// Copyright 2014 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include <memory>
#include <optional>
#include <string>
#include <utility>

#include "base/base_switches.h"
#include "base/check_deref.h"
#include "base/command_line.h"
#include "base/files/file_path.h"
#include "base/files/file_util.h"
#include "base/json/json_file_value_serializer.h"
#include "base/json/json_reader.h"
#include "base/metrics/histogram_base.h"
#include "base/metrics/histogram_samples.h"
#include "base/metrics/statistics_recorder.h"
#include "base/path_service.h"
#include "base/strings/string_number_conversions.h"
#include "base/strings/string_util.h"
#include "base/strings/stringprintf.h"
#include "base/strings/utf_string_conversions.h"
#include "base/test/metrics/histogram_tester.h"
#include "base/test/scoped_feature_list.h"
#include "base/values.h"
#include "build/build_config.h"
#include "chrome/browser/extensions/extension_browsertest.h"
#include "chrome/browser/prefs/chrome_pref_service_factory.h"
#include "chrome/browser/prefs/profile_pref_store_manager.h"
#include "chrome/browser/prefs/session_startup_pref.h"
#include "chrome/browser/profiles/profile.h"
#include "chrome/browser/search_engine_choice/search_engine_choice_service_factory.h"
#include "chrome/browser/search_engines/template_url_prepopulate_data_resolver_factory.h"
#include "chrome/browser/sync/test/integration/sync_test.h"
#include "chrome/browser/ui/browser.h"
#include "chrome/common/chrome_constants.h"
#include "chrome/common/chrome_paths.h"
#include "chrome/common/pref_names.h"
#include "chrome/test/base/testing_profile.h"
#include "components/prefs/json_pref_store.h"
#include "components/prefs/pref_service.h"
#include "components/prefs/scoped_user_pref_update.h"
#include "components/prefs/segregated_pref_store.h"
#include "components/search_engines/default_search_manager.h"
#include "components/search_engines/template_url_data.h"
#include "components/signin/public/base/signin_switches.h"
#include "components/sync/base/features.h"
#include "content/public/test/browser_task_environment.h"
#include "content/public/test/browser_test.h"
#include "content/public/test/test_launcher.h"
#include "extensions/browser/pref_names.h"
#include "extensions/common/extension.h"
#include "services/preferences/public/cpp/tracked/tracked_preference_histogram_names.h"
#include "services/preferences/tracked/features.h"

#if BUILDFLAG(IS_CHROMEOS)
#include "ash/constants/ash_switches.h"
#endif

#if BUILDFLAG(IS_WIN)
#include "base/win/registry.h"
#include "chrome/install_static/install_util.h"
#endif

namespace {

// Extension ID of chrome/test/data/extensions/good.crx
const char kGoodCrxId[] = "ldnnhddmnhbkjipkidpdiheffobcpfmf";

// Explicit expectations from the caller of GetTrackedPrefHistogramCount(). This
// enables detailed reporting of the culprit on failure.
enum AllowedBuckets {
  // Allow no samples in any buckets.
  ALLOW_NONE = -1,
  // Any integer between BEGIN_ALLOW_SINGLE_BUCKET and END_ALLOW_SINGLE_BUCKET
  // indicates that only this specific bucket is allowed to have a sample.
  BEGIN_ALLOW_SINGLE_BUCKET = 0,
  END_ALLOW_SINGLE_BUCKET = 100,
  // Allow any buckets (no extra verifications performed).
  ALLOW_ANY
};

#if BUILDFLAG(IS_WIN)
std::wstring GetRegistryPathForTestProfile() {
  // Cleanup follow-up to http://crbug.com/721245 for the previous location of
  // this test key which had similar problems (to a lesser extent). It's
  // redundant but harmless to have multiple callers hit this on the same
  // machine. TODO(gab): remove this mid-june 2017.
  base::win::RegKey key;
  if (key.Open(HKEY_CURRENT_USER, L"SOFTWARE\\Chromium\\PrefHashBrowserTest",
               KEY_SET_VALUE | KEY_WOW64_32KEY) == ERROR_SUCCESS) {
    LONG result = key.DeleteKey(L"");
    EXPECT_TRUE(result == ERROR_SUCCESS || result == ERROR_FILE_NOT_FOUND);
  }

  base::FilePath profile_dir;
  EXPECT_TRUE(base::PathService::Get(chrome::DIR_USER_DATA, &profile_dir));

  // |DIR_USER_DATA| usually has format %TMP%\12345_6789012345\user_data
  // (unless running with --single-process-tests, where the format is
  // %TMP%\scoped_dir12345_6789012345). Use the parent directory name instead of
  // the leaf directory name "user_data" to avoid conflicts in parallel tests,
  // which would try to modify the same registry key otherwise.
  if (profile_dir.BaseName().value() == L"user_data") {
    profile_dir = profile_dir.DirName();
  }
  // Try to detect regressions when |DIR_USER_DATA| test location changes, which
  // could cause this test to become flaky. See http://crbug/1091409 for more
  // details.
  DCHECK(profile_dir.BaseName().value().find_first_of(L"0123456789") !=
         std::string::npos);

  // Use a location under the real PreferenceMACs path so that the backup
  // cleanup logic in ChromeTestLauncherDelegate::PreSharding() for interrupted
  // tests covers this test key as well.
  return install_static::GetRegistryPath() +
         L"\\PreferenceMACs\\PrefHashBrowserTest\\" +
         profile_dir.BaseName().value();
}
#endif

// Returns the number of times |histogram_name| was reported so far; adding the
// results of the first 100 buckets (there are only ~19 reporting IDs as of this
// writing; varies depending on the platform). |allowed_buckets| hints at extra
// requirements verified in this method (see AllowedBuckets for details).
int GetTrackedPrefHistogramCount(const char* histogram_name,
                                 const char* histogram_suffix,
                                 int allowed_buckets) {
  std::string full_histogram_name(histogram_name);
  if (*histogram_suffix)
    full_histogram_name.append(".").append(histogram_suffix);
  const base::HistogramBase* histogram =
      base::StatisticsRecorder::FindHistogram(full_histogram_name);
  if (!histogram)
    return 0;

  std::unique_ptr<base::HistogramSamples> samples(histogram->SnapshotSamples());
  int sum = 0;
  for (int i = 0; i < 100; ++i) {
    int count_for_id = samples->GetCount(i);
    EXPECT_GE(count_for_id, 0);
    sum += count_for_id;

    if (allowed_buckets == ALLOW_NONE ||
        (allowed_buckets != ALLOW_ANY && i != allowed_buckets)) {
      EXPECT_EQ(0, count_for_id) << "Unexpected reporting_id: " << i;
    }
  }
  return sum;
}

// Helper function to call GetTrackedPrefHistogramCount with no external
// validation suffix.
int GetTrackedPrefHistogramCount(const char* histogram_name,
                                 int allowed_buckets) {
  return GetTrackedPrefHistogramCount(histogram_name, "", allowed_buckets);
}

#if !BUILDFLAG(IS_CHROMEOS)
// Helper function to get the test profile directory path.
base::FilePath GetProfileDir() {
  base::FilePath profile_dir;
  CHECK(base::PathService::Get(chrome::DIR_USER_DATA, &profile_dir));
  return profile_dir.AppendASCII(TestingProfile::kTestUserProfileDir);
}

std::optional<base::Value::Dict> ReadPrefsDictionary(
    const base::FilePath& pref_file) {
  JSONFileValueDeserializer deserializer(pref_file);
  int error_code = JSONFileValueDeserializer::JSON_NO_ERROR;
  std::string error_str;
  std::unique_ptr<base::Value> prefs =
      deserializer.Deserialize(&error_code, &error_str);
  if (!prefs || error_code != JSONFileValueDeserializer::JSON_NO_ERROR) {
    ADD_FAILURE() << "Error #" << error_code << ": " << error_str;
    return std::nullopt;
  }
  if (!prefs->is_dict()) {
    ADD_FAILURE();
    return std::nullopt;
  }
  return std::move(*prefs).TakeDict();
}
#endif

// Returns whether external validation is supported on the platform through
// storing MACs in the registry.
bool SupportsRegistryValidation() {
#if BUILDFLAG(IS_WIN)
  return true;
#else
  return false;
#endif
}

#define PREF_HASH_BROWSER_TEST(fixture, test_name)                             \
  IN_PROC_BROWSER_TEST_F(fixture, PRE_##test_name) { SetupPreferences(); }     \
  IN_PROC_BROWSER_TEST_F(fixture, test_name) { VerifyReactionToPrefAttack(); } \
  static_assert(true, "")

// A base fixture designed such that implementations do two things:
//  1) Override all three pure-virtual methods below to setup, attack, and
//     verify preferences throughout the tests provided by this fixture.
//  2) Instantiate their test via the PREF_HASH_BROWSER_TEST macro above.
// Based on top of ExtensionBrowserTest to allow easy interaction with the
// ExtensionRegistry.
class PrefHashBrowserTestBase : public extensions::ExtensionBrowserTest {
 public:
  // List of potential protection levels for this test in strict increasing
  // order of protection levels.
  enum SettingsProtectionLevel {
    PROTECTION_DISABLED_ON_PLATFORM,
    PROTECTION_DISABLED_FOR_GROUP,
    PROTECTION_ENABLED_BASIC,
    PROTECTION_ENABLED_DSE,
    PROTECTION_ENABLED_EXTENSIONS,
    // Represents the strongest level (i.e. always equivalent to the last one in
    // terms of protection), leave this one last when adding new levels.
    PROTECTION_ENABLED_ALL
  };

  PrefHashBrowserTestBase() : protection_level_(GetProtectionLevel()) {}

  void SetUpCommandLine(base::CommandLine* command_line) override {
    extensions::ExtensionBrowserTest::SetUpCommandLine(command_line);
#if BUILDFLAG(IS_CHROMEOS)
    command_line->AppendSwitch(
        ash::switches::kIgnoreUserProfileMappingForTests);
#endif
  }

  bool SetUpUserDataDirectory() override {
    // Do the normal setup in the PRE test and attack preferences in the main
    // test.
    if (content::IsPreTest())
      return extensions::ExtensionBrowserTest::SetUpUserDataDirectory();

