# Copyright (c) 2012 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

import json
import logging

from autotest_lib.client.common_lib import error
from autotest_lib.client.cros import cros_ui_test

"""A test verifying that Chrome Bluetooth Settings UI isn't vulnerable to XSS

Uses PyAuto to execute JavaScript on the clients, using API calls to create
fake devices with malicious input and simulating user interaction to test
display implementation for vulnerabilities.
"""

class security_BluetoothUIXSS(cros_ui_test.UITest):
    version = 1

    # List of malicious strings to try as inputs to the UI.
    # Note that these strings must be escaped to be contained in JavaScript
    # double quote strings.
    _MALICIOUS_STRINGS = [
            '<SCRIPT>alert(1)</SCRIPT>',
            '>\'>\\"><SCRIPT>alert(1)</SCRIPT>',
            '<IMG SRC=\\"javascript:alert(1)\\">',
            ('<A HREF=\\"data:text/html;base64,'
                    'PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pgo=\\">...</A>'),
            '<div>',
            '<textarea>',
            '<style>',
            ('[0xC0][0xBC]SCRIPT[0xC0][0xBE]alert(1)[0xC0][0xBC]/SCRIPT[0xC0]'
                    '[0xBE]'),
            '+ADw-SCRIPT+AD4-alert(1)+ADw-/SCRIPT+AD4-',
            '&#<script>alert(1)</script>;',
            '<!-- Hello -- world > <SCRIPT>alert(1)</SCRIPT> -->',
            '<!<!-- Hello world > <SCRIPT>alert(1)</SCRIPT> -->',
            '\x3CSCRIPT\x3Ealert(1)\x3C/SCRIPT\x3E',
            '<IMG SRC=\\"j[0x00]avascript:alert(1)\\">',
            '<BASE HREF=\\"javascript:1;/**/\\"><IMG SRC=\\"alert(1)\\">',
            'javascript:alert(1);',
            ' xss_injection=\\"\\" ',
            '\\" xss_injection=\\"',
            '\' xss_injection=\'',
            '<!--',
            '\'',
            '\\"'
    ]

    # JavaScript helper function to determine the number of tag and text nodes
    # on a page.  Also looks for an injected attribute named "xss_injection".
    _NUMBER_OF_NODES_FUNC = """
            function numberOfNodesIn(currentNode) {
              if(currentNode.getAttribute && currentNode.getAttribute(
                  "xss_injection")) {
                var results = {
                    "effects_found":true,
                    "reason":"XSS attribute injection was successful"};
                window.domAutomationController.send(JSON.stringify(results));
                throw "XSS injection success";
              }
              var currentCount = currentNode.childNodes.length,
                  total = currentCount;
              for (var i = 0; i < currentCount; i++) total += numberOfNodesIn(
                  currentNode.childNodes[i]);
              return total;}
            """

    # JavaScript helper function to record the number of DOM nodes on a page
    # before and after calling a function to alter the DOM and compare the
    # difference result to an expected difference.
    _TEST_FOR_EFFECTS_FUNC = """
            function testForEffects(changeFunction, additionExpected) {
              var numberOfNodesBeforeAdding = numberOfNodesIn(document);
              changeFunction();
              var numberOfNodesAfterAdding = numberOfNodesIn(document);
              var reason = (numberOfNodesAfterAdding -
                  numberOfNodesBeforeAdding) + " new nodes found, " +
                  additionExpected + " expected.";
              var results = {
                  "effects_found":!(numberOfNodesAfterAdding ==
                  numberOfNodesBeforeAdding + additionExpected),
                  "count": (numberOfNodesAfterAdding-numberOfNodesBeforeAdding),
                  "reason":reason};
              return results;
            }
            """

    # The test needs to evaluate the impact to the DOM, of adding
    # certain malformed strings to the Bluetooth interface. To avoid
    # having a brittle connection to the current particular UI,
    # we avoid hardcoding these values. Instead, we can determine them
    # at runtime by sending a "nice" value through the test first,
    # and measuring the impact of that.
    _EXPECTED_DOM_IMPACT = None

    def init_expectations(self):
        self._EXPECTED_DOM_IMPACT = {}
        # A fake, but non-malicious, device name/address to use:
        fake = 'fake'
        # For add_bluetooth_device_to_list we need to baseline 2 cases,
        # 'unpaired' and 'paired'. It takes 2 calls to do this.
        self._EXPECTED_DOM_IMPACT['add'] = {'paired': 0, 'unpaired': 0}
        self.add_bluetooth_device_to_list(fake, fake, False, False, False, True)
        self.add_bluetooth_device_to_list(fake, fake, True, False, False, True)

        # For connect_bluetooth_device we need to baseline 2 cases,
        # 'clean' and 'unclean'. We can do this in 1 call.
        self._EXPECTED_DOM_IMPACT['connect'] = {'clean': 0, 'unclean': 0}
        self.connect_bluetooth_device(fake, fake, True, True, True, True)

    def add_bluetooth_device_to_list(self, name, address, paired, bonded,
            connected, self_calibrating=False):
        """Adds a fake Bluetooth device and checks for side effects.

