提交 cbb6a8ac 编写于 作者: J Jesse Glick

JUnit 4.

上级 3f295879
......@@ -9,21 +9,25 @@ package hudson.security.csrf;
import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
import com.gargoylesoftware.htmlunit.html.HtmlPage;
import java.net.HttpURLConnection;
import static org.junit.Assert.*;
import org.junit.Before;
import org.junit.Rule;
import org.junit.Test;
import org.jvnet.hudson.test.Bug;
import org.jvnet.hudson.test.HudsonTestCase;
import org.jvnet.hudson.test.JenkinsRule;
import org.jvnet.hudson.test.JenkinsRule.WebClient;
import org.jvnet.hudson.test.recipes.PresetData;
/**
*
* @author dty
*/
public class DefaultCrumbIssuerTest extends HudsonTestCase {
protected void setUp() throws Exception {
super.setUp();
assertNotNull(jenkins);
CrumbIssuer issuer = new DefaultCrumbIssuer(false);
assertNotNull(issuer);
jenkins.setCrumbIssuer(issuer);
public class DefaultCrumbIssuerTest {
@Rule public JenkinsRule r = new JenkinsRule();
@Before public void setIssuer() {
r.jenkins.setCrumbIssuer(new DefaultCrumbIssuer(false));
}
private static final String[] testData = {
......@@ -35,17 +39,17 @@ public class DefaultCrumbIssuerTest extends HudsonTestCase {
private static final String HEADER_NAME = "X-Forwarded-For";
@Bug(3854)
public void testClientIPFromHeader() throws Exception {
WebClient wc = new WebClient();
@Test public void clientIPFromHeader() throws Exception {
WebClient wc = r.createWebClient();
wc.addRequestHeader(HEADER_NAME, testData[0]);
HtmlPage p = wc.goTo("configure");
submit(p.getFormByName("config"));
r.submit(p.getFormByName("config"));
}
@Bug(3854)
public void testHeaderChange() throws Exception {
WebClient wc = new WebClient();
@Test public void headerChange() throws Exception {
WebClient wc = r.createWebClient();
wc.addRequestHeader(HEADER_NAME, testData[0]);
HtmlPage p = wc.goTo("configure");
......@@ -53,7 +57,7 @@ public class DefaultCrumbIssuerTest extends HudsonTestCase {
wc.removeRequestHeader(HEADER_NAME);
try {
// The crumb should no longer match if we remove the proxy info
submit(p.getFormByName("config"));
r.submit(p.getFormByName("config"));
}
catch (FailingHttpStatusCodeException e) {
assertEquals(403,e.getStatusCode());
......@@ -61,8 +65,8 @@ public class DefaultCrumbIssuerTest extends HudsonTestCase {
}
@Bug(3854)
public void testProxyIPChanged() throws Exception {
WebClient wc = new WebClient();
@Test public void proxyIPChanged() throws Exception {
WebClient wc = r.createWebClient();
wc.addRequestHeader(HEADER_NAME, testData[1]);
HtmlPage p = wc.goTo("configure");
......@@ -71,58 +75,58 @@ public class DefaultCrumbIssuerTest extends HudsonTestCase {
wc.addRequestHeader(HEADER_NAME, testData[2]);
// The crumb should be the same even if the proxy IP changes
submit(p.getFormByName("config"));
r.submit(p.getFormByName("config"));
}
@Bug(3854)
public void testProxyIPChain() throws Exception {
WebClient wc = new WebClient();
@Test public void proxyIPChain() throws Exception {
WebClient wc = r.createWebClient();
wc.addRequestHeader(HEADER_NAME, testData[3]);
HtmlPage p = wc.goTo("configure");
submit(p.getFormByName("config"));
r.submit(p.getFormByName("config"));
}
@Bug(7518)
public void testProxyCompatibilityMode() throws Exception {
@Test public void proxyCompatibilityMode() throws Exception {
CrumbIssuer issuer = new DefaultCrumbIssuer(true);
assertNotNull(issuer);
jenkins.setCrumbIssuer(issuer);
r.jenkins.setCrumbIssuer(issuer);
WebClient wc = new WebClient();