#if BUILDFLAG(IS_CHROMEOS)
    // For some reason, the Preferences file does not exist in the location
    // below on Chrome OS. Since protection is disabled on Chrome OS, it's okay
    // to simply not attack preferences at all (and still assert that no
    // hardening related histogram kicked in in VerifyReactionToPrefAttack()).
    // TODO(gab): Figure out why there is no Preferences file in this location
    // on Chrome OS (and re-enable the section disabled for OS_CHROMEOS further
    // below).
    EXPECT_EQ(PROTECTION_DISABLED_ON_PLATFORM, protection_level_);
    return true;
#else
    base::FilePath profile_dir;
    EXPECT_TRUE(base::PathService::Get(chrome::DIR_USER_DATA, &profile_dir));
    profile_dir = profile_dir.AppendASCII(TestingProfile::kTestUserProfileDir);

    // Sanity check that old protected pref file is never present in modern
    // Chromes.
    EXPECT_FALSE(base::PathExists(
        profile_dir.Append(FILE_PATH_LITERAL("Protected Preferences"))));

    // Read the preferences from disk.

    const base::FilePath unprotected_pref_file =
        profile_dir.Append(chrome::kPreferencesFilename);
    EXPECT_TRUE(base::PathExists(unprotected_pref_file));

    const base::FilePath protected_pref_file =
        profile_dir.Append(chrome::kSecurePreferencesFilename);
    EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM,
              base::PathExists(protected_pref_file));

    std::optional<base::Value::Dict> unprotected_preferences(
        ReadPrefsDictionary(unprotected_pref_file));
    if (!unprotected_preferences)
      return false;

    std::optional<base::Value::Dict> protected_preferences;
    if (protection_level_ > PROTECTION_DISABLED_ON_PLATFORM) {
      protected_preferences = ReadPrefsDictionary(protected_pref_file);
      if (!protected_preferences)
        return false;
    }

    // Let the underlying test modify the preferences.
    AttackPreferencesOnDisk(
        &unprotected_preferences.value(),
        protected_preferences ? &protected_preferences.value() : nullptr);

    // Write the modified preferences back to disk.
    JSONFileValueSerializer unprotected_prefs_serializer(unprotected_pref_file);
    EXPECT_TRUE(
        unprotected_prefs_serializer.Serialize(*unprotected_preferences));

    if (protected_preferences) {
      JSONFileValueSerializer protected_prefs_serializer(protected_pref_file);
      EXPECT_TRUE(protected_prefs_serializer.Serialize(*protected_preferences));
    }

    return true;
#endif
  }

  void SetUpInProcessBrowserTestFixture() override {
    extensions::ExtensionBrowserTest::SetUpInProcessBrowserTestFixture();

    // Bots are on a domain, turn off the domain check for settings hardening in
    // order to be able to test all SettingsEnforcement groups.
    chrome_prefs::DisableDomainCheckForTesting();

#if BUILDFLAG(IS_WIN)
    // Avoid polluting prefs for the user and the bots by writing to a specific
    // testing registry path.
    registry_key_for_external_validation_ = GetRegistryPathForTestProfile();
    ProfilePrefStoreManager::SetPreferenceValidationRegistryPathForTesting(
        &registry_key_for_external_validation_);

    // Keys should be unique, but to avoid flakes in the long run make sure an
    // identical test key wasn't left behind by a previous test.
    if (content::IsPreTest()) {
      base::win::RegKey key;
      if (key.Open(HKEY_CURRENT_USER,
                   registry_key_for_external_validation_.c_str(),
                   KEY_SET_VALUE | KEY_WOW64_32KEY) == ERROR_SUCCESS) {
        LONG result = key.DeleteKey(L"");
        ASSERT_TRUE(result == ERROR_SUCCESS || result == ERROR_FILE_NOT_FOUND);
      }
    }
#endif
  }

  void TearDown() override {
#if BUILDFLAG(IS_WIN)
    // When done, delete the Registry key to avoid polluting the registry.
    if (!content::IsPreTest()) {
      std::wstring registry_key = GetRegistryPathForTestProfile();
      base::win::RegKey key;
      if (key.Open(HKEY_CURRENT_USER, registry_key.c_str(),
                   KEY_SET_VALUE | KEY_WOW64_32KEY) == ERROR_SUCCESS) {
        LONG result = key.DeleteKey(L"");
        ASSERT_TRUE(result == ERROR_SUCCESS || result == ERROR_FILE_NOT_FOUND);
      }
    }
#endif
    extensions::ExtensionBrowserTest::TearDown();
  }

  void TearDownOnMainThread() override {
    // In the PRE_ test, we must ensure all asynchronous
    // work is flushed before the test exits, guaranteeing the pref files on
    // disk are in a stable state for the main test to read.
    if (content::IsPreTest()) {
      // First, allow any pending asynchronous tasks (like our deferred
      // validation) to complete.
      base::RunLoop().RunUntilIdle();
      // Then, commit any writes that were scheduled by those tasks.
      base::RunLoop run_loop;
      profile()->GetPrefs()->CommitPendingWrite(run_loop.QuitClosure());
      run_loop.Run();
    }
    extensions::ExtensionBrowserTest::TearDownOnMainThread();
  }

  // In the PRE_ test, find the number of tracked preferences that were
  // initialized and save it to a file to be read back in the main test and used
  // as the total number of tracked preferences.
  void SetUpOnMainThread() override {
    extensions::ExtensionBrowserTest::SetUpOnMainThread();

    // File in which the PRE_ test will save the number of tracked preferences
    // on this platform.
    const char kNumTrackedPrefFilename[] = "NumTrackedPrefs";

    base::FilePath num_tracked_prefs_file;
    ASSERT_TRUE(
        base::PathService::Get(chrome::DIR_USER_DATA, &num_tracked_prefs_file));
    num_tracked_prefs_file =
        num_tracked_prefs_file.AppendASCII(kNumTrackedPrefFilename);

    if (content::IsPreTest()) {
      num_tracked_prefs_ = GetTrackedPrefHistogramCount(
          user_prefs::tracked::kTrackedPrefHistogramNullInitialized, ALLOW_ANY);
      EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM,
                num_tracked_prefs_ > 0);
      // Split tracked prefs are reported as Unchanged not as NullInitialized
      // when an empty dictionary is encountered on first run (this should only
      // hit for pref #5 in the current design).
      int num_split_tracked_prefs = GetTrackedPrefHistogramCount(
          user_prefs::tracked::kTrackedPrefHistogramUnchanged,
          BEGIN_ALLOW_SINGLE_BUCKET + 5);
      EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
                num_split_tracked_prefs);
      if (SupportsRegistryValidation()) {
        // Same checks as above, but for the registry.
        num_tracked_prefs_ = GetTrackedPrefHistogramCount(
            user_prefs::tracked::kTrackedPrefHistogramNullInitialized,
            user_prefs::tracked::kTrackedPrefRegistryValidationSuffix,
            ALLOW_ANY);
        EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM,
                  num_tracked_prefs_ > 0);

        int split_tracked_prefs = GetTrackedPrefHistogramCount(
            user_prefs::tracked::kTrackedPrefHistogramUnchanged,
            user_prefs::tracked::kTrackedPrefRegistryValidationSuffix,
            BEGIN_ALLOW_SINGLE_BUCKET + 5);
        EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
                  split_tracked_prefs);
      }

      num_tracked_prefs_ += num_split_tracked_prefs;

      std::string num_tracked_prefs_str =
          base::NumberToString(num_tracked_prefs_);
      EXPECT_TRUE(
          base::WriteFile(num_tracked_prefs_file, num_tracked_prefs_str));
    } else {
      std::string num_tracked_prefs_str;
      EXPECT_TRUE(base::ReadFileToString(num_tracked_prefs_file,
                                         &num_tracked_prefs_str));
      EXPECT_TRUE(
          base::StringToInt(num_tracked_prefs_str, &num_tracked_prefs_));
    }
  }

 protected:
  // Called from the PRE_ test's body. Overrides should use it to setup
  // preferences through Chrome.
  virtual void SetupPreferences() = 0;

  // Called prior to the main test launching its browser. Overrides should use
  // it to attack preferences. |(un)protected_preferences| represent the state
  // on disk prior to launching the main test, they can be modified by this
  // method and modifications will be flushed back to disk before launching the
  // main test. |unprotected_preferences| is never NULL, |protected_preferences|
  // may be NULL if in PROTECTION_DISABLED_ON_PLATFORM mode.
  virtual void AttackPreferencesOnDisk(
      base::Value::Dict* unprotected_preferences,
      base::Value::Dict* protected_preferences) = 0;

  // Called from the body of the main test. Overrides should use it to verify
  // that the browser had the desired reaction when faced when the attack
  // orchestrated in AttackPreferencesOnDisk().
  virtual void VerifyReactionToPrefAttack() = 0;

  int num_tracked_prefs() const { return num_tracked_prefs_; }

  const SettingsProtectionLevel protection_level_;

  base::HistogramTester histograms_;

 private:
  SettingsProtectionLevel GetProtectionLevel() {
    if (!ProfilePrefStoreManager::kPlatformSupportsPreferenceTracking)
      return PROTECTION_DISABLED_ON_PLATFORM;

#if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC)
    // The strongest mode is enforced on Windows and MacOS in the absence of a
    // field trial.
    return PROTECTION_ENABLED_ALL;
#else
    return PROTECTION_DISABLED_FOR_GROUP;
#endif  // BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC)
  }

  int num_tracked_prefs_;

#if BUILDFLAG(IS_WIN)
  std::wstring registry_key_for_external_validation_;
#endif
};