        Uses JavaScript API calls to create a malicious fake Bluetooth device
        and counts the number of text/tag nodes on the web page to make sure
        that XSS wasn't successful.

        Args:
            name: String name of the fake device.
            address: String address of the fake device.
            paired: Boolean for whether or not device is already paired.
            bonded: Boolean for whether or not device is already bonded.
            connected: Boolean for whether or not device is already connected.
            self_calibrating: Boolean for whether the test is being run in a
                              self calibrating mode.

        Returns:
            A boolean representing whether or not XSS was successful.
        """
        if paired:
            expectations_key = 'paired'
        else:
            expectations_key = 'unpaired'
        expected_nodes = self._EXPECTED_DOM_IMPACT['add'][expectations_key]

        output = json.loads(self.pyauto.ExecuteJavascript("""
                %s
                %s
                function testAddToBluetoothList(name, address, paired, bonded,
                    connected, additionExpected) {
                  var addBluetoothDevice = function() {
                    options.BrowserOptions.addBluetoothDevice(
                        {"name":name, "address":address, "paired":paired,
                        "bonded":bonded, "connected":connected});
                  };
                  var results = testForEffects(addBluetoothDevice,
                      additionExpected);
                  options.BrowserOptions.removeBluetoothDevice(address);
                  window.domAutomationController.send(JSON.stringify(results));
                }
                testAddToBluetoothList("%s", "%s", %s, %s, %s, %d);
                """ % (self._NUMBER_OF_NODES_FUNC, self._TEST_FOR_EFFECTS_FUNC,
                name, address, str(paired).lower(), str(bonded).lower(),
                str(connected).lower(), expected_nodes)))

        if self_calibrating:
            logging.debug('Setting expectations for %s to %s' %
                          (expectations_key, output['count']))
            self._EXPECTED_DOM_IMPACT['add'][expectations_key] = output['count']

        side_effects_found = output['effects_found']

        if not side_effects_found:
            log_msg = '[PASS]'
        else:
            log_msg = '[FAIL]'
            self.pyauto.NavigateToURL('chrome://settings-frame/')

        logging.debug('%s Added device with name "%s", address "%s", paired:%s,'
                ' bonded:%s, connected:%s; %s' % (log_msg,
                name, address, paired, bonded, connected, output['reason']))

        return side_effects_found

    def add_bluetooth_devices_to_list(self, name, address):
        """Adds a fake Bluetooth device in all possible configurations.

        Calls add_bluetooth_device_to_list for each possible combination of
        paired, bonded, and connected flags for full coverage of a given name/
        address pair.

        Args:
            name: String name of the desired fake Bluetooth device.
            address: String address of the desired fake Bluetooth device.

        Returns:
            A boolean representing whether or not XSS was successful.
        """
        side_effects_found = self.add_bluetooth_device_to_list(name, address,
                False, False, False)
        side_effects_found = self.add_bluetooth_device_to_list(name, address,
                False, False, True) or side_effects_found
        side_effects_found = self.add_bluetooth_device_to_list(name, address,
                False, True, False) or side_effects_found
        side_effects_found = self.add_bluetooth_device_to_list(name, address,
                False, True, True) or side_effects_found
        side_effects_found = self.add_bluetooth_device_to_list(name, address,
                True, False, False) or side_effects_found
        side_effects_found = self.add_bluetooth_device_to_list(name, address,
                True, False, True) or side_effects_found
        side_effects_found = self.add_bluetooth_device_to_list(name, address,
                True, True, False) or side_effects_found
        side_effects_found = self.add_bluetooth_device_to_list(name, address,
                True, True, True) or side_effects_found
        return side_effects_found

    def test_adding(self):
        """Tests adding malicious Bluetooth devices.

        Calls add_bluetooth_devices_to_list() for all malicious strings.

        Returns:
            A boolean representing whether or not XSS is possible when
            adding a Bluetooth device.
        """
        self.pyauto.NavigateToURL('chrome://settings-frame/')

        side_effects_found = False
        for entry in self._MALICIOUS_STRINGS:
            side_effects_found = self.add_bluetooth_devices_to_list(entry,
                    entry) or side_effects_found
        return side_effects_found

    def connect_bluetooth_device(self, name, address, paired, bonded,
            connected, self_calibrating=False):
        """Connects a fake Bluetooth device and checks for side effects.

        Uses JavaScript UI API calls to simulate connecting to a fake Bluetooth
        device and counts the number of text/tag nodes on the web page to make
        sure that XSS wasn't successful.

        Args:
            name: String name of the fake device.
            address: String address of the fake device.
            paired: Boolean for whether or not device is already paired.
            bonded: Boolean for whether or not device is already bonded.
            connected: Boolean for whether or not device is already connected.
            self_calibrating: Boolean for whether the test is being run in
                              a self calibrating mode.

