File D:\maven-qcr-plugin-testsunitaires\qcr4java\jenkins-master\target\site\qc\test\src\test\java\hudson\security\csrf\DefaultCrumbIssuerTest.java.html

1 /**
2 * Copyright (c) 2008-2010 Yahoo! Inc.
3 * All rights reserved.
4 * The copyrights to the contents of this file are licensed under the MIT License (http://www.opensource.org/licenses/mit-license.php)
5 */
6
7 package hudson.security.csrf;
8
9 import com.gargoylesoftware.htmlunit.FailingHttpStatusCodeException;
10 import com.gargoylesoftware.htmlunit.html.HtmlPage;
11 import java.net.HttpURLConnection;
12 import org.jvnet.hudson.test.Bug;
13 import org.jvnet.hudson.test.HudsonTestCase;
14
15 /**
16 *
17 * @author dty
18 */
19 public class DefaultCrumbIssuerTest extends HudsonTestCase {
20 protected void setUp() throws Exception {
21 super.setUp();
22 assertNotNull(jenkins);
23 CrumbIssuer issuer = new DefaultCrumbIssuer(false);
24 assertNotNull(issuer);
25 jenkins.setCrumbIssuer(issuer);
26 }
27
28 private static final String[] testData = {
29 "10.2.3.1",
30 "10.2.3.1,10.20.30.40",
31 "10.2.3.1,10.20.30.41",
32 "10.2.3.3,10.20.30.40,10.20.30.41"
33 };
34 private static final String HEADER_NAME = "X-Forwarded-For";
35
36 @Bug(3854)
37 public void testClientIPFromHeader() throws Exception {
38 WebClient wc = new WebClient();
39
40 wc.addRequestHeader(HEADER_NAME, testData[0]);
41 HtmlPage p = wc.goTo("configure");
42 submit(p.getFormByName("config"));
43 }
44
45 @Bug(3854)
46 public void testHeaderChange() throws Exception {
47 WebClient wc = new WebClient();
48
49 wc.addRequestHeader(HEADER_NAME, testData[0]);
50 HtmlPage p = wc.goTo("configure");
51
52 wc.removeRequestHeader(HEADER_NAME);
53 try {
54 // The crumb should no longer match if we remove the proxy info
55 submit(p.getFormByName("config"));
56 }
57 catch (FailingHttpStatusCodeException e) {
58 assertEquals(403,e.getStatusCode());
59 }
60 }
61
62 @Bug(3854)
63 public void testProxyIPChanged() throws Exception {
64 WebClient wc = new WebClient();
65
66 wc.addRequestHeader(HEADER_NAME, testData[1]);
67 HtmlPage p = wc.goTo("configure");
68
69 wc.removeRequestHeader(HEADER_NAME);
70 wc.addRequestHeader(HEADER_NAME, testData[2]);
71
72 // The crumb should be the same even if the proxy IP changes
73 submit(p.getFormByName("config"));
74 }
75
76 @Bug(3854)
77 public void testProxyIPChain() throws Exception {
78 WebClient wc = new WebClient();
79
80 wc.addRequestHeader(HEADER_NAME, testData[3]);
81 HtmlPage p = wc.goTo("configure");
82 submit(p.getFormByName("config"));
83 }
84
85 @Bug(7518)
86 public void testProxyCompatibilityMode() throws Exception {
87 CrumbIssuer issuer = new DefaultCrumbIssuer(true);
88 assertNotNull(issuer);
89 jenkins.setCrumbIssuer(issuer);
90
91 WebClient wc = new WebClient();
92 wc.addRequestHeader(HEADER_NAME, testData[0]);
93 HtmlPage p = wc.goTo("configure");
94
95 wc.removeRequestHeader(HEADER_NAME);
96 // The crumb should still match if we remove the proxy info
97 submit(p.getFormByName("config"));
98 }
99
100 public void testApiXml() throws Exception {
101 WebClient wc = new WebClient();
102 assertXPathValue(wc.goToXml("crumbIssuer/api/xml"), "//crumbRequestField", jenkins.getCrumbIssuer().getCrumbRequestField());
103 String text = wc.goTo("crumbIssuer/api/xml?xpath=concat(//crumbRequestField,'=',//crumb)", "text/plain").getWebResponse().getContentAsString();
104 assertTrue(text, text.matches("\\Q" + jenkins.getCrumbIssuer().getCrumbRequestField() + "\\E=[0-9a-f]+"));
105 text = wc.goTo("crumbIssuer/api/xml?xpath=concat(//crumbRequestField,\":\",//crumb)", "text/plain").getWebResponse().getContentAsString();
106 assertTrue(text, text.matches("\\Q" + jenkins.getCrumbIssuer().getCrumbRequestField() + "\\E:[0-9a-f]+"));
107 text = wc.goTo("crumbIssuer/api/xml?xpath=/*/crumbRequestField/text()", "text/plain").getWebResponse().getContentAsString();
108 assertEquals(jenkins.getCrumbIssuer().getCrumbRequestField(), text);
109 text = wc.goTo("crumbIssuer/api/xml?xpath=/*/crumb/text()", "text/plain").getWebResponse().getContentAsString();
110 assertTrue(text, text.matches("[0-9a-f]+"));
111 wc.assertFails("crumbIssuer/api/xml?xpath=concat('hack=\"',//crumb,'\"')", HttpURLConnection.HTTP_FORBIDDEN);
112 wc.assertFails("crumbIssuer/api/xml?xpath=concat(\"hack='\",//crumb,\"'\")", HttpURLConnection.HTTP_FORBIDDEN);
113 wc.assertFails("crumbIssuer/api/xml?xpath=concat('{',//crumb,':1}')", HttpURLConnection.HTTP_FORBIDDEN); // 37.5% chance that crumb ~ /[a-f].+/
114 wc.assertFails("crumbIssuer/api/xml?xpath=concat('hack.',//crumb,'=1')", HttpURLConnection.HTTP_FORBIDDEN); // ditto
115 jenkins.getCrumbIssuer().getDescriptor().setCrumbRequestField("_crumb");
116 wc.assertFails("crumbIssuer/api/xml?xpath=concat(//crumbRequestField,'=',//crumb)", HttpURLConnection.HTTP_FORBIDDEN); // perhaps interpretable as JS number
117 }
118
119 public void testApiJson() throws Exception {
120 WebClient wc = new WebClient();
121 String json = wc.goTo("crumbIssuer/api/json", "application/json").getWebResponse().getContentAsString();
122 assertTrue(json, json.matches("\\Q{\"crumb\":\"\\E[0-9a-f]+\\Q\",\"crumbRequestField\":\"" + jenkins.getCrumbIssuer().getCrumbRequestField() + "\"}\\E"));
123 wc.assertFails("crumbIssuer/api/json?jsonp=hack", HttpURLConnection.HTTP_FORBIDDEN);
124 }
125
126 }
127