}  // namespace

// Verifies that nothing is reset when nothing is tampered with.
// Also sanity checks that the expected preferences files are in place.
class PrefHashBrowserTestUnchangedDefault : public PrefHashBrowserTestBase {
 public:
  void SetupPreferences() override {
    // Default Chrome setup.
  }

  void AttackPreferencesOnDisk(
      base::Value::Dict* unprotected_preferences,
      base::Value::Dict* protected_preferences) override {
    // No attack.
  }

  void VerifyReactionToPrefAttack() override {
    // Expect all prefs to be reported as Unchanged with no resets.
    EXPECT_EQ(
        protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
            ? num_tracked_prefs()
            : 0,
        GetTrackedPrefHistogramCount(
            user_prefs::tracked::kTrackedPrefHistogramUnchanged, ALLOW_ANY));
    EXPECT_EQ(0, GetTrackedPrefHistogramCount(
                     user_prefs::tracked::kTrackedPrefHistogramWantedReset,
                     ALLOW_NONE));
    EXPECT_EQ(0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramReset, ALLOW_NONE));

    // Nothing else should have triggered.
    EXPECT_EQ(
        0, GetTrackedPrefHistogramCount(
               user_prefs::tracked::kTrackedPrefHistogramChanged, ALLOW_NONE));
    EXPECT_EQ(
        0, GetTrackedPrefHistogramCount(
               user_prefs::tracked::kTrackedPrefHistogramCleared, ALLOW_NONE));
    EXPECT_EQ(0, GetTrackedPrefHistogramCount(
                     user_prefs::tracked::kTrackedPrefHistogramInitialized,
                     ALLOW_NONE));
    EXPECT_EQ(0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramTrustedInitialized,
                  ALLOW_NONE));
    EXPECT_EQ(0, GetTrackedPrefHistogramCount(
                     user_prefs::tracked::kTrackedPrefHistogramNullInitialized,
                     ALLOW_NONE));

    histograms_.ExpectUniqueSample(
        DefaultSearchManager::kDefaultSearchEngineMirroredMetric, true,
#if BUILDFLAG(IS_CHROMEOS)
        2);  // CHROMEOS doesn't support Preference tracking.
#else
        1);
#endif  // BUILDFLAG(IS_CHROMEOS)

    if (SupportsRegistryValidation()) {
      // Expect all prefs to be reported as Unchanged.
      EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
                    ? num_tracked_prefs()
                    : 0,
                GetTrackedPrefHistogramCount(
                    user_prefs::tracked::kTrackedPrefHistogramUnchanged,
                    user_prefs::tracked::kTrackedPrefRegistryValidationSuffix,
                    ALLOW_ANY));
    }
  }
};

PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUnchangedDefault, UnchangedDefault);

// Augments PrefHashBrowserTestUnchangedDefault to confirm that nothing is reset
// when nothing is tampered with, even if Chrome itself wrote custom prefs in
// its last run.
class PrefHashBrowserTestUnchangedCustom
    : public PrefHashBrowserTestUnchangedDefault {
 public:
  void SetupPreferences() override {
    profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com");

    InstallExtensionWithUIAutoConfirm(test_data_dir_.AppendASCII("good.crx"),
                                      1);
  }

  void VerifyReactionToPrefAttack() override {
    // Make sure the settings written in the last run stuck.
    EXPECT_EQ("http://example.com",
              profile()->GetPrefs()->GetString(prefs::kHomePage));

    EXPECT_TRUE(extension_registry()->enabled_extensions().GetByID(kGoodCrxId));

    // Reaction should be identical to unattacked default prefs.
    PrefHashBrowserTestUnchangedDefault::VerifyReactionToPrefAttack();
  }
};

PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUnchangedCustom, UnchangedCustom);

// Verifies that cleared prefs are reported.
class PrefHashBrowserTestClearedAtomic : public PrefHashBrowserTestBase {
 public:
  void SetupPreferences() override {
    profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com");
  }

  void AttackPreferencesOnDisk(
      base::Value::Dict* unprotected_preferences,
      base::Value::Dict* protected_preferences) override {
    base::Value::Dict* selected_prefs =
        protection_level_ >= PROTECTION_ENABLED_BASIC ? protected_preferences
                                                      : unprotected_preferences;
    // |selected_prefs| should never be NULL under the protection level picking
    // it.
    EXPECT_TRUE(selected_prefs);
    EXPECT_TRUE(selected_prefs->Remove(prefs::kHomePage));
  }

  void VerifyReactionToPrefAttack() override {
    // The clearance of homepage should have been noticed (as pref #2 being
    // cleared), but shouldn't have triggered a reset (as there is nothing we
    // can do when the pref is already gone).
    EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramCleared,
                  BEGIN_ALLOW_SINGLE_BUCKET + 2));
    EXPECT_EQ(
        protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
            ? num_tracked_prefs() - 1
            : 0,
        GetTrackedPrefHistogramCount(
            user_prefs::tracked::kTrackedPrefHistogramUnchanged, ALLOW_ANY));
    EXPECT_EQ(0, GetTrackedPrefHistogramCount(
                     user_prefs::tracked::kTrackedPrefHistogramWantedReset,
                     ALLOW_NONE));
    EXPECT_EQ(0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramReset, ALLOW_NONE));

    // Nothing else should have triggered.
    EXPECT_EQ(
        0, GetTrackedPrefHistogramCount(
               user_prefs::tracked::kTrackedPrefHistogramChanged, ALLOW_NONE));
    EXPECT_EQ(0, GetTrackedPrefHistogramCount(
                     user_prefs::tracked::kTrackedPrefHistogramInitialized,
                     ALLOW_NONE));
    EXPECT_EQ(0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramTrustedInitialized,
                  ALLOW_NONE));
    EXPECT_EQ(0, GetTrackedPrefHistogramCount(
                     user_prefs::tracked::kTrackedPrefHistogramNullInitialized,
                     ALLOW_NONE));

    if (SupportsRegistryValidation()) {
      // Expect homepage clearance to have been noticed by registry validation.
      EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
                GetTrackedPrefHistogramCount(
                    user_prefs::tracked::kTrackedPrefHistogramCleared,
                    user_prefs::tracked::kTrackedPrefRegistryValidationSuffix,
                    BEGIN_ALLOW_SINGLE_BUCKET + 2));
    }
  }
};

PREF_HASH_BROWSER_TEST(PrefHashBrowserTestClearedAtomic, ClearedAtomic);

// Verifies that clearing the MACs results in untrusted Initialized pings for
// non-null protected prefs.
class PrefHashBrowserTestUntrustedInitialized : public PrefHashBrowserTestBase {
 public:
  void SetupPreferences() override {
    // Explicitly set the DSE (it's otherwise NULL by default, preventing
    // thorough testing of the PROTECTION_ENABLED_DSE level).
    DefaultSearchManager default_search_manager(
        profile()->GetPrefs(),
        search_engines::SearchEngineChoiceServiceFactory::GetForProfile(
            profile()),
        CHECK_DEREF(TemplateURLPrepopulateData::ResolverFactory::GetForProfile(
            profile())),
        DefaultSearchManager::ObserverCallback());
    DefaultSearchManager::Source dse_source =
        static_cast<DefaultSearchManager::Source>(-1);

    const TemplateURLData* default_template_url_data =
        default_search_manager.GetDefaultSearchEngine(&dse_source);
    EXPECT_EQ(DefaultSearchManager::FROM_FALLBACK, dse_source);

    default_search_manager.SetUserSelectedDefaultSearchEngine(
        *default_template_url_data);

    default_search_manager.GetDefaultSearchEngine(&dse_source);
    EXPECT_EQ(DefaultSearchManager::FROM_USER, dse_source);

    // Also explicitly set an atomic pref that falls under
    // PROTECTION_ENABLED_BASIC.
    profile()->GetPrefs()->SetInteger(prefs::kRestoreOnStartup,
                                      SessionStartupPref::URLS);
  }

  void AttackPreferencesOnDisk(
      base::Value::Dict* unprotected_preferences,
      base::Value::Dict* protected_preferences) override {
    unprotected_preferences->RemoveByDottedPath("protection.macs");
    if (protected_preferences)
      protected_preferences->RemoveByDottedPath("protection.macs");
  }

  void VerifyReactionToPrefAttack() override {
    // Preferences that are NULL by default will be NullInitialized.
    int num_null_values = GetTrackedPrefHistogramCount(
        user_prefs::tracked::kTrackedPrefHistogramNullInitialized, ALLOW_ANY);
    EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM,
              num_null_values > 0);
    if (num_null_values > 0) {
      // This test requires that at least 3 prefs be non-null (extensions, DSE,
      // and 1 atomic pref explictly set for this test above).
      EXPECT_GE(num_tracked_prefs() - num_null_values, 3);
    }

    // Expect all non-null prefs to be reported as Initialized (with
    // accompanying resets or wanted resets based on the current protection
    // level).
    EXPECT_EQ(
        num_tracked_prefs() - num_null_values,
        GetTrackedPrefHistogramCount(
            user_prefs::tracked::kTrackedPrefHistogramInitialized, ALLOW_ANY));

    int num_protected_prefs = 0;
    // A switch statement falling through each protection level in decreasing
    // levels of protection to add expectations for each level which augments
    // the previous one.
    switch (protection_level_) {
      case PROTECTION_ENABLED_ALL:
      case PROTECTION_ENABLED_EXTENSIONS:
        ++num_protected_prefs;
        [[fallthrough]];
      case PROTECTION_ENABLED_DSE:
        ++num_protected_prefs;
        [[fallthrough]];
      case PROTECTION_ENABLED_BASIC:
        num_protected_prefs += num_tracked_prefs() - num_null_values - 2;
        [[fallthrough]];
      case PROTECTION_DISABLED_FOR_GROUP:
      case PROTECTION_DISABLED_ON_PLATFORM:
        // No protection.
        break;
    }

    EXPECT_EQ(
        num_tracked_prefs() - num_null_values - num_protected_prefs,
        GetTrackedPrefHistogramCount(
            user_prefs::tracked::kTrackedPrefHistogramWantedReset, ALLOW_ANY));
    EXPECT_EQ(num_protected_prefs,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramReset, ALLOW_ANY));

    // Explicitly verify the result of reported resets.

