mozilla-central/toolkit/components/cleardata/tests/unit/test_security_settings.js (file symbol)

Source code

Revision control

Copy as Markdown

Other Tools

Test Info: Warnings

/* Any copyright is dedicated to the Public Domain.
/**
* Test for SecuritySettingsCleaner.
* This tests both, the SiteSecurityService and the ClientAuthRememberService.
*/
"use strict";
let gSSService = Cc["@mozilla.org/ssservice;1"].getService(
Ci.nsISiteSecurityService
);
let cars = Cc["@mozilla.org/security/clientAuthRememberService;1"].getService(
Ci.nsIClientAuthRememberService
);
let certDB = Cc["@mozilla.org/security/x509certdb;1"].getService(
Ci.nsIX509CertDB
);
// These are not actual server and client certs. The ClientAuthRememberService
// does not care which certs we store decisions for, as long as they're valid.
let [clientCert] = certDB.getCerts();
function addSecurityInfo({ host, topLevelBaseDomain, originAttributes = {} }) {
let attrs = getOAWithPartitionKey({ topLevelBaseDomain }, originAttributes);
let uri = Services.io.newURI(`https://${host}`);
gSSService.processHeader(uri, "max-age=1000;", attrs);
cars.rememberDecisionScriptable(host, attrs, clientCert);
}
function addTestSecurityInfo() {
// First party
addSecurityInfo({ host: "example.net" });
addSecurityInfo({ host: "test.example.net" });
addSecurityInfo({ host: "example.org" });
// Third-party partitioned
addSecurityInfo({ host: "example.com", topLevelBaseDomain: "example.net" });
addSecurityInfo({ host: "example.net", topLevelBaseDomain: "example.org" });
addSecurityInfo({
host: "test.example.net",
topLevelBaseDomain: "example.org",
});
// Ensure we have the correct state initially.
testSecurityInfo({ host: "example.net" });
testSecurityInfo({ host: "test.example.net" });
testSecurityInfo({ host: "example.org" });
testSecurityInfo({ host: "example.com", topLevelBaseDomain: "example.net" });
testSecurityInfo({ host: "example.net", topLevelBaseDomain: "example.org" });
testSecurityInfo({
host: "test.example.net",
topLevelBaseDomain: "example.org",
});
}
function testSecurityInfo({
host,
topLevelBaseDomain,
expectedHSTS = true,
expectedCARS = true,
originAttributes = {},
}) {
let attrs = getOAWithPartitionKey({ topLevelBaseDomain }, originAttributes);
let messageSuffix = `for ${host}`;
if (topLevelBaseDomain) {
messageSuffix += ` partitioned under ${topLevelBaseDomain}`;
}
let uri = Services.io.newURI(`https://${host}`);
let isSecure = gSSService.isSecureURI(uri, attrs);
Assert.equal(
isSecure,
expectedHSTS,
`HSTS ${expectedHSTS ? "is set" : "is not set"} ${messageSuffix}`
);
let hasRemembered = cars.hasRememberedDecisionScriptable(host, attrs, {});
// CARS deleteDecisionsByHost does not include subdomains. That means for some
// test cases we expect a different remembered state.
Assert.equal(
hasRemembered,
expectedCARS,
`CAR ${expectedCARS ? "is set" : "is not set"} ${messageSuffix}`
);
}
add_task(async function test_baseDomain() {
gSSService.clearAll();
// ---- hsts cleaner ----
addTestSecurityInfo();
// Clear hsts data of example.net including partitions.
await new Promise(aResolve => {
Services.clearData.deleteDataFromSite(
"example.net",
{},
false,
Ci.nsIClearDataService.CLEAR_HSTS,
aResolve
);
});
testSecurityInfo({
host: "example.net",
expectedHSTS: false,
expectedCARS: true,
});
// HSTSCleaner also removes subdomain settings.
testSecurityInfo({
host: "test.example.net",
expectedHSTS: false,
expectedCARS: true,
});
testSecurityInfo({ host: "example.org" });
testSecurityInfo({
host: "example.com",
topLevelBaseDomain: "example.net",
expectedHSTS: false,
expectedCARS: true,
});
testSecurityInfo({
host: "example.net",
topLevelBaseDomain: "example.org",
expectedHSTS: false,
expectedCARS: true,
});
testSecurityInfo({
host: "test.example.net",
topLevelBaseDomain: "example.org",
expectedHSTS: false,
expectedCARS: true,
});
// ---- client auth remember cleaner -----
addTestSecurityInfo();
// Clear security settings of example.net including partitions.
await new Promise(aResolve => {
Services.clearData.deleteDataFromSite(
"example.net",
{},
false,
Ci.nsIClearDataService.CLEAR_CLIENT_AUTH_REMEMBER_SERVICE,
aResolve
);
});
testSecurityInfo({
host: "example.net",
expectedHSTS: true,
expectedCARS: false,
});
// ClientAuthRememberCleaner also removes subdomain settings.
testSecurityInfo({
host: "test.example.net",
expectedHSTS: true,
expectedCARS: false,
});
testSecurityInfo({ host: "example.org" });
testSecurityInfo({
host: "example.com",
topLevelBaseDomain: "example.net",
expectedHSTS: true,
expectedCARS: false,
});
testSecurityInfo({
host: "example.net",
topLevelBaseDomain: "example.org",
expectedHSTS: true,
expectedCARS: false,
});
testSecurityInfo({
host: "test.example.net",
topLevelBaseDomain: "example.org",
expectedHSTS: true,
expectedCARS: false,
});
// Cleanup
gSSService.clearAll();
});
add_task(async function test_host() {
gSSService.clearAll();
// ---- HSTS cleaer ----
addTestSecurityInfo();
// Clear security settings of example.net without partitions.
await new Promise(aResolve => {
Services.clearData.deleteDataFromHost(
"example.net",
false,
Ci.nsIClearDataService.CLEAR_HSTS,
aResolve
);
});
testSecurityInfo({
host: "example.net",
expectedHSTS: false,
expectedCARS: true,
});
testSecurityInfo({
host: "test.example.net",
expectedHSTS: false,
expectedCARS: true,
});
testSecurityInfo({ host: "example.org" });
testSecurityInfo({ host: "example.com", topLevelBaseDomain: "example.net" });
testSecurityInfo({
host: "example.net",
topLevelBaseDomain: "example.org",
expectedHSTS: false,
expectedCARS: true,
});
testSecurityInfo({
host: "test.example.net",
topLevelBaseDomain: "example.org",
expectedHSTS: false,
expectedCARS: true,
});
// Cleanup
gSSService.clearAll();
// --- clientAuthRemember cleaner ---
addTestSecurityInfo();
// Clear security settings of example.net without partitions.
await new Promise(aResolve => {
Services.clearData.deleteDataFromHost(
"example.net",
false,
Ci.nsIClearDataService.CLEAR_CLIENT_AUTH_REMEMBER_SERVICE,
aResolve
);
});
testSecurityInfo({
host: "example.net",
expectedHSTS: true,
expectedCARS: false,
});
testSecurityInfo({
host: "test.example.net",
expectedHSTS: true,
expectedCARS: true,
});
testSecurityInfo({ host: "example.org" });
testSecurityInfo({ host: "example.com", topLevelBaseDomain: "example.net" });
testSecurityInfo({
host: "example.net",
topLevelBaseDomain: "example.org",
expectedHSTS: true,
expectedCARS: false,
});
testSecurityInfo({
host: "test.example.net",
topLevelBaseDomain: "example.org",
expectedHSTS: true,
expectedCARS: true,
});
// Cleanup
gSSService.clearAll();
});