// Copyright 2013 The Chromium Authors // Use of this source code is governed by a BSD-style license that can be // found in the LICENSE file. #include #include #include #include #include "base/cfi_buildflags.h" #include "base/command_line.h" #include "base/containers/flat_map.h" #include "base/feature_list.h" #include "base/files/file_util.h" #include "base/files/scoped_temp_dir.h" #include "base/functional/callback.h" #include "base/json/json_reader.h" #include "base/json/json_writer.h" #include "base/memory/raw_ptr.h" #include "base/run_loop.h" #include "base/strings/string_number_conversions.h" #include "base/strings/stringprintf.h" #include "base/task/thread_pool/thread_pool_instance.h" #include "base/test/metrics/histogram_tester.h" #include "base/test/scoped_feature_list.h" #include "base/test/simple_test_clock.h" #include "base/test/with_feature_override.h" #include "base/threading/thread_restrictions.h" #include "base/time/clock.h" #include "base/time/time.h" #include "base/values.h" #include "build/build_config.h" #include "chrome/browser/browser_process.h" #include "chrome/browser/enterprise/browser_management/management_service_factory.h" #include "chrome/browser/enterprise/reporting/cloud_profile_reporting_service.h" #include "chrome/browser/enterprise/reporting/cloud_profile_reporting_service_factory.h" #include "chrome/browser/policy/profile_policy_connector_builder.h" #include "chrome/browser/policy/schema_registry_service.h" #include "chrome/browser/profiles/profile.h" #include "chrome/common/chrome_switches.h" #include "chrome/common/url_constants.h" #include "chrome/test/base/chrome_test_utils.h" #include "chrome/test/base/platform_browser_test.h" #include "components/policy/core/browser/browser_policy_connector.h" #include "components/policy/core/browser/webui/policy_status_provider.h" #include "components/policy/core/common/cloud/cloud_policy_refresh_scheduler.h" #include "components/policy/core/common/cloud/enterprise_metrics.h" #include "components/policy/core/common/external_data_fetcher.h" #include "components/policy/core/common/features.h" #include "components/policy/core/common/management/scoped_management_service_override_for_testing.h" #include "components/policy/core/common/mock_configuration_policy_provider.h" #include "components/policy/core/common/policy_logger.h" #include "components/policy/core/common/policy_map.h" #include "components/policy/core/common/policy_namespace.h" #include "components/policy/core/common/policy_pref_names.h" #include "components/policy/core/common/policy_types.h" #include "components/policy/core/common/schema.h" #include "components/policy/policy_constants.h" #include "components/strings/grit/components_strings.h" #include "content/public/browser/web_contents.h" #include "content/public/test/browser_test.h" #include "content/public/test/browser_test_utils.h" #include "testing/gmock/include/gmock/gmock.h" #include "testing/gtest/include/gtest/gtest.h" #include "ui/base/l10n/l10n_util.h" #include "url/gurl.h" #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) #include "chrome/browser/google/google_update_policy_fetcher.h" #endif // BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) #if BUILDFLAG(IS_CHROMEOS) #include "chrome/browser/ash/login/test/device_state_mixin.h" #include "chrome/browser/ash/login/test/logged_in_user_mixin.h" #include "chrome/browser/ash/profiles/profile_helper.h" #include "chrome/test/base/mixin_based_in_process_browser_test.h" #endif // BUILDFLAG(IS_CHROMEOS) #if !BUILDFLAG(IS_ANDROID) #include "chrome/browser/download/download_prefs.h" #include "chrome/browser/ui/browser_window/public/browser_window_interface.h" #include "chrome/browser/ui/ui_features.h" #include "chrome/test/base/ui_test_utils.h" #include "components/account_id/account_id.h" #include "extensions/browser/extension_registrar.h" #include "extensions/browser/install_verifier.h" #include "extensions/common/extension_builder.h" #include "extensions/common/features/simple_feature.h" #endif // !BUILDFLAG(IS_ANDROID) #if !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_CHROMEOS) #include "chrome/browser/enterprise/reporting/browser_launch/scoped_initial_command_line.h" #endif // !BUILDFLAG(IS_ANDROID) && !BUILDFLAG(IS_CHROMEOS) using testing::_; using testing::Return; namespace { // Allows waiting until the policy schema for a |PolicyNamespace| has been made // available by a |Profile|'s |SchemaRegistry|. class PolicySchemaAvailableWaiter : public policy::SchemaRegistry::Observer { public: PolicySchemaAvailableWaiter(Profile* profile, const policy::PolicyNamespace& policy_namespace) : registry_(profile->GetPolicySchemaRegistryService()->registry()), policy_namespace_(policy_namespace) {} PolicySchemaAvailableWaiter(const PolicySchemaAvailableWaiter&) = delete; PolicySchemaAvailableWaiter& operator=(const PolicySchemaAvailableWaiter&) = delete; ~PolicySchemaAvailableWaiter() override { registry_->RemoveObserver(this); } // Starts waiting for a policy schema to be available for the // |policy_namespace_| that has been passed to the constructor. Returns // immediately if the policy schema is already available. void Wait() { if (RegistryHasSchemaForNamespace()) { return; } registry_->AddObserver(this); run_loop_.Run(); } private: bool RegistryHasSchemaForNamespace() { const policy::ComponentMap* map = registry_->schema_map()->GetComponents(policy_namespace_.domain); if (!map) { return false; } return