    DefaultSearchManager default_search_manager(
        profile()->GetPrefs(),
        search_engines::SearchEngineChoiceServiceFactory::GetForProfile(
            profile()),
        CHECK_DEREF(TemplateURLPrepopulateData::ResolverFactory::GetForProfile(
            profile())),
        DefaultSearchManager::ObserverCallback());
    DefaultSearchManager::Source dse_source =
        static_cast<DefaultSearchManager::Source>(-1);
    default_search_manager.GetDefaultSearchEngine(&dse_source);
    EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_DSE
                  ? DefaultSearchManager::FROM_USER
                  : DefaultSearchManager::FROM_FALLBACK,
              dse_source);

    EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_BASIC,
              profile()->GetPrefs()->GetInteger(prefs::kRestoreOnStartup) ==
                  SessionStartupPref::URLS);

    // Nothing else should have triggered.
    EXPECT_EQ(0, GetTrackedPrefHistogramCount(
                     user_prefs::tracked::kTrackedPrefHistogramUnchanged,
                     ALLOW_NONE));
    EXPECT_EQ(
        0, GetTrackedPrefHistogramCount(
               user_prefs::tracked::kTrackedPrefHistogramChanged, ALLOW_NONE));
    EXPECT_EQ(
        0, GetTrackedPrefHistogramCount(
               user_prefs::tracked::kTrackedPrefHistogramCleared, ALLOW_NONE));

    if (SupportsRegistryValidation()) {
      // The MACs have been cleared but the preferences have not been tampered.
      // The registry should report all prefs as unchanged.
      EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
                    ? num_tracked_prefs()
                    : 0,
                GetTrackedPrefHistogramCount(
                    user_prefs::tracked::kTrackedPrefHistogramUnchanged,
                    user_prefs::tracked::kTrackedPrefRegistryValidationSuffix,
                    ALLOW_ANY));
    }
  }
};

PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUntrustedInitialized,
                       UntrustedInitialized);

// Verifies that changing an atomic pref results in it being reported (and reset
// if the protection level allows it).
class PrefHashBrowserTestChangedAtomic : public PrefHashBrowserTestBase {
 public:
  void SetupPreferences() override {
    profile()->GetPrefs()->SetInteger(prefs::kRestoreOnStartup,
                                      SessionStartupPref::URLS);

    ScopedListPrefUpdate update(profile()->GetPrefs(),
                                prefs::kURLsToRestoreOnStartup);
    update->Append("http://example.com");
  }

  void AttackPreferencesOnDisk(
      base::Value::Dict* unprotected_preferences,
      base::Value::Dict* protected_preferences) override {
    base::Value::Dict* selected_prefs =
        protection_level_ >= PROTECTION_ENABLED_BASIC ? protected_preferences
                                                      : unprotected_preferences;
    // `selected_prefs` should never be NULL under the protection level picking
    // it.
    ASSERT_TRUE(selected_prefs);
    base::Value::List* startup_urls =
        selected_prefs->FindListByDottedPath(prefs::kURLsToRestoreOnStartup);
    ASSERT_TRUE(startup_urls);
    EXPECT_EQ(1U, startup_urls->size());
    startup_urls->Append("http://example.org");
  }

  void VerifyReactionToPrefAttack() override {
    // Expect a single Changed event for tracked pref #4 (startup URLs).
    EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramChanged,
                  BEGIN_ALLOW_SINGLE_BUCKET + 4));
    EXPECT_EQ(
        protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
            ? num_tracked_prefs() - 1
            : 0,
        GetTrackedPrefHistogramCount(
            user_prefs::tracked::kTrackedPrefHistogramUnchanged, ALLOW_ANY));

    EXPECT_EQ((protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
               protection_level_ < PROTECTION_ENABLED_BASIC)
                  ? 1
                  : 0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramWantedReset,
                  BEGIN_ALLOW_SINGLE_BUCKET + 4));
    EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_BASIC ? 1 : 0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramReset,
                  BEGIN_ALLOW_SINGLE_BUCKET + 4));

// TODO(gab): This doesn't work on OS_CHROMEOS because we fail to attack
// Preferences.
#if !BUILDFLAG(IS_CHROMEOS)
    // Explicitly verify the result of reported resets.
    EXPECT_EQ(
        protection_level_ >= PROTECTION_ENABLED_BASIC ? 0U : 2U,
        profile()->GetPrefs()->GetList(prefs::kURLsToRestoreOnStartup).size());
#endif

    // Nothing else should have triggered.
    EXPECT_EQ(
        0, GetTrackedPrefHistogramCount(
               user_prefs::tracked::kTrackedPrefHistogramCleared, ALLOW_NONE));
    EXPECT_EQ(0, GetTrackedPrefHistogramCount(
                     user_prefs::tracked::kTrackedPrefHistogramInitialized,
                     ALLOW_NONE));
    EXPECT_EQ(0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramTrustedInitialized,
                  ALLOW_NONE));
    EXPECT_EQ(0, GetTrackedPrefHistogramCount(
                     user_prefs::tracked::kTrackedPrefHistogramNullInitialized,
                     ALLOW_NONE));

    if (SupportsRegistryValidation()) {
      // Expect a single Changed event for tracked pref #4 (startup URLs).
      EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
                GetTrackedPrefHistogramCount(
                    user_prefs::tracked::kTrackedPrefHistogramChanged,
                    user_prefs::tracked::kTrackedPrefRegistryValidationSuffix,
                    BEGIN_ALLOW_SINGLE_BUCKET + 4));
    }
  }
};

PREF_HASH_BROWSER_TEST(PrefHashBrowserTestChangedAtomic, ChangedAtomic);

// Verifies that changing or adding an entry in a split pref results in both
// items being reported (and remove if the protection level allows it).
class PrefHashBrowserTestChangedSplitPref : public PrefHashBrowserTestBase {
 public:
  void SetupPreferences() override {
    InstallExtensionWithUIAutoConfirm(test_data_dir_.AppendASCII("good.crx"),
                                      1);
  }

  void AttackPreferencesOnDisk(
      base::Value::Dict* unprotected_preferences,
      base::Value::Dict* protected_preferences) override {
    base::Value::Dict* selected_prefs =
        protection_level_ >= PROTECTION_ENABLED_EXTENSIONS
            ? protected_preferences
            : unprotected_preferences;
    // |selected_prefs| should never be NULL under the protection level picking
    // it.
    EXPECT_TRUE(selected_prefs);
    base::Value::Dict* extensions_dict = selected_prefs->FindDictByDottedPath(
        extensions::pref_names::kExtensions);
    EXPECT_TRUE(extensions_dict);

    // Tamper with any installed setting for good.crx
    base::Value::Dict* good_crx_dict = extensions_dict->FindDict(kGoodCrxId);
    ASSERT_TRUE(good_crx_dict);

    std::optional<int> good_crx_incognito_access =
        good_crx_dict->FindBool("incognito");
    ASSERT_FALSE(good_crx_incognito_access.has_value());
    good_crx_dict->Set("incognito", true);

    // Drop a fake extension (for the purpose of this test, dropped settings
    // don't need to be valid extension settings).
    base::Value::Dict fake_extension;
    fake_extension.Set("name", "foo");
    extensions_dict->Set(std::string(32, 'a'), std::move(fake_extension));
  }

  void VerifyReactionToPrefAttack() override {
    EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramChanged,
                  BEGIN_ALLOW_SINGLE_BUCKET + 5));

    // Everything else should have remained unchanged.
    EXPECT_EQ(
        protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
            ? num_tracked_prefs() - 1
            : 0,
        GetTrackedPrefHistogramCount(
            user_prefs::tracked::kTrackedPrefHistogramUnchanged, ALLOW_ANY));

    EXPECT_EQ((protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
               protection_level_ < PROTECTION_ENABLED_EXTENSIONS)
                  ? 1
                  : 0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramWantedReset,
                  BEGIN_ALLOW_SINGLE_BUCKET + 5));
    EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_EXTENSIONS ? 1 : 0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramReset,
                  BEGIN_ALLOW_SINGLE_BUCKET + 5));

    EXPECT_EQ(
        protection_level_ < PROTECTION_ENABLED_EXTENSIONS,
        extension_registry()->GetExtensionById(
            kGoodCrxId, extensions::ExtensionRegistry::EVERYTHING) != nullptr);

    // Nothing else should have triggered.
    EXPECT_EQ(
        0, GetTrackedPrefHistogramCount(
               user_prefs::tracked::kTrackedPrefHistogramCleared, ALLOW_NONE));
    EXPECT_EQ(0, GetTrackedPrefHistogramCount(
                     user_prefs::tracked::kTrackedPrefHistogramInitialized,
                     ALLOW_NONE));
    EXPECT_EQ(0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramTrustedInitialized,
                  ALLOW_NONE));
    EXPECT_EQ(0, GetTrackedPrefHistogramCount(
                     user_prefs::tracked::kTrackedPrefHistogramNullInitialized,
                     ALLOW_NONE));

    if (SupportsRegistryValidation()) {
      // Expect that the registry validation caught the invalid MAC in split
      // pref #5 (extensions).
      EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
                GetTrackedPrefHistogramCount(
                    user_prefs::tracked::kTrackedPrefHistogramChanged,
                    user_prefs::tracked::kTrackedPrefRegistryValidationSuffix,
                    BEGIN_ALLOW_SINGLE_BUCKET + 5));
    }
  }
};

PREF_HASH_BROWSER_TEST(PrefHashBrowserTestChangedSplitPref, ChangedSplitPref);

