| // Copyright 2026 Google LLC |
| // |
| // Licensed under the Apache License, Version 2.0 (the "License"); |
| // you may not use this file except in compliance with the License. |
| // You may obtain a copy of the License at |
| // |
| // https://www.apache.org/licenses/LICENSE-2.0 |
| // |
| // Unless required by applicable law or agreed to in writing, software |
| // distributed under the License is distributed on an "AS IS" BASIS, |
| // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| // See the License for the specific language governing permissions and |
| // limitations under the License. |
| // |
| |
| #include "assertion/hashed_uri_validator.h" |
| |
| #include <memory> |
| #include <optional> |
| |
| #include "absl/log/check.h" |
| #include "absl/status/statusor.h" |
| #include "absl/strings/escaping.h" |
| #include "absl/strings/string_view.h" |
| #include "constants/status_codes.h" |
| #include "crypto/algorithms.h" |
| #include "crypto/hash.h" |
| #include "gmock/gmock.h" |
| #include "gtest/gtest.h" |
| #include "jumbf/box.h" |
| #include "jumbf/uri.h" |
| #include "proto/hashed_uri.pb.h" |
| #include "testing/jumbf_utils.h" |
| #include "testing/proto_test_utils.h" |
| #include "testing/test_validation_tracker.h" |
| |
| namespace credentio { |
| namespace { |
| |
| using ::credentio_testing::ParseTextProtoOrDie; |
| using ::testing::Eq; |
| using ::testing::IsEmpty; |
| |
| class FakeHashChecker : public HashChecker { |
| public: |
| explicit FakeHashChecker(absl::string_view hash_value) |
| : hash_value_(hash_value) {} |
| void Update(absl::string_view data) override {} |
| bool Check(absl::string_view hash) override { return hash == hash_value_; } |
| |
| private: |
| absl::string_view hash_value_; |
| }; |
| |
| class FakeHashCheckerFactory : public HashCheckerFactory { |
| public: |
| explicit FakeHashCheckerFactory(absl::string_view hash_value) |
| : hash_value_(hash_value) {} |
| |
| absl::StatusOr<std::unique_ptr<HashChecker>> Create( |
| HashAlgorithm algorithm) const override { |
| return std::make_unique<FakeHashChecker>(hash_value_); |
| } |
| |
| private: |
| absl::string_view hash_value_; |
| }; |
| |
| class HashedUriValidatorTest : public ::testing::Test { |
| protected: |
| HashedUriValidatorTest() |
| : box_a_({ |
| .description = {.label = "box_a"}, |
| .raw_bytes = "box a contents", |
| }), |
| box_a_hash_("1CCMpryihdV55fyQNDUQgDLS5aXhkyGwEH6cVcNtmCE="), |
| manifest_store_(CreateManifestStore( |
| {CreateStandardManifest("urn:c2pa:manifest0", {}), |
| CreateStandardManifest("urn:c2pa:manifest1", {box_a_})})), |
| uri_resolver_( |
| jumbf::UriResolver::WithSingleRootChild(&manifest_store_)) {} |
| |
| jumbf::SuperBox box_a_; |
| absl::string_view box_a_hash_; |
| jumbf::SuperBox manifest_store_; |
| jumbf::UriResolver uri_resolver_; |
| TestValidationTracker t_; |
| }; |
| |
| TEST_F(HashedUriValidatorTest, UriDoesNotResolve) { |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest0", uri_resolver_); |
