zydronium/google-nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus.git synced 2025-05-20 19:29:35 +02:00
Code Issues Projects Releases Packages Wiki Activity

Daggerize XsrfTokenManager

Browse source 
The one-day validity period is also moved from the caller into XsrfTokenManager.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=147857716
This commit is contained in:
mountford 2017-02-17 11:13:49 -08:00 • committed by Ben McIlwain
parent 4a92d97a70
commit 0417f3d3a1
18 changed files with 112 additions and 80 deletions
Download patch file Download diff file Expand all files Collapse all files

37
javatests/google/registry/request/RequestHandlerTest.java
View file

@ -17,7 +17,6 @@ package google.registry.request;
import static com.google.common.truth.Truth.assertThat;
import static google.registry.request.Action.Method.GET;
import static google.registry.request.Action.Method.POST;
import static google.registry.security.XsrfTokenManager.generateToken;
import static org.mockito.Mockito.verify;
import static org.mockito.Mockito.verifyNoMoreInteractions;
import static org.mockito.Mockito.verifyZeroInteractions;
@ -25,7 +24,6 @@ import static org.mockito.Mockito.when;
import com.google.appengine.api.oauth.OAuthServiceFactory;
import com.google.appengine.api.users.User;
import com.google.appengine.api.users.UserService;
import com.google.common.collect.ImmutableList;
import com.google.common.collect.ImmutableSet;
import com.google.common.testing.NullPointerTester;
@ -38,7 +36,10 @@ import google.registry.request.auth.AuthenticationMechanism;
import google.registry.request.auth.LegacyAuthenticationMechanism;
import google.registry.request.auth.OAuthAuthenticationMechanism;
import google.registry.request.auth.RequestAuthenticator;
import google.registry.security.XsrfTokenManager;
import google.registry.testing.AppEngineRule;
import google.registry.testing.FakeClock;
import google.registry.testing.FakeUserService;
import google.registry.testing.Providers;
import google.registry.testing.UserInfo;
import java.io.PrintWriter;
@ -207,9 +208,6 @@ public final class RequestHandlerTest {
@Mock
private HttpServletResponse rsp;
@Mock
private UserService userService;
@Mock
private BumblebeeTask bumblebeeTask;
@ -228,9 +226,13 @@ public final class RequestHandlerTest {
private AuthResult providedAuthResult = null;
private final User testUser = new User("test@example.com", "test@example.com");
private RequestAuthenticator requestAuthenticator;
private XsrfTokenManager xsrfTokenManager;
private FakeUserService userService;
@Before
public void before() throws Exception {
userService = new FakeUserService();
xsrfTokenManager = new XsrfTokenManager(new FakeClock(), userService);
requestAuthenticator = new RequestAuthenticator(
new AppEngineInternalAuthenticationMechanism(),
ImmutableList.<AuthenticationMechanism>of(
@ -252,7 +254,8 @@ public final class RequestHandlerTest {
}
}),
userService,
requestAuthenticator);
requestAuthenticator,
xsrfTokenManager);
when(rsp.getWriter()).thenReturn(new PrintWriter(httpOutput));
}
@ -361,6 +364,7 @@ public final class RequestHandlerTest {
public void testNullness() {
NullPointerTester tester = new NullPointerTester();
tester.setDefault(RequestAuthenticator.class, requestAuthenticator);
tester.setDefault(XsrfTokenManager.class, xsrfTokenManager);
tester.testAllPublicStaticMethods(RequestHandler.class);
tester.testAllPublicInstanceMethods(handler);
}
@ -375,8 +379,9 @@ public final class RequestHandlerTest {
@Test
public void testXsrfProtection_validTokenProvided_runsAction() throws Exception {
userService.setUser(testUser, false);
when(req.getMethod()).thenReturn("POST");
when(req.getHeader("X-CSRF-Token")).thenReturn(generateToken("vampire"));
when(req.getHeader("X-CSRF-Token")).thenReturn(xsrfTokenManager.generateToken("vampire"));
when(req.getRequestURI()).thenReturn("/safe-sloth");
handler.handleRequest(req, rsp);
verify(safeSlothTask).run();
@ -384,8 +389,9 @@ public final class RequestHandlerTest {
@Test
public void testXsrfProtection_tokenWithInvalidScopeProvided_returns403() throws Exception {
userService.setUser(testUser, false);
when(req.getMethod()).thenReturn("POST");
when(req.getHeader("X-CSRF-Token")).thenReturn(generateToken("blood"));
when(req.getHeader("X-CSRF-Token")).thenReturn(xsrfTokenManager.generateToken("blood"));
when(req.getRequestURI()).thenReturn("/safe-sloth");
handler.handleRequest(req, rsp);
verify(rsp).sendError(403, "Invalid X-CSRF-Token");
@ -401,19 +407,16 @@ public final class RequestHandlerTest {
@Test
public void testMustBeLoggedIn_notLoggedIn_redirectsToLoginPage() throws Exception {
when(userService.isUserLoggedIn()).thenReturn(false);
when(userService.createLoginURL("/users-only")).thenReturn("/login");
when(req.getMethod()).thenReturn("GET");
when(req.getRequestURI()).thenReturn("/users-only");
handler.handleRequest(req, rsp);
verify(rsp).setStatus(302);
verify(rsp).setHeader("Location", "/login");
verify(rsp).setHeader("Location", "/login?dest=/users-only");
}
@Test
public void testMustBeLoggedIn_loggedIn_runsAction() throws Exception {
when(userService.isUserLoggedIn()).thenReturn(true);
when(userService.getCurrentUser()).thenReturn(testUser);
userService.setUser(testUser, false);
when(req.getMethod()).thenReturn("GET");
when(req.getRequestURI()).thenReturn("/users-only");
handler.handleRequest(req, rsp);
@ -441,9 +444,7 @@ public final class RequestHandlerTest {
@Test
public void testAuthNeeded_notAuthorized() throws Exception {
when(userService.isUserLoggedIn()).thenReturn(true);
when(userService.getCurrentUser()).thenReturn(testUser);
when(userService.isUserAdmin()).thenReturn(false);
userService.setUser(testUser, false);
when(req.getMethod()).thenReturn("GET");
when(req.getRequestURI()).thenReturn("/auth/adminUserAnyMethod");
handler.handleRequest(req, rsp);
@ -453,9 +454,7 @@ public final class RequestHandlerTest {
@Test
public void testAuthNeeded_success() throws Exception {
when(userService.isUserLoggedIn()).thenReturn(true);
when(userService.getCurrentUser()).thenReturn(testUser);
when(userService.isUserAdmin()).thenReturn(true);
userService.setUser(testUser, true);
when(req.getMethod()).thenReturn("GET");
when(req.getRequestURI()).thenReturn("/auth/adminUserAnyMethod");
handler.handleRequest(req, rsp);