// Verifies that adding a value to unprotected preferences for a key which is
// still using the default (i.e. has no value stored in protected preferences)
// doesn't allow that value to slip in with no valid MAC (regression test for
// http://crbug.com/414554)
class PrefHashBrowserTestUntrustedAdditionToPrefs
    : public PrefHashBrowserTestBase {
 public:
  void SetupPreferences() override {
    // Ensure there is no user-selected value for kRestoreOnStartup.
    EXPECT_FALSE(
        profile()->GetPrefs()->GetUserPrefValue(prefs::kRestoreOnStartup));
  }

  void AttackPreferencesOnDisk(
      base::Value::Dict* unprotected_preferences,
      base::Value::Dict* protected_preferences) override {
    unprotected_preferences->SetByDottedPath(
        prefs::kRestoreOnStartup, static_cast<int>(SessionStartupPref::LAST));
  }

  void VerifyReactionToPrefAttack() override {
    // Expect a single Changed event for tracked pref #3 (kRestoreOnStartup) if
    // not protecting; if protection is enabled the change should be a no-op.
    int changed_expected =
        protection_level_ == PROTECTION_DISABLED_FOR_GROUP ? 1 : 0;
    EXPECT_EQ((protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
               protection_level_ < PROTECTION_ENABLED_BASIC)
                  ? changed_expected
                  : 0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramChanged,
                  BEGIN_ALLOW_SINGLE_BUCKET + 3));
    EXPECT_EQ(
        protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
            ? num_tracked_prefs() - changed_expected
            : 0,
        GetTrackedPrefHistogramCount(
            user_prefs::tracked::kTrackedPrefHistogramUnchanged, ALLOW_ANY));

    EXPECT_EQ((protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
               protection_level_ < PROTECTION_ENABLED_BASIC)
                  ? 1
                  : 0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramWantedReset,
                  BEGIN_ALLOW_SINGLE_BUCKET + 3));
    EXPECT_EQ(0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramReset, ALLOW_NONE));

    // Nothing else should have triggered.
    EXPECT_EQ(
        0, GetTrackedPrefHistogramCount(
               user_prefs::tracked::kTrackedPrefHistogramCleared, ALLOW_NONE));
    EXPECT_EQ(0, GetTrackedPrefHistogramCount(
                     user_prefs::tracked::kTrackedPrefHistogramInitialized,
                     ALLOW_NONE));
    EXPECT_EQ(0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramTrustedInitialized,
                  ALLOW_NONE));
    EXPECT_EQ(0, GetTrackedPrefHistogramCount(
                     user_prefs::tracked::kTrackedPrefHistogramNullInitialized,
                     ALLOW_NONE));

    if (SupportsRegistryValidation()) {
      EXPECT_EQ((protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
                 protection_level_ < PROTECTION_ENABLED_BASIC)
                    ? changed_expected
                    : 0,
                GetTrackedPrefHistogramCount(
                    user_prefs::tracked::kTrackedPrefHistogramChanged,
                    user_prefs::tracked::kTrackedPrefRegistryValidationSuffix,
                    BEGIN_ALLOW_SINGLE_BUCKET + 3));
    }
  }
};

PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUntrustedAdditionToPrefs,
                       UntrustedAdditionToPrefs);

// Verifies that adding a value to unprotected preferences while wiping a
// user-selected value from protected preferences doesn't allow that value to
// slip in with no valid MAC (regression test for http://crbug.com/414554).
class PrefHashBrowserTestUntrustedAdditionToPrefsAfterWipe
    : public PrefHashBrowserTestBase {
 public:
  void SetupPreferences() override {
    profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com");
  }

  void AttackPreferencesOnDisk(
      base::Value::Dict* unprotected_preferences,
      base::Value::Dict* protected_preferences) override {
    // Set or change the value in Preferences to the attacker's choice.
    unprotected_preferences->Set(prefs::kHomePage, "http://example.net");
    // Clear the value in Secure Preferences, if any.
    if (protected_preferences)
      protected_preferences->Remove(prefs::kHomePage);
  }

  void VerifyReactionToPrefAttack() override {
    // Expect a single Changed event for tracked pref #2 (kHomePage) if
    // not protecting; if protection is enabled the change should be a Cleared.
    int changed_expected =
        protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
                protection_level_ < PROTECTION_ENABLED_BASIC
            ? 1
            : 0;
    int cleared_expected =
        protection_level_ >= PROTECTION_ENABLED_BASIC
        ? 1 : 0;
    EXPECT_EQ(changed_expected,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramChanged,
                  BEGIN_ALLOW_SINGLE_BUCKET + 2));
    EXPECT_EQ(cleared_expected,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramCleared,
                  BEGIN_ALLOW_SINGLE_BUCKET + 2));
    EXPECT_EQ(
        protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
            ? num_tracked_prefs() - changed_expected - cleared_expected
            : 0,
        GetTrackedPrefHistogramCount(
            user_prefs::tracked::kTrackedPrefHistogramUnchanged, ALLOW_ANY));

    EXPECT_EQ(changed_expected,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramWantedReset,
                  BEGIN_ALLOW_SINGLE_BUCKET + 2));
    EXPECT_EQ(0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramReset, ALLOW_NONE));

    // Nothing else should have triggered.
    EXPECT_EQ(0, GetTrackedPrefHistogramCount(
                     user_prefs::tracked::kTrackedPrefHistogramInitialized,
                     ALLOW_NONE));
    EXPECT_EQ(0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramTrustedInitialized,
                  ALLOW_NONE));
    EXPECT_EQ(0, GetTrackedPrefHistogramCount(
                     user_prefs::tracked::kTrackedPrefHistogramNullInitialized,
                     ALLOW_NONE));

    if (SupportsRegistryValidation()) {
      EXPECT_EQ(changed_expected,
                GetTrackedPrefHistogramCount(
                    user_prefs::tracked::kTrackedPrefHistogramChanged,
                    user_prefs::tracked::kTrackedPrefRegistryValidationSuffix,
                    BEGIN_ALLOW_SINGLE_BUCKET + 2));
      EXPECT_EQ(cleared_expected,
                GetTrackedPrefHistogramCount(
                    user_prefs::tracked::kTrackedPrefHistogramCleared,
                    user_prefs::tracked::kTrackedPrefRegistryValidationSuffix,
                    BEGIN_ALLOW_SINGLE_BUCKET + 2));
    }
  }
};

PREF_HASH_BROWSER_TEST(PrefHashBrowserTestUntrustedAdditionToPrefsAfterWipe,
                       UntrustedAdditionToPrefsAfterWipe);

#if BUILDFLAG(IS_WIN)
class PrefHashBrowserTestRegistryValidationFailure
    : public PrefHashBrowserTestBase {
 public:
  void SetupPreferences() override {
    profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com");
  }

  void AttackPreferencesOnDisk(
      base::Value::Dict* unprotected_preferences,
      base::Value::Dict* protected_preferences) override {
    std::wstring registry_key =
        GetRegistryPathForTestProfile() + L"\\PreferenceMACs\\Default";
    base::win::RegKey key;
    ASSERT_EQ(ERROR_SUCCESS, key.Open(HKEY_CURRENT_USER, registry_key.c_str(),
                                      KEY_SET_VALUE | KEY_WOW64_32KEY));
    // An incorrect hash should still have the correct size.
    ASSERT_EQ(ERROR_SUCCESS,
              key.WriteValue(L"homepage", std::wstring(64, 'A').c_str()));
  }

  void VerifyReactionToPrefAttack() override {
    EXPECT_EQ(
        protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
            ? num_tracked_prefs()
            : 0,
        GetTrackedPrefHistogramCount(
            user_prefs::tracked::kTrackedPrefHistogramUnchanged, ALLOW_ANY));

    if (SupportsRegistryValidation()) {
      // Expect that the registry validation caught the invalid MAC for pref #2
      // (homepage).
      EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
                GetTrackedPrefHistogramCount(
                    user_prefs::tracked::kTrackedPrefHistogramChanged,
                    user_prefs::tracked::kTrackedPrefRegistryValidationSuffix,
                    BEGIN_ALLOW_SINGLE_BUCKET + 2));
    }
  }
};

PREF_HASH_BROWSER_TEST(PrefHashBrowserTestRegistryValidationFailure,
                       RegistryValidationFailure);
#endif

// Verifies that all preferences related to choice of default search engine are
// protected.
class PrefHashBrowserTestDefaultSearch : public PrefHashBrowserTestBase {
 public:
  void SetupPreferences() override {
    // Set user selected default search engine.
    DefaultSearchManager default_search_manager(
        profile()->GetPrefs(),
        search_engines::SearchEngineChoiceServiceFactory::GetForProfile(
            profile()),
        CHECK_DEREF(TemplateURLPrepopulateData::ResolverFactory::GetForProfile(
            profile())),
        DefaultSearchManager::ObserverCallback());
    DefaultSearchManager::Source dse_source =
        static_cast<DefaultSearchManager::Source>(-1);

    TemplateURLData user_dse;
    user_dse.SetKeyword(u"userkeyword");
    user_dse.SetShortName(u"username");
    user_dse.SetURL("http://user_default_engine/search?q=good_user_query");
    default_search_manager.SetUserSelectedDefaultSearchEngine(user_dse);

    const TemplateURLData* current_dse =
        default_search_manager.GetDefaultSearchEngine(&dse_source);
    EXPECT_EQ(DefaultSearchManager::FROM_USER, dse_source);
    EXPECT_EQ(current_dse->keyword(), u"userkeyword");
    EXPECT_EQ(current_dse->short_name(), u"username");
    EXPECT_EQ(current_dse->url(),
              "http://user_default_engine/search?q=good_user_query");
  }

  void AttackPreferencesOnDisk(
      base::Value::Dict* unprotected_preferences,
      base::Value::Dict* protected_preferences) override {
    static constexpr char default_search_provider_data[] = R"(
    {
      "default_search_provider_data" : {
        "template_url_data" : {
          "keyword" : "badkeyword",
          "short_name" : "badname",
          "url" : "http://bad_default_engine/search?q=dirty_user_query"
        }
      }
    })";
    static constexpr char search_provider_overrides[] = R"(
    {
      "search_provider_overrides" : [
        {
          "keyword" : "badkeyword",
          "name" : "badname",
          "search_url" :
          "http://bad_default_engine/search?q=dirty_user_query", "encoding" :
          "utf-8", "id" : 1
        }, {
          "keyword" : "badkeyword2",
          "name" : "badname2",
          "search_url" :
          "http://bad_default_engine2/search?q=dirty_user_query", "encoding"
          : "utf-8", "id" : 2
        }
      ]
    })";

