsing-update",
+        false
+      );
+      response.setStatusLine(request.httpVersion, 200, "OK");
+      response.bodyOutputStream.write(blob, blob.length);
+    });
+
+    let streamUpdater = Cc[
+      "@mozilla.org/url-classifier/streamupdater;1"
+    ].getService(Ci.nsIUrlClassifierStreamUpdater);
+
+    // Load up some update chunks for the safebrowsing server to serve. This
+    // particular chunk contains the hash of whitelisted.com/ and
+    // sb-ssl.google.com/safebrowsing/csd/certificate/.
+    registerTableUpdate("goog-downloadwhite-digest256", "data/digest.chunk");
+
+    // Resolve the promise once processing the updates is complete.
+    function updateSuccess(aEvent) {
+      // Timeout of n:1000 is constructed in processUpdateRequest above and
+      // passed back in the callback in nsIUrlClassifierStreamUpdater on success.
+      Assert.equal("1000", aEvent);
+      info("All data processed");
+      resolve(true);
+    }
+    // Just throw if we ever get an update or download error.
+    function handleError(aEvent) {
+      do_throw("We didn't download or update correctly: " + aEvent);
+      reject();
+    }
+    streamUpdater.downloadUpdates(
+      "goog-downloadwhite-digest256",
+      "goog-downloadwhite-digest256;\n",
+      true,
+      "http://localhost:4444/downloads",
+      updateSuccess,
+      handleError,
+      handleError
+    );
+  });
+}
+
+function promiseQueryReputation(query, expected) {
+  return new Promise(resolve => {
+    function onComplete(aShouldBlock, aStatus) {
+      Assert.equal(Cr.NS_OK, aStatus);
+      check_telemetry(expected);
+      resolve(true);
+    }
+    gAppRep.queryReputation(query, onComplete);
+  });
+}
+
+add_task(async function () {
+  // Wait for Safebrowsing local list updates to complete.
+  await waitForUpdates();
+});
+
+add_task(async function test_blocked_binary() {
+  // We should reach the remote server for a verdict.
+  Services.prefs.setBoolPref(remoteEnabledPref, true);
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+  let expected = get_telemetry_snapshot();
+  expected.shouldBlock++;
+  add_telemetry_count(expected.local, NO_LIST, 1);
+  add_telemetry_count(expected.reason, VerdictDangerous, 1);
+
+  // evil.com should return a malware verdict from the remote server.
+  await promiseQueryReputation(
+    {
+      sourceURI: createURI("http://evil.com"),
+      suggestedFileName: "noop.bat",
+      fileSize: 12,
+      signatureInfo: [],
+    },
+    expected
+  );
+});
+
+add_task(async function test_non_binary() {
+  // We should not reach the remote server for a verdict for non-binary files.
+  Services.prefs.setBoolPref(remoteEnabledPref, true);
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/throw");
+
+  let expected = get_telemetry_snapshot();
+  add_telemetry_count(expected.local, NO_LIST, 1);
+  add_telemetry_count(expected.reason, NonBinaryFile, 1);
+
+  await promiseQueryReputation(
+    {
+      sourceURI: createURI("http://evil.com"),
+      suggestedFileName: "noop.txt",
+      fileSize: 12,
+      signatureInfo: [],
+    },
+    expected
+  );
+});
+
+add_task(async function test_good_binary() {
+  // We should reach the remote server for a verdict.
+  Services.prefs.setBoolPref(remoteEnabledPref, true);
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+
+  let expected = get_telemetry_snapshot();
+  add_telemetry_count(expected.local, NO_LIST, 1);
+  add_telemetry_count(expected.reason, VerdictSafe, 1);
+
+  // mozilla.com should return a not-guilty verdict from the remote server.
