// Copyright 2020 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "components/lookalikes/core/lookalike_url_util.h"

#include "base/functional/bind.h"
#include "base/strings/utf_string_conversions.h"
#include "components/lookalikes/core/safety_tip_test_utils.h"
#include "components/lookalikes/core/safety_tips_config.h"
#include "components/url_formatter/spoof_checks/common_words/common_words_test-inc.cc"
#include "components/url_formatter/spoof_checks/common_words/common_words_util.h"
#include "components/url_formatter/spoof_checks/idn_spoof_checker.h"
#include "components/url_formatter/spoof_checks/top_domains/test_domains_trie.h"
#include "components/url_formatter/spoof_checks/top_domains/test_top_bucket_domains.h"
#include "components/version_info/channel.h"
#include "testing/gtest/include/gtest/gtest.h"

using lookalikes::ComboSquattingParams;
using lookalikes::ComboSquattingType;
using lookalikes::DomainInfo;
using lookalikes::GetDomainInfo;
using lookalikes::IsHeuristicEnabledForHostname;
using lookalikes::LookalikeUrlMatchType;
using lookalikes::TargetEmbeddingType;
using version_info::Channel;

namespace {
// Tests lists for Combo Squatting. Some of these entries are intended to test
// for various edge cases and aren't realistic for production.
constexpr std::string_view kBrandNames[][2] = {{"google", "google"},
                                               {"youtube", "youtube"},
                                               {"sample", "sarnple"},
                                               {"example", "exarnple"},
                                               {"vices", "vices"}};
constexpr std::string_view kPopularKeywords[] = {
    "online", "login", "account", "arnple", "services", "test", "security"};
const ComboSquattingParams kComboSquattingParams{kBrandNames, kPopularKeywords};

}  // namespace

std::string TargetEmbeddingTypeToString(TargetEmbeddingType type) {
  switch (type) {
    case TargetEmbeddingType::kNone:
      return "kNone";
    case TargetEmbeddingType::kInterstitial:
      return "kInterstitial";
    case TargetEmbeddingType::kSafetyTip:
      return "kSafetyTip";
  }
  NOTREACHED();
}

// These tests do not use the production top domain list. This is to avoid
// having to adjust the tests when the top domain list is updated. Instead,
// these tests use the data in `test_domains.list` and `common_words_test.gpref`
// files.
class LookalikeUrlUtilTest : public testing::Test {
 protected:
  void SetUp() override {
    // Use test top domain lists instead of the actual list.
    url_formatter::IDNSpoofChecker::HuffmanTrieParams trie_params{
        url_formatter::kTestTopDomainsHuffmanTree,
        url_formatter::kTestTopDomainsTrie,
        url_formatter::kTestTopDomainsTrieBits,
        url_formatter::kTestTopDomainsRootPosition};
    url_formatter::IDNSpoofChecker::SetTrieParamsForTesting(trie_params);

    // Use test top bucket domain skeletons instead of the actual list.
    lookalikes::TopBucketDomainsParams top_bucket_params{
        test_top_bucket_domains::kTopBucketEditDistanceSkeletons,
        test_top_bucket_domains::kNumTopBucketEditDistanceSkeletons};
    lookalikes::SetTopBucketDomainsParamsForTesting(top_bucket_params);

    url_formatter::common_words::SetCommonWordDAFSAForTesting(test::kDafsa);
  }

  void TearDown() override {
    url_formatter::common_words::ResetCommonWordDAFSAForTesting();
    lookalikes::ResetTopBucketDomainsParamsForTesting();
    url_formatter::IDNSpoofChecker::RestoreTrieParamsForTesting();
  }
};

TEST_F(LookalikeUrlUtilTest, IsEditDistanceAtMostOne) {
  const struct TestCase {
    const wchar_t* domain;
    const wchar_t* top_domain;
    bool expected;
  } kTestCases[] = {
      {L"", L"", true},
      {L"a", L"a", true},
      {L"a", L"", true},
      {L"", L"a", true},

      {L"", L"ab", false},
      {L"ab", L"", false},

      {L"ab", L"a", true},
      {L"a", L"ab", true},
      {L"ab", L"b", true},
      {L"b", L"ab", true},
      {L"ab", L"ab", true},

      {L"", L"ab", false},
      {L"ab", L"", false},
      {L"a", L"abc", false},
      {L"abc", L"a", false},

      {L"aba", L"ab", true},
      {L"ba", L"aba", true},
      {L"abc", L"ac", true},
      {L"ac", L"abc", true},

      // Same length.
      {L"xbc", L"ybc", true},
      {L"axc", L"ayc", true},
      {L"abx", L"aby", true},

      // Should also work for non-ASCII.
      {L"é", L"", true},
      {L"", L"é", true},
      {L"tést", L"test", true},
      {L"test", L"tést", true},
      {L"tés", L"test", false},
      {L"test", L"tés", false},