    // Try to override default search in all three of available preferences.
    base::Value attack1 = *base::JSONReader::Read(default_search_provider_data);
    base::Value attack2 = *base::JSONReader::Read(search_provider_overrides);
    unprotected_preferences->Merge(attack1.GetDict().Clone());
    unprotected_preferences->Merge(attack2.GetDict().Clone());
    if (protected_preferences) {
      // Override here, too.
      protected_preferences->Merge(attack1.GetDict().Clone());
      protected_preferences->Merge(attack2.GetDict().Clone());
    }
  }

  void VerifyReactionToPrefAttack() override {
    DefaultSearchManager default_search_manager(
        profile()->GetPrefs(),
        search_engines::SearchEngineChoiceServiceFactory::GetForProfile(
            profile()),
        CHECK_DEREF(TemplateURLPrepopulateData::ResolverFactory::GetForProfile(
            profile())),
        DefaultSearchManager::ObserverCallback());
    DefaultSearchManager::Source dse_source =
        static_cast<DefaultSearchManager::Source>(-1);

    const TemplateURLData* current_dse =
        default_search_manager.GetDefaultSearchEngine(&dse_source);

    if (protection_level_ < PROTECTION_ENABLED_DSE) {
// This doesn't work on OS_CHROMEOS because we fail to attack Preferences.
#if !BUILDFLAG(IS_CHROMEOS)
      // Attack is successful.
      EXPECT_EQ(DefaultSearchManager::FROM_USER, dse_source);
      EXPECT_EQ(current_dse->keyword(), u"badkeyword");
      EXPECT_EQ(current_dse->short_name(), u"badname");
      EXPECT_EQ(current_dse->url(),
                "http://bad_default_engine/search?q=dirty_user_query");
#endif
    } else {
      // Attack fails.
      EXPECT_EQ(DefaultSearchManager::FROM_FALLBACK, dse_source);
      EXPECT_NE(current_dse->keyword(), u"badkeyword");
      EXPECT_NE(current_dse->short_name(), u"badname");
      EXPECT_NE(current_dse->url(),
                "http://bad_default_engine/search?q=dirty_user_query");
    }
// This doesn't work on OS_CHROMEOS because we fail to attack Preferences.
#if !BUILDFLAG(IS_CHROMEOS)
    // This test creates 2 DefaultSearchManagers, because the browser creates
    // one, and this function creates a second one, so 2 samples are emitted,
    // both attacked by the PRE_ test.
    histograms_.ExpectUniqueSample(
        DefaultSearchManager::kDefaultSearchEngineMirroredMetric, false, 2);
#endif  // !BUILDFLAG(IS_CHROMEOS)
  }
};

PREF_HASH_BROWSER_TEST(PrefHashBrowserTestDefaultSearch, SearchProtected);

// Verifies that we handle a protected Dict preference being changed to an
// unexpected type (int). See https://crbug.com/1512724.
class PrefHashBrowserTestExtensionDictTypeChanged
    : public PrefHashBrowserTestBase {
 public:
  void SetupPreferences() override {
    InstallExtensionWithUIAutoConfirm(test_data_dir_.AppendASCII("good.crx"),
                                      1);
  }

  void AttackPreferencesOnDisk(
      base::Value::Dict* unprotected_preferences,
      base::Value::Dict* protected_preferences) override {
    base::Value::Dict* const selected_prefs =
        protection_level_ >= PROTECTION_ENABLED_EXTENSIONS
            ? protected_preferences
            : unprotected_preferences;
    // |selected_prefs| should never be NULL under the protection level picking
    // it.
    ASSERT_TRUE(selected_prefs);
    EXPECT_TRUE(selected_prefs->FindDictByDottedPath(
        extensions::pref_names::kExtensions));
    // Overwrite with an int (wrong type).
    selected_prefs->SetByDottedPath(extensions::pref_names::kExtensions, 13);
    EXPECT_EQ(13, selected_prefs
                      ->FindIntByDottedPath(extensions::pref_names::kExtensions)
                      .value());
  }

  void VerifyReactionToPrefAttack() override {
    // Setting the extensions dict to an invalid type gets noticed regardless
    // of protection level. This implementation just happened to be easier and
    // it doesn't seem important to not protect the kExtensions from being the
    // wrong type at any protection level. PrefService will correct the
    // type either way.
    EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramCleared,
                  BEGIN_ALLOW_SINGLE_BUCKET + 5));

    // Expect a dictionary for extensions. This shouldn't somehow explode.
    profile()->GetPrefs()->GetDict(extensions::pref_names::kExtensions);
  }
};

PREF_HASH_BROWSER_TEST(PrefHashBrowserTestExtensionDictTypeChanged,
                       ExtensionDictTypeChanged);

// Verifies that changing the account value of a tracked pref results in it
// being reported under the same id as the local value (and reset if the
// protection level allows it).
class PrefHashBrowserTestAccountValueUntrustedAddition
    : public PrefHashBrowserTestBase {
 public:
  PrefHashBrowserTestAccountValueUntrustedAddition()
      : feature_list_(switches::kEnablePreferencesAccountStorage) {}

  void SetupPreferences() override {
    EXPECT_FALSE(profile()->GetPrefs()->GetBoolean(prefs::kShowHomeButton));
  }

  void AttackPreferencesOnDisk(
      base::Value::Dict* unprotected_preferences,
      base::Value::Dict* protected_preferences) override {
    base::Value::Dict* selected_prefs =
        protection_level_ >= PROTECTION_ENABLED_BASIC ? protected_preferences
                                                      : unprotected_preferences;
    // `selected_prefs` should never be NULL under the protection level picking
    // it.
    ASSERT_TRUE(selected_prefs);
    selected_prefs->SetByDottedPath(
        base::StringPrintf("%s.%s", chrome_prefs::kAccountPreferencesPrefix,
                           prefs::kShowHomeButton),
        true);
  }

  void VerifyReactionToPrefAttack() override {
    // Expect a single Changed event for tracked pref #0 (show home button).
    EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramChanged,
                  BEGIN_ALLOW_SINGLE_BUCKET + 0));
    EXPECT_EQ(
        protection_level_ > PROTECTION_DISABLED_ON_PLATFORM
            ? num_tracked_prefs() - 1
            : 0,
        GetTrackedPrefHistogramCount(
            user_prefs::tracked::kTrackedPrefHistogramUnchanged, ALLOW_ANY));

    EXPECT_EQ((protection_level_ > PROTECTION_DISABLED_ON_PLATFORM &&
               protection_level_ < PROTECTION_ENABLED_BASIC)
                  ? 1
                  : 0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramWantedReset,
                  BEGIN_ALLOW_SINGLE_BUCKET + 0));
    EXPECT_EQ(protection_level_ >= PROTECTION_ENABLED_BASIC ? 1 : 0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramReset,
                  BEGIN_ALLOW_SINGLE_BUCKET + 0));

// TODO(gab): This doesn't work on OS_CHROMEOS because we fail to attack
// Preferences.
#if !BUILDFLAG(IS_CHROMEOS)
    // Explicitly verify the result of reported resets.
    EXPECT_EQ(protection_level_ < PROTECTION_ENABLED_BASIC,
              profile()->GetPrefs()->GetBoolean(prefs::kShowHomeButton));
#endif  // !BUILDFLAG(IS_CHROMEOS)

    // Nothing else should have triggered.
    EXPECT_EQ(
        0, GetTrackedPrefHistogramCount(
               user_prefs::tracked::kTrackedPrefHistogramCleared, ALLOW_NONE));
    EXPECT_EQ(0, GetTrackedPrefHistogramCount(
                     user_prefs::tracked::kTrackedPrefHistogramInitialized,
                     ALLOW_NONE));
    EXPECT_EQ(0,
              GetTrackedPrefHistogramCount(
                  user_prefs::tracked::kTrackedPrefHistogramTrustedInitialized,
                  ALLOW_NONE));
    EXPECT_EQ(0, GetTrackedPrefHistogramCount(
                     user_prefs::tracked::kTrackedPrefHistogramNullInitialized,
                     ALLOW_NONE));

    if (SupportsRegistryValidation()) {
      // Expect a single Changed event for tracked pref #0 (show home button).
      EXPECT_EQ(protection_level_ > PROTECTION_DISABLED_ON_PLATFORM ? 1 : 0,
                GetTrackedPrefHistogramCount(
                    user_prefs::tracked::kTrackedPrefHistogramChanged,
                    user_prefs::tracked::kTrackedPrefRegistryValidationSuffix,
                    BEGIN_ALLOW_SINGLE_BUCKET + 0));
    }
  }

 private:
  base::test::ScopedFeatureList feature_list_;
};

PREF_HASH_BROWSER_TEST(PrefHashBrowserTestAccountValueUntrustedAddition,
                       AccountValueUntrustedAddition);

// Suffix used to distinguish encrypted hash keys from MAC keys in storage.
const char kEncryptedHashSuffix[] = "_encrypted_hash";
// Base class for tests that need to control the EncryptedPrefHashing
// feature flag.
class PrefHashBrowserTestEncryptedBase : public PrefHashBrowserTestBase {};