+  await promiseQueryReputation(
+    {
+      sourceURI: createURI("http://mozilla.com"),
+      suggestedFileName: "noop.bat",
+      fileSize: 12,
+      signatureInfo: [],
+    },
+    expected
+  );
+});
+
+add_task(async function test_disabled() {
+  // Explicitly disable remote checks
+  Services.prefs.setBoolPref(remoteEnabledPref, false);
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/throw");
+
+  let expected = get_telemetry_snapshot();
+  add_telemetry_count(expected.local, NO_LIST, 1);
+  add_telemetry_count(expected.reason, RemoteLookupDisabled, 1);
+
+  let query = {
+    sourceURI: createURI("http://example.com"),
+    suggestedFileName: "noop.bat",
+    fileSize: 12,
+    signatureInfo: [],
+  };
+  await new Promise(resolve => {
+    gAppRep.queryReputation(query, function onComplete(aShouldBlock, aStatus) {
+      // We should be getting NS_ERROR_NOT_AVAILABLE if the service is disabled
+      Assert.equal(Cr.NS_ERROR_NOT_AVAILABLE, aStatus);
+      Assert.ok(!aShouldBlock);
+      check_telemetry(expected);
+      resolve(true);
+    });
+  });
+});
+
+add_task(async function test_disabled_through_lists() {
+  Services.prefs.setBoolPref(remoteEnabledPref, false);
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+  Services.prefs.setCharPref("urlclassifier.downloadBlockTable", "");
+
+  let expected = get_telemetry_snapshot();
+  add_telemetry_count(expected.local, NO_LIST, 1);
+  add_telemetry_count(expected.reason, RemoteLookupDisabled, 1);
+
+  let query = {
+    sourceURI: createURI("http://example.com"),
+    suggestedFileName: "noop.bat",
+    fileSize: 12,
+    signatureInfo: [],
+  };
+  await new Promise(resolve => {
+    gAppRep.queryReputation(query, function onComplete(aShouldBlock, aStatus) {
+      // We should be getting NS_ERROR_NOT_AVAILABLE if the service is disabled
+      Assert.equal(Cr.NS_ERROR_NOT_AVAILABLE, aStatus);
+      Assert.ok(!aShouldBlock);
+      check_telemetry(expected);
+      resolve(true);
+    });
+  });
+});
+add_task(async function test_teardown() {
+  gStillRunning = false;
+});
diff --git a/toolkit/components/reputationservice/test/unit/test_app_rep_windows.js b/toolkit/components/reputationservice/test/unit/test_app_rep_windows.js
new file mode 100644
index 0000000000..597810859f
--- /dev/null
+++ b/toolkit/components/reputationservice/test/unit/test_app_rep_windows.js
@@ -0,0 +1,484 @@
+/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */
+/* vim: set ts=2 et sw=2 tw=80: */
+/* Any copyright is dedicated to the Public Domain.
+ * http://creativecommons.org/publicdomain/zero/1.0/ */
+
+/**
+ * This file tests signature extraction using Windows Authenticode APIs of
+ * downloaded files.
+ */
+
+// Globals
+
+ChromeUtils.defineESModuleGetters(this, {
+  FileTestUtils: "resource://testing-common/FileTestUtils.sys.mjs",
+  NetUtil: "resource://gre/modules/NetUtil.sys.mjs",
+});
+
+const BackgroundFileSaverOutputStream = Components.Constructor(
+  "@mozilla.org/network/background-file-saver;1?mode=outputstream",
+  "nsIBackgroundFileSaver"
+);
+
+const StringInputStream = Components.Constructor(
+  "@mozilla.org/io/string-input-stream;1",
+  "nsIStringInputStream",
+  "setData"
+);
+
+const TEST_FILE_NAME_1 = "test-backgroundfilesaver-1.txt";
+
+const gAppRep = Cc[
+  "@mozilla.org/reputationservice/application-reputation-service;1"
+].getService(Ci.nsIApplicationReputationService);
+var gStillRunning = true;
+var gTables = {};
+var gHttpServer = null;
+
+const appRepURLPref = "browser.safebrowsing.downloads.remote.url";
+const remoteEnabledPref = "browser.safebrowsing.downloads.remote.enabled";
+
+function readFileToString(aFilename) {
+  let f = do_get_file(aFilename);
+  let stream = Cc["@mozilla.org/network/file-input-stream;1"].createInstance(
+    Ci.nsIFileInputStream
+  );
+  stream.init(f, -1, 0, 0);
+  let buf = NetUtil.readInputStreamToString(stream, stream.available());
+  return buf;
+}
+
+/**
+ * Waits for the given saver object to complete.