WebClient wc = r.createWebClient();
wc.addRequestHeader(HEADER_NAME, testData[0]);
HtmlPage p = wc.goTo("configure");
wc.removeRequestHeader(HEADER_NAME);
// The crumb should still match if we remove the proxy info
submit(p.getFormByName("config"));
r.submit(p.getFormByName("config"));
}
@PresetData(PresetData.DataSet.ANONYMOUS_READONLY)
public void testApiXml() throws Exception {
WebClient wc = new WebClient();
assertXPathValue(wc.goToXml("crumbIssuer/api/xml"), "//crumbRequestField", jenkins.getCrumbIssuer().getCrumbRequestField());
@Test public void apiXml() throws Exception {
WebClient wc = r.createWebClient();
r.assertXPathValue(wc.goToXml("crumbIssuer/api/xml"), "//crumbRequestField", r.jenkins.getCrumbIssuer().getCrumbRequestField());
String text = wc.goTo("crumbIssuer/api/xml?xpath=concat(//crumbRequestField,'=',//crumb)", "text/plain").getWebResponse().getContentAsString();
assertTrue(text, text.matches("\\Q" + jenkins.getCrumbIssuer().getCrumbRequestField() + "\\E=[0-9a-f]+"));
assertTrue(text, text.matches("\\Q" + r.jenkins.getCrumbIssuer().getCrumbRequestField() + "\\E=[0-9a-f]+"));
text = wc.goTo("crumbIssuer/api/xml?xpath=concat(//crumbRequestField,\":\",//crumb)", "text/plain").getWebResponse().getContentAsString();
assertTrue(text, text.matches("\\Q" + jenkins.getCrumbIssuer().getCrumbRequestField() + "\\E:[0-9a-f]+"));
assertTrue(text, text.matches("\\Q" + r.jenkins.getCrumbIssuer().getCrumbRequestField() + "\\E:[0-9a-f]+"));
text = wc.goTo("crumbIssuer/api/xml?xpath=/*/crumbRequestField/text()", "text/plain").getWebResponse().getContentAsString();
assertEquals(jenkins.getCrumbIssuer().getCrumbRequestField(), text);
assertEquals(r.jenkins.getCrumbIssuer().getCrumbRequestField(), text);
text = wc.goTo("crumbIssuer/api/xml?xpath=/*/crumb/text()", "text/plain").getWebResponse().getContentAsString();
assertTrue(text, text.matches("[0-9a-f]+"));
wc.assertFails("crumbIssuer/api/xml?xpath=concat('hack=\"',//crumb,'\"')", HttpURLConnection.HTTP_FORBIDDEN);
wc.assertFails("crumbIssuer/api/xml?xpath=concat(\"hack='\",//crumb,\"'\")", HttpURLConnection.HTTP_FORBIDDEN);
wc.assertFails("crumbIssuer/api/xml?xpath=concat('{',//crumb,':1}')", HttpURLConnection.HTTP_FORBIDDEN); // 37.5% chance that crumb ~ /[a-f].+/
wc.assertFails("crumbIssuer/api/xml?xpath=concat('hack.',//crumb,'=1')", HttpURLConnection.HTTP_FORBIDDEN); // ditto
jenkins.getCrumbIssuer().getDescriptor().setCrumbRequestField("_crumb");
r.jenkins.getCrumbIssuer().getDescriptor().setCrumbRequestField("_crumb");
wc.assertFails("crumbIssuer/api/xml?xpath=concat(//crumbRequestField,'=',//crumb)", HttpURLConnection.HTTP_FORBIDDEN); // perhaps interpretable as JS number
}
@PresetData(PresetData.DataSet.ANONYMOUS_READONLY)
public void testApiJson() throws Exception {
WebClient wc = new WebClient();
@Test public void apiJson() throws Exception {
WebClient wc = r.createWebClient();
String json = wc.goTo("crumbIssuer/api/json", "application/json").getWebResponse().getContentAsString();
assertTrue(json, json.matches("\\Q{\"crumb\":\"\\E[0-9a-f]+\\Q\",\"crumbRequestField\":\"" + jenkins.getCrumbIssuer().getCrumbRequestField() + "\"}\\E"));
assertTrue(json, json.matches("\\Q{\"crumb\":\"\\E[0-9a-f]+\\Q\",\"crumbRequestField\":\"" + r.jenkins.getCrumbIssuer().getCrumbRequestField() + "\"}\\E"));
wc.assertFails("crumbIssuer/api/json?jsonp=hack", HttpURLConnection.HTTP_FORBIDDEN);
}
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册