42
javatests/google/registry/security/XsrfTokenManagerTest.java
View file

@ -15,16 +15,14 @@
package google.registry.security;
import static com.google.common.truth.Truth.assertThat;
import static google.registry.security.XsrfTokenManager.generateToken;
import static google.registry.security.XsrfTokenManager.validateToken;
import static google.registry.util.DateTimeUtils.START_OF_TIME;
import com.google.common.base.Splitter;
import google.registry.testing.AppEngineRule;
import google.registry.testing.FakeClock;
import google.registry.testing.FakeUserService;
import google.registry.testing.InjectRule;
import google.registry.testing.UserInfo;
import org.joda.time.Duration;
import org.junit.Before;
import org.junit.Rule;
import org.junit.Test;
@ -35,9 +33,10 @@ import org.mockito.runners.MockitoJUnitRunner;
@RunWith(MockitoJUnitRunner.class)
public class XsrfTokenManagerTest {
private static final Duration ONE_DAY = Duration.standardDays(1);
FakeClock clock = new FakeClock(START_OF_TIME);
FakeUserService userService = new FakeUserService();
XsrfTokenManager xsrfTokenManager = new XsrfTokenManager(clock, userService);
@Rule
public final AppEngineRule appEngine = AppEngineRule.builder()
@ -50,46 +49,51 @@ public class XsrfTokenManagerTest {
@Before
public void init() {
inject.setStaticField(XsrfTokenManager.class, "clock", clock);
// inject.setStaticField(XsrfTokenManager.class, "clock", clock);
}
@Test
public void testSuccess() {
assertThat(validateToken(generateToken("console"), "console", ONE_DAY)).isTrue();
assertThat(xsrfTokenManager.validateToken(xsrfTokenManager.generateToken("console"), "console"))
.isTrue();
}
@Test
public void testNoTimestamp() {
assertThat(validateToken("foo", "console", ONE_DAY)).isFalse();
assertThat(xsrfTokenManager.validateToken("foo", "console")).isFalse();
}
@Test
public void testBadNumberTimestamp() {
assertThat(validateToken("foo:bar", "console", ONE_DAY)).isFalse();
assertThat(xsrfTokenManager.validateToken("foo:bar", "console")).isFalse();
}
@Test
public void testExpired() {
String token = generateToken("console");
String token = xsrfTokenManager.generateToken("console");
clock.setTo(START_OF_TIME.plusDays(2));
assertThat(validateToken(token, "console", ONE_DAY)).isFalse();
assertThat(xsrfTokenManager.validateToken(token, "console")).isFalse();
}
@Test
public void testTimestampTamperedWith() {
String encodedPart = Splitter.on(':').splitToList(generateToken("console")).get(0);
String encodedPart =
Splitter.on(':').splitToList(xsrfTokenManager.generateToken("console")).get(0);
long tamperedTimestamp = clock.nowUtc().plusMillis(1).getMillis();
assertThat(validateToken(encodedPart + ":" + tamperedTimestamp, "console", ONE_DAY)).isFalse();
}
@Test
public void testDifferentUser() {
assertThat(validateToken(generateToken("console", "b@example.com"), "console", ONE_DAY))
assertThat(xsrfTokenManager.validateToken(encodedPart + ":" + tamperedTimestamp, "console"))
.isFalse();
}
@Test
public void testDifferentUser() {
assertThat(xsrfTokenManager
.validateToken(xsrfTokenManager.generateToken("console", "b@example.com"), "console"))
.isFalse();
}
@Test
public void testDifferentScope() {
assertThat(validateToken(generateToken("console"), "foobar", ONE_DAY)).isFalse();
assertThat(xsrfTokenManager.validateToken(xsrfTokenManager.generateToken("console"), "foobar"))
.isFalse();
}
}

