| // Copyright 2026 Google LLC | |
| // | |
| // Licensed under the Apache License, Version 2.0 (the "License"); | |
| // you may not use this file except in compliance with the License. | |
| // You may obtain a copy of the License at | |
| // | |
| // https://www.apache.org/licenses/LICENSE-2.0 | |
| // | |
| // Unless required by applicable law or agreed to in writing, software | |
| // distributed under the License is distributed on an "AS IS" BASIS, | |
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | |
| // See the License for the specific language governing permissions and | |
| // limitations under the License. | |
| // | |
| #include "assertion/hashed_uri_validator.h" | |
| #include <memory> | |
| #include <optional> | |
| #include "absl/log/check.h" | |
| #include "absl/status/statusor.h" | |
| #include "absl/strings/escaping.h" | |
| #include "absl/strings/string_view.h" | |
| #include "constants/status_codes.h" | |
| #include "crypto/algorithms.h" | |
| #include "crypto/hash.h" | |
| #include "gmock/gmock.h" | |
| #include "gtest/gtest.h" | |
| #include "jumbf/box.h" | |
| #include "jumbf/uri.h" | |
| #include "proto/hashed_uri.pb.h" | |
| #include "testing/jumbf_utils.h" | |
| #include "testing/proto_test_utils.h" | |
| #include "testing/test_validation_tracker.h" | |
| namespace credentio { | |
| namespace { | |
| using ::credentio_testing::ParseTextProtoOrDie; | |
| using ::testing::Eq; | |
| using ::testing::IsEmpty; | |
| class FakeHashChecker : public HashChecker { | |
| public: | |
| explicit FakeHashChecker(absl::string_view hash_value) | |
| : hash_value_(hash_value) {} | |
| void Update(absl::string_view data) override {} | |
| bool Check(absl::string_view hash) override { return hash == hash_value_; } | |
| private: | |
| absl::string_view hash_value_; | |
| }; | |
| class FakeHashCheckerFactory : public HashCheckerFactory { | |
| public: | |
| explicit FakeHashCheckerFactory(absl::string_view hash_value) | |
| : hash_value_(hash_value) {} | |
| absl::StatusOr<std::unique_ptr<HashChecker>> Create( | |
| HashAlgorithm algorithm) const override { | |
| return std::make_unique<FakeHashChecker>(hash_value_); | |
| } | |
| private: | |
| absl::string_view hash_value_; | |
| }; | |
| class HashedUriValidatorTest : public ::testing::Test { | |
| protected: | |
| HashedUriValidatorTest() | |
| : box_a_({ | |
| .description = {.label = "box_a"}, | |
| .raw_bytes = "box a contents", | |
| }), | |
| box_a_hash_("1CCMpryihdV55fyQNDUQgDLS5aXhkyGwEH6cVcNtmCE="), | |
| manifest_store_(CreateManifestStore( | |
| {CreateStandardManifest("urn:c2pa:manifest0", {}), | |
| CreateStandardManifest("urn:c2pa:manifest1", {box_a_})})), | |
| uri_resolver_( | |
| jumbf::UriResolver::WithSingleRootChild(&manifest_store_)) {} | |
| jumbf::SuperBox box_a_; | |
| absl::string_view box_a_hash_; | |
| jumbf::SuperBox manifest_store_; | |
| jumbf::UriResolver uri_resolver_; | |
| TestValidationTracker t_; | |
| }; | |
| TEST_F(HashedUriValidatorTest, UriDoesNotResolve) { | |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest0", uri_resolver_); | |