map->find(policy_namespace_.component_id) != map->end(); } // policy::SchemaRegistry::Observer: void OnSchemaRegistryUpdated(bool has_new_schemas) override { if (RegistryHasSchemaForNamespace()) { run_loop_.Quit(); } } const raw_ptr registry_; const policy::PolicyNamespace policy_namespace_; base::RunLoop run_loop_; }; std::vector PopulateExpectedPolicy( const std::string& name, const std::string& value, const std::string& source, const policy::PolicyMap::Entry* policy_map_entry, bool unknown, const std::string& identifier = "chrome") { std::vector expected_policy; // Populate expected policy name. expected_policy.push_back(name); // Populate expected policy value. expected_policy.push_back(value); // Populate expected source name. expected_policy.push_back(source); // Populate expected scope. if (policy_map_entry) { expected_policy.push_back(l10n_util::GetStringUTF8( policy_map_entry->scope == policy::POLICY_SCOPE_MACHINE ? IDS_POLICY_SCOPE_DEVICE : IDS_POLICY_SCOPE_USER)); } else { expected_policy.emplace_back(); } // Populate expected level. if (policy_map_entry) { expected_policy.push_back(l10n_util::GetStringUTF8( policy_map_entry->level == policy::POLICY_LEVEL_RECOMMENDED ? IDS_POLICY_LEVEL_RECOMMENDED : IDS_POLICY_LEVEL_MANDATORY)); } else { expected_policy.emplace_back(); } // Populate expected status. if (unknown) { expected_policy.push_back(l10n_util::GetStringUTF8(IDS_POLICY_LABEL_ERROR)); } else if (!policy_map_entry) { expected_policy.push_back(l10n_util::GetStringUTF8(IDS_POLICY_UNSET)); } else { expected_policy.push_back(l10n_util::GetStringUTF8(IDS_POLICY_OK)); } // Populate expected identifier. expected_policy.push_back(identifier); return expected_policy; } } // namespace class PolicyUITestBase : public PlatformBrowserTest { public: PolicyUITestBase() = default; PolicyUITestBase(const PolicyUITestBase&) = delete; PolicyUITestBase& operator=(const PolicyUITestBase&) = delete; ~PolicyUITestBase() override = default; protected: // PlatformBrowserTest implementation. void SetUpInProcessBrowserTestFixture() override { provider_.SetDefaultReturns(/*is_initialization_complete_return=*/true, /*is_first_policy_load_complete_return=*/true); policy::BrowserPolicyConnector::SetPolicyProviderForTesting(&provider_); policy::PushProfilePolicyConnectorProviderForTesting(&provider_); } // Uses the |MockConfiguratonPolicyProvider| installed for testing to publish // |policy| for |policy_namespace|. void UpdateProviderPolicyForNamespace( const policy::PolicyNamespace& policy_namespace, const policy::PolicyMap& policy) { policy::PolicyBundle bundle; bundle.Get(policy_namespace) = policy.Clone(); provider_.UpdatePolicy(std::move(bundle)); } void VerifyPolicies(std::vector> expected_policies); void VerifyReportButton(bool visible); content::WebContents* web_contents() { return chrome_test_utils::GetActiveWebContents(this); } testing::NiceMock provider_; }; void PolicyUITestBase::VerifyPolicies( std::vector> expected_policies) { ASSERT_TRUE( content::NavigateToURL(web_contents(), GURL(chrome::kChromeUIPolicyURL))); #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) // Google Update policies are fetched asynchronously and always displayed // eventually. for (const auto& key_value : GetGoogleUpdatePolicySchemas()) { expected_policies.push_back( PopulateExpectedPolicy(key_value.first, std::string(), std::string(), nullptr, false, "updater")); } #endif // BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC) // Retrieve the text contents of the policy table cells for all policies. // Policy rendering is async under Mojo. Poll to avoid race conditions with // DOM rendering. The test fails with a timeout if the condition is never met. const std::string javascript = "new Promise(resolve => {" " const check = () => {" " var entries = getAllPolicyTables();" " var policies = [];" " for (var i = 0; i < entries.length; ++i) {" " var items = getAllPolicyRows(entries[i]);" " for (var j = 0; j < items.length; ++j) {" " var children = getAllPolicyRowDivs(items[j]);" " var values = [];" " for(var k = 0; k < children.length - 1; ++k) {" " values.push(children[k].textContent.trim());" " }" " values.push(entries[i].dataModel.id || '');" " policies.push(values);" " }" " }" " if (policies.length === " + base::NumberToString(expected_policies.size()) + ") {" " resolve(JSON.stringify(policies));" " } else {" " setTimeout(check, 50);" " }" " };" " check();" "});"; std::string json = content::EvalJs(web_contents(), javascript).ExtractString(); std::optional value_ptr = base::JSONReader::Read(json, base::JSON_PARSE_CHROMIUM_EXTENSIONS); ASSERT_TRUE(value_ptr); ASSERT_TRUE(value_ptr->is_list()); const base::ListValue& actual_policies = value_ptr->GetList(); // Verify that the cells contain the expected strings for all policies. ASSERT_EQ(expected_policies.size(), actual_policies.size()); for (size_t i = 0; i < expected_policies.size(); ++i) { const std::vector expected_policy = expected_policies[i]; ASSERT_TRUE(actual_policies[i].is_list()); const base::ListValue& actual_policy = actual_policies[i].GetList(); ASSERT_EQ(expected_policy.size(), actual_policy.size()); for (size_t j = 0; j < expected_policy.size(); ++j) { const std::string* value = actual_policy[j].GetIfString(); ASSERT_TRUE(value); if (expected_policy[j] != *value) { EXPECT_EQ(expected_policy[j], *value); } } } } void PolicyUITestBase::VerifyReportButton(bool visible) { bool expect_visible = visible; #if BUILDFLAG(IS_CHROMEOS) // The