diff options
Diffstat (limited to 'toolkit/components/reputationservice/test')
11 files changed, 2132 insertions, 0 deletions
diff --git a/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp new file mode 100644 index 0000000000..3c24221b87 --- /dev/null +++ b/toolkit/components/reputationservice/test/gtest/TestExecutableLists.cpp @@ -0,0 +1,376 @@ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/3.0/ */ + +#include "gtest/gtest.h" +#include "mozilla/ArrayUtils.h" +#include "nsLocalFileCommon.h" +#include "ApplicationReputation.h" + +// PLEASE read the comment in ApplicationReputation.cpp before modifying this +// list. +static const char* const kTestFileExtensions[] = { + ".accda", // MS Access database + ".accdb", // MS Access database + ".accde", // MS Access database + ".accdr", // MS Access database + ".action", // Nac script + ".ad", // Windows (ignored for app rep) + ".ade", // MS Access + ".adp", // MS Access + ".afploc", // Apple Filing Protocol Location (ignored for app rep) + ".air", // Adobe Air (ignored for app rep) + ".apk", // Android package + ".app", // Executable application + ".applescript", + ".application", // MS ClickOnce + ".appref-ms", // MS ClickOnce + ".as", // Mac archive + ".asp", // Windows Server script + ".asx", // Windows Media Player + ".atloc", // Appletalk Location (ignored for app rep) + ".bas", // Basic script + ".bash", // Linux shell + ".bat", // Windows shell + ".bin", + ".btapp", // uTorrent and Transmission + ".btinstall", // uTorrent and Transmission + ".btkey", // uTorrent and Transmission + ".btsearch", // uTorrent and Transmission + ".btskin", // uTorrent and Transmission + ".bz", // Linux archive (bzip) + ".bz2", // Linux archive (bzip2) + ".bzip2", // Linux archive (bzip2) + ".cab", // Windows archive + ".caction", // Automator action + ".cdr", // Mac disk image + ".cer", // Signed certificate file + ".cfg", // Windows + ".chi", // Windows Help + ".chm", // Windows Help + ".class", // Java + ".cmd", // Windows executable + ".com", // Windows executable + ".command", // Mac script + ".configprofile", // Configuration file for Apple systems + ".cpgz", // Mac archive + ".cpi", // Control Panel Item. Executable used for adding icons + // to Control Panel + ".cpl", // Windows executable + ".crt", // Windows signed certificate + ".crx", // Chrome extensions + ".csh", // Linux shell + ".dart", // Mac disk image + ".dc42", // Apple DiskCopy Image + ".deb", // Linux package + ".definition", // Automator action + ".der", // Signed certificate file + ".desktop", // A shortcut that runs other files + ".dex", // Android + ".dht", // HTML + ".dhtm", // HTML + ".dhtml", // HTML + ".diskcopy42", // Apple DiskCopy Image + ".dll", // Windows executable + ".dmg", // Mac disk image + ".dmgpart", // Mac disk image + ".doc", // MS Office + ".docb", // MS Office + ".docm", // MS Word + ".docx", // MS Word + ".dot", // MS Word + ".dotm", // MS Word + ".dott", // MS Office + ".dotx", // MS Word + ".drv", // Windows driver + ".dvdr", // Mac Disk image + ".dylib", // Mach object dynamic library file + ".efi", // Firmware + ".eml", // MS Outlook + ".exe", // Windows executable + ".fileloc", // Apple finder internet location data file + ".fon", // Windows font + ".ftploc", // Apple FTP Location (ignored for app rep) + ".fxp", // MS FoxPro + ".gadget", // Windows + ".grp", // Windows + ".gz", // Linux archive (gzip) + ".gzip", // Linux archive (gzip) + ".hfs", // Mac disk image + ".hlp", // Windows Help + ".hqx", // Mac archive + ".hta", // HTML trusted application + ".htm", ".html", + ".htt", // MS HTML template + ".img", // Mac disk image + ".imgpart", // Mac disk image + ".inetloc", // Apple finder internet location data file + ".inf", // Windows installer + ".ini", // Generic config file + ".ins", // IIS config + ".internetconnect", // Configuration file for Apple system + ".iso", // CD image + ".isp", // IIS config + ".jar", // Java + ".jnlp", // Java + ".js", // JavaScript script + ".jse", // JScript + ".ksh", // Linux shell + ".lnk", // Windows + ".local", // Windows + ".mad", // MS Access + ".maf", // MS Access + ".mag", // MS Access + ".mam", // MS Access + ".manifest", // Windows + ".maq", // MS Access + ".mar", // MS Access + ".mas", // MS Access + ".mat", // MS Access + ".mau", // Media attachment + ".mav", // MS Access + ".maw", // MS Access + ".mda", // MS Access + ".mdb", // MS Access + ".mde", // MS Access + ".mdt", // MS Access + ".mdw", // MS Access + ".mdz", // MS Access + ".mht", // MS HTML + ".mhtml", // MS HTML + ".mim", // MS Mail + ".mmc", // MS Office + ".mobileconfig", // Configuration file for Apple systems + ".mof", // Windows + ".mpkg", // Mac installer + ".msc", // Windows executable + ".msg", // MS Outlook + ".msh", // Windows shell + ".msh1", // Windows shell + ".msh1xml", // Windows shell + ".msh2", // Windows shell + ".msh2xml", // Windows shell + ".mshxml", // Windows + ".msi", // Windows installer + ".msp", // Windows installer + ".mst", // Windows installer + ".ndif", // Mac disk image + ".networkconnect", // Configuration file for Apple system + ".ocx", // ActiveX + ".ops", // MS Office + ".osas", // AppleScript + ".osax", // AppleScript + ".oxt", // OpenOffice extension, can execute arbitrary code + ".partial", // Downloads + ".pax", // Mac archive + ".pcd", // Microsoft Visual Test + ".pdf", // Adobe Acrobat + ".pet", // Linux package + ".pif", // Windows + ".pkg", // Mac installer + ".pl", // Perl script + ".plg", // MS Visual Studio + ".pot", // MS PowerPoint + ".potm", // MS PowerPoint + ".potx", // MS PowerPoint + ".ppam", // MS PowerPoint + ".pps", // MS PowerPoint + ".ppsm", // MS PowerPoint + ".ppsx", // MS PowerPoint + ".ppt", // MS PowerPoint + ".pptm", // MS PowerPoint + ".pptx", // MS PowerPoint + ".prf", // MS Outlook + ".prg", // Windows + ".ps1", // Windows shell + ".ps1xml", // Windows shell + ".ps2", // Windows shell + ".ps2xml", // Windows shell + ".psc1", // Windows shell + ".psc2", // Windows shell + ".pst", // MS Outlook + ".pup", // Linux package + ".py", // Python script + ".pyc", // Python binary + ".pyd", // Equivalent of a DLL, for python libraries + ".pyo", // Compiled python code + ".pyw", // Python GUI + ".rb", // Ruby script + ".reg", // Windows Registry + ".rels", // MS Office + ".rpm", // Linux package + ".rtf", // MS Office + ".scf", // Windows shell + ".scpt", // AppleScript + ".scptd", // AppleScript + ".scr", // Windows + ".sct", // Windows shell + ".search-ms", // Windows + ".seplugin", // AppleScript + ".service", // Systemd service unit file + ".settingcontent-ms", // Windows settings + ".sh", // Linux shell + ".shar", // Linux shell + ".shb", // Windows + ".shs", // Windows shell + ".sht", // HTML + ".shtm", // HTML + ".shtml", // HTML + ".sldm", // MS PowerPoint + ".sldx", // MS PowerPoint + ".slk", // MS Excel + ".slp", // Linux package + ".smi", // Mac disk image + ".sparsebundle", // Mac disk image + ".sparseimage", // Mac disk image + ".spl", // Adobe Flash + ".svg", + ".swf", // Adobe Flash + ".swm", // Windows Imaging + ".sys", // Windows + ".tar", // Linux archive + ".taz", // Linux archive (bzip2) + ".tbz", // Linux archive (bzip2) + ".tbz2", // Linux archive (bzip2) + ".tcsh", // Linux shell + ".tgz", // Linux archive (gzip) + ".torrent", // Bittorrent + ".tpz", // Linux archive (gzip) + ".txz", // Linux archive (xz) + ".tz", // Linux archive (gzip) + ".udf", // MS Excel + ".udif", // Mac disk image + ".url", // Windows + ".vb", // Visual Basic script + ".vbe", // Visual Basic script + ".vbs", // Visual Basic script + ".vdx", // MS Visio + ".vhd", // Windows virtual hard drive + ".vhdx", // Windows virtual hard drive + ".vmdk", // VMware virtual disk + ".vsd", // MS Visio + ".vsdm", // MS Visio + ".vsdx", // MS Visio + ".vsmacros", // MS Visual Studio + ".vss", // MS Visio + ".vssm", // MS Visio + ".vssx", // MS Visio + ".vst", // MS Visio + ".vstm", // MS Visio + ".vstx", // MS Visio + ".vsw", // MS Visio + ".vsx", // MS Visio + ".vtx", // MS Visio + ".webloc", // MacOS website location file + ".website", // Windows + ".wflow", // Automator action + ".wim", // Windows Imaging + ".workflow", // Mac Automator + ".ws", // Windows script + ".wsc", // Windows script + ".wsf", // Windows script + ".wsh", // Windows script + ".xar", // MS Excel + ".xbap", // XAML Browser Application + ".xht", ".xhtm", ".xhtml", + ".xip", // Mac archive + ".xla", // MS Excel + ".xlam", // MS Excel + ".xldm", // MS Excel + ".xll", // MS Excel + ".xlm", // MS Excel + ".xls", // MS Excel + ".xlsb", // MS Excel + ".xlsm", // MS Excel + ".xlsx", // MS Excel + ".xlt", // MS Excel + ".xltm", // MS Excel + ".xltx", // MS Excel + ".xlw", // MS Excel + ".xml", // MS Excel + ".xnk", // MS Exchange + ".xrm-ms", // Windows + ".xsd", // XML schema definition + ".xsl", // XML Stylesheet + ".xz", // Linux archive (xz) + ".z", // InstallShield +#ifdef XP_WIN // disable on Mac/Linux, see 1167493 + ".zip", // Generic archive +#endif + ".zipx", // WinZip +}; + +#define CheckListSorted(_list) \ + { \ + for (size_t i = 1; i < mozilla::ArrayLength(_list); ++i) { \ + nsDependentCString str1((_list)[i - 1]); \ + nsDependentCString str2((_list)[i]); \ + EXPECT_LE(Compare(str1, str2), -1) \ + << "Expected " << str1.get() << " to be sorted after " \ + << str2.get(); \ + } \ + } + +// First, verify that the 2 lists are both sorted. This helps when checking for +// duplicates manually, ensures we could start doing more efficient lookups if +// we felt that was necessary (e.g. if the lists get much bigger), and that it's +// easy for humans to find things... +TEST(TestExecutableLists, ListsAreSorted) +{ + CheckListSorted(sExecutableExts); + CheckListSorted(ApplicationReputationService::kBinaryFileExtensions); + CheckListSorted(ApplicationReputationService::kNonBinaryExecutables); + CheckListSorted(kTestFileExtensions); +} + +bool _IsInList(const char* ext, const char* const _list[], const size_t len) { + nsDependentCString extStr(ext); + for (size_t i = 0; i < len; ++i) { + if (extStr.EqualsASCII(_list[i])) { + return true; + } + } + return false; +} + +#define IsInList(_ext, _list) \ + _IsInList(_ext, _list, mozilla::ArrayLength(_list)) + +TEST(TestExecutableLists, NonBinariesInExecutablesList) +{ + for (auto nonBinary : ApplicationReputationService::kNonBinaryExecutables) { + EXPECT_TRUE(IsInList(nonBinary, sExecutableExts)) + << "Expected " << nonBinary << " to be part of sExecutableExts list"; + } +} + +TEST(TestExecutableLists, AllExtensionsInTestList) +{ + for (auto ext : ApplicationReputationService::kBinaryFileExtensions) { + EXPECT_TRUE(IsInList(ext, kTestFileExtensions)) + << "Expected binary extension " << ext + << " to be listed in the test extension list"; + } + + for (auto ext : sExecutableExts) { + EXPECT_TRUE(IsInList(ext, kTestFileExtensions)) + << "Expected executable extension " << ext + << " to be listed in the test extension list"; + } + + for (auto ext : ApplicationReputationService::kNonBinaryExecutables) { + EXPECT_TRUE(IsInList(ext, kTestFileExtensions)) + << "Expected non-binary executable extension " << ext + << " to be listed in the test extension list"; + } +} + +TEST(TestExecutableLists, TestListExtensionsExistSomewhere) +{ + for (auto ext : kTestFileExtensions) { + EXPECT_TRUE( + IsInList(ext, ApplicationReputationService::kBinaryFileExtensions) != + IsInList(ext, sExecutableExts)) + << "Expected test extension " << ext + << " to be in exactly one of the other lists."; + } +} diff --git a/toolkit/components/reputationservice/test/gtest/moz.build b/toolkit/components/reputationservice/test/gtest/moz.build new file mode 100644 index 0000000000..384076b57f --- /dev/null +++ b/toolkit/components/reputationservice/test/gtest/moz.build @@ -0,0 +1,18 @@ +# -*- Mode: python; indent-tabs-mode: nil; tab-width: 40 -*- +# vim: set filetype=python: +# This Source Code Form is subject to the terms of the Mozilla Public +# License, v. 2.0. If a copy of the MPL was not distributed with this +# file, You can obtain one at http://mozilla.org/MPL/2.0/. + +LOCAL_INCLUDES += [ + "../..", +] + +DEFINES["GOOGLE_PROTOBUF_NO_RTTI"] = True +DEFINES["GOOGLE_PROTOBUF_NO_STATIC_INITIALIZER"] = True + +UNIFIED_SOURCES += ["TestExecutableLists.cpp"] + +FINAL_LIBRARY = "xul-gtest" + +REQUIRES_UNIFIED_BUILD = True diff --git a/toolkit/components/reputationservice/test/unit/data/block_digest.chunk b/toolkit/components/reputationservice/test/unit/data/block_digest.chunk new file mode 100644 index 0000000000..34c47c4bb5 --- /dev/null +++ b/toolkit/components/reputationservice/test/unit/data/block_digest.chunk @@ -0,0 +1,2 @@ +a:5:32:37 +,AJ,AJ8Wbb_e ;OτCV
\ No newline at end of file diff --git a/toolkit/components/reputationservice/test/unit/data/digest.chunk b/toolkit/components/reputationservice/test/unit/data/digest.chunk new file mode 100644 index 0000000000..b1fbb46673 --- /dev/null +++ b/toolkit/components/reputationservice/test/unit/data/digest.chunk @@ -0,0 +1,3 @@ +a:5:32:64 +_H^a7]=#nmnoQ +@.R0D7Y4ퟆS$8
\ No newline at end of file diff --git a/toolkit/components/reputationservice/test/unit/data/signed_win.exe b/toolkit/components/reputationservice/test/unit/data/signed_win.exe Binary files differnew file mode 100644 index 0000000000..de3bb40e84 --- /dev/null +++ b/toolkit/components/reputationservice/test/unit/data/signed_win.exe diff --git a/toolkit/components/reputationservice/test/unit/head_download_manager.js b/toolkit/components/reputationservice/test/unit/head_download_manager.js new file mode 100644 index 0000000000..292ff96f9e --- /dev/null +++ b/toolkit/components/reputationservice/test/unit/head_download_manager.js @@ -0,0 +1,134 @@ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +// This file tests the download manager backend + +do_get_profile(); + +var { XPCOMUtils } = ChromeUtils.importESModule( + "resource://gre/modules/XPCOMUtils.sys.mjs" +); +var { + HTTP_400, + HTTP_401, + HTTP_402, + HTTP_403, + HTTP_404, + HTTP_405, + HTTP_406, + HTTP_407, + HTTP_408, + HTTP_409, + HTTP_410, + HTTP_411, + HTTP_412, + HTTP_413, + HTTP_414, + HTTP_415, + HTTP_417, + HTTP_500, + HTTP_501, + HTTP_502, + HTTP_503, + HTTP_504, + HTTP_505, + HttpError, + HttpServer, +} = ChromeUtils.import("resource://testing-common/httpd.js"); + +// List types, this should sync with |enum LIST_TYPES| defined in PendingLookup. +var ALLOW_LIST = 0; +var BLOCK_LIST = 1; +var NO_LIST = 2; + +// Allow or block reason, this should sync with |enum Reason| in ApplicationReputation.cpp +var NotSet = 0; +var LocalWhitelist = 1; +var LocalBlocklist = 2; +var NonBinaryFile = 3; +var VerdictSafe = 4; +var VerdictUnknown = 5; +var VerdictDangerous = 6; +var VerdictDangerousHost = 7; +var VerdictUnwanted = 8; +var VerdictUncommon = 9; +var VerdictUnrecognized = 10; +var DangerousPrefOff = 11; +var DangerousHostPrefOff = 12; +var UnwantedPrefOff = 13; +var UncommonPrefOff = 14; +var NetworkError = 15; +var RemoteLookupDisabled = 16; +var InternalError = 17; +var DPDisabled = 18; +var MAX_REASON = 19; + +function createURI(aObj) { + return aObj instanceof Ci.nsIFile + ? Services.io.newFileURI(aObj) + : Services.io.newURI(aObj); +} + +function add_telemetry_count(telemetry, index, count) { + let val = telemetry[index] || 0; + telemetry[index] = val + count; +} + +function check_telemetry(aExpectedTelemetry) { + // SHOULD_BLOCK = true + let shouldBlock = Services.telemetry + .getHistogramById("APPLICATION_REPUTATION_SHOULD_BLOCK") + .snapshot(); + let expectedShouldBlock = aExpectedTelemetry.shouldBlock; + Assert.equal(shouldBlock.values[1] || 0, expectedShouldBlock); + + let local = Services.telemetry + .getHistogramById("APPLICATION_REPUTATION_LOCAL") + .snapshot(); + + let expectedLocal = aExpectedTelemetry.local; + Assert.equal( + local.values[ALLOW_LIST] || 0, + expectedLocal[ALLOW_LIST] || 0, + "Allow list.values don't match" + ); + Assert.equal( + local.values[BLOCK_LIST] || 0, + expectedLocal[BLOCK_LIST] || 0, + "Block list.values don't match" + ); + Assert.equal( + local.values[NO_LIST] || 0, + expectedLocal[NO_LIST] || 0, + "No list.values don't match" + ); + + let reason = Services.telemetry + .getHistogramById("APPLICATION_REPUTATION_REASON") + .snapshot(); + let expectedReason = aExpectedTelemetry.reason; + + for (let i = 0; i < MAX_REASON; i++) { + if ((reason.values[i] || 0) != (expectedReason[i] || 0)) { + Assert.ok(false, "Allow or Block reason(" + i + ") doesn't match"); + } + } +} + +function get_telemetry_snapshot() { + let local = Services.telemetry + .getHistogramById("APPLICATION_REPUTATION_LOCAL") + .snapshot(); + let shouldBlock = Services.telemetry + .getHistogramById("APPLICATION_REPUTATION_SHOULD_BLOCK") + .snapshot(); + let reason = Services.telemetry + .getHistogramById("APPLICATION_REPUTATION_REASON") + .snapshot(); + return { + shouldBlock: shouldBlock.values[1] || 0, + local: local.values, + reason: reason.values, + }; +} diff --git a/toolkit/components/reputationservice/test/unit/test_app_rep.js b/toolkit/components/reputationservice/test/unit/test_app_rep.js new file mode 100644 index 0000000000..854c8ad11c --- /dev/null +++ b/toolkit/components/reputationservice/test/unit/test_app_rep.js @@ -0,0 +1,569 @@ +/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */ +/* vim: set ts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +const { NetUtil } = ChromeUtils.import("resource://gre/modules/NetUtil.jsm"); + +const gAppRep = Cc[ + "@mozilla.org/reputationservice/application-reputation-service;1" +].getService(Ci.nsIApplicationReputationService); + +const ReferrerInfo = Components.Constructor( + "@mozilla.org/referrer-info;1", + "nsIReferrerInfo", + "init" +); + +var gHttpServ = null; +var gTables = {}; +var gExpectedRemote = false; +var gExpectedRemoteRequestBody = ""; + +var whitelistedURI = createURI("http://foo:bar@whitelisted.com/index.htm#junk"); +var exampleURI = createURI("http://user:password@example.com/i.html?foo=bar"); +var exampleReferrerURI = createURI( + "http://user:password@example.referrer.com/i.html?foo=bar" +); +var exampleRedirectURI = createURI( + "http://user:password@example.redirect.com/i.html?foo=bar" +); +var blocklistedURI = createURI("http://baz:qux@blocklisted.com?xyzzy"); + +var binaryFile = "binaryFile.exe"; +var nonBinaryFile = "nonBinaryFile.txt"; + +const appRepURLPref = "browser.safebrowsing.downloads.remote.url"; + +function createReferrerInfo( + aURI, + aRefererPolicy = Ci.nsIReferrerInfo.NO_REFERRER +) { + return new ReferrerInfo(aRefererPolicy, true, aURI); +} + +function readFileToString(aFilename) { + let f = do_get_file(aFilename); + let stream = Cc["@mozilla.org/network/file-input-stream;1"].createInstance( + Ci.nsIFileInputStream + ); + stream.init(f, -1, 0, 0); + let buf = NetUtil.readInputStreamToString(stream, stream.available()); + return buf; +} + +// Registers a table for which to serve update chunks. Returns a promise that +// resolves when that chunk has been downloaded. +function registerTableUpdate(aTable, aFilename) { + // If we haven't been given an update for this table yet, add it to the map + if (!(aTable in gTables)) { + gTables[aTable] = []; + } + + // The number of chunks associated with this table. + let numChunks = gTables[aTable].length + 1; + let redirectPath = "/" + aTable + "-" + numChunks; + let redirectUrl = "localhost:4444" + redirectPath; + + // Store redirect url for that table so we can return it later when we + // process an update request. + gTables[aTable].push(redirectUrl); + + gHttpServ.registerPathHandler(redirectPath, function(request, response) { + info("Mock safebrowsing server handling request for " + redirectPath); + let contents = readFileToString(aFilename); + info("Length of " + aFilename + ": " + contents.length); + response.setHeader( + "Content-Type", + "application/vnd.google.safebrowsing-update", + false + ); + response.setStatusLine(request.httpVersion, 200, "OK"); + response.bodyOutputStream.write(contents, contents.length); + }); +} + +add_task(async function test_setup() { + // Set up a local HTTP server to return bad verdicts. + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + // Ensure safebrowsing is enabled for this test, even if the app + // doesn't have it enabled. + Services.prefs.setBoolPref("browser.safebrowsing.malware.enabled", true); + Services.prefs.setBoolPref("browser.safebrowsing.downloads.enabled", true); + registerCleanupFunction(function() { + Services.prefs.clearUserPref("browser.safebrowsing.malware.enabled"); + Services.prefs.clearUserPref("browser.safebrowsing.downloads.enabled"); + }); + + // Set block and allow tables explicitly, since the allowlist is normally + // disabled on non-Windows platforms. + Services.prefs.setCharPref( + "urlclassifier.downloadBlockTable", + "goog-badbinurl-shavar" + ); + Services.prefs.setCharPref( + "urlclassifier.downloadAllowTable", + "goog-downloadwhite-digest256" + ); + registerCleanupFunction(function() { + Services.prefs.clearUserPref("urlclassifier.downloadBlockTable"); + Services.prefs.clearUserPref("urlclassifier.downloadAllowTable"); + }); + + gHttpServ = new HttpServer(); + gHttpServ.registerDirectory("/", do_get_cwd()); + gHttpServ.registerPathHandler("/download", function(request, response) { + if (gExpectedRemote) { + let body = NetUtil.readInputStreamToString( + request.bodyInputStream, + request.bodyInputStream.available() + ); + Assert.equal(gExpectedRemoteRequestBody, body); + } else { + do_throw("This test should never make a remote lookup"); + } + }); + gHttpServ.start(4444); + + registerCleanupFunction(function() { + return (async function() { + await new Promise(resolve => { + gHttpServ.stop(resolve); + }); + })(); + }); +}); + +add_test(function test_nullSourceURI() { + let expected = get_telemetry_snapshot(); + add_telemetry_count(expected.reason, InternalError, 1); + + gAppRep.queryReputation( + { + // No source URI + fileSize: 12, + }, + function onComplete(aShouldBlock, aStatus) { + Assert.equal(Cr.NS_ERROR_UNEXPECTED, aStatus); + Assert.ok(!aShouldBlock); + check_telemetry(expected); + run_next_test(); + } + ); +}); + +add_test(function test_nullCallback() { + let expected = get_telemetry_snapshot(); + + try { + gAppRep.queryReputation( + { + sourceURI: createURI("http://example.com"), + fileSize: 12, + }, + null + ); + do_throw("Callback cannot be null"); + } catch (ex) { + if (ex.result != Cr.NS_ERROR_INVALID_POINTER) { + throw ex; + } + // We don't even increment the count here, because there's no callback. + check_telemetry(expected); + run_next_test(); + } +}); + +// Set up the local whitelist. +add_test(function test_local_list() { + // Construct a response with redirect urls. + function processUpdateRequest() { + let response = "n:1000\n"; + for (let table in gTables) { + response += "i:" + table + "\n"; + for (let i = 0; i < gTables[table].length; ++i) { + response += "u:" + gTables[table][i] + "\n"; + } + } + info("Returning update response: " + response); + return response; + } + gHttpServ.registerPathHandler("/downloads", function(request, response) { + let blob = processUpdateRequest(); + response.setHeader( + "Content-Type", + "application/vnd.google.safebrowsing-update", + false + ); + response.setStatusLine(request.httpVersion, 200, "OK"); + response.bodyOutputStream.write(blob, blob.length); + }); + + let streamUpdater = Cc[ + "@mozilla.org/url-classifier/streamupdater;1" + ].getService(Ci.nsIUrlClassifierStreamUpdater); + + // Load up some update chunks for the safebrowsing server to serve. + // This chunk contains the hash of blocklisted.com/. + registerTableUpdate("goog-badbinurl-shavar", "data/block_digest.chunk"); + // This chunk contains the hash of whitelisted.com/. + registerTableUpdate("goog-downloadwhite-digest256", "data/digest.chunk"); + + // Download some updates, and don't continue until the downloads are done. + function updateSuccess(aEvent) { + // Timeout of n:1000 is constructed in processUpdateRequest above and + // passed back in the callback in nsIUrlClassifierStreamUpdater on success. + Assert.equal("1000", aEvent); + info("All data processed"); + run_next_test(); + } + // Just throw if we ever get an update or download error. + function handleError(aEvent) { + do_throw("We didn't download or update correctly: " + aEvent); + } + streamUpdater.downloadUpdates( + "goog-downloadwhite-digest256,goog-badbinurl-shavar", + "goog-downloadwhite-digest256,goog-badbinurl-shavar;\n", + true, // isPostRequest. + "http://localhost:4444/downloads", + updateSuccess, + handleError, + handleError + ); +}); + +add_test(function test_unlisted() { + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + let expected = get_telemetry_snapshot(); + add_telemetry_count(expected.local, NO_LIST, 1); + add_telemetry_count(expected.reason, NonBinaryFile, 1); + + gAppRep.queryReputation( + { + sourceURI: exampleURI, + fileSize: 12, + }, + function onComplete(aShouldBlock, aStatus) { + Assert.equal(Cr.NS_OK, aStatus); + Assert.ok(!aShouldBlock); + check_telemetry(expected); + run_next_test(); + } + ); +}); + +add_test(function test_non_uri() { + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + let expected = get_telemetry_snapshot(); + add_telemetry_count(expected.reason, NonBinaryFile, 1); + + // No listcount is incremented, since the sourceURI is not an nsIURL + let source = NetUtil.newURI("data:application/octet-stream,ABC"); + Assert.equal(false, source instanceof Ci.nsIURL); + gAppRep.queryReputation( + { + sourceURI: source, + fileSize: 12, + }, + function onComplete(aShouldBlock, aStatus) { + Assert.equal(Cr.NS_OK, aStatus); + Assert.ok(!aShouldBlock); + check_telemetry(expected); + run_next_test(); + } + ); +}); + +add_test(function test_local_blacklist() { + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + let expected = get_telemetry_snapshot(); + expected.shouldBlock++; + add_telemetry_count(expected.local, BLOCK_LIST, 1); + add_telemetry_count(expected.reason, LocalBlocklist, 1); + + gAppRep.queryReputation( + { + sourceURI: blocklistedURI, + fileSize: 12, + }, + function onComplete(aShouldBlock, aStatus) { + Assert.equal(Cr.NS_OK, aStatus); + Assert.ok(aShouldBlock); + check_telemetry(expected); + + run_next_test(); + } + ); +}); + +add_test(async function test_referer_blacklist() { + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + let testReferrerPolicies = [ + Ci.nsIReferrerInfo.EMPTY, + Ci.nsIReferrerInfo.NO_REFERRER, + Ci.nsIReferrerInfo.NO_REFERRER_WHEN_DOWNGRADE, + Ci.nsIReferrerInfo.ORIGIN, + Ci.nsIReferrerInfo.ORIGIN_WHEN_CROSS_ORIGIN, + Ci.nsIReferrerInfo.UNSAFE_URL, + Ci.nsIReferrerInfo.SAME_ORIGIN, + Ci.nsIReferrerInfo.STRICT_ORIGIN, + Ci.nsIReferrerInfo.STRICT_ORIGIN_WHEN_CROSS_ORIGIN, + ]; + + function runReferrerPolicyTest(referrerPolicy) { + return new Promise(resolve => { + let expected = get_telemetry_snapshot(); + expected.shouldBlock++; + add_telemetry_count(expected.local, BLOCK_LIST, 1); + add_telemetry_count(expected.local, NO_LIST, 1); + add_telemetry_count(expected.reason, LocalBlocklist, 1); + + gAppRep.queryReputation( + { + sourceURI: exampleURI, + referrerInfo: createReferrerInfo(blocklistedURI, referrerPolicy), + fileSize: 12, + }, + function onComplete(aShouldBlock, aStatus) { + Assert.equal(Cr.NS_OK, aStatus); + Assert.ok(aShouldBlock); + check_telemetry(expected); + resolve(); + } + ); + }); + } + + // We run tests with referrer policies but download protection should use + // "full URL" original referrer to block the download + for (let i = 0; i < testReferrerPolicies.length; ++i) { + await runReferrerPolicyTest(testReferrerPolicies[i]); + } + + run_next_test(); +}); + +add_test(function test_blocklist_trumps_allowlist() { + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + let expected = get_telemetry_snapshot(); + expected.shouldBlock++; + add_telemetry_count(expected.local, BLOCK_LIST, 1); + add_telemetry_count(expected.local, ALLOW_LIST, 1); + add_telemetry_count(expected.reason, LocalBlocklist, 1); + + gAppRep.queryReputation( + { + sourceURI: whitelistedURI, + referrerInfo: createReferrerInfo(blocklistedURI), + suggestedFileName: binaryFile, + fileSize: 12, + signatureInfo: [], + }, + function onComplete(aShouldBlock, aStatus) { + Assert.equal(Cr.NS_OK, aStatus); + Assert.ok(aShouldBlock); + check_telemetry(expected); + + run_next_test(); + } + ); +}); + +add_test(function test_redirect_on_blocklist() { + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + let expected = get_telemetry_snapshot(); + expected.shouldBlock++; + add_telemetry_count(expected.local, BLOCK_LIST, 1); + add_telemetry_count(expected.local, ALLOW_LIST, 1); + add_telemetry_count(expected.local, NO_LIST, 1); + add_telemetry_count(expected.reason, LocalBlocklist, 1); + let secman = Services.scriptSecurityManager; + let badRedirects = Cc["@mozilla.org/array;1"].createInstance( + Ci.nsIMutableArray + ); + + let redirect1 = { + QueryInterface: ChromeUtils.generateQI(["nsIRedirectHistoryEntry"]), + principal: secman.createContentPrincipal(exampleURI, {}), + }; + badRedirects.appendElement(redirect1); + + let redirect2 = { + QueryInterface: ChromeUtils.generateQI(["nsIRedirectHistoryEntry"]), + principal: secman.createContentPrincipal(blocklistedURI, {}), + }; + badRedirects.appendElement(redirect2); + + // Add a whitelisted URI that will not be looked up against the + // whitelist (i.e. it will match NO_LIST). + let redirect3 = { + QueryInterface: ChromeUtils.generateQI(["nsIRedirectHistoryEntry"]), + principal: secman.createContentPrincipal(whitelistedURI, {}), + }; + badRedirects.appendElement(redirect3); + + gAppRep.queryReputation( + { + sourceURI: whitelistedURI, + referrerInfo: createReferrerInfo(exampleURI), + redirects: badRedirects, + suggestedFileName: binaryFile, + fileSize: 12, + signatureInfo: [], + }, + function onComplete(aShouldBlock, aStatus) { + Assert.equal(Cr.NS_OK, aStatus); + Assert.ok(aShouldBlock); + check_telemetry(expected); + run_next_test(); + } + ); +}); + +add_test(function test_whitelisted_source() { + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + let expected = get_telemetry_snapshot(); + add_telemetry_count(expected.local, ALLOW_LIST, 1); + add_telemetry_count(expected.reason, LocalWhitelist, 1); + gAppRep.queryReputation( + { + sourceURI: whitelistedURI, + suggestedFileName: binaryFile, + fileSize: 12, + signatureInfo: [], + }, + function onComplete(aShouldBlock, aStatus) { + Assert.equal(Cr.NS_OK, aStatus); + Assert.ok(!aShouldBlock); + check_telemetry(expected); + run_next_test(); + } + ); +}); + +add_test(function test_whitelisted_non_binary_source() { + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + let expected = get_telemetry_snapshot(); + add_telemetry_count(expected.local, NO_LIST, 1); + add_telemetry_count(expected.reason, NonBinaryFile, 1); + gAppRep.queryReputation( + { + sourceURI: whitelistedURI, + suggestedFileName: nonBinaryFile, + fileSize: 12, + }, + function onComplete(aShouldBlock, aStatus) { + Assert.equal(Cr.NS_OK, aStatus); + Assert.ok(!aShouldBlock); + check_telemetry(expected); + run_next_test(); + } + ); +}); + +add_test(function test_whitelisted_referrer() { + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + let expected = get_telemetry_snapshot(); + add_telemetry_count(expected.local, NO_LIST, 2); + add_telemetry_count(expected.reason, NonBinaryFile, 1); + + gAppRep.queryReputation( + { + sourceURI: exampleURI, + referrerInfo: createReferrerInfo(exampleURI), + fileSize: 12, + }, + function onComplete(aShouldBlock, aStatus) { + Assert.equal(Cr.NS_OK, aStatus); + Assert.ok(!aShouldBlock); + check_telemetry(expected); + run_next_test(); + } + ); +}); + +add_test(function test_whitelisted_redirect() { + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + let expected = get_telemetry_snapshot(); + add_telemetry_count(expected.local, NO_LIST, 3); + add_telemetry_count(expected.reason, NonBinaryFile, 1); + let secman = Services.scriptSecurityManager; + let okayRedirects = Cc["@mozilla.org/array;1"].createInstance( + Ci.nsIMutableArray + ); + + let redirect1 = { + QueryInterface: ChromeUtils.generateQI(["nsIRedirectHistoryEntry"]), + principal: secman.createContentPrincipal(exampleURI, {}), + }; + okayRedirects.appendElement(redirect1); + + // Add a whitelisted URI that will not be looked up against the + // whitelist (i.e. it will match NO_LIST). + let redirect2 = { + QueryInterface: ChromeUtils.generateQI(["nsIRedirectHistoryEntry"]), + principal: secman.createContentPrincipal(whitelistedURI, {}), + }; + okayRedirects.appendElement(redirect2); + + gAppRep.queryReputation( + { + sourceURI: exampleURI, + redirects: okayRedirects, + fileSize: 12, + }, + function onComplete(aShouldBlock, aStatus) { + Assert.equal(Cr.NS_OK, aStatus); + Assert.ok(!aShouldBlock); + check_telemetry(expected); + run_next_test(); + } + ); +}); + +add_test(function test_remote_lookup_protocolbuf() { + // This long hard-coded string is the contents of the request generated by + // the Application Reputation component, converted to the binary protobuf format. + // If this test is changed, or we add anything to the remote lookup requests + // in ApplicationReputation.cpp, then we'll need to update this hard-coded string. + gExpectedRemote = true; + gExpectedRemoteRequestBody = + "\x0A\x19\x68\x74\x74\x70\x3A\x2F\x2F\x65\x78\x61\x6D\x70\x6C\x65\x2E\x63\x6F\x6D\x2F\x69\x2E\x68\x74\x6D\x6C\x12\x22\x0A\x20\x61\x62\x63\x00\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x64\x65\x18\x0C\x22\x41\x0A\x19\x68\x74\x74\x70\x3A\x2F\x2F\x65\x78\x61\x6D\x70\x6C\x65\x2E\x63\x6F\x6D\x2F\x69\x2E\x68\x74\x6D\x6C\x10\x00\x22\x22\x68\x74\x74\x70\x3A\x2F\x2F\x65\x78\x61\x6D\x70\x6C\x65\x2E\x72\x65\x66\x65\x72\x72\x65\x72\x2E\x63\x6F\x6D\x2F\x69\x2E\x68\x74\x6D\x6C\x22\x26\x0A\x22\x68\x74\x74\x70\x3A\x2F\x2F\x65\x78\x61\x6D\x70\x6C\x65\x2E\x72\x65\x64\x69\x72\x65\x63\x74\x2E\x63\x6F\x6D\x2F\x69\x2E\x68\x74\x6D\x6C\x10\x01\x30\x01\x4A\x0E\x62\x69\x6E\x61\x72\x79\x46\x69\x6C\x65\x2E\x65\x78\x65\x50\x00\x5A\x05\x65\x6E\x2D\x55\x53"; + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + let secman = Services.scriptSecurityManager; + let expected = get_telemetry_snapshot(); + add_telemetry_count(expected.local, NO_LIST, 3); + add_telemetry_count(expected.reason, VerdictSafe, 1); + + // Redirects + let redirects = Cc["@mozilla.org/array;1"].createInstance(Ci.nsIMutableArray); + let redirect1 = { + QueryInterface: ChromeUtils.generateQI(["nsIRedirectHistoryEntry"]), + principal: secman.createContentPrincipal(exampleRedirectURI, {}), + }; + redirects.appendElement(redirect1); + + // Insert null(\x00) in the middle of the hash to test we won't truncate it. + let sha256Hash = "abc\x00" + "de".repeat(14); + + gAppRep.queryReputation( + { + sourceURI: exampleURI, + referrerInfo: createReferrerInfo(exampleReferrerURI), + suggestedFileName: binaryFile, + sha256Hash, + redirects, + fileSize: 12, + signatureInfo: [], + }, + function onComplete(aShouldBlock, aStatus) { + Assert.equal(Cr.NS_OK, aStatus); + Assert.ok(!aShouldBlock); + check_telemetry(expected); + + gExpectedRemote = false; + run_next_test(); + } + ); +}); diff --git a/toolkit/components/reputationservice/test/unit/test_app_rep_maclinux.js b/toolkit/components/reputationservice/test/unit/test_app_rep_maclinux.js new file mode 100644 index 0000000000..0c5eadaf1d --- /dev/null +++ b/toolkit/components/reputationservice/test/unit/test_app_rep_maclinux.js @@ -0,0 +1,342 @@ +/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */ +/* vim: set ts=2 et sw=2 tw=80: */ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +// Globals + +ChromeUtils.defineModuleGetter( + this, + "NetUtil", + "resource://gre/modules/NetUtil.jsm" +); + +const gAppRep = Cc[ + "@mozilla.org/reputationservice/application-reputation-service;1" +].getService(Ci.nsIApplicationReputationService); +var gStillRunning = true; +var gTables = {}; +var gHttpServer = null; + +const appRepURLPref = "browser.safebrowsing.downloads.remote.url"; +const remoteEnabledPref = "browser.safebrowsing.downloads.remote.enabled"; + +function readFileToString(aFilename) { + let f = do_get_file(aFilename); + let stream = Cc["@mozilla.org/network/file-input-stream;1"].createInstance( + Ci.nsIFileInputStream + ); + stream.init(f, -1, 0, 0); + let buf = NetUtil.readInputStreamToString(stream, stream.available()); + return buf; +} + +function registerTableUpdate(aTable, aFilename) { + // If we haven't been given an update for this table yet, add it to the map + if (!(aTable in gTables)) { + gTables[aTable] = []; + } + + // The number of chunks associated with this table. + let numChunks = gTables[aTable].length + 1; + let redirectPath = "/" + aTable + "-" + numChunks; + let redirectUrl = "localhost:4444" + redirectPath; + + // Store redirect url for that table so we can return it later when we + // process an update request. + gTables[aTable].push(redirectUrl); + + gHttpServer.registerPathHandler(redirectPath, function(request, response) { + info("Mock safebrowsing server handling request for " + redirectPath); + let contents = readFileToString(aFilename); + info("Length of " + aFilename + ": " + contents.length); + response.setHeader( + "Content-Type", + "application/vnd.google.safebrowsing-update", + false + ); + response.setStatusLine(request.httpVersion, 200, "OK"); + response.bodyOutputStream.write(contents, contents.length); + }); +} + +// Tests + +add_task(function test_setup() { + // Wait 10 minutes, that is half of the external xpcshell timeout. + do_timeout(10 * 60 * 1000, function() { + if (gStillRunning) { + do_throw("Test timed out."); + } + }); + // Set up a local HTTP server to return bad verdicts. + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + // Ensure safebrowsing is enabled for this test, even if the app + // doesn't have it enabled. + Services.prefs.setBoolPref("browser.safebrowsing.malware.enabled", true); + Services.prefs.setBoolPref("browser.safebrowsing.downloads.enabled", true); + // Set block table explicitly, no need for the allow table though + Services.prefs.setCharPref( + "urlclassifier.downloadBlockTable", + "goog-badbinurl-shavar" + ); + // SendRemoteQueryInternal needs locale preference. + let originalReqLocales = Services.locale.requestedLocales; + Services.locale.requestedLocales = ["en-US"]; + + registerCleanupFunction(function() { + Services.prefs.clearUserPref("browser.safebrowsing.malware.enabled"); + Services.prefs.clearUserPref("browser.safebrowsing.downloads.enabled"); + Services.prefs.clearUserPref("urlclassifier.downloadBlockTable"); + Services.locale.requestedLocales = originalReqLocales; + }); + + gHttpServer = new HttpServer(); + gHttpServer.registerDirectory("/", do_get_cwd()); + + function createVerdict(aShouldBlock) { + // We can't programmatically create a protocol buffer here, so just + // hardcode some already serialized ones. + let blob = String.fromCharCode(parseInt(0x08, 16)); + if (aShouldBlock) { + // A safe_browsing::ClientDownloadRequest with a DANGEROUS verdict + blob += String.fromCharCode(parseInt(0x01, 16)); + } else { + // A safe_browsing::ClientDownloadRequest with a SAFE verdict + blob += String.fromCharCode(parseInt(0x00, 16)); + } + return blob; + } + + gHttpServer.registerPathHandler("/throw", function(request, response) { + do_throw("We shouldn't be getting here"); + }); + + gHttpServer.registerPathHandler("/download", function(request, response) { + info("Querying remote server for verdict"); + response.setHeader("Content-Type", "application/octet-stream", false); + let buf = NetUtil.readInputStreamToString( + request.bodyInputStream, + request.bodyInputStream.available() + ); + info("Request length: " + buf.length); + // A garbage response. By default this produces NS_CANNOT_CONVERT_DATA as + // the callback status. + let blob = + "this is not a serialized protocol buffer (the length doesn't match our hard-coded values)"; + // We can't actually parse the protocol buffer here, so just switch on the + // length instead of inspecting the contents. + if (buf.length == 67) { + // evil.com + blob = createVerdict(true); + } else if (buf.length == 73) { + // mozilla.com + blob = createVerdict(false); + } + response.bodyOutputStream.write(blob, blob.length); + }); + + gHttpServer.start(4444); + + registerCleanupFunction(function() { + return (async function() { + await new Promise(resolve => { + gHttpServer.stop(resolve); + }); + })(); + }); +}); + +// Construct a response with redirect urls. +function processUpdateRequest() { + let response = "n:1000\n"; + for (let table in gTables) { + response += "i:" + table + "\n"; + for (let i = 0; i < gTables[table].length; ++i) { + response += "u:" + gTables[table][i] + "\n"; + } + } + info("Returning update response: " + response); + return response; +} + +// Set up the local whitelist. +function waitForUpdates() { + return new Promise((resolve, reject) => { + gHttpServer.registerPathHandler("/downloads", function(request, response) { + let blob = processUpdateRequest(); + response.setHeader( + "Content-Type", + "application/vnd.google.safebrowsing-update", + false + ); + response.setStatusLine(request.httpVersion, 200, "OK"); + response.bodyOutputStream.write(blob, blob.length); + }); + + let streamUpdater = Cc[ + "@mozilla.org/url-classifier/streamupdater;1" + ].getService(Ci.nsIUrlClassifierStreamUpdater); + + // Load up some update chunks for the safebrowsing server to serve. This + // particular chunk contains the hash of whitelisted.com/ and + // sb-ssl.google.com/safebrowsing/csd/certificate/. + registerTableUpdate("goog-downloadwhite-digest256", "data/digest.chunk"); + + // Resolve the promise once processing the updates is complete. + function updateSuccess(aEvent) { + // Timeout of n:1000 is constructed in processUpdateRequest above and + // passed back in the callback in nsIUrlClassifierStreamUpdater on success. + Assert.equal("1000", aEvent); + info("All data processed"); + resolve(true); + } + // Just throw if we ever get an update or download error. + function handleError(aEvent) { + do_throw("We didn't download or update correctly: " + aEvent); + reject(); + } + streamUpdater.downloadUpdates( + "goog-downloadwhite-digest256", + "goog-downloadwhite-digest256;\n", + true, + "http://localhost:4444/downloads", + updateSuccess, + handleError, + handleError + ); + }); +} + +function promiseQueryReputation(query, expected) { + return new Promise(resolve => { + function onComplete(aShouldBlock, aStatus) { + Assert.equal(Cr.NS_OK, aStatus); + check_telemetry(expected); + resolve(true); + } + gAppRep.queryReputation(query, onComplete); + }); +} + +add_task(async function() { + // Wait for Safebrowsing local list updates to complete. + await waitForUpdates(); +}); + +add_task(async function test_blocked_binary() { + // We should reach the remote server for a verdict. + Services.prefs.setBoolPref(remoteEnabledPref, true); + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + let expected = get_telemetry_snapshot(); + expected.shouldBlock++; + add_telemetry_count(expected.local, NO_LIST, 1); + add_telemetry_count(expected.reason, VerdictDangerous, 1); + + // evil.com should return a malware verdict from the remote server. + await promiseQueryReputation( + { + sourceURI: createURI("http://evil.com"), + suggestedFileName: "noop.bat", + fileSize: 12, + signatureInfo: [], + }, + expected + ); +}); + +add_task(async function test_non_binary() { + // We should not reach the remote server for a verdict for non-binary files. + Services.prefs.setBoolPref(remoteEnabledPref, true); + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/throw"); + + let expected = get_telemetry_snapshot(); + add_telemetry_count(expected.local, NO_LIST, 1); + add_telemetry_count(expected.reason, NonBinaryFile, 1); + + await promiseQueryReputation( + { + sourceURI: createURI("http://evil.com"), + suggestedFileName: "noop.txt", + fileSize: 12, + signatureInfo: [], + }, + expected + ); +}); + +add_task(async function test_good_binary() { + // We should reach the remote server for a verdict. + Services.prefs.setBoolPref(remoteEnabledPref, true); + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + + let expected = get_telemetry_snapshot(); + add_telemetry_count(expected.local, NO_LIST, 1); + add_telemetry_count(expected.reason, VerdictSafe, 1); + + // mozilla.com should return a not-guilty verdict from the remote server. + await promiseQueryReputation( + { + sourceURI: createURI("http://mozilla.com"), + suggestedFileName: "noop.bat", + fileSize: 12, + signatureInfo: [], + }, + expected + ); +}); + +add_task(async function test_disabled() { + // Explicitly disable remote checks + Services.prefs.setBoolPref(remoteEnabledPref, false); + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/throw"); + + let expected = get_telemetry_snapshot(); + add_telemetry_count(expected.local, NO_LIST, 1); + add_telemetry_count(expected.reason, RemoteLookupDisabled, 1); + + let query = { + sourceURI: createURI("http://example.com"), + suggestedFileName: "noop.bat", + fileSize: 12, + signatureInfo: [], + }; + await new Promise(resolve => { + gAppRep.queryReputation(query, function onComplete(aShouldBlock, aStatus) { + // We should be getting NS_ERROR_NOT_AVAILABLE if the service is disabled + Assert.equal(Cr.NS_ERROR_NOT_AVAILABLE, aStatus); + Assert.ok(!aShouldBlock); + check_telemetry(expected); + resolve(true); + }); + }); +}); + +add_task(async function test_disabled_through_lists() { + Services.prefs.setBoolPref(remoteEnabledPref, false); + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + Services.prefs.setCharPref("urlclassifier.downloadBlockTable", ""); + + let expected = get_telemetry_snapshot(); + add_telemetry_count(expected.local, NO_LIST, 1); + add_telemetry_count(expected.reason, RemoteLookupDisabled, 1); + + let query = { + sourceURI: createURI("http://example.com"), + suggestedFileName: "noop.bat", + fileSize: 12, + signatureInfo: [], + }; + await new Promise(resolve => { + gAppRep.queryReputation(query, function onComplete(aShouldBlock, aStatus) { + // We should be getting NS_ERROR_NOT_AVAILABLE if the service is disabled + Assert.equal(Cr.NS_ERROR_NOT_AVAILABLE, aStatus); + Assert.ok(!aShouldBlock); + check_telemetry(expected); + resolve(true); + }); + }); +}); +add_task(async function test_teardown() { + gStillRunning = false; +}); diff --git a/toolkit/components/reputationservice/test/unit/test_app_rep_windows.js b/toolkit/components/reputationservice/test/unit/test_app_rep_windows.js new file mode 100644 index 0000000000..2de0949262 --- /dev/null +++ b/toolkit/components/reputationservice/test/unit/test_app_rep_windows.js @@ -0,0 +1,488 @@ +/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */ +/* vim: set ts=2 et sw=2 tw=80: */ +/* Any copyright is dedicated to the Public Domain. + * http://creativecommons.org/publicdomain/zero/1.0/ */ + +/** + * This file tests signature extraction using Windows Authenticode APIs of + * downloaded files. + */ + +// Globals + +ChromeUtils.defineModuleGetter( + this, + "NetUtil", + "resource://gre/modules/NetUtil.jsm" +); +ChromeUtils.defineESModuleGetters(this, { + FileTestUtils: "resource://testing-common/FileTestUtils.sys.mjs", +}); + +const BackgroundFileSaverOutputStream = Components.Constructor( + "@mozilla.org/network/background-file-saver;1?mode=outputstream", + "nsIBackgroundFileSaver" +); + +const StringInputStream = Components.Constructor( + "@mozilla.org/io/string-input-stream;1", + "nsIStringInputStream", + "setData" +); + +const TEST_FILE_NAME_1 = "test-backgroundfilesaver-1.txt"; + +const gAppRep = Cc[ + "@mozilla.org/reputationservice/application-reputation-service;1" +].getService(Ci.nsIApplicationReputationService); +var gStillRunning = true; +var gTables = {}; +var gHttpServer = null; + +const appRepURLPref = "browser.safebrowsing.downloads.remote.url"; +const remoteEnabledPref = "browser.safebrowsing.downloads.remote.enabled"; + +function readFileToString(aFilename) { + let f = do_get_file(aFilename); + let stream = Cc["@mozilla.org/network/file-input-stream;1"].createInstance( + Ci.nsIFileInputStream + ); + stream.init(f, -1, 0, 0); + let buf = NetUtil.readInputStreamToString(stream, stream.available()); + return buf; +} + +/** + * Waits for the given saver object to complete. + * + * @param aSaver + * The saver, with the output stream or a stream listener implementation. + * @param aOnTargetChangeFn + * Optional callback invoked with the target file name when it changes. + * + * @return {Promise} + * @resolves When onSaveComplete is called with a success code. + * @rejects With an exception, if onSaveComplete is called with a failure code. + */ +function promiseSaverComplete(aSaver, aOnTargetChangeFn) { + return new Promise((resolve, reject) => { + aSaver.observer = { + onTargetChange: function BFSO_onSaveComplete(unused, aTarget) { + if (aOnTargetChangeFn) { + aOnTargetChangeFn(aTarget); + } + }, + onSaveComplete: function BFSO_onSaveComplete(unused, aStatus) { + if (Components.isSuccessCode(aStatus)) { + resolve(); + } else { + reject(new Components.Exception("Saver failed.", aStatus)); + } + }, + }; + }); +} + +/** + * Feeds a string to a BackgroundFileSaverOutputStream. + * + * @param aSourceString + * The source data to copy. + * @param aSaverOutputStream + * The BackgroundFileSaverOutputStream to feed. + * @param aCloseWhenDone + * If true, the output stream will be closed when the copy finishes. + * + * @return {Promise} + * @resolves When the copy completes with a success code. + * @rejects With an exception, if the copy fails. + */ +function promiseCopyToSaver(aSourceString, aSaverOutputStream, aCloseWhenDone) { + return new Promise((resolve, reject) => { + let inputStream = new StringInputStream( + aSourceString, + aSourceString.length + ); + let copier = Cc[ + "@mozilla.org/network/async-stream-copier;1" + ].createInstance(Ci.nsIAsyncStreamCopier); + copier.init( + inputStream, + aSaverOutputStream, + null, + false, + true, + 0x8000, + true, + aCloseWhenDone + ); + copier.asyncCopy( + { + onStartRequest() {}, + onStopRequest(aRequest, aContext, aStatusCode) { + if (Components.isSuccessCode(aStatusCode)) { + resolve(); + } else { + reject(new Components.Exception(aStatusCode)); + } + }, + }, + null + ); + }); +} + +// Registers a table for which to serve update chunks. +function registerTableUpdate(aTable, aFilename) { + // If we haven't been given an update for this table yet, add it to the map + if (!