// Tests that a tampered encrypted hash is caught and triggers a reset.
class PrefHashBrowserTestEncryptedTampered
    : public PrefHashBrowserTestEncryptedBase {
 public:
  PrefHashBrowserTestEncryptedTampered() {
    // Feature must be ON for both the PRE_ and main test phases.
    feature_list_.InitAndEnableFeature(tracked::kEncryptedPrefHashing);
  }

  void SetupPreferences() override {
    // PRE_ test (feature ON): Set a value to ensure both MAC and encrypted
    // hashes are written.
    profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com");
  }

  void AttackPreferencesOnDisk(
      base::Value::Dict* unprotected_preferences,
      base::Value::Dict* protected_preferences) override {
    // Attack the encrypted hash, leaving the legacy MAC intact.
    base::Value::Dict* selected_prefs =
        protection_level_ >= PROTECTION_ENABLED_BASIC ? protected_preferences
                                                      : unprotected_preferences;
    ASSERT_TRUE(selected_prefs);

    // Hashes are stored in the "protection.macs" dictionary.
    base::Value::Dict* macs_dict =
        selected_prefs->FindDictByDottedPath("protection.macs");
    ASSERT_TRUE(macs_dict);

    const std::string encrypted_hash_key =
        std::string(prefs::kHomePage) + kEncryptedHashSuffix;

    // Verify the key exists, then tamper with it.
    ASSERT_TRUE(macs_dict->contains(encrypted_hash_key));
    macs_dict->Set(encrypted_hash_key, "invalid_tampered_hash");
  }

  void VerifyReactionToPrefAttack() override {
    // Main test (feature ON):
    if (protection_level_ <= PROTECTION_DISABLED_ON_PLATFORM) {
      return;
    }

    // The validation prioritizes the encrypted hash. Since it's invalid, a
    // change should be detected.
    if (protection_level_ >= PROTECTION_ENABLED_BASIC) {
      // The tampered encrypted hash should be detected and trigger a reset.
      histograms_.ExpectUniqueSample(
          user_prefs::tracked::kTrackedPrefHistogramChangedEncrypted,
          2 /* homepage reporting_id */, 1);
      histograms_.ExpectUniqueSample(
          user_prefs::tracked::kTrackedPrefHistogramResetEncrypted,
          2 /* homepage reporting_id */, 1);
      // The pref should now be reset to its default value.
      EXPECT_TRUE(profile()->GetPrefs()->GetString(prefs::kHomePage).empty());
    } else {
      // If enforcement is off, we should want a reset but not perform it.
      histograms_.ExpectUniqueSample(
          user_prefs::tracked::kTrackedPrefHistogramChangedEncrypted,
          2 /* homepage reporting_id */, 1);
      histograms_.ExpectUniqueSample(
          user_prefs::tracked::kTrackedPrefHistogramWantedResetEncrypted,
          2 /* homepage reporting_id */, 1);
      // The pref value should remain as it was on disk.
      EXPECT_EQ("http://example.com",
                profile()->GetPrefs()->GetString(prefs::kHomePage));
    }
  }

 private:
  base::test::ScopedFeatureList feature_list_;
};

PREF_HASH_BROWSER_TEST(PrefHashBrowserTestEncryptedTampered, EncryptedTampered);

// Tests the fallback path: loads prefs with only legacy MACs and verifies
// that new encrypted hashes are created without resetting any values.
class PrefHashBrowserTestEncryptedFallbackAndGeneratingEH
    : public PrefHashBrowserTestEncryptedBase {
 public:
  PrefHashBrowserTestEncryptedFallbackAndGeneratingEH() {
    if (content::IsPreTest()) {
      // PRE_ phase: Feature is explicitly OFF to write only legacy MACs.
      feature_list_.InitWithFeatures({}, {tracked::kEncryptedPrefHashing});
    } else {
      // Main phase: Feature is ON to trigger the fallback and the generation of
      // encrypted hash process.
      feature_list_.InitWithFeatures({tracked::kEncryptedPrefHashing}, {});
    }
  }

  // Runs in the PRE_ test, with the encryption feature OFF.
  void SetupPreferences() override {
    profile()->GetPrefs()->SetString(prefs::kHomePage, "http://example.com");
  }

  // Runs before the main test. Verifies the on-disk state.
  void AttackPreferencesOnDisk(
      base::Value::Dict* unprotected_preferences,
      base::Value::Dict* protected_preferences) override {
    if (protection_level_ <= PROTECTION_DISABLED_ON_PLATFORM) {
      return;
    }

    // The 'macs' dict may be in either pref file depending on platform.
    base::Value::Dict* macs_dict = nullptr;
    if (protected_preferences) {
      macs_dict =
          protected_preferences->FindDictByDottedPath("protection.macs");
    }
    if (!macs_dict) {
      macs_dict =
          unprotected_preferences->FindDictByDottedPath("protection.macs");
    }
    ASSERT_TRUE(macs_dict);

    // VERIFY: The legacy MAC for 'homepage' must exist.
    ASSERT_TRUE(macs_dict->contains(prefs::kHomePage));

    // VERIFY: The encrypted hash for 'homepage' must NOT exist yet.
    const std::string encrypted_hash_key =
        std::string(prefs::kHomePage) + kEncryptedHashSuffix;
    ASSERT_FALSE(macs_dict->contains(encrypted_hash_key));
  }

  // Runs in the main test, with the encryption feature ON.
  void VerifyReactionToPrefAttack() override {
    if (protection_level_ <= PROTECTION_DISABLED_ON_PLATFORM) {
      return;
    }

    // Verify initial load behavior.
    EXPECT_EQ("http://example.com",
              profile()->GetPrefs()->GetString(prefs::kHomePage));

    histograms_.ExpectBucketCount(
        user_prefs::tracked::kTrackedPrefHistogramUnchangedViaHmacFallback,
        2 /* homepage reporting_id */, 1);
    EXPECT_GE(
        GetTrackedPrefHistogramCount(
            user_prefs::tracked::kTrackedPrefHistogramUnchangedViaHmacFallback,
            ALLOW_ANY),
        1);
    histograms_.ExpectTotalCount(
        user_prefs::tracked::kTrackedPrefHistogramReset, 0);

    base::RunLoop run_loop;
    // A write operation is scheduled after the encryptor received.
    profile()->GetPrefs()->CommitPendingWrite(run_loop.QuitClosure());
    run_loop.Run();
#if !BUILDFLAG(IS_CHROMEOS)
    std::optional<base::Value::Dict> final_protected_prefs;
    std::optional<base::Value::Dict> final_unprotected_prefs;
    base::Value::Dict* final_macs_dict = nullptr;

    {
      base::ScopedAllowBlockingForTesting allow_blocking;
      base::FilePath profile_dir = GetProfileDir();
      const base::FilePath protected_pref_file =
          profile_dir.Append(chrome::kSecurePreferencesFilename);
      if (base::PathExists(protected_pref_file)) {
        final_protected_prefs = ReadPrefsDictionary(protected_pref_file);
      }
    }

    if (final_protected_prefs.has_value()) {
      final_macs_dict =
          final_protected_prefs->FindDictByDottedPath("protection.macs");
    }

    if (!final_macs_dict) {
      base::ScopedAllowBlockingForTesting allow_blocking;
      base::FilePath profile_dir = GetProfileDir();
      const base::FilePath unprotected_pref_file =
          profile_dir.Append(chrome::kPreferencesFilename);
      final_unprotected_prefs = ReadPrefsDictionary(unprotected_pref_file);
      ASSERT_TRUE(final_unprotected_prefs.has_value());
      final_macs_dict =
          final_unprotected_prefs->FindDictByDottedPath("protection.macs");
    }
    ASSERT_TRUE(final_macs_dict);

    // VERIFY: The new encrypted hash should now exist on disk.
    const std::string encrypted_hash_key =
        std::string(prefs::kHomePage) + kEncryptedHashSuffix;
    EXPECT_TRUE(final_macs_dict->contains(encrypted_hash_key));
#endif  // #if !BUILDFLAG(IS_CHROMEOS)
  }

 private:
  base::test::ScopedFeatureList feature_list_;
};

PREF_HASH_BROWSER_TEST(PrefHashBrowserTestEncryptedFallbackAndGeneratingEH,
                       EncryptedHashGeneration);

class PrefHashBrowserTestEncryptedSplitPrefFallbackAndGeneratingEH
    : public PrefHashBrowserTestEncryptedBase {
 public:
  PrefHashBrowserTestEncryptedSplitPrefFallbackAndGeneratingEH() {
    if (content::IsPreTest()) {
      // PRE_ phase: Feature is OFF to write only legacy MACs.
      feature_list_.InitWithFeatures({}, {tracked::kEncryptedPrefHashing});
    } else {
      // Main phase: Feature is ON to trigger FallbackAndGeneratingEH.
      feature_list_.InitWithFeatures({tracked::kEncryptedPrefHashing}, {});
    }
  }

  void SetupPreferences() override {
    // This creates a split preference entry for extensions.settings.
    InstallExtensionWithUIAutoConfirm(test_data_dir_.AppendASCII("good.crx"),
                                      1);
  }

  void AttackPreferencesOnDisk(
      base::Value::Dict* unprotected_preferences,
      base::Value::Dict* protected_preferences) override {
    if (protection_level_ <= PROTECTION_DISABLED_ON_PLATFORM) {
      pre_test_state_ok_ = true;
      return;
    }

    base::Value::Dict* macs_dict = nullptr;
    if (protected_preferences) {
      macs_dict =
          protected_preferences->FindDictByDottedPath("protection.macs");
    }
    if (!macs_dict) {
      macs_dict =
          unprotected_preferences->FindDictByDottedPath("protection.macs");
    }

    // Instead of asserting, check if the required legacy hashes were actually
    // written by the PRE_ test.
    if (macs_dict && macs_dict->FindDict(extensions::pref_names::kExtensions)) {
      // State is good, we can proceed.
      pre_test_state_ok_ = true;

