Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
李少辉-开发者
gitlab-foss
提交
203e3b2d
G
gitlab-foss
项目概览
李少辉-开发者
/
gitlab-foss
通知
15
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
G
gitlab-foss
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
203e3b2d
编写于
10月 31, 2017
作者:
M
Michael Kozono
提交者:
Francisco Lopez
11月 17, 2017
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
Dry up URLs and get args construction
上级
6c5f46ac
变更
1
隐藏空白更改
内联
并排
Showing
1 changed file
with
48 addition
and
36 deletion
+48
-36
spec/requests/rack_attack_global_spec.rb
spec/requests/rack_attack_global_spec.rb
+48
-36
未找到文件。
spec/requests/rack_attack_global_spec.rb
浏览文件 @
203e3b2d
...
...
@@ -22,6 +22,10 @@ describe 'Rack Attack global throttles' do
let
(
:period_in_seconds
)
{
10000
}
let
(
:period
)
{
period_in_seconds
.
seconds
}
let
(
:url_that_does_not_require_authentication
)
{
'/users/sign_in'
}
let
(
:url_that_requires_authentication
)
{
'/dashboard/snippets'
}
let
(
:api_partial_url
)
{
'/todos'
}
# Make time-dependent tests deterministic
around
do
|
example
|
# Instead of test environment's :null_store
...
...
@@ -132,42 +136,42 @@ describe 'Rack Attack global throttles' do
it
'rejects requests over the rate limit'
do
# At first, allow requests under the rate limit.
requests_per_period
.
times
do
get
'/users/sign_in'
get
url_that_does_not_require_authentication
expect
(
response
).
to
have_http_status
200
end
# the last straw
expect_rejection
{
get
'/users/sign_in'
}
expect_rejection
{
get
url_that_does_not_require_authentication
}
end
it
'allows requests after throttling and then waiting for the next period'
do
requests_per_period
.
times
do
get
'/users/sign_in'
get
url_that_does_not_require_authentication
expect
(
response
).
to
have_http_status
200
end
expect_rejection
{
get
'/users/sign_in'
}
expect_rejection
{
get
url_that_does_not_require_authentication
}
Timecop
.
travel
((
1
.
second
+
period
).
from_now
)
do
# Add 1 because flaky
requests_per_period
.
times
do
get
'/users/sign_in'
get
url_that_does_not_require_authentication
expect
(
response
).
to
have_http_status
200
end
expect_rejection
{
get
'/users/sign_in'
}
expect_rejection
{
get
url_that_does_not_require_authentication
}
end
end
it
'counts requests from different IPs separately'
do
requests_per_period
.
times
do
get
'/users/sign_in'
get
url_that_does_not_require_authentication
expect
(
response
).
to
have_http_status
200
end
expect_any_instance_of
(
Rack
::
Attack
::
Request
).
to
receive
(
:ip
).
and_return
(
'1.2.3.4'
)
# would be over limit for the same IP
get
'/users/sign_in'
get
url_that_does_not_require_authentication
expect
(
response
).
to
have_http_status
200
end
end
...
...
@@ -180,7 +184,7 @@ describe 'Rack Attack global throttles' do
it
'allows requests over the rate limit'
do
(
1
+
requests_per_period
).
times
do
get
'/users/sign_in'
get
url_that_does_not_require_authentication
expect
(
response
).
to
have_http_status
200
end
end
...
...
@@ -193,15 +197,15 @@ describe 'Rack Attack global throttles' do
let
(
:throttle_setting_prefix
)
{
'throttle_authenticated_api'
}
context
'with the token in the query string'
do
let
(
:get_args
)
{
[
api
(
'/todos'
,
user
)]
}
let
(
:other_user_get_args
)
{
[
api
(
'/todos'
,
other_user
)]
}
let
(
:get_args
)
{
[
api
(
api_partial_url
,
user
)]
}
let
(
:other_user_get_args
)
{
[
api
(
api_partial_url
,
other_user
)]
}
it_behaves_like
'rate-limited token-authenticated requests'
end
context
'with the token in the headers'
do
let
(
:get_args
)
{
[
"/api/
#{
API
::
API
.