| EXPECT_THAT(validator.Validate(ParseTextProtoOrDie<HashedUri>(R"pb( | |
| url: "no_such_box" | |
| )pb"), | |
| "", t_.tracker()), | |
| Eq(std::nullopt)); | |
| EXPECT_THAT(t_.GetFailures(), | |
| ContainsFailure(FailureStatusCode::kHashedUriMissing)); | |
| } | |
| TEST_F(HashedUriValidatorTest, UriDoesNotResolveCustomCode) { | |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest0", uri_resolver_); | |
| validator.SetErrorCodes( | |
| {.missing = FailureStatusCode::kIngredientManifestMissing, | |
| .mismatch = FailureStatusCode::kIngredientManifestMismatch}); | |
| EXPECT_THAT(validator.Validate(ParseTextProtoOrDie<HashedUri>(R"pb( | |
| url: "no_such_box" | |
| )pb"), | |
| "", t_.tracker()), | |
| Eq(std::nullopt)); | |
| EXPECT_THAT(t_.GetFailures(), | |
| ContainsFailure(FailureStatusCode::kIngredientManifestMissing)); | |
| } | |
| TEST_F(HashedUriValidatorTest, InvalidBoxHeader) { | |
| jumbf::SuperBox manifest_store = CreateManifestStore( | |
| {CreateStandardManifest("urn:c2pa:manifest0", {}), | |
| CreateStandardManifest("urn:c2pa:manifest1", | |
| {{ | |
| .description = {.label = "box_a"}, | |
| .raw_bytes = "x", // Invalid header | |
| }})}); | |
| jumbf::UriResolver uri_resolver = | |
| jumbf::UriResolver::WithSingleRootChild(&manifest_store); | |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest0", uri_resolver); | |
| EXPECT_THAT( | |
| validator.Validate(ParseTextProtoOrDie<HashedUri>(R"pb( | |
| url: "self#jumbf=/c2pa/urn:c2pa:manifest1/box_a" | |
| algorithm: "sha256" | |
| hash: "abc" | |
| )pb"), | |
| "", t_.tracker()), | |
| Eq(std::nullopt)); | |
| EXPECT_THAT(t_.GetFailures(), | |
| ContainsFailure(FailureStatusCode::kHashedUriMismatch)); | |
| } | |
| TEST_F(HashedUriValidatorTest, HashMismatch) { | |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest0", uri_resolver_); | |
| EXPECT_THAT(validator.Validate(ParseTextProtoOrDie<HashedUri>(R"pb( | |
| url: "self#jumbf=/c2pa/urn:c2pa:manifest1" | |
| algorithm: "sha256" | |
| hash: "abc" | |
| )pb"), | |
| "", t_.tracker()), | |
| Eq(std::nullopt)); | |
| EXPECT_THAT(t_.GetFailures(), | |
| ContainsFailure(FailureStatusCode::kHashedUriMismatch)); | |
| } | |
| TEST_F(HashedUriValidatorTest, HashMismatchCustomCode) { | |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest0", uri_resolver_); | |
| validator.SetErrorCodes( | |
| {.missing = FailureStatusCode::kIngredientManifestMissing, | |
| .mismatch = FailureStatusCode::kIngredientManifestMismatch}); | |
| EXPECT_THAT(validator.Validate(ParseTextProtoOrDie<HashedUri>(R"pb( | |
| url: "self#jumbf=/c2pa/urn:c2pa:manifest1" | |
| algorithm: "sha256" | |
| hash: "abc" | |
| )pb"), | |
| "", t_.tracker()), | |
| Eq(std::nullopt)); | |
| EXPECT_THAT(t_.GetFailures(), | |
| ContainsFailure(FailureStatusCode::kIngredientManifestMismatch)); | |
| } | |
| TEST_F(HashedUriValidatorTest, UnsupportedAlgorithm) { | |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest0", uri_resolver_); | |
| EXPECT_THAT(validator.Validate(ParseTextProtoOrDie<HashedUri>(R"pb( | |
| url: "self#jumbf=/c2pa/urn:c2pa:manifest1" | |
| algorithm: "rutabaga256" | |
| hash: "abc" | |
| )pb"), | |