+ *
+ * @param aSaver
+ *        The saver, with the output stream or a stream listener implementation.
+ * @param aOnTargetChangeFn
+ *        Optional callback invoked with the target file name when it changes.
+ *
+ * @return {Promise}
+ * @resolves When onSaveComplete is called with a success code.
+ * @rejects With an exception, if onSaveComplete is called with a failure code.
+ */
+function promiseSaverComplete(aSaver, aOnTargetChangeFn) {
+  return new Promise((resolve, reject) => {
+    aSaver.observer = {
+      onTargetChange: function BFSO_onSaveComplete(unused, aTarget) {
+        if (aOnTargetChangeFn) {
+          aOnTargetChangeFn(aTarget);
+        }
+      },
+      onSaveComplete: function BFSO_onSaveComplete(unused, aStatus) {
+        if (Components.isSuccessCode(aStatus)) {
+          resolve();
+        } else {
+          reject(new Components.Exception("Saver failed.", aStatus));
+        }
+      },
+    };
+  });
+}
+
+/**
+ * Feeds a string to a BackgroundFileSaverOutputStream.
+ *
+ * @param aSourceString
+ *        The source data to copy.
+ * @param aSaverOutputStream
+ *        The BackgroundFileSaverOutputStream to feed.
+ * @param aCloseWhenDone
+ *        If true, the output stream will be closed when the copy finishes.
+ *
+ * @return {Promise}
+ * @resolves When the copy completes with a success code.
+ * @rejects With an exception, if the copy fails.
+ */
+function promiseCopyToSaver(aSourceString, aSaverOutputStream, aCloseWhenDone) {
+  return new Promise((resolve, reject) => {
+    let inputStream = new StringInputStream(
+      aSourceString,
+      aSourceString.length
+    );
+    let copier = Cc[
+      "@mozilla.org/network/async-stream-copier;1"
+    ].createInstance(Ci.nsIAsyncStreamCopier);
+    copier.init(
+      inputStream,
+      aSaverOutputStream,
+      null,
+      false,
+      true,
+      0x8000,
+      true,
+      aCloseWhenDone
+    );
+    copier.asyncCopy(
+      {
+        onStartRequest() {},
+        onStopRequest(aRequest, aContext, aStatusCode) {
+          if (Components.isSuccessCode(aStatusCode)) {
+            resolve();
+          } else {
+            reject(new Components.Exception(aStatusCode));
+          }
+        },
+      },
+      null
+    );
+  });
+}
+
+// Registers a table for which to serve update chunks.
+function registerTableUpdate(aTable, aFilename) {
+  // If we haven't been given an update for this table yet, add it to the map
+  if (!(aTable in gTables)) {
+    gTables[aTable] = [];
+  }
+
+  // The number of chunks associated with this table.
+  let numChunks = gTables[aTable].length + 1;
+  let redirectPath = "/" + aTable + "-" + numChunks;
+  let redirectUrl = "localhost:4444" + redirectPath;
+
+  // Store redirect url for that table so we can return it later when we
+  // process an update request.
+  gTables[aTable].push(redirectUrl);
+
+  gHttpServer.registerPathHandler(redirectPath, function (request, response) {
+    info("Mock safebrowsing server handling request for " + redirectPath);
+    let contents = readFileToString(aFilename);
+    info("Length of " + aFilename + ": " + contents.length);
+    response.setHeader(
+      "Content-Type",
+      "application/vnd.google.safebrowsing-update",
+      false
+    );
+    response.setStatusLine(request.httpVersion, 200, "OK");
+    response.bodyOutputStream.write(contents, contents.length);
+  });
+}
+
+// Tests
+
+add_task(async function test_setup() {
+  // Wait 10 minutes, that is half of the external xpcshell timeout.
+  do_timeout(10 * 60 * 1000, function () {
+    if (gStillRunning) {
+      do_throw("Test timed out.");
+    }
+  });
+  // Set up a local HTTP server to return bad verdicts.
