Prevent JS from bypassing RTP data channel bandwidth limitation.

talk/app/webrtc/webrtcsdp_unittest.cc

 /*
  * libjingle
  * Copyright 2011 Google Inc.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
  *
  *  1. Redistributions of source code must retain the above copyright notice,
  *     this list of conditions and the following disclaimer.
  *  2. Redistributions in binary form must reproduce the above copyright notice,
@@ skipping 1680 matching lines @@
 TEST_F(WebRtcSdpTest, SerializeSessionDescriptionWithDataChannelAndBandwidth) {
   AddRtpDataChannel();
   data_desc_->set_bandwidth(100*1000);
   JsepSessionDescription jsep_desc(kDummyString);
 
   ASSERT_TRUE(jsep_desc.Initialize(desc_.Copy(), kSessionId, kSessionVersion));
   std::string message = webrtc::SdpSerialize(jsep_desc);
 
   std::string expected_sdp = kSdpString;
   expected_sdp.append(kSdpRtpDataChannelString);
-  // We want to test that serializing data content ignores bandwidth
-  // settings (it should always be the default).  Thus, we don't do
-  // the following:
-  // TODO(pthatcher): We need to temporarily allow the SDP to control
-  // this for backwards-compatibility.  Once we don't need that any
-  // more, remove this.
+  // Serializing data content shouldn't ignore bandwidth settings.
   InjectAfter("m=application 9 RTP/SAVPF 101\r\nc=IN IP4 0.0.0.0\r\n",
               "b=AS:100\r\n",
               &expected_sdp);
   EXPECT_EQ(expected_sdp, message);
 }
 
 TEST_F(WebRtcSdpTest, SerializeSessionDescriptionWithExtmap) {
   AddExtmap();
   JsepSessionDescription desc_with_extmap("dummy");
   ASSERT_TRUE(desc_with_extmap.Initialize(desc_.Copy(),
@@ skipping 537 matching lines @@
                              unusual_portstr, strlen(unusual_portstr),
                              &sdp_with_data);
 
   EXPECT_TRUE(SdpDeserialize(sdp_with_data, &jdesc_output));
   EXPECT_TRUE(CompareSessionDescription(jdesc, jdesc_output));
 }
 
 TEST_F(WebRtcSdpTest, DeserializeSdpWithRtpDataChannelsAndBandwidth) {
   AddRtpDataChannel();
   JsepSessionDescription jdesc(kDummyString);
-  // We want to test that deserializing data content ignores bandwidth
-  // settings (it should always be the default).  Thus, we don't do
-  // the following:
-  // TODO(pthatcher): We need to temporarily allow the SDP to control
-  // this for backwards-compatibility.  Once we don't need that any
-  // more, remove this.
+  // We want to test that deserializing data content limits bandwidth
+  // settings (it should never be greater than the default).
+  // This should prevent someone from using unlimited data bandwidth through
+  // JS and "breaking the Internet".
   DataContentDescription* dcd = static_cast<DataContentDescription*>(
      GetFirstDataContent(&desc_)->description);
   dcd->set_bandwidth(100 * 1000);
   ASSERT_TRUE(jdesc.Initialize(desc_.Copy(), kSessionId, kSessionVersion));
 
   std::string sdp_with_bandwidth = kSdpString;
   sdp_with_bandwidth.append(kSdpRtpDataChannelString);
   InjectAfter("a=mid:data_content_name\r\n",
               "b=AS:100\r\n",
               &sdp_with_bandwidth);
   JsepSessionDescription jdesc_with_bandwidth(kDummyString);
 
-  EXPECT_TRUE(
-      SdpDeserialize(sdp_with_bandwidth, &jdesc_with_bandwidth));
-  EXPECT_TRUE(CompareSessionDescription(jdesc, jdesc_with_bandwidth));
+  EXPECT_FALSE(SdpDeserialize(sdp_with_bandwidth, &jdesc_with_bandwidth));
 }
 
 TEST_F(WebRtcSdpTest, DeserializeSessionDescriptionWithSessionLevelExtmap) {
   TestDeserializeExtmap(true, false);
 }
 
 TEST_F(WebRtcSdpTest, DeserializeSessionDescriptionWithMediaLevelExtmap) {
   TestDeserializeExtmap(false, true);
 }
 
@@ skipping 414 matching lines @@
       const cricket::MediaContentDescription* mdesc =
           static_cast<const cricket::MediaContentDescription*>(
               desc->contents()[i].description);
       EXPECT_EQ(media_types[media_content_in_sdp[i]], mdesc->type());
     }
 
     std::string serialized_sdp = webrtc::SdpSerialize(jdesc);
     EXPECT_EQ(sdp_string, serialized_sdp);
   }
 }