        Returns:
            A boolean representing whether or not XSS was successful.
        """
        # list of strings representing Bluetooth pairing states
        _PAIRING_STATES = ['bluetoothStartConnecting',
                'bluetoothEnterPinCode', 'bluetoothEnterPasskey',
                'bluetoothRemotePinCode', 'bluetoothRemotePasskey',
                'bluetoothConfirmPasskey']

        self.pyauto.NavigateToURL('chrome://settings-frame/')

        is_clean = 'clean'
        side_effects_found = False
        for state in _PAIRING_STATES:
            new_nodes_expected = self._EXPECTED_DOM_IMPACT['connect'][is_clean]
            js = """
                %s
                %s
                function testConnectBluetoothDevice(name, address, paired,
                    bonded, connected, pairing, additionExpected) {
                  var device = {"name":name, "address":address, "paired":paired,
                      "bonded":bonded, "connected":connected,
                      "pairing":pairing};
                  var connectBluetoothDevice = function(device) {
                    return function() {
                      options.BluetoothPairing.showDialog(device);
                    };
                  };
                  device.pairing = pairing;
                  results = testForEffects(connectBluetoothDevice(device),
                      additionExpected);
                  if(results.effects_found) {
                    window.domAutomationController.send(JSON.stringify(
                        results));
                    return;
                  }
                  window.domAutomationController.send(JSON.stringify(results));
                }
                testConnectBluetoothDevice("%s", "%s", %s, %s, %s, "%s", %d);
                """ % (self._NUMBER_OF_NODES_FUNC, self._TEST_FOR_EFFECTS_FUNC,
                       name, address, str(paired).lower(), str(bonded).lower(),
                       str(connected).lower(), state, new_nodes_expected)
            output = json.loads(self.pyauto.ExecuteJavascript(js))

            if self_calibrating:
                logging.debug('Setting expectations for %s to %s' %
                              (is_clean, output['count']))
                self._EXPECTED_DOM_IMPACT['connect'][is_clean] = output['count']

            side_effects_found_now = output['effects_found']

            if not side_effects_found_now:
                log_msg = '[PASS]'
                is_clean = 'unclean'
            else:
                side_effects_found = True
                log_msg = '[FAIL]'
                self.pyauto.NavigateToURL('chrome://settings-frame/')
                is_clean = 'clean'

            logging.debug('%s Connected device at stage %s with name "%s", '
            'address "%s", paired:%s, bonded:%s, connected:%s; %s' % (log_msg,
                    state, name, address, paired, bonded, connected,
                    output['reason']))

        return side_effects_found

    def connect_bluetooth_devices(self, name, address):
        """Connects a Bluetooth device in all possible configurations.

        Calls connect_bluetooth_device for each normally possible combination
        of paired, bonded, and connected flags for full coverage of a given
        name/address pair.

        Args:
            name: String name of the desired fake Bluetooth device.
            address: String address of the desired fake Bluetooth device.

        Returns:
            A boolean representing whether or not XSS was successful.
        """
        side_effects_found = self.connect_bluetooth_device(name, address, False,
                False, False)
        side_effects_found = self.connect_bluetooth_device(name, address, False,
                True, False) or side_effects_found
        return side_effects_found

    def test_connecting(self):
        """Tests connecting to malicious Bluetooth devices.

        Calls connect_bluetooth_devices() for all malicious strings.

        Returns:
            A boolean representing whether or not XSS is possible when
            connecting to a Bluetooth device.
        """
        side_effects_found = False
        for entry in self._MALICIOUS_STRINGS:
            side_effects_found = self.connect_bluetooth_devices(entry,
                    entry) or side_effects_found
        return side_effects_found

    def set_up(self):
        """Sets up environment for testing.

        Checks if Bluetooth was already turned on and turns it on if it wasn't
        on already.
        """
        self.pyauto.NavigateToURL('chrome://settings-frame/')
        setup_js = ('$("advanced-settings-expander").click();'
                'var bluetooth_was_enabled = $("enable-bluetooth").checked;'
                'if(!bluetooth_was_enabled) $("enable-bluetooth").click();'
                'var results = {"bluetooth_was_enabled":bluetooth_was_enabled};'
                'window.domAutomationController.send(JSON.stringify(results));')
        self.start_env = json.loads(self.pyauto.ExecuteJavascript(setup_js))

    def tear_down(self):
        """Tears down environment after testing.

        Disables Bluetooth if it was disabled before testing.
        """
        if not self.start_env['bluetooth_was_enabled']:
            self.pyauto.NavigateToURL('chrome://settings-frame/')
            teardown_js = ('$("advanced-settings-expander").click();'
                    '$("enable-bluetooth").click();'
                    'window.domAutomationController.send("")')
            self.pyauto.ExecuteJavascript(teardown_js)

    def run_once(self):
        """Main function.

        Runs all test helper functions.

        Raises:
            error.TestFail if XSS was successful in any test.
        """
        self.set_up()
        self.init_expectations()

        side_effects_found = self.test_adding()
        side_effects_found = self.test_connecting() or side_effects_found

        self.tear_down()

        if side_effects_found:
            raise error.TestFail('XSS vulnerabilities were found.')