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+  // Ensure safebrowsing is enabled for this test, even if the app
+  // doesn't have it enabled.
+  Services.prefs.setBoolPref("browser.safebrowsing.malware.enabled", true);
+  Services.prefs.setBoolPref("browser.safebrowsing.downloads.enabled", true);
+  // Set block and allow tables explicitly, since the allowlist is normally
+  // disabled on comm-central.
+  Services.prefs.setCharPref(
+    "urlclassifier.downloadBlockTable",
+    "goog-badbinurl-shavar"
+  );
+  Services.prefs.setCharPref(
+    "urlclassifier.downloadAllowTable",
+    "goog-downloadwhite-digest256"
+  );
+  // SendRemoteQueryInternal needs locale preference.
+  let originalReqLocales = Services.locale.requestedLocales;
+  Services.locale.requestedLocales = ["en-US"];
+
+  registerCleanupFunction(function () {
+    Services.prefs.clearUserPref("browser.safebrowsing.malware.enabled");
+    Services.prefs.clearUserPref("browser.safebrowsing.downloads.enabled");
+    Services.prefs.clearUserPref("urlclassifier.downloadBlockTable");
+    Services.prefs.clearUserPref("urlclassifier.downloadAllowTable");
+    Services.locale.requestedLocales = originalReqLocales;
+  });
+
+  gHttpServer = new HttpServer();
+  gHttpServer.registerDirectory("/", do_get_cwd());
+
+  function createVerdict(aShouldBlock) {
+    // We can't programmatically create a protocol buffer here, so just
+    // hardcode some already serialized ones.
+    let blob = String.fromCharCode(parseInt(0x08, 16));
+    if (aShouldBlock) {
+      // A safe_browsing::ClientDownloadRequest with a DANGEROUS verdict
+      blob += String.fromCharCode(parseInt(0x01, 16));
+    } else {
+      // A safe_browsing::ClientDownloadRequest with a SAFE verdict
+      blob += String.fromCharCode(parseInt(0x00, 16));
+    }
+    return blob;
+  }
+
+  gHttpServer.registerPathHandler("/throw", function (request, response) {
+    do_throw("We shouldn't be getting here");
+  });
+
+  gHttpServer.registerPathHandler("/download", function (request, response) {
+    info("Querying remote server for verdict");
+    response.setHeader("Content-Type", "application/octet-stream", false);
+    let buf = NetUtil.readInputStreamToString(
+      request.bodyInputStream,
+      request.bodyInputStream.available()
+    );
+    info("Request length: " + buf.length);
+    // A garbage response. By default this produces NS_CANNOT_CONVERT_DATA as
+    // the callback status.
+    let blob =
+      "this is not a serialized protocol buffer (the length doesn't match our hard-coded values)";
+    // We can't actually parse the protocol buffer here, so just switch on the
+    // length instead of inspecting the contents.
+    if (buf.length == 67) {
+      // evil.com
+      blob = createVerdict(true);
+    } else if (buf.length == 73) {
+      // mozilla.com
+      blob = createVerdict(false);
+    }
+    response.bodyOutputStream.write(blob, blob.length);
+  });
+
+  gHttpServer.start(4444);
+
+  registerCleanupFunction(function () {
+    return (async function () {
+      await new Promise(resolve => {
+        gHttpServer.stop(resolve);
+      });
+    })();
+  });
+});
+
+// Construct a response with redirect urls.
+function processUpdateRequest() {
+  let response = "n:1000\n";
+  for (let table in gTables) {
+    response += "i:" + table + "\n";
+    for (let i = 0; i < gTables[table].length; ++i) {
+      response += "u:" + gTables[table][i] + "\n";
+    }
+  }
+  info("Returning update response: " + response);
+  return response;
+}
+
+// Set up the local whitelist.