version
}
/todos"
,
nil
,
private_token_headers
(
user
)]
}
let
(
:other_user_get_args
)
{
[
"/api/
#{
API
::
API
.
version
}
/todos"
,
nil
,
private_token_headers
(
other_user
)]
}
let
(
:get_args
)
{
api_get_args_with_token_headers
(
api_partial_url
,
private_token_headers
(
user
))
}
let
(
:other_user_get_args
)
{
api_get_args_with_token_headers
(
api_partial_url
,
private_token_headers
(
other_user
))
}
it_behaves_like
'rate-limited token-authenticated requests'
end
...
...
@@ -215,15 +219,15 @@ describe 'Rack Attack global throttles' do
let
(
:throttle_setting_prefix
)
{
'throttle_authenticated_api'
}
context
'with the token in the query string'
do
let
(
:get_args
)
{
[
api
(
'/todos'
,
personal_access_token:
token
)]
}
let
(
:other_user_get_args
)
{
[
api
(
'/todos'
,
personal_access_token:
other_user_token
)]
}
let
(
:get_args
)
{
[
api
(
api_partial_url
,
personal_access_token:
token
)]
}
let
(
:other_user_get_args
)
{
[
api
(
api_partial_url
,
personal_access_token:
other_user_token
)]
}
it_behaves_like
'rate-limited token-authenticated requests'
end
context
'with the token in the headers'
do
let
(
:get_args
)
{
[
"/api/
#{
API
::
API
.
version
}
/todos"
,
nil
,
personal_access_token_headers
(
token
)]
}
let
(
:other_user_get_args
)
{
[
"/api/
#{
API
::
API
.
version
}
/todos"
,
nil
,
personal_access_token_headers
(
other_user_token
)]
}
let
(
:get_args
)
{
api_get_args_with_token_headers
(
api_partial_url
,
personal_access_token_headers
(
token
))
}
let
(
:other_user_get_args
)
{
api_get_args_with_token_headers
(
api_partial_url
,
personal_access_token_headers
(
other_user_token
))
}
it_behaves_like
'rate-limited token-authenticated requests'
end
...
...
@@ -239,15 +243,15 @@ describe 'Rack Attack global throttles' do
let
(
:throttle_setting_prefix
)
{
'throttle_authenticated_api'
}
context
'with the token in the query string'
do
let
(
:get_args
)
{
[
api
(
'/todos'
,
oauth_access_token:
token
)]
}
let
(
:other_user_get_args
)
{
[
api
(
'/todos'
,
oauth_access_token:
other_user_token
)]
}
let
(
:get_args
)
{
[
api
(
api_partial_url
,
oauth_access_token:
token
)]
}
let
(
:other_user_get_args
)
{
[
api
(
api_partial_url
,
oauth_access_token:
other_user_token
)]
}
it_behaves_like
'rate-limited token-authenticated requests'
end
context
'with the token in the headers'
do
let
(
:get_args
)
{
[
"/api/
#{
API
::
API
.
version
}
/todos"
,
nil
,
oauth_token_headers
(
token
)]
}
let
(
:other_user_get_args
)
{
[
"/api/
#{
API
::
API
.
version
}
/todos"
,
nil
,
oauth_token_headers
(
other_user_token
)]
}
let
(
:get_args
)
{
api_get_args_with_token_headers
(
api_partial_url
,
oauth_token_headers
(
token
))
}
let
(
:other_user_get_args
)
{
api_get_args_with_token_headers
(
api_partial_url
,
oauth_token_headers
(
other_user_token
))
}
it_behaves_like
'rate-limited token-authenticated requests'
end
...
...