report button is never visible on ChromeOS. We force `expect_visible` // to false here to prevent the JS promise from polling indefinitely and // timing out. expect_visible = false; #endif // BUILDFLAG(IS_CHROMEOS) // Poll until the report button's visibility matches our expectation. // This cleanly handles asynchronous WebUI updates (on Windows and macOS) // while resolving immediately on other platforms. const std::string kJavaScript = base::StringPrintf( "new Promise(resolve => {" " const check = () => {" " var display = getReportButtonVisibility();" " if ((display === 'none') === %s) {" " resolve(display);" " } else {" " setTimeout(check, 50);" " }" " };" " check();" "});", expect_visible ? "false" : "true"); std::string ret = content::EvalJs(web_contents(), kJavaScript).ExtractString(); #if !BUILDFLAG(IS_CHROMEOS) EXPECT_EQ(visible, ret != "none"); #else EXPECT_FALSE(ret != "none"); #endif } class PolicyUITest : public base::test::WithFeatureOverride, public PolicyUITestBase { public: PolicyUITest() : base::test::WithFeatureOverride( policy::features::kPolicyPageMojoMigration) {} }; INSTANTIATE_FEATURE_OVERRIDE_TEST_SUITE(PolicyUITest); #if BUILDFLAG(IS_CHROMEOS) class PolicyUIStatusTest : public MixinBasedInProcessBrowserTest { public: void SetUpOnMainThread() override { MixinBasedInProcessBrowserTest::SetUpOnMainThread(); logged_in_user_mixin_.LogInUser(); // By default DeviceStateMixin sets public key version to 17 whereas policy // test server inside LoggedInUserMixin has only one version. By setting // public_key_version to 1, we make device policy requests succeed and thus // device policy timestamp set. device_state_.RequestDevicePolicyUpdate() ->policy_data() ->set_public_key_version(1); } bool ReadStatusFor(const std::string& policy_legend, base::flat_map* policy_status); bool ReloadPolicies(); bool ReloadPolicies(content::WebContents* contents); protected: ash::DeviceStateMixin device_state_{ &mixin_host_, ash::DeviceStateMixin::State::OOBE_COMPLETED_CLOUD_ENROLLED}; ash::LoggedInUserMixin logged_in_user_mixin_{ &mixin_host_, /*test_base=*/this, embedded_test_server(), ash::LoggedInUserMixin::LogInType::kManaged}; }; bool PolicyUIStatusTest::ReadStatusFor( const std::string& policy_legend, base::flat_map* policy_status) { // Retrieve the text contents of the status table with specified heading. const std::string javascript = R"JS( (function() { function readStatus() { // Wait for the status box to appear in case page just loaded. const app = document.querySelector('policy-app'); const statusSection = app && app.shadowRoot ? app.shadowRoot.querySelector('#status-section') : null; if (!statusSection || statusSection.hidden) { return new Promise(resolve => { window.requestIdleCallback(resolve); }).then(readStatus); } const policies = getPolicyFieldsets(); const statuses = {}; for (let i = 0; i < policies.length; ++i) { const statusHeading = policies[i] .querySelector('.status-box-heading').textContent; const entries = {}; const rows = policies[i] .querySelectorAll('.status-entry div:nth-child(2)'); for (let j = 0; j < rows.length; ++j) { entries[rows[j].className.split(' ')[0]] = rows[j].textContent .trim(); } statuses[statusHeading.trim()] = entries; } return JSON.stringify(statuses); }; return new Promise(resolve => { window.requestIdleCallback(resolve); }).then(readStatus); })(); )JS"; content::WebContents* contents = chrome_test_utils::GetActiveWebContents(this); std::string json = content::EvalJs(contents, javascript).ExtractString(); std::optional statuses = base::JSONReader::Read(json, base::JSON_PARSE_CHROMIUM_EXTENSIONS); if (!statuses.has_value() || !statuses->is_dict()) { return false; } const base::DictValue& status_dict = statuses->GetDict(); const base::DictValue* actual_entries = status_dict.FindDict(policy_legend); if (!actual_entries) { return false; } for (const auto entry : *actual_entries) { policy_status->insert_or_assign(entry.first, entry.second.GetString()); } return true; } bool PolicyUIStatusTest::ReloadPolicies() { content::WebContents* contents = chrome_test_utils::GetActiveWebContents(this); return ReloadPolicies(contents); } bool PolicyUIStatusTest::ReloadPolicies(content::WebContents* contents) { return content::ExecJs(contents, "reloadPolicies()"); } #if !BUILDFLAG(IS_ANDROID) IN_PROC_BROWSER_TEST_F(PolicyUIStatusTest, CheckPolicyUiInGuestProfile) { // Verifies that the page opens in guest session. const BrowserWindowInterface* policy_browser = OpenURLOffTheRecord( browser()->GetProfile(), GURL(chrome::kChromeUIPolicyURL)); ASSERT_TRUE(policy_browser); content::WebContents* contents = policy_browser->GetTabStripModel()->GetActiveWebContents(); ASSERT_TRUE(ReloadPolicies(contents)); } #endif // !BUILDFLAG(IS_ANDROID) IN_PROC_BROWSER_TEST_F(PolicyUIStatusTest, ShowsZeroSecondsSinceRefreshAfterReloadingPolicies) { // Verifies that the time since refresh of a policy set is set to 0 seconds // after "Reload policies" button is pressed and policies are reloaded. // Mock time in policy server and classes used by refresh logic. base::Time now = base::Time::Now(); logged_in_user_mixin_.GetEmbeddedPolicyTestServerMixin() ->UpdatePolicyTimestamp(now); base::SimpleTestClock status_provider_clock_mock; status_provider_clock_mock.SetNow(now); auto status_provider_clock_mock_closure = policy::PolicyStatusProvider::OverrideClockForTesting( &status_provider_clock_mock); base::SimpleTestClock policy_refresher_clock_mock; policy_refresher_clock_mock.SetNow(now); auto