| EXPECT_THAT(validator.Validate(ParseTextProtoOrDie<HashedUri>(R"pb( |
| url: "no_such_box" |
| )pb"), |
| "", t_.tracker()), |
| Eq(std::nullopt)); |
| EXPECT_THAT(t_.GetFailures(), |
| ContainsFailure(FailureStatusCode::kHashedUriMissing)); |
| } |
| |
| TEST_F(HashedUriValidatorTest, UriDoesNotResolveCustomCode) { |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest0", uri_resolver_); |
| validator.SetErrorCodes( |
| {.missing = FailureStatusCode::kIngredientManifestMissing, |
| .mismatch = FailureStatusCode::kIngredientManifestMismatch}); |
| EXPECT_THAT(validator.Validate(ParseTextProtoOrDie<HashedUri>(R"pb( |
| url: "no_such_box" |
| )pb"), |
| "", t_.tracker()), |
| Eq(std::nullopt)); |
| EXPECT_THAT(t_.GetFailures(), |
| ContainsFailure(FailureStatusCode::kIngredientManifestMissing)); |
| } |
| |
| TEST_F(HashedUriValidatorTest, InvalidBoxHeader) { |
| jumbf::SuperBox manifest_store = CreateManifestStore( |
| {CreateStandardManifest("urn:c2pa:manifest0", {}), |
| CreateStandardManifest("urn:c2pa:manifest1", |
| {{ |
| .description = {.label = "box_a"}, |
| .raw_bytes = "x", // Invalid header |
| }})}); |
| jumbf::UriResolver uri_resolver = |
| jumbf::UriResolver::WithSingleRootChild(&manifest_store); |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest0", uri_resolver); |
| EXPECT_THAT( |
| validator.Validate(ParseTextProtoOrDie<HashedUri>(R"pb( |
| url: "self#jumbf=/c2pa/urn:c2pa:manifest1/box_a" |
| algorithm: "sha256" |
| hash: "abc" |
| )pb"), |
| "", t_.tracker()), |
| Eq(std::nullopt)); |
| EXPECT_THAT(t_.GetFailures(), |
| ContainsFailure(FailureStatusCode::kHashedUriMismatch)); |
| } |
| |
| TEST_F(HashedUriValidatorTest, HashMismatch) { |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest0", uri_resolver_); |
| EXPECT_THAT(validator.Validate(ParseTextProtoOrDie<HashedUri>(R"pb( |
| url: "self#jumbf=/c2pa/urn:c2pa:manifest1" |
| algorithm: "sha256" |
| hash: "abc" |
| )pb"), |
| "", t_.tracker()), |
| Eq(std::nullopt)); |
| EXPECT_THAT(t_.GetFailures(), |
| ContainsFailure(FailureStatusCode::kHashedUriMismatch)); |
| } |
| |
| TEST_F(HashedUriValidatorTest, HashMismatchCustomCode) { |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest0", uri_resolver_); |
| validator.SetErrorCodes( |
| {.missing = FailureStatusCode::kIngredientManifestMissing, |
| .mismatch = FailureStatusCode::kIngredientManifestMismatch}); |
| EXPECT_THAT(validator.Validate(ParseTextProtoOrDie<HashedUri>(R"pb( |
| url: "self#jumbf=/c2pa/urn:c2pa:manifest1" |
| algorithm: "sha256" |
| hash: "abc" |
| )pb"), |
| "", t_.tracker()), |
| Eq(std::nullopt)); |
| EXPECT_THAT(t_.GetFailures(), |
| ContainsFailure(FailureStatusCode::kIngredientManifestMismatch)); |
| } |
| |
| TEST_F(HashedUriValidatorTest, UnsupportedAlgorithm) { |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest0", uri_resolver_); |
| EXPECT_THAT(validator.Validate(ParseTextProtoOrDie<HashedUri>(R"pb( |
| url: "self#jumbf=/c2pa/urn:c2pa:manifest1" |
| algorithm: "rutabaga256" |
| hash: "abc" |
| )pb"), |