      // Real world test cases.
      {L"google.com", L"gooogle.com", true},
      {L"gogle.com", L"google.com", true},
      {L"googlé.com", L"google.com", true},
      {L"google.com", L"googlé.com", true},
      // Different by two characters.
      {L"google.com", L"goooglé.com", false},
  };
  for (const TestCase& test_case : kTestCases) {
    bool result = lookalikes::IsEditDistanceAtMostOne(
        base::WideToUTF16(test_case.domain),
        base::WideToUTF16(test_case.top_domain));
    EXPECT_EQ(test_case.expected, result)
        << "when comparing " << test_case.domain << " with "
        << test_case.top_domain;
  }
}

TEST_F(LookalikeUrlUtilTest, EditDistanceExcludesCommonFalsePositives) {
  const struct TestCase {
    const char* domain;
    const char* top_domain;
    bool is_likely_false_positive;
  } kTestCases[] = {
      // Most edit distance instances are not likely false positives.
      {"abcxd.com", "abcyd.com", false},   // Substitution
      {"abcxd.com", "abcxxd.com", false},  // Deletion
      {"abcxxd.com", "abcxd.com", false},  // Insertion

      // But we permit cases where the only difference is in the tld.
      {"abcde.com", "abcde.net", true},

      // We also permit matches that are only due to a numeric suffix,
      {"abcd1.com", "abcd2.com", true},    // Substitution
      {"abcde.com", "abcde1.com", true},   // Numeric deletion
      {"abcde1.com", "abcde.com", true},   // Numeric insertion
      {"abcd11.com", "abcd21.com", true},  // Not-final-digit substitution
      {"a.abcd1.com", "abcd2.com", true},  // Only relevant for eTLD+1.
      // ...and that change must be due to the numeric suffix.
      {"abcx1.com", "abcy1.com", false},   // Substitution before suffix
      {"abcd1.com", "abcde1.com", false},  // Deletion before suffix
      {"abcde1.com", "abcd1.com", false},  // Insertion before suffix
      {"abcdx.com", "abcdy.com", false},   // Non-numeric substitution at end

      // We also permit matches that are only due to a first-character change,
      {"xabcd.com", "yabcd.com", true},     // Substitution
      {"xabcde.com", "abcde.com", true},    // Insertion
      {"abcde.com", "xabcde.com", true},    // Deletion
      {"a.abcde.com", "xabcde.com", true},  // For eTLD+1
      // ...so long as that change is only on the first character, not later.
      {"abcde.com", "axbcde.com", false},   // Deletion
      {"axbcde.com", "abcde.com", false},   // Insertion
      {"axbcde.com", "aybcde.com", false},  // Substitution

      // We permit matches that only differ due to a single "-".
      {"-abcde.com", "abcde.com", true},
      {"ab-cde.com", "abcde.com", true},
      {"abcde-.com", "abcde.com", true},
      {"abcde.com", "-abcde.com", true},
      {"abcde.com", "ab-cde.com", true},
      {"abcde.com", "abcde-.com", true},
  };
  for (const TestCase& test_case : kTestCases) {
    auto navigated =
        GetDomainInfo(GURL(std::string(url::kHttpsScheme) +
                           url::kStandardSchemeSeparator + test_case.domain));
    auto matched = GetDomainInfo(GURL(std::string(url::kHttpsScheme) +
                                      url::kStandardSchemeSeparator +
                                      test_case.top_domain));
    bool result = IsLikelyEditDistanceFalsePositive(navigated, matched);
    EXPECT_EQ(test_case.is_likely_false_positive, result)
        << "when comparing " << test_case.domain << " with "
        << test_case.top_domain;
  }
}

TEST_F(LookalikeUrlUtilTest, CharacterSwapExcludesCommonFalsePositives) {
  const struct TestCase {
    const char* domain;
    const char* top_domain;
    bool is_likely_false_positive;
  } kTestCases[] = {
      {"abcde.com", "abced.com", false},
      // Only differs by registry:
      {"abcde.sr", "abcde.rs", true},
  };
  for (const TestCase& test_case : kTestCases) {
    auto navigated =
        GetDomainInfo(GURL(std::string(url::kHttpsScheme) +
                           url::kStandardSchemeSeparator + test_case.domain));
    auto matched = GetDomainInfo(GURL(std::string(url::kHttpsScheme) +
                                      url::kStandardSchemeSeparator +
                                      test_case.top_domain));
    bool result = IsLikelyCharacterSwapFalsePositive(navigated, matched);
    EXPECT_EQ(test_case.is_likely_false_positive, result)
        << "when comparing " << test_case.domain << " with "
        << test_case.top_domain;
  }
}

bool IsGoogleScholar(const std::string& hostname) {
  return hostname == "scholar.google.com";
}

struct TargetEmbeddingHeuristicTestCase {
  const std::string hostname;
  // Empty when there is no match.
  const std::string expected_safe_host;
  const TargetEmbeddingType expected_type;
};