| "", t_.tracker()), | |
| Eq(std::nullopt)); | |
| EXPECT_THAT(t_.GetFailures(), | |
| ContainsFailure(FailureStatusCode::kAlgorithmUnsupported)); | |
| } | |
| TEST_F(HashedUriValidatorTest, Success) { | |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest0", uri_resolver_); | |
| HashedUri hashed_uri; | |
| hashed_uri.set_url("self#jumbf=/c2pa/urn:c2pa:manifest1/box_a"); | |
| hashed_uri.set_algorithm("sha256"); | |
| ASSERT_TRUE( | |
| absl::Base64Unescape("1CCMpryihdV55fyQNDUQgDLS5aXhkyGwEH6cVcNtmCE=", | |
| hashed_uri.mutable_hash())); | |
| EXPECT_THAT(validator.Validate(hashed_uri, "", t_.tracker()), | |
| Eq("/c2pa/urn:c2pa:manifest1/box_a")); | |
| EXPECT_THAT(t_.GetFailures(), IsEmpty()); | |
| } | |
| TEST_F(HashedUriValidatorTest, RelativeUri) { | |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest1", uri_resolver_); | |
| HashedUri hashed_uri; | |
| hashed_uri.set_url("self#jumbf=box_a"); | |
| hashed_uri.set_algorithm("sha256"); | |
| ASSERT_TRUE( | |
| absl::Base64Unescape("1CCMpryihdV55fyQNDUQgDLS5aXhkyGwEH6cVcNtmCE=", | |
| hashed_uri.mutable_hash())); | |
| EXPECT_THAT(validator.Validate(hashed_uri, "", t_.tracker()), | |
| Eq("/c2pa/urn:c2pa:manifest1/box_a")); | |
| EXPECT_THAT(t_.GetFailures(), IsEmpty()); | |
| } | |
| TEST_F(HashedUriValidatorTest, DefaultAlgorithmIgnoredWithExplicitAlgorithm) { | |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest1", uri_resolver_); | |
| validator.SetDefaultAlgorithm("sha512"); | |
| HashedUri hashed_uri; | |
| hashed_uri.set_url("self#jumbf=box_a"); | |
| hashed_uri.set_algorithm("sha256"); | |
| ASSERT_TRUE( | |
| absl::Base64Unescape("1CCMpryihdV55fyQNDUQgDLS5aXhkyGwEH6cVcNtmCE=", | |
| hashed_uri.mutable_hash())); | |
| EXPECT_THAT(validator.Validate(hashed_uri, "", t_.tracker()), | |
| Eq("/c2pa/urn:c2pa:manifest1/box_a")); | |
| EXPECT_THAT(t_.GetFailures(), IsEmpty()); | |
| } | |
| TEST_F(HashedUriValidatorTest, DefaultAlgorithmUsed) { | |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest1", uri_resolver_); | |
| validator.SetDefaultAlgorithm("sha512"); | |
| HashedUri hashed_uri; | |
| hashed_uri.set_url("self#jumbf=box_a"); | |
| ASSERT_TRUE(absl::Base64Unescape( | |
| R"(69KGliqftQfRtFL+ouQG63R8RZef70mzgHC1GmUahLbyrFOzXliLyZkzDNwX2WfUGLYP1b4KCc5JRfl4OvtNSQ==)", | |
| hashed_uri.mutable_hash())); | |
| EXPECT_THAT(validator.Validate(hashed_uri, "", t_.tracker()), | |
| Eq("/c2pa/urn:c2pa:manifest1/box_a")); | |
| EXPECT_THAT(t_.GetFailures(), IsEmpty()); | |
| } | |
| TEST_F(HashedUriValidatorTest, InjectedHashCheckerFactory) { | |
| FakeHashCheckerFactory hash_checker_factory("fake_hash_value"); | |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest1", uri_resolver_, | |
| &hash_checker_factory); | |
| auto hashed_uri = ParseTextProtoOrDie<HashedUri>(R"pb( | |
| url: "self#jumbf=box_a" | |
| algorithm: "sha256" | |
| hash: "fake_hash_value" | |
| )pb"); | |
| EXPECT_THAT(validator.Validate(hashed_uri, "", t_.tracker()), | |
| Eq("/c2pa/urn:c2pa:manifest1/box_a")); | |
| EXPECT_THAT(t_.GetFailures(), IsEmpty()); | |
| } | |
| } // namespace | |
| } // namespace credentio |