| "", t_.tracker()), |
| Eq(std::nullopt)); |
| EXPECT_THAT(t_.GetFailures(), |
| ContainsFailure(FailureStatusCode::kAlgorithmUnsupported)); |
| } |
| |
| TEST_F(HashedUriValidatorTest, Success) { |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest0", uri_resolver_); |
| HashedUri hashed_uri; |
| hashed_uri.set_url("self#jumbf=/c2pa/urn:c2pa:manifest1/box_a"); |
| hashed_uri.set_algorithm("sha256"); |
| ASSERT_TRUE( |
| absl::Base64Unescape("1CCMpryihdV55fyQNDUQgDLS5aXhkyGwEH6cVcNtmCE=", |
| hashed_uri.mutable_hash())); |
| EXPECT_THAT(validator.Validate(hashed_uri, "", t_.tracker()), |
| Eq("/c2pa/urn:c2pa:manifest1/box_a")); |
| EXPECT_THAT(t_.GetFailures(), IsEmpty()); |
| } |
| |
| TEST_F(HashedUriValidatorTest, RelativeUri) { |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest1", uri_resolver_); |
| HashedUri hashed_uri; |
| hashed_uri.set_url("self#jumbf=box_a"); |
| hashed_uri.set_algorithm("sha256"); |
| ASSERT_TRUE( |
| absl::Base64Unescape("1CCMpryihdV55fyQNDUQgDLS5aXhkyGwEH6cVcNtmCE=", |
| hashed_uri.mutable_hash())); |
| EXPECT_THAT(validator.Validate(hashed_uri, "", t_.tracker()), |
| Eq("/c2pa/urn:c2pa:manifest1/box_a")); |
| EXPECT_THAT(t_.GetFailures(), IsEmpty()); |
| } |
| |
| TEST_F(HashedUriValidatorTest, DefaultAlgorithmIgnoredWithExplicitAlgorithm) { |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest1", uri_resolver_); |
| validator.SetDefaultAlgorithm("sha512"); |
| HashedUri hashed_uri; |
| hashed_uri.set_url("self#jumbf=box_a"); |
| hashed_uri.set_algorithm("sha256"); |
| ASSERT_TRUE( |
| absl::Base64Unescape("1CCMpryihdV55fyQNDUQgDLS5aXhkyGwEH6cVcNtmCE=", |
| hashed_uri.mutable_hash())); |
| EXPECT_THAT(validator.Validate(hashed_uri, "", t_.tracker()), |
| Eq("/c2pa/urn:c2pa:manifest1/box_a")); |
| EXPECT_THAT(t_.GetFailures(), IsEmpty()); |
| } |
| |
| TEST_F(HashedUriValidatorTest, DefaultAlgorithmUsed) { |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest1", uri_resolver_); |
| validator.SetDefaultAlgorithm("sha512"); |
| HashedUri hashed_uri; |
| hashed_uri.set_url("self#jumbf=box_a"); |
| ASSERT_TRUE(absl::Base64Unescape( |
| R"(69KGliqftQfRtFL+ouQG63R8RZef70mzgHC1GmUahLbyrFOzXliLyZkzDNwX2WfUGLYP1b4KCc5JRfl4OvtNSQ==)", |
| hashed_uri.mutable_hash())); |
| EXPECT_THAT(validator.Validate(hashed_uri, "", t_.tracker()), |
| Eq("/c2pa/urn:c2pa:manifest1/box_a")); |
| EXPECT_THAT(t_.GetFailures(), IsEmpty()); |
| } |
| |
| TEST_F(HashedUriValidatorTest, InjectedHashCheckerFactory) { |
| FakeHashCheckerFactory hash_checker_factory("fake_hash_value"); |
| HashedUriValidator validator("/c2pa/urn:c2pa:manifest1", uri_resolver_, |
| &hash_checker_factory); |
| auto hashed_uri = ParseTextProtoOrDie<HashedUri>(R"pb( |
| url: "self#jumbf=box_a" |
| algorithm: "sha256" |
| hash: "fake_hash_value" |
| )pb"); |
| EXPECT_THAT(validator.Validate(hashed_uri, "", t_.tracker()), |
| Eq("/c2pa/urn:c2pa:manifest1/box_a")); |
| EXPECT_THAT(t_.GetFailures(), IsEmpty()); |
| } |
| |
| } // namespace |
| } // namespace credentio |