TEST_F(LookalikeUrlUtilTest, ShouldBlockBySpoofCheckResult) {
  EXPECT_FALSE(ShouldBlockBySpoofCheckResult(
      GetDomainInfo(GURL("https://example.com"))));
  // ASCII short eTLD+1:
  EXPECT_FALSE(
      ShouldBlockBySpoofCheckResult(GetDomainInfo(GURL("https://e.com"))));
  EXPECT_FALSE(ShouldBlockBySpoofCheckResult(
      GetDomainInfo(GURL("https://subdomain.e.com"))));
  // Unicode single character e2LD:
  EXPECT_FALSE(
      ShouldBlockBySpoofCheckResult(GetDomainInfo(GURL("https://τ.com"))));
  EXPECT_FALSE(
      ShouldBlockBySpoofCheckResult(GetDomainInfo(GURL("https://test.τ.com"))));
  // Unicode single character e2LD with a unicode registry.
  EXPECT_FALSE(
      ShouldBlockBySpoofCheckResult(GetDomainInfo(GURL("https://τ.рф"))));
  EXPECT_FALSE(
      ShouldBlockBySpoofCheckResult(GetDomainInfo(GURL("https://test.τ.рф"))));
  // Non-unique hostname:
  EXPECT_FALSE(ShouldBlockBySpoofCheckResult(GetDomainInfo(GURL("https://τ"))));

  // Multi character e2LD with disallowed characters:
  EXPECT_TRUE(
      ShouldBlockBySpoofCheckResult(GetDomainInfo(GURL("https://ττ.com"))));
  EXPECT_TRUE(ShouldBlockBySpoofCheckResult(
      GetDomainInfo(GURL("https://test.ττ.com"))));
  EXPECT_TRUE(
      ShouldBlockBySpoofCheckResult(GetDomainInfo(GURL("https://ττ.рф"))));
  EXPECT_TRUE(
      ShouldBlockBySpoofCheckResult(GetDomainInfo(GURL("https://test.ττ.рф"))));
}

TEST_F(LookalikeUrlUtilTest, TargetEmbeddingTest) {
  const std::vector<DomainInfo> kEngagedSites = {
      GetDomainInfo(GURL("https://highengagement.com")),
      GetDomainInfo(GURL("https://highengagement.inthesubdomain.com")),
      GetDomainInfo(GURL("https://highengagement.co.uk")),
      GetDomainInfo(GURL("https://subdomain.highengagement.com")),
      GetDomainInfo(GURL("https://www.highengagementwithwww.com")),
      GetDomainInfo(GURL("https://subdomain.google.com")),
  };
  const std::vector<TargetEmbeddingHeuristicTestCase> kTestCases = {
      // The length of the url should not affect the outcome.
      {"this-is-a-very-long-url-but-it-should-not-affect-the-"
       "outcome-of-this-target-embedding-test-google.com-login.com",
       "google.com", TargetEmbeddingType::kInterstitial},
      {"google-com-this-is-a-very-long-url-but-it-should-not-affect-"
       "the-outcome-of-this-target-embedding-test-login.com",
       "google.com", TargetEmbeddingType::kInterstitial},
      {"this-is-a-very-long-url-but-it-should-not-affect-google-the-"
       "outcome-of-this-target-embedding-test.com-login.com",
       "", TargetEmbeddingType::kNone},
      {"google-this-is-a-very-long-url-but-it-should-not-affect-the-"
       "outcome-of-this-target-embedding-test.com-login.com",
       "", TargetEmbeddingType::kNone},

      // We need exact skeleton match for our domain so exclude edit-distance
      // matches.
      {"goog0le.com-login.com", "", TargetEmbeddingType::kNone},

      // Unicode characters should be handled
      {"googlé.com-login.com", "google.com",
       TargetEmbeddingType::kInterstitial},
      {"foo-googlé.com-bar.com", "google.com",
       TargetEmbeddingType::kInterstitial},

      // The basic states
      {"google.com.foo.com", "google.com", TargetEmbeddingType::kInterstitial},
      // - before the domain name should be ignored.
      {"foo-google.com-bar.com", "google.com",
       TargetEmbeddingType::kInterstitial},
      // The embedded target's TLD doesn't necessarily need to be followed by a
      // '-' and could be a subdomain by itself.
      {"foo-google.com.foo.com", "google.com",
       TargetEmbeddingType::kInterstitial},
      {"a.b.c.d.e.f.g.h.foo-google.com.foo.com", "google.com",
       TargetEmbeddingType::kInterstitial},
      {"a.b.c.d.e.f.g.h.google.com-foo.com", "google.com",
       TargetEmbeddingType::kInterstitial},
      {"1.2.3.4.5.6.google.com-foo.com", "google.com",
       TargetEmbeddingType::kInterstitial},
      // Target domain could be in the middle of subdomains.
      {"foo.google.com.foo.com", "google.com",
       TargetEmbeddingType::kInterstitial},
      // The target domain and its tld should be next to each other.
      {"foo-google.l.com-foo.com", "", TargetEmbeddingType::kNone},
      // Target domain might be separated with a dash instead of dot.
      {"foo.google-com-foo.com", "google.com",
       TargetEmbeddingType::kInterstitial},