@@ -260,15 +264,15 @@ describe 'Rack Attack global throttles' do
context
'with the token in the query string'
do
context
'with the atom extension'
do
let
(
:get_args
)
{
[
"/dashboard/projects.atom?rss_token=
#{
user
.
rss_token
}
"
]
}
let
(
:other_user_get_args
)
{
[
"/dashboard/projects.atom?rss_token=
#{
other_user
.
rss_token
}
"
]
}
let
(
:get_args
)
{
[
rss_url
(
user
)
]
}
let
(
:other_user_get_args
)
{
[
rss_url
(
other_user
)
]
}
it_behaves_like
'rate-limited token-authenticated requests'
end
context
'with the atom format in the Accept header'
do
let
(
:get_args
)
{
[
"/dashboard/projects?rss_token=
#{
user
.
rss_token
}
"
,
nil
,
{
'HTTP_ACCEPT'
=>
'application/atom+xml'
}]
}
let
(
:other_user_get_args
)
{
[
"/dashboard/projects?rss_token=
#{
other_user
.
rss_token
}
"
,
nil
,
{
'HTTP_ACCEPT'
=>
'application/atom+xml'
}]
}
let
(
:get_args
)
{
[
rss_url
(
user
)
,
nil
,
{
'HTTP_ACCEPT'
=>
'application/atom+xml'
}]
}
let
(
:other_user_get_args
)
{
[
rss_url
(
other_user
)
,
nil
,
{
'HTTP_ACCEPT'
=>
'application/atom+xml'
}]
}
it_behaves_like
'rate-limited token-authenticated requests'
end
...
...
@@ -295,54 +299,54 @@ describe 'Rack Attack global throttles' do
it
'rejects requests over the rate limit'
do
# At first, allow requests under the rate limit.
requests_per_period
.
times
do
get
'/dashboard/snippets'
get
url_that_requires_authentication
expect
(
response
).
to
have_http_status
200
end
# the last straw
expect_rejection
{
get
'/dashboard/snippets'
}
expect_rejection
{
get
url_that_requires_authentication
}
end
it
'allows requests after throttling and then waiting for the next period'
do
requests_per_period
.
times
do
get
'/dashboard/snippets'
get
url_that_requires_authentication
expect
(
response
).
to
have_http_status
200
end
expect_rejection
{
get
'/dashboard/snippets'
}
expect_rejection
{
get
url_that_requires_authentication
}
Timecop
.
travel
((
1
.
second
+
period
).
from_now
)
do
# Add 1 because flaky
requests_per_period
.
times
do
get
'/dashboard/snippets'
get
url_that_requires_authentication
expect
(
response
).
to
have_http_status
200
end
expect_rejection
{
get
'/dashboard/snippets'
}
expect_rejection
{
get
url_that_requires_authentication
}
end
end
it
'counts requests from different users separately, even from the same IP'
do
requests_per_period
.
times
do
get
'/dashboard/snippets'
get
url_that_requires_authentication
expect
(
response
).
to
have_http_status
200
end
# would be over the limit if this wasn't a different user
login_as
(
create
(
:user
))
get
'/dashboard/snippets'
get
url_that_requires_authentication
expect
(
response
).
to
have_http_status
200
end
it
'counts all requests from the same user, even via different IPs'
do
requests_per_period
.
times
do
get
'/dashboard/snippets'
get
url_that_requires_authentication
expect
(
response
).
to
have_http_status
200
end
expect_any_instance_of
(
Rack
::
Attack
::
Request
).
to
receive
(
:ip
).
and_return
(
'1.2.3.4'
)
expect_rejection
{
get
'/dashboard/snippets'
}
expect_rejection
{
get
url_that_requires_authentication
}
end
end
...
...
@@ -354,13 +358,21 @@ describe 'Rack Attack global throttles' do
it
'allows requests over the rate limit'
do
(
1
+
requests_per_period
).
times
do
get
'/dashboard/snippets'
get
url_that_requires_authentication
expect
(
response
).
to
have_http_status
200
end
end
end
end
def
api_get_args_with_token_headers
(
partial_url
,
token_headers
)
[
"/api/
#{
API
::
API
.
version
}#{
partial_url
}
"
,
nil
,
token_headers
]
end
def
rss_url
(
user
)
"/dashboard/projects.atom?rss_token=
#{
user
.
rss_token
}
"
end
def
private_token_headers
(
user
)
{
'HTTP_PRIVATE_TOKEN'
=>
user
.
private_token
}
end
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录