policy_refresher_clock_mock_closure = policy::CloudPolicyRefreshScheduler::OverrideClockForTesting( &policy_refresher_clock_mock); ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), GURL(chrome::kChromeUIPolicyURL))); ASSERT_TRUE(ReloadPolicies()); base::flat_map status; ASSERT_TRUE(ReadStatusFor("User policies", &status)); EXPECT_EQ(status["time-since-last-refresh"], "0 secs ago"); EXPECT_EQ(status["time-since-last-fetch-attempt"], "0 secs ago"); ASSERT_TRUE(ReadStatusFor("Device policies", &status)); EXPECT_EQ(status["time-since-last-refresh"], "0 secs ago"); EXPECT_EQ(status["time-since-last-fetch-attempt"], "0 secs ago"); } IN_PROC_BROWSER_TEST_F(PolicyUIStatusTest, ShowsCorrectTimesSinceRefresh) { // Verifies that the time since refresh of a policy set is correctly computed. // Mock time in policy server and classes used by refresh logic. base::Time now = base::Time::Now(); logged_in_user_mixin_.GetEmbeddedPolicyTestServerMixin() ->UpdatePolicyTimestamp(now); base::SimpleTestClock status_provider_clock_mock; status_provider_clock_mock.SetNow(now); auto status_provider_clock_mock_closure = policy::PolicyStatusProvider::OverrideClockForTesting( &status_provider_clock_mock); base::SimpleTestClock policy_refresher_clock_mock; policy_refresher_clock_mock.SetNow(now); auto policy_refresher_clock_mock_closure = policy::CloudPolicyRefreshScheduler::OverrideClockForTesting( &policy_refresher_clock_mock); ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), GURL(chrome::kChromeUIPolicyURL))); ASSERT_TRUE(ReloadPolicies()); status_provider_clock_mock.Advance(base::Hours(1)); policy_refresher_clock_mock.Advance(base::Hours(1)); // Refresh the page without reloading policies. ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), GURL(chrome::kChromeUIPolicyURL))); base::RunLoop().RunUntilIdle(); // Ensure status request has been processed. base::flat_map status; ASSERT_TRUE(ReadStatusFor("User policies", &status)); EXPECT_EQ(status["time-since-last-refresh"], "1 hour ago"); EXPECT_EQ(status["time-since-last-fetch-attempt"], "1 hour ago"); ASSERT_TRUE(ReadStatusFor("Device policies", &status)); EXPECT_EQ(status["time-since-last-refresh"], "1 hour ago"); EXPECT_EQ(status["time-since-last-fetch-attempt"], "1 hour ago"); } IN_PROC_BROWSER_TEST_F(PolicyUIStatusTest, ShowsCorrectRefreshTimesAfterFailedReload) { // Verifies that the time since refresh of a policy set is correctly updated // after a failed attempt to update policies. // Mock time in policy server and classes used by refresh logic. base::Time now = base::Time::Now(); logged_in_user_mixin_.GetEmbeddedPolicyTestServerMixin() ->UpdatePolicyTimestamp(now); base::SimpleTestClock status_provider_clock_mock; status_provider_clock_mock.SetNow(now); auto status_provider_clock_mock_closure = policy::PolicyStatusProvider::OverrideClockForTesting( &status_provider_clock_mock); base::SimpleTestClock policy_refresher_clock_mock; policy_refresher_clock_mock.SetNow(now); auto policy_refresher_clock_mock_closure = policy::CloudPolicyRefreshScheduler::OverrideClockForTesting( &policy_refresher_clock_mock); ASSERT_TRUE(ui_test_utils::NavigateToURL(browser(), GURL(chrome::kChromeUIPolicyURL))); ASSERT_TRUE(ReloadPolicies()); logged_in_user_mixin_.GetEmbeddedPolicyTestServerMixin()->SetPolicyFetchError( 500); status_provider_clock_mock.Advance(base::Hours(1)); policy_refresher_clock_mock.Advance(base::Hours(1)); ASSERT_TRUE(ReloadPolicies()); base::flat_map status; ASSERT_TRUE(ReadStatusFor("User policies", &status)); EXPECT_EQ(status["time-since-last-refresh"], "1 hour ago"); EXPECT_EQ(status["time-since-last-fetch-attempt"], "0 secs ago"); ASSERT_TRUE(ReadStatusFor("Device policies", &status)); EXPECT_EQ(status["time-since-last-refresh"], "1 hour ago"); EXPECT_EQ(status["time-since-last-fetch-attempt"], "0 secs ago"); } #endif // BUILDFLAG(IS_CHROMEOS) IN_PROC_BROWSER_TEST_P(PolicyUITest, LogsPageRedirectsOnChromeOS) { // Verifies that navigating to chrome://policy/logs redirects to // chrome://policy on ChromeOS, but stays on the logs page on other platforms. content::WebContents* contents = web_contents(); GURL logs_url = GURL(chrome::kChromeUIPolicyURL).Resolve("logs"); GURL policy_url = GURL(chrome::kChromeUIPolicyURL); // We use LoadURL and WaitForLoadStop to avoid NavigateToURL's strict URL // check. contents->GetController().LoadURL(logs_url, content::Referrer(), ui::PAGE_TRANSITION_TYPED, std::string()); EXPECT_TRUE(content::WaitForLoadStop(contents)); #if BUILDFLAG(IS_CHROMEOS) if (policy::PolicyLogger::GetInstance()->IsPolicyLoggingEnabled()) { EXPECT_EQ(contents->GetLastCommittedURL(), logs_url); } else { EXPECT_EQ(contents->GetLastCommittedURL(), policy_url); } #else EXPECT_EQ(contents->GetLastCommittedURL(), logs_url); #endif } IN_PROC_BROWSER_TEST_P(PolicyUITest, SendPolicyNames) { // Verifies that the names of known policies are sent to the UI and processed // there correctly by checking that the policy table contains all policies in // the correct order. // Expect that the policy table contains all known policies in alphabetical // order and none of the policies have a set value. std::vector> expected_policies; policy::Schema chrome_schema = policy::Schema::Wrap(policy::GetChromeSchemaData()); ASSERT_TRUE(chrome_schema.valid()); for (policy::Schema::Iterator it = chrome_schema.GetPropertiesIterator(); !it.IsAtEnd(); it.Advance()) { expected_policies.push_back(PopulateExpectedPolicy( it.key(), std::string(), std::string(), nullptr, false)); } #if !BUILDFLAG(IS_CHROMEOS) // Add policies found in the Policy Precedence table. for (auto* policy : policy::metapolicy::kPrecedence) { expected_policies.push_back(PopulateExpectedPolicy( policy, std::string(), std::string(), nullptr, false, "precedence")); } #endif // !BUILDFLAG(IS_CHROMEOS) // Retrieve the contents of the policy table from the UI and verify that it // matches the expectation. VerifyPolicies(expected_policies); } IN_PROC_BROWSER_TEST_P(PolicyUITest, SendPolicyValues) { // Verifies that policy values are sent to the UI and processed there // correctly by setting the values of four known and one unknown policy and // checking that the policy table contains the policy names, values and // metadata in the correct order. policy::PolicyMap values; std::map expected_values; // Set the values of four existing policies. base::ListValue blocked_urls; blocked_urls.Append("site1.com"); blocked_urls.Append("site2.com"); blocked_urls.Append("site3.com"); values.Set(policy::key::kURLBlocklist, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD, base::Value(std::move(blocked_urls)), nullptr); expected_values[policy::key::kURLBlocklist] = R"(["site1.com","site2.com","site3.com"])"; values.Set(policy::key::kHomepageLocation, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_MACHINE, policy::POLICY_SOURCE_CLOUD, base::Value("http://google.com"), nullptr); expected_values[policy::key::kHomepageLocation] = "http://google.com"; values.Set(policy::key::kSafeBrowsingProtectionLevel, policy::POLICY_LEVEL_RECOMMENDED, policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD, base::Value(1), nullptr); expected_values[policy::key::kSafeBrowsingProtectionLevel] = "1"; values.Set(policy::key::kPasswordLeakDetectionEnabled, policy::POLICY_LEVEL_RECOMMENDED, policy::POLICY_SCOPE_MACHINE, policy::POLICY_SOURCE_CLOUD, base::Value(true), nullptr); expected_values[policy::key::kPasswordLeakDetectionEnabled] = "true"; // Set the value of a policy that does not exist. const std::string kUnknownPolicy = "NoSuchThing"; values.Set(kUnknownPolicy, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_PLATFORM, base::Value(true), nullptr); expected_values[kUnknownPolicy] = "true"; const std::string kUnknownPolicyWithDots = "no.such.thing"; values.Set(kUnknownPolicyWithDots, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_PLATFORM, base::Value("blub"), nullptr); expected_values[kUnknownPolicyWithDots] = "blub"; provider_.UpdateChromePolicy(values); // Expect that the policy table contains, in order: // * All known policies whose value has been set, in alphabetical order. // * The unknown policy. // * All known policies whose value has not been set, in alphabetical order. std::vector> expected_policies; size_t first_unset_position = 0; policy::Schema chrome_schema = policy::Schema::Wrap(policy::GetChromeSchemaData()); ASSERT_TRUE(chrome_schema.valid()); for (policy::Schema::Iterator props = chrome_schema.GetPropertiesIterator(); !props.IsAtEnd(); props.Advance()) { std::map::const_iterator it = expected_values.find(props.key()); const std::string value = it == expected_values.end() ? std::string() : it->second; const std::string source = it == expected_values.end() ? std::string() : "Cloud"; const policy::PolicyMap::Entry* metadata = values.Get(props.key()); expected_policies.insert( metadata ? expected_policies.begin() + first_unset_position++ : expected_policies.end(), PopulateExpectedPolicy(props.key(), value, source, metadata, false)); } expected_policies.insert( expected_policies.begin() + first_unset_position++, PopulateExpectedPolicy(kUnknownPolicy, expected_values[kUnknownPolicy], "Platform", values.Get(kUnknownPolicy), true)); expected_policies.insert( expected_policies.begin() + first_unset_position++, PopulateExpectedPolicy( kUnknownPolicyWithDots, expected_values[kUnknownPolicyWithDots], "Platform", values.Get(kUnknownPolicyWithDots), true)); #if !BUILDFLAG(IS_CHROMEOS) // Add policies found in the Policy Precedence table. for (auto* policy : policy::metapolicy::kPrecedence) { expected_policies.push_back( PopulateExpectedPolicy(policy, std::string(), std::string(), values.Get(policy), false, "precedence")); } #endif // !BUILDFLAG(IS_CHROMEOS) // Retrieve the contents of the policy table from the UI and verify that it // matches the expectation. VerifyPolicies(expected_policies); } IN_PROC_BROWSER_TEST_P(PolicyUITest, ReportButton) { ASSERT_TRUE( content::NavigateToURL(web_contents(), GURL(chrome::kChromeUIPolicyURL))); // Hide by default. VerifyReportButton(/*visible=*/false); // Turn on with the policy policy::PolicyMap policy_map; policy_map.Set(policy::key::kCloudReportingEnabled, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_MACHINE, policy::POLICY_SOURCE_CLOUD, base::Value(true), nullptr); provider_.UpdateChromePolicy(policy_map); VerifyReportButton(/*visible=*/true); // Hide while policy is off. policy_map.Set(policy::key::kCloudReportingEnabled, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_MACHINE, policy::POLICY_SOURCE_CLOUD, base::Value(false), nullptr); provider_.UpdateChromePolicy(policy_map); VerifyReportButton(/*visible=*/false); } IN_PROC_BROWSER_TEST_P(PolicyUITest, ReportButtonWithProfileReporting) { ASSERT_TRUE( content::NavigateToURL(web_contents(), GURL(chrome::kChromeUIPolicyURL))); // Hide by default. VerifyReportButton(/*visible=*/false); // Turn on with the policy