(aTable in gTables)) { + gTables[aTable] = []; + } + + // The number of chunks associated with this table. + let numChunks = gTables[aTable].length + 1; + let redirectPath = "/" + aTable + "-" + numChunks; + let redirectUrl = "localhost:4444" + redirectPath; + + // Store redirect url for that table so we can return it later when we + // process an update request. + gTables[aTable].push(redirectUrl); + + gHttpServer.registerPathHandler(redirectPath, function(request, response) { + info("Mock safebrowsing server handling request for " + redirectPath); + let contents = readFileToString(aFilename); + info("Length of " + aFilename + ": " + contents.length); + response.setHeader( + "Content-Type", + "application/vnd.google.safebrowsing-update", + false + ); + response.setStatusLine(request.httpVersion, 200, "OK"); + response.bodyOutputStream.write(contents, contents.length); + }); +} + +// Tests + +add_task(async function test_setup() { + // Wait 10 minutes, that is half of the external xpcshell timeout. + do_timeout(10 * 60 * 1000, function() { + if (gStillRunning) { + do_throw("Test timed out."); + } + }); + // Set up a local HTTP server to return bad verdicts. + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + // Ensure safebrowsing is enabled for this test, even if the app + // doesn't have it enabled. + Services.prefs.setBoolPref("browser.safebrowsing.malware.enabled", true); + Services.prefs.setBoolPref("browser.safebrowsing.downloads.enabled", true); + // Set block and allow tables explicitly, since the allowlist is normally + // disabled on comm-central. + Services.prefs.setCharPref( + "urlclassifier.downloadBlockTable", + "goog-badbinurl-shavar" + ); + Services.prefs.setCharPref( + "urlclassifier.downloadAllowTable", + "goog-downloadwhite-digest256" + ); + // SendRemoteQueryInternal needs locale preference. + let originalReqLocales = Services.locale.requestedLocales; + Services.locale.requestedLocales = ["en-US"]; + + registerCleanupFunction(function() { + Services.prefs.clearUserPref("browser.safebrowsing.malware.enabled"); + Services.prefs.clearUserPref("browser.safebrowsing.downloads.enabled"); + Services.prefs.clearUserPref("urlclassifier.downloadBlockTable"); + Services.prefs.clearUserPref("urlclassifier.downloadAllowTable"); + Services.locale.requestedLocales = originalReqLocales; + }); + + gHttpServer = new HttpServer(); + gHttpServer.registerDirectory("/", do_get_cwd()); + + function createVerdict(aShouldBlock) { + // We can't programmatically create a protocol buffer here, so just + // hardcode some already serialized ones. + let blob = String.fromCharCode(parseInt(0x08, 16)); + if (aShouldBlock) { + // A safe_browsing::ClientDownloadRequest with a DANGEROUS verdict + blob += String.fromCharCode(parseInt(0x01, 16)); + } else { + // A safe_browsing::ClientDownloadRequest with a SAFE verdict + blob += String.fromCharCode(parseInt(0x00, 16)); + } + return blob; + } + + gHttpServer.registerPathHandler("/throw", function(request, response) { + do_throw("We shouldn't be getting here"); + }); + + gHttpServer.registerPathHandler("/download", function(request, response) { + info("Querying remote server for verdict"); + response.setHeader("Content-Type", "application/octet-stream", false); + let buf = NetUtil.readInputStreamToString( + request.bodyInputStream, + request.bodyInputStream.available() + ); + info("Request length: " + buf.length); + // A garbage response. By default this produces NS_CANNOT_CONVERT_DATA as + // the callback status. + let blob = + "this is not a serialized protocol buffer (the length doesn't match our hard-coded values)"; + // We can't actually parse the protocol buffer here, so just switch on the + // length instead of inspecting the contents. + if (buf.length == 67) { + // evil.com + blob = createVerdict(true); + } else if (buf.length == 73) { + // mozilla.com + blob = createVerdict(false); + } + response.bodyOutputStream.write(blob, blob.length); + }); + + gHttpServer.start(4444); + + registerCleanupFunction(function() { + return (async function() { + await new Promise(resolve => { + gHttpServer.stop(resolve); + }); + })(); + }); +}); + +// Construct a response with redirect urls. +function processUpdateRequest() { + let response = "n:1000\n"; + for (let table in gTables) { + response += "i:" + table + "\n"; + for (let i = 0; i < gTables[table].length; ++i) { + response += "u:" + gTables[table][i] + "\n"; + } + } + info("Returning update response: " + response); + return response; +} + +// Set up the local whitelist. +function waitForUpdates() { + return new Promise((resolve, reject) => { + gHttpServer.registerPathHandler("/downloads", function(request, response) { + let blob = processUpdateRequest(); + response.setHeader( + "Content-Type", + "application/vnd.google.safebrowsing-update", + false + ); + response.setStatusLine(request.httpVersion, 200, "OK"); + response.bodyOutputStream.write(blob, blob.length); + }); + + let streamUpdater = Cc[ + "@mozilla.org/url-classifier/streamupdater;1" + ].getService(Ci.nsIUrlClassifierStreamUpdater); + + // Load up some update chunks for the safebrowsing server to serve. This + // particular chunk contains the hash of whitelisted.com/ and + // sb-ssl.google.com/safebrowsing/csd/certificate/. + registerTableUpdate("goog-downloadwhite-digest256", "data/digest.chunk"); + + // Resolve the promise once processing the updates is complete. + function updateSuccess(aEvent) { + // Timeout of n:1000 is constructed in processUpdateRequest above and + // passed back in the callback in nsIUrlClassifierStreamUpdater on success. + Assert.equal("1000", aEvent); + info("All data processed"); + resolve(true); + } + // Just throw if we ever get an update or download error. + function handleError(aEvent) { + do_throw("We didn't download or update correctly: " + aEvent); + reject(); + } + streamUpdater.downloadUpdates( + "goog-downloadwhite-digest256", + "goog-downloadwhite-digest256;\n", + true, + "http://localhost:4444/downloads", + updateSuccess, + handleError, + handleError + ); + }); +} + +function promiseQueryReputation(query, expected) { + return new Promise(resolve => { + function onComplete(aShouldBlock, aStatus) { + Assert.equal(Cr.NS_OK, aStatus); + check_telemetry(expected); + resolve(true); + } + gAppRep.queryReputation(query, onComplete); + }); +} + +add_task(async function() { + // Wait for Safebrowsing local list updates to complete. + await waitForUpdates(); +}); + +add_task(async function test_signature_whitelists() { + // We should never get to the remote server. + Services.prefs.setBoolPref(remoteEnabledPref, true); + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/throw"); + + let expected = get_telemetry_snapshot(); + add_telemetry_count(expected.local, NO_LIST, 1); + add_telemetry_count(expected.reason, NonBinaryFile, 1); + + // Use BackgroundFileSaver to extract the signature on Windows. + let destFile = FileTestUtils.getTempFile(TEST_FILE_NAME_1); + + let data = readFileToString("data/signed_win.exe"); + let saver = new BackgroundFileSaverOutputStream(); + let completionPromise = promiseSaverComplete(saver); + saver.enableSignatureInfo(); + saver.setTarget(destFile, false); + await promiseCopyToSaver(data, saver, true); + + saver.finish(Cr.NS_OK); + await completionPromise; + + // Clean up. + destFile.remove(false); + + // evil.com is not on the allowlist, but this binary is signed by an entity + // whose certificate information is on the allowlist. + await promiseQueryReputation( + { + sourceURI: createURI("http://evil.com"), + signatureInfo: saver.signatureInfo, + fileSize: 12, + }, + expected + ); +}); + +add_task(async function test_blocked_binary() { + // We should reach the remote server for a verdict. + Services.prefs.setBoolPref(remoteEnabledPref, true); + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + + let expected = get_telemetry_snapshot(); + expected.shouldBlock++; + add_telemetry_count(expected.local, NO_LIST, 1); + add_telemetry_count(expected.reason, VerdictDangerous, 1); + + // evil.com should return a malware verdict from the remote server. + await promiseQueryReputation( + { + sourceURI: createURI("http://evil.com"), + suggestedFileName: "noop.bat", + fileSize: 12, + signatureInfo: [], + }, + expected + ); +}); + +add_task(async function test_non_binary() { + // We should not reach the remote server for a verdict for non-binary files. + Services.prefs.setBoolPref(remoteEnabledPref, true); + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/throw"); + + let expected = get_telemetry_snapshot(); + add_telemetry_count(expected.local, NO_LIST, 1); + add_telemetry_count(expected.reason, NonBinaryFile, 1); + + await promiseQueryReputation( + { + sourceURI: createURI("http://evil.com"), + suggestedFileName: "noop.txt", + fileSize: 12, + signatureInfo: [], + }, + expected + ); +}); + +add_task(async function test_good_binary() { + // We should reach the remote server for a verdict. + Services.prefs.setBoolPref(remoteEnabledPref, true); + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + + let expected = get_telemetry_snapshot(); + add_telemetry_count(expected.local, NO_LIST, 1); + add_telemetry_count(expected.reason, VerdictSafe, 1); + + // mozilla.com should return a not-guilty verdict from the remote server. + await promiseQueryReputation( + { + sourceURI: createURI("http://mozilla.com"), + suggestedFileName: "noop.bat", + fileSize: 12, + signatureInfo: [], + }, + expected + ); +}); + +add_task(async function test_disabled() { + // Explicitly disable remote checks + Services.prefs.setBoolPref(remoteEnabledPref, false); + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/throw"); + + let expected = get_telemetry_snapshot(); + add_telemetry_count(expected.local, NO_LIST, 1); + add_telemetry_count(expected.reason, RemoteLookupDisabled, 1); + + let query = { + sourceURI: createURI("http://example.com"), + suggestedFileName: "noop.bat", + signatureInfo: [], + fileSize: 12, + }; + await new Promise(resolve => { + gAppRep.queryReputation(query, function onComplete(aShouldBlock, aStatus) { + // We should be getting NS_ERROR_NOT_AVAILABLE if the service is disabled + Assert.equal(Cr.NS_ERROR_NOT_AVAILABLE, aStatus); + Assert.ok(!aShouldBlock); + check_telemetry(expected); + resolve(true); + }); + }); +}); + +add_task(async function test_disabled_through_lists() { + Services.prefs.setBoolPref(remoteEnabledPref, false); + Services.prefs.setCharPref(appRepURLPref, "http://localhost:4444/download"); + Services.prefs.setCharPref("urlclassifier.downloadBlockTable", ""); + + let expected = get_telemetry_snapshot(); + add_telemetry_count(expected.local, NO_LIST, 1); + add_telemetry_count(expected.reason, RemoteLookupDisabled, 1); + + let query = { + sourceURI: createURI("http://example.com"), + suggestedFileName: "noop.bat", + fileSize: 12, + signatureInfo: [], + }; + await new Promise(resolve => { + gAppRep.queryReputation(query, function onComplete(aShouldBlock, aStatus) { + // We should be getting NS_ERROR_NOT_AVAILABLE if the service is disabled + Assert.equal(Cr.NS_ERROR_NOT_AVAILABLE, aStatus); + Assert.ok(!aShouldBlock); + check_telemetry(expected); + resolve(true); + }); + }); +}); +add_task(async function test_teardown() { + gStillRunning = false; +}); diff --git a/toolkit/components/reputationservice/test/unit/test_login_rep.js b/toolkit/components/reputationservice/test/unit/test_login_rep.js new file mode 100644 index 0000000000..d81815996f --- /dev/null +++ b/toolkit/components/reputationservice/test/unit/test_login_rep.js @@ -0,0 +1,183 @@ +/* -*- indent-tabs-mode: nil; js-indent-level: 2 -*- */ +/* vim: set ts=2 et sw=2 tw=80: */ +/* This Source Code Form is subject to the terms of the Mozilla Public + * License, v. 2.0. If a copy of the MPL was not distributed with this + * file, You can obtain one at http://mozilla.org/MPL/2.0/. */ + +const { NetUtil } = ChromeUtils.import("resource://gre/modules/NetUtil.jsm"); + +// LoginReputationService +const gLoginRep = Cc[ + "@mozilla.org/reputationservice/login-reputation-service;1" +].getService(Ci.nsILoginReputationService); + +let gListManager = Cc["@mozilla.org/url-classifier/listmanager;1"].getService( + Ci.nsIUrlListManager +); + +var gHttpServ = null; + +const whitelistedURI = "http://foo:bar@whitelisted.com/index.htm#junk"; +const exampleURI = "http://user:password@example.com/i.html?foo=bar"; + +const LOCAL_WHITELIST_DATA = { + tableName: "test-passwordwhite-proto", + providerName: "test", + updateUrl: "http://localhost:5555/safebrowsing/update?", + gethashUrl: "", +}; + +add_task(async function test_setup() { + // Enable login reputation service + Services.prefs.setBoolPref("browser.safebrowsing.passwords.enabled", true); + gLoginRep.init(); + + // Setup local whitelist table. + Services.prefs.setCharPref( + "urlclassifier.passwordAllowTable", + "test-passwordwhite-proto" + ); + gListManager.registerTable( + LOCAL_WHITELIST_DATA.tableName, + LOCAL_WHITELIST_DATA.providerName, + LOCAL_WHITELIST_DATA.updateUrl, + LOCAL_WHITELIST_DATA.gethashUrl + ); + + registerCleanupFunction(function() { + gListManager.unregisterTable(LOCAL_WHITELIST_DATA.tableName); + + Services.prefs.clearUserPref("browser.safebrowsing.passwords.enabled"); + Services.prefs.clearUserPref("urlclassifier.passwordAllowTable"); + }); +}); + +add_test(function test_setup_local_whitelist() { + // Setup the http server for SafeBrowsing update, so we can save SAFE entries + // to SafeBrowsing database while update. + gHttpServ = new HttpServer(); + gHttpServ.registerDirectory("/", do_get_cwd()); + gHttpServ.registerPathHandler("/safebrowsing/update", function( + request, + response + ) { + response.setHeader( + "Content-Type", + "application/vnd.google.safebrowsing-update", + false + ); + + response.setStatusLine(request.httpVersion, 200, "OK"); + + // The protobuf binary represention of response: + // + // [ + // { + // 'threat_type': 8, // CSD_WHITELIST + // 'response_type': 2, // FULL_UPDATE + // 'new_client_state': 'sta\x00te', // NEW_CLIENT_STATE + // 'checksum': { "sha256": CHECKSUM }, // CHECKSUM + // 'additions': { 'compression_type': RAW, + // 'prefix_size': 32, + // 'raw_hashes': "whitelisted.com/index.htm"} + // } + // ] + // + let content = + "\x0A\x36\x08\x08\x20\x02\x2A\x28\x08\x01\x12\x24\x08" + + "\x20\x12\x20\x0F\xE4\x66\xBB\xDD\x34\xAB\x1E\xF7\x8F" + + "\xDD\x9D\x8C\xF8\x9F\x4E\x42\x97\x92\x86\x02\x03\xE0" + + "\xE9\x60\xBD\xD6\x3A\x85\xCD\x08\xD0\x3A\x06\x73\x74" + + "\x61\x00\x74\x65\x12\x04\x08\x0C\x10\x0A"; + + response.bodyOutputStream.write(content, content.length); + }); + + gHttpServ.start(5555); + + // Trigger the update once http server is ready. + Services.obs.addObserver(function(aSubject, aTopic, aData) { + if (aData.startsWith("success")) { + run_next_test(); + } else { + do_throw("update fail"); + } + }, "safebrowsing-update-finished"); + gListManager.forceUpdates(LOCAL_WHITELIST_DATA.tableName); + + registerCleanupFunction(function() { + return (async function() { + await new Promise(resolve => { + gHttpServ.stop(resolve); + }); + })(); + }); +}); + +add_test(function test_disable() { + Services.prefs.setBoolPref("browser.safebrowsing.passwords.enabled", false); + + gLoginRep.queryReputation( + { + formURI: NetUtil.newURI("http://example.com"), + }, + { + onComplete(aStatus, aVerdict) { + Assert.equal(aStatus, Cr.NS_ERROR_ABORT); + Assert.equal(aVerdict, Ci.nsILoginReputationVerdictType.UNSPECIFIED); + + Services.prefs.setBoolPref( + "browser.safebrowsing.passwords.enabled", + true + ); + + run_next_test(); + }, + } + ); +}); + +add_test(function test_nullQuery() { + try { + gLoginRep.queryReputation(null, { + onComplete(aStatus, aVerdict) {}, + }); + do_throw("Query parameter cannot be null"); + } catch (ex) { + Assert.equal(ex.result, Cr.NS_ERROR_INVALID_POINTER); + + run_next_test(); + } +}); + +add_test(function test_local_whitelist() { + gLoginRep.queryReputation( + { + formURI: NetUtil.newURI(whitelistedURI), + }, + { + onComplete(aStatus, aVerdict) { + Assert.equal(aStatus, Cr.NS_OK); + Assert.equal(aVerdict, Ci.nsILoginReputationVerdictType.SAFE); + + run_next_test(); + }, + } + ); +}); + +add_test(function test_notin_local_whitelist() { + gLoginRep.queryReputation( + { + formURI: NetUtil.newURI(exampleURI), + }, + { + onComplete(aStatus, aVerdict) { + Assert.equal(aStatus, Cr.NS_OK); + Assert.equal(aVerdict, Ci.nsILoginReputationVerdictType.UNSPECIFIED); + + run_next_test(); + }, + } + ); +}); diff --git a/toolkit/components/reputationservice/test/unit/xpcshell.ini b/toolkit/components/reputationservice/test/unit/xpcshell.ini new file mode 100644 index 0000000000..eb1f1ebbed --- /dev/null +++ b/toolkit/components/reputationservice/test/unit/xpcshell.ini @@ -0,0 +1,17 @@ +[DEFAULT] +head = head_download_manager.js +skip-if = toolkit == 'android' +support-files = + data/digest.chunk + data/block_digest.chunk + data/signed_win.exe + +[test_app_rep.js] +run-sequentially = very high failure rate in parallel +[test_app_rep_windows.js] +skip-if = os != "win" +[test_app_rep_maclinux.js] +skip-if = os == "win" +run-sequentially = very high failure rate in parallel + +[test_login_rep.js] |