      // Allowlisted domains should not trigger heuristic.
      {"scholar.google.com.foo.com", "", TargetEmbeddingType::kNone},
      {"scholar.google.com-google.com.foo.com", "google.com",
       TargetEmbeddingType::kInterstitial},
      {"google.com-scholar.google.com.foo.com", "google.com",
       TargetEmbeddingType::kInterstitial},
      {"foo.scholar.google.com.foo.com", "", TargetEmbeddingType::kNone},
      {"scholar.foo.google.com.foo.com", "google.com",
       TargetEmbeddingType::kInterstitial},

      // e2LDs should be longer than 3 characters.
      {"hp.com-foo.com", "", TargetEmbeddingType::kNone},

      // Targets with common words as e2LD are not considered embedded targets
      // either for all TLDs or another-TLD matching.
      {"foo.jobs.com-foo.com", "", TargetEmbeddingType::kNone},
      {"foo.office.com-foo.com", "office.com",
       TargetEmbeddingType::kInterstitial},
      {"foo.jobs.org-foo.com", "", TargetEmbeddingType::kNone},
      {"foo.office.org-foo.com", "", TargetEmbeddingType::kNone},
      // Common words (like 'jobs' are included in the big common word list.
      // Ensure that the supplemental kCommonWords list is also checked.
      {"foo.hoteles.com-foo.com", "", TargetEmbeddingType::kNone},

      // Targets could be embedded without their dots and dashes.
      {"googlecom-foo.com", "google.com", TargetEmbeddingType::kInterstitial},
      {"foo.googlecom-foo.com", "google.com",
       TargetEmbeddingType::kInterstitial},
      // But should not be detected if they're using a common word. weather.com
      // is on the top domain list, but 'weather' is a common word.
      {"weathercom-foo.com", "", TargetEmbeddingType::kNone},
      // And should also not be detected if they're too short. vk.com is on the
      // top domain list, but is shorter than kMinE2LDLengthForTargetEmbedding.
      {"vkcom-foo.com", "", TargetEmbeddingType::kNone},

      // Ensure legitimate domains don't trigger.
      {"foo.google.com", "", TargetEmbeddingType::kNone},
      {"foo.bar.google.com", "", TargetEmbeddingType::kNone},
      {"google.com", "", TargetEmbeddingType::kNone},
      {"google.co.uk", "", TargetEmbeddingType::kNone},
      {"google.randomreg-login.com", "", TargetEmbeddingType::kNone},
      {"com.foo.com", "", TargetEmbeddingType::kNone},

      // Multipart eTLDs should work.
      {"foo.google.co.uk.foo.com", "google.co.uk",
       TargetEmbeddingType::kInterstitial},
      {"foo.highengagement-co-uk.foo.com", "highengagement.co.uk",
       TargetEmbeddingType::kInterstitial},

      // Cross-TLD matches should not trigger, even when they're embedding
      // another domain, even when using a de-facto public eTLD.
      {"google.com.mx", "", TargetEmbeddingType::kNone},  // public
      {"google.com.de", "", TargetEmbeddingType::kNone},  // de-facto public

      // Engaged sites should trigger as specifically as possible, and should
      // trigger preferentially to top sites when possible.
      {"foo.highengagement.com.foo.com", "highengagement.com",
       TargetEmbeddingType::kInterstitial},
      {"foo.subdomain.highengagement.com.foo.com",
       "subdomain.highengagement.com", TargetEmbeddingType::kInterstitial},
      {"foo.subdomain.google.com.foo.com", "subdomain.google.com",
       TargetEmbeddingType::kInterstitial},

      // Skeleton matching should work against engaged sites at a eTLD+1 level,
      {"highengagement.inthesubdomain.com-foo.com",
       "highengagement.inthesubdomain.com", TargetEmbeddingType::kInterstitial},
      // but only if the bare eTLD+1, or www.[eTLD+1] has been engaged.
      {"subdomain.highéngagement.com-foo.com", "highengagement.com",
       TargetEmbeddingType::kInterstitial},
      {"subdomain.highéngagementwithwww.com-foo.com",
       "highengagementwithwww.com", TargetEmbeddingType::kInterstitial},
      {"other.inthésubdomain.com-foo.com", "", TargetEmbeddingType::kNone},
      // Ideally, we'd be able to combine subdomains and skeleton matching, but
      // our current algorithm can't detect that precisely.
      {"highengagement.inthésubdomain.com-foo.com", "",
       TargetEmbeddingType::kNone},

      // Domains should be allowed to embed themselves.
      {"highengagement.com.highengagement.com", "", TargetEmbeddingType::kNone},
      {"subdomain.highengagement.com.highengagement.com", "",
       TargetEmbeddingType::kNone},
      {"nothighengagement.highengagement.com.highengagement.com", "",
       TargetEmbeddingType::kNone},
      {"google.com.google.com", "", TargetEmbeddingType::kNone},
      {"www.google.com.google.com", "", TargetEmbeddingType::kNone},