policy::PolicyMap policy_map; policy_map.Set(policy::key::kCloudProfileReportingEnabled, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_MACHINE, policy::POLICY_SOURCE_CLOUD, base::Value(true), nullptr); provider_.UpdateChromePolicy(policy_map); VerifyReportButton(/*visible=*/true); // Hide while policy is off. policy_map.Set(policy::key::kCloudProfileReportingEnabled, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_MACHINE, policy::POLICY_SOURCE_CLOUD, base::Value(false), nullptr); provider_.UpdateChromePolicy(policy_map); VerifyReportButton(/*visible=*/false); } #if !BUILDFLAG(IS_CHROMEOS) && !BUILDFLAG(IS_ANDROID) IN_PROC_BROWSER_TEST_P(PolicyUITest, ReportButtonOTRProfile) { BrowserWindowInterface* otr_browser = OpenURLOffTheRecord( browser()->GetProfile(), GURL(chrome::kChromeUIPolicyURL)); ASSERT_TRUE(otr_browser); content::WebContents* otr_contents = otr_browser->GetTabStripModel()->GetActiveWebContents(); // Concretely assert that CloudProfileReportingServiceFactory returns nullptr // for OTR profile, so no reporting service / scheduler is available. EXPECT_EQ( nullptr, enterprise_reporting::CloudProfileReportingServiceFactory::GetForProfile( otr_browser->GetProfile())); // Turn on the reporting policy. policy::PolicyMap policy_map; policy_map.Set(policy::key::kCloudProfileReportingEnabled, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_MACHINE, policy::POLICY_SOURCE_CLOUD, base::Value(true), nullptr); provider_.UpdateChromePolicy(policy_map); // Verify the button is NOT visible in the OTR profile, even when enabled by // policy. const std::string kJavaScript = "getReportButtonVisibility();"; std::string visibility = content::EvalJs(otr_contents, kJavaScript).ExtractString(); EXPECT_EQ("none", visibility); // Verify that calling uploadReport does not crash and completes safely. EXPECT_TRUE(content::ExecJs(otr_contents, "chrome.send('uploadReport', ['test_id']);")); } #endif // !BUILDFLAG(IS_CHROMEOS) && !BUILDFLAG(IS_ANDROID) // TODO(crbug.com/442259475): Crashes on Android WebUI. #if !BUILDFLAG(IS_CHROMEOS) && !BUILDFLAG(IS_ANDROID) class PolicyPrecedenceUITest : public PolicyUITestBase, public ::testing::WithParamInterface> { public: PolicyPrecedenceUITest() { feature_list_.InitWithFeatureState( policy::features::kPolicyPageMojoMigration, std::get<3>(GetParam())); } bool CloudPolicyOverridesPlatformPolicy() { return std::get<0>(GetParam()); } bool CloudUserPolicyOverridesCloudMachinePolicy() { return std::get<1>(GetParam()); } bool IsUserAffiliated() { return std::get<2>(GetParam()); } void ValidatePrecedenceValue(const std::string& precedence_row_value) { if (CloudPolicyOverridesPlatformPolicy() && CloudUserPolicyOverridesCloudMachinePolicy() && IsUserAffiliated()) { EXPECT_EQ(precedence_row_value, "Cloud user > Cloud machine > Platform machine > " "Platform user"); } else if (CloudPolicyOverridesPlatformPolicy()) { EXPECT_EQ(precedence_row_value, "Cloud machine > Platform machine > Platform user > " "Cloud user"); } else if (CloudUserPolicyOverridesCloudMachinePolicy() && IsUserAffiliated()) { EXPECT_EQ(precedence_row_value, "Platform machine > Cloud user > Cloud machine > " "Platform user"); } else { EXPECT_EQ(precedence_row_value, "Platform machine > Cloud machine > Platform user > " "Cloud user"); } } // Used to retrieve the contents of the policy precedence rows. const std::string kJavaScript = "new Promise(resolve => {" " const check = () => {" " const precedence_row = getPrecedenceRowValue();" " if (precedence_row && precedence_row.textContent.trim() !== '') {" " resolve(precedence_row.textContent.trim());" " } else {" " setTimeout(check, 50);" " }" " };" " check();" "});"; private: base::test::ScopedFeatureList feature_list_; }; // Verify that the precedence order displayed in the Policy Precedence table is // correct. IN_PROC_BROWSER_TEST_P(PolicyPrecedenceUITest, PrecedenceOrder) { // Set precedence policies. policy::PolicyMap policy_map; if (IsUserAffiliated()) { base::flat_set affiliation_ids; affiliation_ids.insert("12345"); // Treat user as affiliated by setting identical user and device IDs. policy_map.SetUserAffiliationIds(affiliation_ids); policy_map.SetDeviceAffiliationIds(affiliation_ids); } policy_map.Set(policy::key::kCloudPolicyOverridesPlatformPolicy, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_MACHINE, policy::POLICY_SOURCE_PLATFORM, base::Value(CloudPolicyOverridesPlatformPolicy()), nullptr); policy_map.Set(policy::key::kCloudUserPolicyOverridesCloudMachinePolicy, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_MACHINE, policy::POLICY_SOURCE_PLATFORM, base::Value(CloudUserPolicyOverridesCloudMachinePolicy()), nullptr); provider_.UpdateChromePolicy(policy_map); // Retrieve the contents of the policy precedence rows. ASSERT_TRUE( content::NavigateToURL(web_contents(), GURL(chrome::kChromeUIPolicyURL))); std::string precedence_row_value = content::EvalJs(web_contents(), kJavaScript).ExtractString(); ValidatePrecedenceValue(precedence_row_value); } INSTANTIATE_TEST_SUITE_P(PolicyPrecedenceUITestInstance, PolicyPrecedenceUITest, testing::Combine(testing::Bool(), testing::Bool(), testing::Bool(), testing::Bool())); #endif // !BUILDFLAG(IS_CHROMEOS) && !BUILDFLAG(IS_ANDROID) #if !BUILDFLAG(IS_ANDROID) // TODO(https://crbug.com/1027135) Add tests to verify extension policies are // exported correctly. class ExtensionPolicyUITest : public PolicyUITestBase, public ::testing::WithParamInterface> { public: ExtensionPolicyUITest() { feature_list_.InitWithFeatureState( policy::features::kPolicyPageMojoMigration, std::get<1>(GetParam())); } bool UseSigninProfile() const { return std::get<0>(GetParam()); } Profile* extension_profile() { #if BUILDFLAG(IS_CHROMEOS) if (UseSigninProfile()) { return ash::ProfileHelper::GetSigninProfile(); } #endif // BUILDFLAG(IS_CHROMEOS) return chrome_test_utils::GetProfile(this); } private: base::test::ScopedFeatureList feature_list_; }; // TODO(crbug.com/41429868) Flaky time outs on Linux Chromium OS ASan // LSan bot. #if defined(ADDRESS_SANITIZER) #define MAYBE_ExtensionLoadAndSendPolicy DISABLED_ExtensionLoadAndSendPolicy #else #define MAYBE_ExtensionLoadAndSendPolicy ExtensionLoadAndSendPolicy #endif IN_PROC_BROWSER_TEST_P(ExtensionPolicyUITest, MAYBE_ExtensionLoadAndSendPolicy) { base::ScopedAllowBlockingForTesting allow_blocking; base::ScopedTempDir temp_dir_; ASSERT_TRUE(temp_dir_.CreateUniqueTempDir()); const std::string kNormalBooleanPolicy = "normal_boolean"; const std::string kSensitiveBooleanPolicy = "sensitive_boolean"; const std::string kSensitiveStringPolicy = "sensitive_string"; const std::string kSensitiveObjectPolicy = "sensitive_object"; const std::string kSensitiveArrayPolicy = "sensitive_array"; const std::string kSensitiveIntegerPolicy = "sensitive_integer"; const std::string kSensitiveNumberPolicy = "sensitive_number"; std::string json_data = R"({ "type": "object", "properties": { "normal_boolean": { "type": "boolean" }, "sensitive_boolean": { "type": "boolean", "sensitiveValue": true }, "sensitive_string": { "type": "string", "sensitiveValue": true }, "sensitive_object": { "type": "object", "additionalProperties": { "type": "boolean" }, "sensitiveValue": true }, "sensitive_array": { "type": "array", "items": { "type": "boolean" }, "sensitiveValue": true }, "sensitive_integer": { "type": "integer", "sensitiveValue": true }, "sensitive_number": { "type": "number", "sensitiveValue": true } } })"; const std::string schema_file = "schema.json"; base::FilePath schema_path = temp_dir_.GetPath().AppendASCII(schema_file); base::WriteFile(schema_path, json_data); // Build extension that contains the policy schema. auto storage = base::DictValue().Set("managed_schema", schema_file); auto manifest = base::DictValue() .Set("name", "test") .Set("version", "1") .Set("manifest_version", 2) .Set("storage", std::move(storage)); extensions::ExtensionBuilder builder; builder.SetPath(temp_dir_.GetPath()); builder.SetManifest(std::move(manifest)); builder.SetLocation( extensions::mojom::ManifestLocation::kExternalPolicyDownload); // Install extension. scoped_refptr extension = builder.Build(); // Bypass "signin_screen" feature only enabled for allowlisted extensions. extensions::SimpleFeature::ScopedThreadUnsafeAllowlistForTest allowlist( extension->id()); // Disable extension install verification. extensions::ScopedInstallVerifierBypassForTest ignore_install_verification_; extensions::ExtensionRegistrar::Get(extension_profile()) ->OnExtensionInstalled(extension.get(), syncer::StringOrdinal(), 0); policy::PolicyDomain policy_domain = UseSigninProfile() ? policy::POLICY_DOMAIN_SIGNIN_EXTENSIONS : policy::POLICY_DOMAIN_EXTENSIONS; const policy::PolicyNamespace extension_policy_namespace(policy_domain, extension->id()); PolicySchemaAvailableWaiter(extension_profile()->GetOriginalProfile(), extension_policy_namespace) .Wait(); std::vector> expected_chrome_policies; policy::Schema chrome_schema = policy::Schema::Wrap(policy::GetChromeSchemaData()); ASSERT_TRUE(chrome_schema.valid()); for (policy::Schema::Iterator it = chrome_schema.GetPropertiesIterator(); !it.IsAtEnd(); it.Advance()) { expected_chrome_policies.push_back(PopulateExpectedPolicy( it.key(), std::string(), std::string(), nullptr, false)); } #if !BUILDFLAG(IS_CHROMEOS) // Add policies found in the precedence policy table. for (auto* policy : policy::metapolicy::kPrecedence) { expected_chrome_policies.push_back(PopulateExpectedPolicy( policy, std::string(), std::string(), nullptr, false, "precedence")); } #endif // !BUILDFLAG(IS_CHROMEOS) // Add extension policy to expected policy list. std::vector> expected_policies = expected_chrome_policies; expected_policies.push_back( PopulateExpectedPolicy(kNormalBooleanPolicy, std::string(), std::string(), nullptr, false, extension->id())); expected_policies.push_back( PopulateExpectedPolicy(kSensitiveArrayPolicy, std::string(), std::string(), nullptr, false, extension->id())); expected_policies.push_back( PopulateExpectedPolicy(kSensitiveBooleanPolicy, std::string(), std::string(), nullptr, false, extension->id())); expected_policies.push_back( PopulateExpectedPolicy(kSensitiveIntegerPolicy, std::string(), std::string(), nullptr, false, extension->id())); expected_policies.push_back( PopulateExpectedPolicy(kSensitiveNumberPolicy, std::string(), std::string(), nullptr, false, extension->id())); expected_policies.push_back( PopulateExpectedPolicy(kSensitiveObjectPolicy, std::string(), std::string(), nullptr, false, extension->id())); expected_policies.push_back( PopulateExpectedPolicy(kSensitiveStringPolicy, std::string(), std::string(), nullptr, false, extension->id())); // Verify if policy UI includes policy that extension have. VerifyPolicies(expected_policies); base::DictValue object_value; object_value.Set("objectProperty", true); base::ListValue array_value; array_value.Append(true); policy::PolicyMap