+function waitForUpdates() {
+  return new Promise((resolve, reject) => {
+    gHttpServer.registerPathHandler("/downloads", function (request, response) {
+      let blob = processUpdateRequest();
+      response.setHeader(
+        "Content-Type",
+        "application/vnd.google.safebrowsing-update",
+        false
+      );
+      response.setStatusLine(request.httpVersion, 200, "OK");
+      response.bodyOutputStream.write(blob, blob.length);
+    });
+
+    let streamUpdater = Cc[
+      "@mozilla.org/url-classifier/streamupdater;1"
+    ].getService(Ci.nsIUrlClassifierStreamUpdater);
+
+    // Load up some update chunks for the safebrowsing server to serve. This
+    // particular chunk contains the hash of whitelisted.com/ and
+    // sb-ssl.google.com/safebrowsing/csd/certificate/.
+    registerTableUpdate("goog-downloadwhite-digest256", "data/digest.chunk");
+
+    // Resolve the promise once processing the updates is complete.
+    function updateSuccess(aEvent) {
+      // Timeout of n:1000 is constructed in processUpdateRequest above and
+      // passed back in the callback in nsIUrlClassifierStreamUpdater on success.
+      Assert.equal("1000", aEvent);
+      info("All data processed");
+      resolve(true);
+    }
+    // Just throw if we ever get an update or download error.
+    function handleError(aEvent) {
+      do_throw("We didn't download or update correctly: " + aEvent);
+      reject();
+    }
+    streamUpdater.downloadUpdates(
+      "goog-downloadwhite-digest256",
+      "goog-downloadwhite-digest256;\n",
+      true,
+      "http://localhost:4444/downloads",
+      updateSuccess,
+      handleError,
+      handleError
+    );
+  });
+}
+
+function promiseQueryReputation(query, expected) {
+  return new Promise(resolve => {
+    function onComplete(aShouldBlock, aStatus) {
+      Assert.equal(Cr.NS_OK, aStatus);
+      check_telemetry(expected);
+      resolve(true);
+    }
+    gAppRep.queryReputation(query, onComplete);
+  });
+}
+
+add_task(async function () {
+  // Wait for Safebrowsing local list updates to complete.
+  await waitForUpdates();
+});
+
+add_task(async function test_signature_whitelists() {
+  // We should never get to the remote server.
+  Services.prefs.setBoolPref(remoteEnabledPref, true);
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/throw");
+
+  let expected = get_telemetry_snapshot();
+  add_telemetry_count(expected.local, NO_LIST, 1);
+  add_telemetry_count(expected.reason, NonBinaryFile, 1);
+
+  // Use BackgroundFileSaver to extract the signature on Windows.
+  let destFile = FileTestUtils.getTempFile(TEST_FILE_NAME_1);
+
+  let data = readFileToString("data/signed_win.exe");
+  let saver = new BackgroundFileSaverOutputStream();
+  let completionPromise = promiseSaverComplete(saver);
+  saver.enableSignatureInfo();
+  saver.setTarget(destFile, false);
+  await promiseCopyToSaver(data, saver, true);
+
+  saver.finish(Cr.NS_OK);
+  await completionPromise;
+
+  // Clean up.
+  destFile.remove(false);
+
+  // evil.com is not on the allowlist, but this binary is signed by an entity
+  // whose certificate information is on the allowlist.
+  await promiseQueryReputation(
+    {
+      sourceURI: createURI("http://evil.com"),
+      signatureInfo: saver.signatureInfo,
+      fileSize: 12,
+    },
+    expected
+  );
+});
+
+add_task(async function test_blocked_binary() {
+  // We should reach the remote server for a verdict.
+  Services.prefs.setBoolPref(remoteEnabledPref, true);
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+
+  let expected = get_telemetry_snapshot();
+  expected.shouldBlock++;
+  add_telemetry_count(expected.local, NO_LIST, 1);
+  add_telemetry_count(expected.reason, VerdictDangerous, 1);
+
+  // evil.com should return a malware verdict from the remote server.
+  await promiseQueryReputation(
+    {
+      sourceURI: createURI("http://evil.com"),
+      suggestedFileName: "noop.bat",
+      fileSize: 12,
+      signatureInfo: [],
+    },
+    expected
+  );
+});
+
+add_task(async function test_non_binary() {
+  // We should not reach the remote server for a verdict for non-binary files.