      // Detect embeddings at the end of the domain, too, but as a Safety Tip.
      {"www-google.com", "google.com", TargetEmbeddingType::kSafetyTip},
      {"www-highengagement.com", "highengagement.com",
       TargetEmbeddingType::kSafetyTip},
      {"subdomain-highengagement.com", "subdomain.highengagement.com",
       TargetEmbeddingType::kSafetyTip},
      // If the match duplicates the TLD, it's not quite tail-embedding.
      {"google-com.com", "google.com", TargetEmbeddingType::kInterstitial},
      // If there are multiple options, it should choose the more severe one.
      {"google-com.google-com.com", "google.com",
       TargetEmbeddingType::kInterstitial},
      {"subdomain.google-com.google-com.com", "google.com",
       TargetEmbeddingType::kInterstitial},
      {"google.com-google.com-google.com", "google.com",
       TargetEmbeddingType::kInterstitial},

      // Ignore end-of-domain embeddings when they're also cross-TLD matches.
      {"google.com.mx", "", TargetEmbeddingType::kNone},

      // For a small set of high-value domains that are also common words (see
      // kDomainsPermittedInEndEmbeddings), we block all embeddings except those
      // at the very end of the domain (e.g. foo-{domain.com}). Ensure this
      // works for domains on the list, but not for others.
      {"office.com-foo.com", "office.com", TargetEmbeddingType::kInterstitial},
      {"example-office.com", "", TargetEmbeddingType::kNone},
      {"example-google.com", "google.com", TargetEmbeddingType::kSafetyTip},
  };

  lookalikes::InitializeBlankLookalikeAllowlistForTesting();
  auto* config_proto = lookalikes::GetSafetyTipsRemoteConfigProto();

  for (auto& test_case : kTestCases) {
    std::string safe_hostname;
    TargetEmbeddingType embedding_type = GetTargetEmbeddingType(
        test_case.hostname, kEngagedSites,
        base::BindRepeating(&IsGoogleScholar), config_proto, &safe_hostname);
    if (test_case.expected_type != TargetEmbeddingType::kNone) {
      EXPECT_EQ(safe_hostname, test_case.expected_safe_host)
          << test_case.hostname << " should trigger on "
          << test_case.expected_safe_host << ", but "
          << (safe_hostname.empty() ? "it didn't trigger at all."
                                    : "triggered on " + safe_hostname);
      EXPECT_EQ(embedding_type, test_case.expected_type)
          << test_case.hostname << " should trigger "
          << TargetEmbeddingTypeToString(test_case.expected_type) << " against "
          << test_case.expected_safe_host << " but it returned "
          << TargetEmbeddingTypeToString(embedding_type);
    } else {
      EXPECT_EQ(embedding_type, TargetEmbeddingType::kNone)
          << test_case.hostname << " unexpectedly triggered "
          << TargetEmbeddingTypeToString(embedding_type) << " against "
          << safe_hostname;
    }
  }
}

TEST_F(LookalikeUrlUtilTest, TargetEmbeddingIgnoresComponentWordlist) {
  const std::vector<DomainInfo> kEngagedSites = {
      GetDomainInfo(GURL("https://commonword.com")),
      GetDomainInfo(GURL("https://uncommonword.com")),
  };

  lookalikes::SetSafetyTipAllowlistPatterns({}, {}, {"commonword"});
  auto* config_proto = lookalikes::GetSafetyTipsRemoteConfigProto();
  TargetEmbeddingType embedding_type;
  std::string safe_hostname;

  // Engaged sites using uncommon words are still blocked.
  embedding_type = GetTargetEmbeddingType(
      "uncommonword.com.evil.com", kEngagedSites,
      base::BindRepeating(&IsGoogleScholar), config_proto, &safe_hostname);
  EXPECT_EQ(embedding_type, TargetEmbeddingType::kInterstitial);

  // But engaged sites using common words are not blocked.
  embedding_type = GetTargetEmbeddingType(
      "commonword.com.evil.com", kEngagedSites,
      base::BindRepeating(&IsGoogleScholar), config_proto, &safe_hostname);
  EXPECT_EQ(embedding_type, TargetEmbeddingType::kNone);
}

TEST_F(LookalikeUrlUtilTest, GetETLDPlusOneHandlesSpecialRegistries) {
  const struct GetETLDPlusOneTestCase {
    const std::string hostname;
    const std::string expected_etldp1;
  } kTestCases[] = {
      // Trivial test cases for public registries.
      {"google.com", "google.com"},
      {"www.google.com", "google.com"},
      {"www.google.co.uk", "google.co.uk"},

      // .com.de is a de-facto public registry.
      {"www.google.com.de", "google.com.de"},
      // Regression test for crbug.com/351775838:
      {"com.de", ""},

      // .cloud.goog is a private registry.
      {"www.example.cloud.goog", "cloud.goog"},
      {"cloud.goog", "cloud.goog"},
  };

  for (auto& test_case : kTestCases) {
    EXPECT_EQ(lookalikes::GetETLDPlusOne(test_case.hostname),
              test_case.expected_etldp1);
  }
}