values; values.Set(kNormalBooleanPolicy, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD, base::Value(true), nullptr); values.Set(kSensitiveArrayPolicy, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD, base::Value(std::move(array_value)), nullptr); values.Set(kSensitiveBooleanPolicy, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD, base::Value(true), nullptr); values.Set(kSensitiveIntegerPolicy, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD, base::Value(42), nullptr); values.Set(kSensitiveNumberPolicy, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD, base::Value(3.141), nullptr); values.Set(kSensitiveObjectPolicy, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD, base::Value(std::move(object_value)), nullptr); values.Set(kSensitiveStringPolicy, policy::POLICY_LEVEL_MANDATORY, policy::POLICY_SCOPE_USER, policy::POLICY_SOURCE_CLOUD, base::Value("value"), nullptr); UpdateProviderPolicyForNamespace(extension_policy_namespace, values); // Add extension policy with values to expected policy list. const std::string mask_value = "********"; std::vector> expected_policies_with_values = expected_chrome_policies; expected_policies_with_values.push_back(PopulateExpectedPolicy( kNormalBooleanPolicy, "true", "Cloud", values.Get(kNormalBooleanPolicy), false, extension->id())); expected_policies_with_values.push_back(PopulateExpectedPolicy( kSensitiveArrayPolicy, mask_value, "Cloud", values.Get(kSensitiveArrayPolicy), false, extension->id())); expected_policies_with_values.push_back(PopulateExpectedPolicy( kSensitiveBooleanPolicy, mask_value, "Cloud", values.Get(kSensitiveBooleanPolicy), false, extension->id())); expected_policies_with_values.push_back(PopulateExpectedPolicy( kSensitiveIntegerPolicy, mask_value, "Cloud", values.Get(kSensitiveIntegerPolicy), false, extension->id())); expected_policies_with_values.push_back(PopulateExpectedPolicy( kSensitiveNumberPolicy, mask_value, "Cloud", values.Get(kSensitiveNumberPolicy), false, extension->id())); expected_policies_with_values.push_back(PopulateExpectedPolicy( kSensitiveObjectPolicy, mask_value, "Cloud", values.Get(kSensitiveObjectPolicy), false, extension->id())); expected_policies_with_values.push_back(PopulateExpectedPolicy( kSensitiveStringPolicy, mask_value, "Cloud", values.Get(kSensitiveStringPolicy), false, extension->id())); VerifyPolicies(expected_policies_with_values); } INSTANTIATE_TEST_SUITE_P(All, ExtensionPolicyUITest, testing::Combine( #if BUILDFLAG(IS_CHROMEOS) testing::Values(false, true), #else testing::Values(false), #endif testing::Bool())); #if !BUILDFLAG(IS_CHROMEOS) constexpr char kCheckBannerJs[] = "(() => {" " const app = document.querySelector('policy-app');" " return !!app && " "!!app.shadowRoot.querySelector('#command-line-arguments-warning');" "})();"; constexpr char kGetCommandLineArgsJs[] = "(() => {" " const app = document.querySelector('policy-app');" " const el = app && " "app.shadowRoot.querySelector('#command-line-arguments');" " return el ? el.textContent : '';" "})();"; IN_PROC_BROWSER_TEST_F(PolicyUITestBase, NoWarningWithoutCommandLineArguments) { base::CommandLine empty_command_line( base::FilePath(FILE_PATH_LITERAL("chrome"))); enterprise_reporting::ScopedInitialCommandLine override_cli( &empty_command_line); ASSERT_TRUE( content::NavigateToURL(web_contents(), GURL(chrome::kChromeUIPolicyURL))); EXPECT_EQ(false, content::EvalJs(web_contents(), kCheckBannerJs)); } IN_PROC_BROWSER_TEST_F(PolicyUITestBase, ShowsWarningWithCommandLineArguments) { base::CommandLine custom_command_line( base::FilePath(FILE_PATH_LITERAL("chrome"))); custom_command_line.AppendSwitch("test-custom-argument"); enterprise_reporting::ScopedInitialCommandLine override_cli( &custom_command_line); ASSERT_TRUE( content::NavigateToURL(web_contents(), GURL(chrome::kChromeUIPolicyURL))); EXPECT_EQ(true, content::EvalJs(web_contents(), kCheckBannerJs)); EXPECT_THAT( content::EvalJs(web_contents(), kGetCommandLineArgsJs).ExtractString(), testing::HasSubstr("test-custom-argument")); } IN_PROC_BROWSER_TEST_F(PolicyUITestBase, NoWarningWithIgnoredCommandLineArguments) { base::CommandLine custom_command_line( base::FilePath(FILE_PATH_LITERAL("chrome"))); custom_command_line.AppendSwitchASCII(switches::kProfileDirectory, "Default"); enterprise_reporting::ScopedInitialCommandLine override_cli( &custom_command_line); ASSERT_TRUE( content::NavigateToURL(web_contents(), GURL(chrome::kChromeUIPolicyURL))); EXPECT_EQ(false, content::EvalJs(web_contents(), kCheckBannerJs)); } IN_PROC_BROWSER_TEST_F(PolicyUITestBase, ShowsWarningWithCustomAndIgnoredCommandLineArguments) { base::CommandLine custom_command_line( base::FilePath(FILE_PATH_LITERAL("chrome"))); // kProfileDirectory is in the ignore list. custom_command_line.AppendSwitchASCII(switches::kProfileDirectory, "Default"); custom_command_line.AppendSwitch("test-custom-argument"); enterprise_reporting::ScopedInitialCommandLine override_cli( &custom_command_line); ASSERT_TRUE( content::NavigateToURL(web_contents(), GURL(chrome::kChromeUIPolicyURL))); EXPECT_EQ(true, content::EvalJs(web_contents(), kCheckBannerJs)); // Ignored switch must not appear. EXPECT_THAT( content::EvalJs(web_contents(), kGetCommandLineArgsJs).ExtractString(), testing::Not(testing::HasSubstr(switches::kProfileDirectory))); EXPECT_THAT( content::EvalJs(web_contents(), kGetCommandLineArgsJs).ExtractString(), testing::HasSubstr("test-custom-argument")); } #endif // !BUILDFLAG(IS_CHROMEOS) #endif // !BUILDFLAG(IS_ANDROID)