path: root/dom/security/test/gtest/TestUnexpectedPrivilegedLoads.cpp

/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
/* vim: set ts=8 sts=2 et sw=2 tw=80: */
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "core/TelemetryEvent.h"
#include "gtest/gtest.h"
#include "js/Array.h"               // JS::GetArrayLength
#include "js/PropertyAndElement.h"  // JS_GetElement, JS_GetProperty
#include "js/TypeDecls.h"
#include "mozilla/BasePrincipal.h"
#include "mozilla/Maybe.h"
#include "mozilla/RefPtr.h"
#include "mozilla/Telemetry.h"
#include "mozilla/Unused.h"
#include "TelemetryFixture.h"
#include "TelemetryTestHelpers.h"

#include <string.h>
#include <stdlib.h>
#include "nsContentSecurityManager.h"
#include "nsContentSecurityUtils.h"
#include "nsContentUtils.h"
#include "nsIContentPolicy.h"
#include "nsILoadInfo.h"
#include "nsNetUtil.h"
#include "nsStringFwd.h"

using namespace mozilla;
using namespace TelemetryTestHelpers;

extern Atomic<bool, mozilla::Relaxed> sJSHacksChecked;
extern Atomic<bool, mozilla::Relaxed> sJSHacksPresent;
extern Atomic<bool, mozilla::Relaxed> sCSSHacksChecked;
extern Atomic<bool, mozilla::Relaxed> sCSSHacksPresent;

TEST_F(TelemetryTestFixture, UnexpectedPrivilegedLoadsTelemetryTest) {
  // Disable JS/CSS Hacks Detection, which would consider this current profile
  // as uninteresting for our measurements:
  bool origJSHacksPresent = sJSHacksPresent;
  bool origJSHacksChecked = sJSHacksChecked;
  sJSHacksPresent = false;
  sJSHacksChecked = true;
  bool origCSSHacksPresent = sCSSHacksPresent;
  bool origCSSHacksChecked = sCSSHacksChecked;
  sCSSHacksPresent = false;
  sCSSHacksChecked = true;

  struct testResults {
    nsCString fileinfo;
    nsCString extraValueContenttype;
    nsCString extraValueRemotetype;
    nsCString extraValueFiledetails;
    nsCString extraValueRedirects;
  };

  struct testCasesAndResults {
    nsCString urlstring;
    nsContentPolicyType contentType;
    nsCString remoteType;
    testResults expected;
  };

  AutoJSContextWithGlobal cx(mCleanGlobal);
  // Make sure we don't look at events from other tests.
  Unused << mTelemetry->ClearEvents();

  // required for telemetry lookups
  constexpr auto category = "security"_ns;
  constexpr auto method = "unexpectedload"_ns;
  constexpr auto object = "systemprincipal"_ns;
  constexpr auto extraKeyContenttype = "contenttype"_ns;
  constexpr auto extraKeyRemotetype = "remotetype"_ns;
  constexpr auto extraKeyFiledetails = "filedetails"_ns;
  constexpr auto extraKeyRedirects = "redirects"_ns;

  // some cases from TestFilenameEvalParser
  // no need to replicate all scenarios?!
  testCasesAndResults myTestCases[] = {
      {"chrome://firegestures/content/browser.js"_ns,
       nsContentPolicyType::TYPE_SCRIPT,
       "web"_ns,
       {"chromeuri"_ns, "TYPE_SCRIPT"_ns, "web"_ns,
        "chrome://firegestures/content/browser.js"_ns, ""_ns}},
      {"resource://firegestures/content/browser.js"_ns,
       nsContentPolicyType::TYPE_SCRIPT,
       "web"_ns,
       {"resourceuri"_ns, "TYPE_SCRIPT"_ns, "web"_ns,
        "resource://firegestures/content/browser.js"_ns, ""_ns}},
      {// test that we don't report blob details
       // ..and test that we strip of URLs from remoteTypes
       "blob://000-000"_ns,
       nsContentPolicyType::TYPE_SCRIPT,
       "webIsolated=https://blob.example/"_ns,
       {"bloburi"_ns, "TYPE_SCRIPT"_ns, "webIsolated"_ns, "unknown"_ns, ""_ns}},
      {// test for cases where finalURI is null, due to a broken nested URI
       // .. like malformed moz-icon URLs
       "moz-icon:blahblah"_ns,
       nsContentPolicyType::TYPE_DOCUMENT,
       "web"_ns,
       {"other"_ns, "TYPE_DOCUMENT"_ns, "web"_ns, "unknown"_ns, ""_ns}},
      {// we dont report data urls
       // ..and test that we strip of URLs from remoteTypes
       "data://blahblahblah"_ns,
       nsContentPolicyType::TYPE_SCRIPT,
       "webCOOP+COEP=https://data.example"_ns,
       {"dataurl"_ns, "TYPE_SCRIPT"_ns, "webCOOP+COEP"_ns, "unknown"_ns,
        ""_ns}},
      {// handle data URLs for webextension content scripts differently
       // .. by noticing their annotation
       "data:text/css;extension=style;charset=utf-8,/* some css here */"_ns,
       nsContentPolicyType::TYPE_STYLESHEET,
       "web"_ns,
       {"dataurl-extension-contentstyle"_ns, "TYPE_STYLESHEET"_ns, "web"_ns,
        "unknown"_ns, ""_ns}},
      {// we only report file URLs on windows, where we can easily sanitize
       "file://c/users/tom/file.txt"_ns,
       nsContentPolicyType::TYPE_SCRIPT,
       "web"_ns,
       {
#if defined(XP_WIN)
           "sanitizedWindowsURL"_ns, "TYPE_SCRIPT"_ns, "web"_ns,
           "file://.../file.txt"_ns, ""_ns