+  Services.prefs.setBoolPref(remoteEnabledPref, true);
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/throw");
+
+  let expected = get_telemetry_snapshot();
+  add_telemetry_count(expected.local, NO_LIST, 1);
+  add_telemetry_count(expected.reason, NonBinaryFile, 1);
+
+  await promiseQueryReputation(
+    {
+      sourceURI: createURI("http://evil.com"),
+      suggestedFileName: "noop.txt",
+      fileSize: 12,
+      signatureInfo: [],
+    },
+    expected
+  );
+});
+
+add_task(async function test_good_binary() {
+  // We should reach the remote server for a verdict.
+  Services.prefs.setBoolPref(remoteEnabledPref, true);
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+
+  let expected = get_telemetry_snapshot();
+  add_telemetry_count(expected.local, NO_LIST, 1);
+  add_telemetry_count(expected.reason, VerdictSafe, 1);
+
+  // mozilla.com should return a not-guilty verdict from the remote server.
+  await promiseQueryReputation(
+    {
+      sourceURI: createURI("http://mozilla.com"),
+      suggestedFileName: "noop.bat",
+      fileSize: 12,
+      signatureInfo: [],
+    },
+    expected
+  );
+});
+
+add_task(async function test_disabled() {
+  // Explicitly disable remote checks
+  Services.prefs.setBoolPref(remoteEnabledPref, false);
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/throw");
+
+  let expected = get_telemetry_snapshot();
+  add_telemetry_count(expected.local, NO_LIST, 1);
+  add_telemetry_count(expected.reason, RemoteLookupDisabled, 1);
+
+  let query = {
+    sourceURI: createURI("http://example.com"),
+    suggestedFileName: "noop.bat",
+    signatureInfo: [],
+    fileSize: 12,
+  };
+  await new Promise(resolve => {
+    gAppRep.queryReputation(query, function onComplete(aShouldBlock, aStatus) {
+      // We should be getting NS_ERROR_NOT_AVAILABLE if the service is disabled
+      Assert.equal(Cr.NS_ERROR_NOT_AVAILABLE, aStatus);
+      Assert.ok(!aShouldBlock);
+      check_telemetry(expected);
+      resolve(true);
+    });
+  });
+});
+
+add_task(async function test_disabled_through_lists() {
+  Services.prefs.setBoolPref(remoteEnabledPref, false);
+  Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download");
+  Services.prefs.setCharPref("urlclassifier.downloadBlockTable", "");
+
+  let expected = get_telemetry_snapshot();
+  add_telemetry_count(expected.local, NO_LIST, 1);
+  add_telemetry_count(expected.reason, RemoteLookupDisabled, 1);
+
+  let query = {
+    sourceURI: createURI("http://example.com"),
+    suggestedFileName: "noop.bat",
+    fileSize: 12,
+    signatureInfo: [],
+  };
+  await new Promise(resolve => {
+    gAppRep.queryReputation(query, function onComplete(aShouldBlock, aStatus) {
+      // We should be getting NS_ERROR_NOT_AVAILABLE if the service is disabled
+      Assert.equal(Cr.NS_ERROR_NOT_AVAILABLE, aStatus);
+      Assert.ok(!aShouldBlock);
+      check_telemetry(expected);
+      resolve(true);
+    });
+  });
+});
+add_task(async function test_teardown() {
+  gStillRunning = false;
+});
diff --git a/toolkit/components/reputationservice/test/unit/xpcshell.toml b/toolkit/components/reputationservice/test/unit/xpcshell.toml
new file mode 100644
index 0000000000..c3af8c7cae
--- /dev/null
+++ b/toolkit/components/reputationservice/test/unit/xpcshell.toml
@@ -0,0 +1,18 @@
+[DEFAULT]
+head = "head_download_manager.js"
+skip-if = ["os == 'android'"]
+support-files = [
+  "data/digest.chunk",
+  "data/block_digest.chunk",
+  "data/signed_win.exe",
+]
+
+["test_app_rep.js"]
+run-sequentially = "very high failure rate in parallel"
+
+["test_app_rep_maclinux.js"]
+skip-if = ["os == 'win'"]
+run-sequentially = "very high failure rate in parallel"
+
+["test_app_rep_windows.js"]
+run-if = ["os == 'win'"]