      // Now we can safely assert that the encrypted hashes are not yet present.
      const std::string encrypted_hash_key =
          std::string(extensions::pref_names::kExtensions) +
          kEncryptedHashSuffix;
      ASSERT_FALSE(macs_dict->FindDict(encrypted_hash_key));
    } else {
      // The PRE_ test failed to write the legacy hashes. Log a warning and
      // set the flag so the main test verification is skipped.
      pre_test_state_ok_ = false;
    }
  }

  void VerifyReactionToPrefAttack() override {
    if (!pre_test_state_ok_) {
      return;
    }

    if (protection_level_ <= PROTECTION_DISABLED_ON_PLATFORM) {
      return;
    }

    EXPECT_TRUE(extension_registry()->enabled_extensions().GetByID(kGoodCrxId));
    histograms_.ExpectBucketCount(
        user_prefs::tracked::kTrackedPrefHistogramUnchangedViaHmacFallback,
        5 /* extensions.settings reporting_id */, 1);
    histograms_.ExpectTotalCount(
        user_prefs::tracked::kTrackedPrefHistogramReset, 0);

    profile()->GetPrefs()->SetBoolean(prefs::kShowHomeButton, true);
    base::RunLoop run_loop;
    profile()->GetPrefs()->CommitPendingWrite(run_loop.QuitClosure());
    run_loop.Run();
#if !BUILDFLAG(IS_CHROMEOS)
    std::optional<base::Value::Dict> final_protected_prefs;
    std::optional<base::Value::Dict> final_unprotected_prefs;
    base::Value::Dict* final_macs_dict = nullptr;
    {
      base::ScopedAllowBlockingForTesting allow_blocking;
      final_protected_prefs = ReadPrefsDictionary(
          GetProfileDir().Append(chrome::kSecurePreferencesFilename));
      if (final_protected_prefs.has_value()) {
        final_macs_dict =
            final_protected_prefs->FindDictByDottedPath("protection.macs");
      }
    }
    if (!final_macs_dict) {
      base::ScopedAllowBlockingForTesting allow_blocking;
      final_unprotected_prefs = ReadPrefsDictionary(
          GetProfileDir().Append(chrome::kPreferencesFilename));
      if (final_unprotected_prefs.has_value()) {
        final_macs_dict =
            final_unprotected_prefs->FindDictByDottedPath("protection.macs");
      }
    }
    ASSERT_TRUE(final_macs_dict);

    const std::string encrypted_hash_key =
        std::string(extensions::pref_names::kExtensions) + kEncryptedHashSuffix;
    EXPECT_TRUE(final_macs_dict->FindDict(encrypted_hash_key));
#endif  // #if !BUILDFLAG(IS_CHROMEOS)
  }

 private:
  base::test::ScopedFeatureList feature_list_;
  bool pre_test_state_ok_ = false;
};

PREF_HASH_BROWSER_TEST(
    PrefHashBrowserTestEncryptedSplitPrefFallbackAndGeneratingEH,
    EncryptedSplitPrefFallbackAndGeneratingEH);

class PrefHashBrowserTestEncryptedSplitPrefTampered
    : public PrefHashBrowserTestEncryptedBase {
 public:
  PrefHashBrowserTestEncryptedSplitPrefTampered() {
    feature_list_.InitAndEnableFeature(tracked::kEncryptedPrefHashing);
  }

  void SetupPreferences() override {
    InstallExtensionWithUIAutoConfirm(test_data_dir_.AppendASCII("good.crx"),
                                      1);
  }

  void AttackPreferencesOnDisk(
      base::Value::Dict* unprotected_preferences,
      base::Value::Dict* protected_preferences) override {
    if (protection_level_ <= PROTECTION_DISABLED_ON_PLATFORM) {
      return;
    }

    base::Value::Dict* macs_dict = nullptr;
    if (protected_preferences) {
      macs_dict =
          protected_preferences->FindDictByDottedPath("protection.macs");
    }
    if (!macs_dict) {
      macs_dict =
          unprotected_preferences->FindDictByDottedPath("protection.macs");
    }
    ASSERT_TRUE(macs_dict);

    const std::string encrypted_hash_key =
        std::string(extensions::pref_names::kExtensions) + kEncryptedHashSuffix;
    base::Value::Dict* encrypted_split_hashes =
        macs_dict->FindDict(encrypted_hash_key);

    if (encrypted_split_hashes) {
      // Hashes exist, so we can perform the attack.
      encrypted_split_hashes->Set(kGoodCrxId, "invalid_split_hash");
      was_attacked_ = true;
    } else {
      // This indicates the race condition occurred. The test will still run but
      // won't be able to verify the tampering-detection logic.
      was_attacked_ = false;
    }
  }

  void VerifyReactionToPrefAttack() override {
    if (!was_attacked_) {
      // If we couldn't perform the attack, we can't verify the reaction.
      // The WARNING log from the attack phase will serve as the failure signal.
      return;
    }

    if (protection_level_ < PROTECTION_ENABLED_EXTENSIONS) {
      EXPECT_TRUE(
          extension_registry()->enabled_extensions().GetByID(kGoodCrxId));
      histograms_.ExpectBucketCount(
          user_prefs::tracked::kTrackedPrefHistogramChangedEncrypted, 5, 1);
      histograms_.ExpectBucketCount(
          user_prefs::tracked::kTrackedPrefHistogramWantedResetEncrypted, 5, 1);
    } else {
      EXPECT_FALSE(
          extension_registry()->enabled_extensions().GetByID(kGoodCrxId));
      histograms_.ExpectBucketCount(
          user_prefs::tracked::kTrackedPrefHistogramChangedEncrypted,
          5 /* extensions.settings reporting_id */, 1);
      histograms_.ExpectBucketCount(
          user_prefs::tracked::kTrackedPrefHistogramResetEncrypted, 5, 1);
    }
  }

 private:
  base::test::ScopedFeatureList feature_list_;
  // Member variable to track if the attack was successfully performed.
  bool was_attacked_ = false;
};

PREF_HASH_BROWSER_TEST(PrefHashBrowserTestEncryptedSplitPrefTampered,
                       EncryptedSplitPrefTampered);

class PrefHashBrowserTestEncryptedHashIsAuthoritative
    : public PrefHashBrowserTestEncryptedBase {
 public:
  PrefHashBrowserTestEncryptedHashIsAuthoritative() {
    feature_list_.InitAndEnableFeature(tracked::kEncryptedPrefHashing);
  }

  void SetupPreferences() override {
    // In the PRE_ test, set a value. This will cause both a valid legacy MAC
    // and a valid encrypted hash to be written to disk on shutdown.
    profile()->GetPrefs()->SetString(prefs::kHomePage, "http://good.com");
  }

  void AttackPreferencesOnDisk(
      base::Value::Dict* unprotected_preferences,
      base::Value::Dict* protected_preferences) override {
    if (protection_level_ <= PROTECTION_DISABLED_ON_PLATFORM) {
      return;
    }

    base::Value::Dict* macs_dict = nullptr;
    if (protected_preferences) {
      macs_dict =
          protected_preferences->FindDictByDottedPath("protection.macs");
    }
    if (!macs_dict) {
      macs_dict =
          unprotected_preferences->FindDictByDottedPath("protection.macs");
    }
    ASSERT_TRUE(macs_dict);

    const std::string encrypted_hash_key =
        std::string(prefs::kHomePage) + kEncryptedHashSuffix;
    ASSERT_TRUE(macs_dict->contains(prefs::kHomePage));
    ASSERT_TRUE(macs_dict->contains(encrypted_hash_key));

    // Tamper with the legacy MAC, but leave the encrypted hash
    // (the authoritative source) and the preference value untouched.
    macs_dict->Set(prefs::kHomePage, "invalid_legacy_mac");
  }

  void VerifyReactionToPrefAttack() override {
    if (protection_level_ <= PROTECTION_DISABLED_ON_PLATFORM) {
      return;
    }

    if (protection_level_ >= PROTECTION_ENABLED_BASIC) {
      // Assert that the preference was reset to its default (empty) value.
      EXPECT_TRUE(profile()->GetPrefs()->GetString(prefs::kHomePage).empty());

      // Verify that the reset was triggered by the non-encrypted, legacy MAC
      // validation path.
      histograms_.ExpectUniqueSample(
          user_prefs::tracked::kTrackedPrefHistogramChanged,
          2 /* homepage reporting_id */, 1);
      histograms_.ExpectUniqueSample(
          user_prefs::tracked::kTrackedPrefHistogramReset,
          2 /* homepage reporting_id */, 1);

      // No other validation paths should have triggered a reset.
      histograms_.ExpectTotalCount(
          user_prefs::tracked::kTrackedPrefHistogramUnchangedEncrypted, 0);
      histograms_.ExpectTotalCount(
          user_prefs::tracked::kTrackedPrefHistogramResetEncrypted, 0);

    } else {
      // On platforms with low enforcement (Linux), the initial validation pass
      // logs the invalid legacy MAC but does NOT reset the preference. The
      // deferred validation pass then checks the authoritative encrypted hash,
      // finds it valid, and the preference value is kept.
      EXPECT_EQ("http://good.com",
                profile()->GetPrefs()->GetString(prefs::kHomePage));

      // Verify the preference was considered unchanged because the
      // authoritative encrypted hash was valid.
      histograms_.ExpectBucketCount(
          user_prefs::tracked::kTrackedPrefHistogramUnchangedEncrypted,
          2 /* homepage reporting_id */, 1);

      // Verify no resets of any kind were performed.
      histograms_.ExpectTotalCount(
          user_prefs::tracked::kTrackedPrefHistogramReset, 0);
      histograms_.ExpectTotalCount(
          user_prefs::tracked::kTrackedPrefHistogramResetEncrypted, 0);
      histograms_.ExpectTotalCount(
          user_prefs::tracked::kTrackedPrefHistogramResetViaHmacFallback, 0);
    }
  }

 private:
  base::test::ScopedFeatureList feature_list_;
};

PREF_HASH_BROWSER_TEST(PrefHashBrowserTestEncryptedHashIsAuthoritative,
                       EncryptedHashIsAuthoritative);