#else
           "other"_ns, "TYPE_SCRIPT"_ns, "web"_ns, "unknown"_ns, ""_ns
#endif
       }},
      {// test for one redirect
       "moz-extension://abcdefab-1234-4321-0000-abcdefabcdef/js/assets.js"_ns,
       nsContentPolicyType::TYPE_SCRIPT,
       "web"_ns,
       {"extension_uri"_ns, "TYPE_SCRIPT"_ns, "web"_ns,
        // the extension-id is made-up, so the extension will report failure
        "moz-extension://[failed finding addon by host]/js/assets.js"_ns,
        "https"_ns}},
      {// test for cases where finalURI is empty
       ""_ns,
       nsContentPolicyType::TYPE_STYLESHEET,
       "web"_ns,
       {"other"_ns, "TYPE_STYLESHEET"_ns, "web"_ns, "unknown"_ns, ""_ns}},
      {// test for cases where finalURI is null, due to the struct layout, we'll
       // override the URL with nullptr in loop below.
       "URLWillResultInNullPtr"_ns,
       nsContentPolicyType::TYPE_SCRIPT,
       "web"_ns,
       {"other"_ns, "TYPE_SCRIPT"_ns, "web"_ns, "unknown"_ns, ""_ns}},
  };

  int i = 0;
  for (auto const& currentTest : myTestCases) {
    nsresult rv;
    nsCOMPtr<nsIURI> uri;

    // special-casing for a case where the uri is null
    if (!currentTest.urlstring.Equals("URLWillResultInNullPtr")) {
      NS_NewURI(getter_AddRefs(uri), currentTest.urlstring);
    }

    // We can't create channels for chrome: URLs unless they are in a chrome
    // registry that maps them into the actual destination URL (usually
    // file://). It seems that gtest don't have chrome manifest registered, so
    // we'll use a mockChannel with a mockUri.
    nsCOMPtr<nsIURI> mockUri;
    rv = NS_NewURI(getter_AddRefs(mockUri), "http://example.com"_ns);
    ASSERT_EQ(rv, NS_OK) << "Could not create mockUri";
    nsCOMPtr<nsIChannel> mockChannel;
    nsCOMPtr<nsIIOService> service = do_GetIOService();
    if (!service) {
      ASSERT_TRUE(false)
      << "Couldn't initialize IOService";
    }
    rv = service->NewChannelFromURI(
        mockUri, nullptr, nsContentUtils::GetSystemPrincipal(),
        nsContentUtils::GetSystemPrincipal(), 0, currentTest.contentType,
        getter_AddRefs(mockChannel));
    ASSERT_EQ(rv, NS_OK) << "Could not create a mock channel";
    nsCOMPtr<nsILoadInfo> mockLoadInfo = mockChannel->LoadInfo();

    // We're adding a redirect entry for one specific test
    if (currentTest.urlstring.EqualsASCII(
            "moz-extension://abcdefab-1234-4321-0000-abcdefabcdef/js/"
            "assets.js")) {
      nsCOMPtr<nsIURI> redirUri;
      NS_NewURI(getter_AddRefs(redirUri),
                "https://www.analytics.example/analytics.js"_ns);
      nsCOMPtr<nsIPrincipal> redirPrincipal =
          BasePrincipal::CreateContentPrincipal(redirUri, OriginAttributes());
      nsCOMPtr<nsIChannel> redirectChannel;
      Unused << service->NewChannelFromURI(redirUri, nullptr, redirPrincipal,
                                           nullptr, 0, currentTest.contentType,
                                           getter_AddRefs(redirectChannel));

      mockLoadInfo->AppendRedirectHistoryEntry(redirectChannel, false);
    }

    // this will record the event
    nsContentSecurityManager::MeasureUnexpectedPrivilegedLoads(
        mockLoadInfo, uri, currentTest.remoteType);

    // let's inspect the recorded events

    JS::Rooted<JS::Value> eventsSnapshot(cx.GetJSContext());
    GetEventSnapshot(cx.GetJSContext(), &eventsSnapshot);

    ASSERT_TRUE(EventPresent(cx.GetJSContext(), eventsSnapshot, category,
                             method, object))
    << "Test event with value and extra must be present.";

    // Convert eventsSnapshot into array/object
    JSContext* aCx = cx.GetJSContext();
    JS::Rooted<JSObject*> arrayObj(aCx, &eventsSnapshot.toObject());