// Tests for the character swap heuristic.
TEST_F(LookalikeUrlUtilTest, HasOneCharacterSwap) {
  const struct TestCase {
    const wchar_t* str1;
    const wchar_t* str2;
    bool expected;
  } kTestCases[] = {{L"", L"", false},
                    {L"", L"a", false},
                    {L"", L"ab", false},
                    {L"a", L"ab", false},
                    {L"a", L"ba", false},
                    {L"abc.com", L"abc.com", false},
                    {L"abc.com", L"abcd.com", false},
                    {L"domain.com", L"nomaid.com", false},
                    // Two swaps (ab to ba, ba to ab):
                    {L"abba", L"baab", false},

                    {L"ab", L"ba", true},
                    {L"abba", L"baba", true},

                    {L"abaaa", L"baaaa", true},
                    {L"abcaa", L"bacaa", true},

                    {L"aaaab", L"aaaba", true},
                    {L"aacab", L"aacba", true},

                    {L"aabaa", L"abaaa", true},
                    {L"aabcc", L"abacc", true},

                    {L"aabaa", L"aaaba", true},
                    {L"ccbaa", L"ccaba", true},

                    {L"domain.com", L"doamin.com", true},
                    {L"gmail.com", L"gmailc.om", true},
                    {L"gmailc.om", L"gmail.com", true}};
  for (const TestCase& test_case : kTestCases) {
    bool result = lookalikes::HasOneCharacterSwap(
        base::WideToUTF16(test_case.str1), base::WideToUTF16(test_case.str2));
    EXPECT_EQ(test_case.expected, result)
        << "when comparing " << test_case.str1 << " with " << test_case.str2;
  }
}

TEST_F(LookalikeUrlUtilTest, GetSuggestedURL) {
  const struct TestCase {
    const LookalikeUrlMatchType match_type;
    const GURL navigated_url;
    const std::string matched_hostname;
    const GURL expected_suggested_url;
  } kTestCases[] = {
      // Certain heuristics such as top domain matches should use https for
      // the suggested URL.
      {LookalikeUrlMatchType::kSkeletonMatchTop500,
       GURL("http://docs.googlé.com"), "google.com",
       GURL("https://google.com")},
      // But not for non-default ports:
      {LookalikeUrlMatchType::kSkeletonMatchTop500,
       GURL("http://docs.googlé.com:8080"), "google.com",
       GURL("http://google.com:8080")},
      // Site engagement should use http for the suggested URL.
      {LookalikeUrlMatchType::kSkeletonMatchSiteEngagement,
       GURL("http://docs.googlé.com"), "google.com", GURL("http://google.com")},

      // Same tests with the matched hostname having a subdomain.
      {LookalikeUrlMatchType::kSkeletonMatchTop500,
       GURL("http://docs.googlé.com"), "docs.google.com",
       GURL("https://google.com")},
      {LookalikeUrlMatchType::kSkeletonMatchTop500,
       GURL("http://docs.googlé.com:8080"), "docs.google.com",
       GURL("http://google.com:8080")},
      {LookalikeUrlMatchType::kSkeletonMatchSiteEngagement,
       GURL("http://docs.googlé.com"), "docs.google.com",
       GURL("http://google.com")},

      // Same tests with neither the matched hostname or navigated domain having
      // a subdomain.
      {LookalikeUrlMatchType::kSkeletonMatchTop500, GURL("http://googlé.com"),
       "docs.google.com", GURL("https://google.com")},
      {LookalikeUrlMatchType::kSkeletonMatchTop500,
       GURL("http://googlé.com:8080"), "docs.google.com",
       GURL("http://google.com:8080")},
      {LookalikeUrlMatchType::kSkeletonMatchSiteEngagement,
       GURL("http://googlé.com"), "docs.google.com", GURL("http://google.com")},
  };

  for (const TestCase& test_case : kTestCases) {
    GURL suggested_url =
        GetSuggestedURL(test_case.match_type, test_case.navigated_url,
                        test_case.matched_hostname);
    EXPECT_EQ(test_case.expected_suggested_url, suggested_url);
  }
}

TEST_F(LookalikeUrlUtilTest, IsHeuristicEnabledForHostname) {
  reputation::SafetyTipsConfig proto;
  reputation::HeuristicLaunchConfig* config = proto.add_launch_config();
  config->set_heuristic(reputation::HeuristicLaunchConfig::
                            HEURISTIC_CHARACTER_SWAP_ENGAGED_SITES);

  // Minimum rollout percentages to enable a heuristic on each site on Stable
  // channel:
  // example1.com: 79%
  // example2.com: 16%
  // example3.com: 36%

  // Slowly ramp up the launch and cover more sites on Stable channel.
  config->set_launch_percentage(0);
  EXPECT_FALSE(IsHeuristicEnabledForHostname(
      &proto,
      reputation::HeuristicLaunchConfig::HEURISTIC_CHARACTER_SWAP_ENGAGED_SITES,
      "example1.com", Channel::STABLE));
  EXPECT_FALSE(IsHeuristicEnabledForHostname(
      &proto,
      reputation::HeuristicLaunchConfig::HEURISTIC_CHARACTER_SWAP_ENGAGED_SITES,
      "example2.com", Channel::STABLE));
  EXPECT_FALSE(IsHeuristicEnabledForHostname(
      &proto,
      reputation::HeuristicLaunchConfig::HEURISTIC_CHARACTER_SWAP_ENGAGED_SITES,
      "example3.com", Channel::STABLE));

  config->set_launch_percentage(25);
  EXPECT_FALSE(IsHeuristicEnabledForHostname(
      &proto,
      reputation::HeuristicLaunchConfig::HEURISTIC_CHARACTER_SWAP_ENGAGED_SITES,
      "example1.com", Channel::STABLE));
  EXPECT_TRUE(IsHeuristicEnabledForHostname(
      &proto,
      reputation::HeuristicLaunchConfig::HEURISTIC_CHARACTER_SWAP_ENGAGED_SITES,
      "example2.com", Channel::STABLE));
  EXPECT_FALSE(IsHeuristicEnabledForHostname(
      &proto,
      reputation::HeuristicLaunchConfig::HEURISTIC_CHARACTER_SWAP_ENGAGED_SITES,
      "example3.com", Channel::STABLE));

  config->set_launch_percentage(50);
  EXPECT_FALSE(IsHeuristicEnabledForHostname(
      &proto,
      reputation::HeuristicLaunchConfig::HEURISTIC_CHARACTER_SWAP_ENGAGED_SITES,
      "example1.com", Channel::STABLE));
  EXPECT_TRUE(IsHeuristicEnabledForHostname(
      &proto,
      reputation::HeuristicLaunchConfig::HEURISTIC_CHARACTER_SWAP_ENGAGED_SITES,
      "example2.com", Channel::STABLE));
  EXPECT_TRUE(IsHeuristicEnabledForHostname(
      &proto,
      reputation::HeuristicLaunchConfig::HEURISTIC_CHARACTER_SWAP_ENGAGED_SITES,
      "example3.com", Channel::STABLE));

  config->set_launch_percentage(100);
  EXPECT_TRUE(IsHeuristicEnabledForHostname(
      &proto,
      reputation::HeuristicLaunchConfig::HEURISTIC_CHARACTER_SWAP_ENGAGED_SITES,
      "example1.com", Channel::STABLE));
  EXPECT_TRUE(IsHeuristicEnabledForHostname(
      &proto,
      reputation::HeuristicLaunchConfig::HEURISTIC_CHARACTER_SWAP_ENGAGED_SITES,
      "example2.com", Channel::STABLE));
  EXPECT_TRUE(IsHeuristicEnabledForHostname(
      &proto,
      reputation::HeuristicLaunchConfig::HEURISTIC_CHARACTER_SWAP_ENGAGED_SITES,
      "example3.com", Channel::STABLE));

  // On Beta, launch is always at 50%.
  config->set_launch_percentage(0);
  EXPECT_FALSE(IsHeuristicEnabledForHostname(
      &proto,
      reputation::HeuristicLaunchConfig::HEURISTIC_CHARACTER_SWAP_ENGAGED_SITES,
      "example1.com", Channel::BETA));
  EXPECT_TRUE(IsHeuristicEnabledForHostname(
      &proto,
      reputation::HeuristicLaunchConfig::HEURISTIC_CHARACTER_SWAP_ENGAGED_SITES,
      "example2.com", Channel::BETA));
  EXPECT_TRUE(IsHeuristicEnabledForHostname(
      &proto,
      reputation::HeuristicLaunchConfig::HEURISTIC_CHARACTER_SWAP_ENGAGED_SITES,
      "example3.com", Channel::BETA));
}

class ComboSquattingTest : public testing::Test {
 protected:
  void SetUp() override {
    lookalikes::SetComboSquattingParamsForTesting(kComboSquattingParams);
  }
  void TearDown() override {
    lookalikes::ResetComboSquattingParamsForTesting();
  }
};

// Test for Combo Squatting check of domains.
TEST_F(ComboSquattingTest, IsComboSquatting) {
  const std::vector<DomainInfo> kEngagedSites = {
      // An engaged site which is not in the hard coded brand names.
      GetDomainInfo(GURL("https://engagedsite.com")),
      // An engaged site which is duplicate with a hard coded brand name.
      GetDomainInfo(GURL("https://subdomain.google.com")),
      // An engaged site with length less than threshold (4) for
      // consideration.
      GetDomainInfo(GURL("https://len.com")),
      // An engaged site with a registry other than com.
      GetDomainInfo(GURL("https://testcombo.org")),
      // Test case for overlapping brand name and keyword (highs +
      // security = highsecurity). Single letter overlap.
      GetDomainInfo(GURL("https://highs.com")),
  };
  const struct TestCase {
    const char* domain;
    const char* expected_suggested_domain;
    const ComboSquattingType expected_type;
  } kTestCases[] = {
      // Not Combo Squatting (CSQ).
      {"google.com", "", ComboSquattingType::kNone},
      {"youtube.ca", "", ComboSquattingType::kNone},