    JS::Rooted<JS::Value> eventRecord(aCx);
    ASSERT_TRUE(JS_GetElement(aCx, arrayObj, i++, &eventRecord))
    << "Must be able to get record.";  // record is already undefined :-/

    ASSERT_TRUE(!eventRecord.isUndefined())
    << "eventRecord should not be undefined";

    JS::Rooted<JSObject*> recordArray(aCx, &eventRecord.toObject());
    uint32_t recordLength;
    ASSERT_TRUE(JS::GetArrayLength(aCx, recordArray, &recordLength))
    << "Event record array must have length.";
    ASSERT_TRUE(recordLength == 6)
    << "Event record must have 6 elements.";

    JS::Rooted<JS::Value> str(aCx);
    nsAutoJSString jsStr;
    // The fileinfo string is at index 4
    ASSERT_TRUE(JS_GetElement(aCx, recordArray, 4, &str))
    << "Must be able to get value.";
    ASSERT_TRUE(jsStr.init(aCx, str))
    << "Value must be able to be init'd to a jsstring.";

    ASSERT_STREQ(NS_ConvertUTF16toUTF8(jsStr).get(),
                 currentTest.expected.fileinfo.get())
        << "Reported fileinfo '" << NS_ConvertUTF16toUTF8(jsStr).get()
        << " 'equals expected value: " << currentTest.expected.fileinfo.get();

    // Extra is at index 5
    JS::Rooted<JS::Value> obj(aCx);
    ASSERT_TRUE(JS_GetElement(aCx, recordArray, 5, &obj))
    << "Must be able to get extra data";
    JS::Rooted<JSObject*> extraObj(aCx, &obj.toObject());
    // looking at remotetype extra for content type
    JS::Rooted<JS::Value> extraValC(aCx);
    ASSERT_TRUE(
        JS_GetProperty(aCx, extraObj, extraKeyContenttype.get(), &extraValC))
    << "Must be able to get the extra key's value for contenttype";
    ASSERT_TRUE(jsStr.init(aCx, extraValC))
    << "Extra value contenttype must be able to be init'd to a jsstring.";
    ASSERT_STREQ(NS_ConvertUTF16toUTF8(jsStr).get(),
                 currentTest.expected.extraValueContenttype.get())
        << "Reported value for extra contenttype '"
        << NS_ConvertUTF16toUTF8(jsStr).get()
        << "' should equals supplied value"
        << currentTest.expected.extraValueContenttype.get();
    // and again for remote type
    JS::Rooted<JS::Value> extraValP(aCx);
    ASSERT_TRUE(
        JS_GetProperty(aCx, extraObj, extraKeyRemotetype.get(), &extraValP))
    << "Must be able to get the extra key's value for remotetype";
    ASSERT_TRUE(jsStr.init(aCx, extraValP))
    << "Extra value remotetype must be able to be init'd to a jsstring.";
    ASSERT_STREQ(NS_ConvertUTF16toUTF8(jsStr).get(),
                 currentTest.expected.extraValueRemotetype.get())
        << "Reported value for extra remotetype '"
        << NS_ConvertUTF16toUTF8(jsStr).get()
        << "' should equals supplied value: "
        << currentTest.expected.extraValueRemotetype.get();
    // repeating the same for filedetails extra
    JS::Rooted<JS::Value> extraValF(aCx);
    ASSERT_TRUE(
        JS_GetProperty(aCx, extraObj, extraKeyFiledetails.get(), &extraValF))
    << "Must be able to get the extra key's value for filedetails";
    ASSERT_TRUE(jsStr.init(aCx, extraValF))
    << "Extra value filedetails must be able to be init'd to a jsstring.";
    ASSERT_STREQ(NS_ConvertUTF16toUTF8(jsStr).get(),
                 currentTest.expected.extraValueFiledetails.get())
        << "Reported value for extra filedetails '"
        << NS_ConvertUTF16toUTF8(jsStr).get() << "'should equals supplied value"
        << currentTest.expected.extraValueFiledetails.get();
    // checking the extraKeyRedirects match
    JS::Rooted<JS::Value> extraValRedirects(aCx);
    ASSERT_TRUE(JS_GetProperty(aCx, extraObj, extraKeyRedirects.get(),
                               &extraValRedirects))
    << "Must be able to get the extra value for redirects";
    ASSERT_TRUE(jsStr.init(aCx, extraValRedirects))
    << "Extra value redirects must be able to be init'd to a jsstring";
    ASSERT_STREQ(NS_ConvertUTF16toUTF8(jsStr).get(),
                 currentTest.expected.extraValueRedirects.get())
        << "Reported value for extra redirect '"
        << NS_ConvertUTF16toUTF8(jsStr).get()
        << "' should equals supplied value: "
        << currentTest.expected.extraValueRedirects.get();
  }

  // Re-store JS/CSS hacks detection state
  sJSHacksPresent = origJSHacksPresent;
  sJSHacksChecked = origJSHacksChecked;
  sCSSHacksPresent = origCSSHacksPresent;
  sCSSHacksChecked = origCSSHacksChecked;
}