      // Not CSQ, contains subdomains.
      {"login.google.com", "", ComboSquattingType::kNone},

      // Not CSQ, non registrable domains.
      {"google-login.test", "", ComboSquattingType::kNone},

      // CSQ with "-".
      {"google-online.com", "google.com", ComboSquattingType::kHardCoded},

      // CSQ with more than one keyword (login, online) with "-".
      {"google-login-online.com", "google.com", ComboSquattingType::kHardCoded},

      // CSQ with one keyword (online) and one random word (one) with "-".
      {"one-sample-online.com", "sample.com", ComboSquattingType::kHardCoded},

      // Not CSQ, with a keyword (test) as TLD.
      {"www.example.test", "", ComboSquattingType::kNone},

      // CSQ with more than one brand (google, youtube) with "-".
      {"google-youtube-account.com", "google.com",
       ComboSquattingType::kHardCoded},

      // CSQ without separator.
      {"loginsample.com", "sample.com", ComboSquattingType::kHardCoded},

      // Not CSQ with a keyword (ample) inside brand name (sample).
      {"sample.com", "", ComboSquattingType::kNone},

      // Current version of the heuristic cannot flag this kind of CSQ
      // with a keyword (ample) inside brand name (sample) and as an added
      // keyword to the domain.
      {"sample-ample.com", "", ComboSquattingType::kNone},

      // CSQ with more than one keyword (account, online) without separator.
      {"accountexampleonline.com", "example.com",
       ComboSquattingType::kHardCoded},

      // CSQ with one keyword (login) and one random word (one) without "-".
      {"oneyoutubelogin.com", "youtube.com", ComboSquattingType::kHardCoded},

      // Not CSQ, google is a public TLD.
      {"online.google", "", ComboSquattingType::kNone},

      // Not CSQ, brand name (vice) is part of keyword (service).
      {"keyservices.com", "", ComboSquattingType::kNone},

      // CSQ, brand name (engagedsite) is from engaged sites list.
      {"engagedsite-login.com", "engagedsite.com",
       ComboSquattingType::kSiteEngagement},

      // Not CSQ, brand name (len) is from engaged sites list but it is short.
      {"len-online.com", "", ComboSquattingType::kNone},

      // CSQ, brand name (googlé) is one of the hard coded brand names and has
      // IDN spoofing as well.
      {"googlé-login.com", "google.com", ComboSquattingType::kHardCoded},

      // CSQ, brand name (engagedsité) is one of the brand names from engaged
      // sites and has IDN spoofing as well.
      {"engagedsité-online.com", "engagedsite.com",
       ComboSquattingType::kSiteEngagement},

      // CSQ, keyword (lógin) has IDN spoofing.
      {"google-lógin.com", "google.com", ComboSquattingType::kHardCoded},

      // CSQ, CSQ with more than one brand (googlé, youtubé) with "-" and IDN
      // spoofing.
      {"googlé-youtubé-account.com", "google.com",
       ComboSquattingType::kHardCoded},

      // Not CSQ.
      {"ónline.googlé", "", ComboSquattingType::kNone},

      // Not CSQ, it has IDN spoofing but brand name (vicé) is part of keyword
      // (servicé).
      {"keyservicés.com", "", ComboSquattingType::kNone},

      // CSQ without separator and with IDN spoofing in the keyword.
      {"lóginsample.com", "sample.com", ComboSquattingType::kHardCoded},

      // CSQ without separator and with IDN spoofing in the brand name.
      {"loginsamplé.com", "sample.com", ComboSquattingType::kHardCoded},

      // Not CSQ, skeleton of brand name (lén) is from engaged sites list but it
      // is short.
      {"lén-online.com", "", ComboSquattingType::kNone},

      // CSQ when domain and registry are in top domains.
      {"google-login.co.kr", "google.co.kr", ComboSquattingType::kHardCoded},

      // CSQ when brand name is in hard coded brand names, but domain and
      // registry are not in top domains.
      {"google-login.co.ir", "google.com", ComboSquattingType::kHardCoded},

      // CSQ when domain and registry are in engaged sites, with registry other
      // than com.
      {"testcomboonline.org", "testcombo.org",
       ComboSquattingType::kSiteEngagement},

      // If the brand name (highsec) and keyword (security) overlap, ignore.
      {"highsecurity.com", "", ComboSquattingType::kNone},
  };
  for (const TestCase& test_case : kTestCases) {
    auto navigated =
        GetDomainInfo(GURL(std::string(url::kHttpsScheme) +
                           url::kStandardSchemeSeparator + test_case.domain));
    std::string matched_domain;
    ComboSquattingType type =
        GetComboSquattingType(navigated, kEngagedSites, &matched_domain);
    EXPECT_EQ(std::string(test_case.expected_suggested_domain), matched_domain);
    EXPECT_EQ(test_case.expected_type, type);
  }
}