8
javatests/google/registry/testing/FakeUserService.java
View file

@ -34,12 +34,12 @@ public class FakeUserService implements UserService {
@Override
public String createLoginURL(String destinationURL) {
throw new UnsupportedOperationException();
return String.format("/login?dest=%s", destinationURL);
}
@Override
public String createLoginURL(String destinationURL, String authDomain) {
throw new UnsupportedOperationException();
return createLoginURL(destinationURL);
}
@Deprecated
@ -51,12 +51,12 @@ public class FakeUserService implements UserService {
@Override
public String createLogoutURL(String destinationURL) {
throw new UnsupportedOperationException();
return String.format("/logout?dest=%s", destinationURL);
}
@Override
public String createLogoutURL(String destinationURL, String authDomain) {
throw new UnsupportedOperationException();
return createLogoutURL(destinationURL);
}
@Override

3
javatests/google/registry/ui/server/registrar/ConsoleUiActionTest.java
View file

@ -20,7 +20,9 @@ import static org.mockito.Mockito.when;
import com.google.appengine.api.users.UserServiceFactory;
import com.google.common.net.MediaType;
import google.registry.security.XsrfTokenManager;
import google.registry.testing.AppEngineRule;
import google.registry.testing.FakeClock;
import google.registry.testing.FakeResponse;
import google.registry.testing.UserInfo;
import javax.servlet.http.HttpServletRequest;
@ -60,6 +62,7 @@ public class ConsoleUiActionTest {
action.response = response;
action.sessionUtils = sessionUtils;
action.userService = UserServiceFactory.getUserService();
action.xsrfTokenManager = new XsrfTokenManager(new FakeClock(), action.userService);
when(sessionUtils.checkRegistrarConsoleLogin(any(HttpServletRequest.class))).thenReturn(true);
when(sessionUtils.getRegistrarClientId(any(HttpServletRequest.class)))
.thenReturn("TheRegistrar");

6
javatests/google/registry/ui/server/registrar/RegistrarSettingsActionTestCase.java
View file

@ -18,7 +18,6 @@ import static google.registry.config.RegistryConfig.getGSuiteOutgoingEmailAddres
import static google.registry.config.RegistryConfig.getGSuiteOutgoingEmailDisplayName;
import static google.registry.security.JsonHttpTestUtils.createJsonPayload;
import static google.registry.security.JsonHttpTestUtils.createJsonResponseSupplier;
import static google.registry.security.XsrfTokenManager.generateToken;
import static google.registry.util.ResourceUtils.readResourceUtf8;
import static org.mockito.Matchers.eq;
import static org.mockito.Mockito.when;
@ -33,8 +32,10 @@ import google.registry.model.registrar.Registrar;
import google.registry.request.JsonActionRunner;
import google.registry.request.JsonResponse;
import google.registry.request.ResponseImpl;
import google.registry.security.XsrfTokenManager;
import google.registry.testing.AppEngineRule;
import google.registry.testing.FakeClock;
import google.registry.testing.FakeUserService;
import google.registry.testing.InjectRule;
import google.registry.util.SendEmailService;
import java.io.PrintWriter;
@ -91,6 +92,7 @@ public class RegistrarSettingsActionTestCase {
final StringWriter writer = new StringWriter();
final Supplier<Map<String, Object>> json = createJsonResponseSupplier(writer);
final FakeClock clock = new FakeClock(DateTime.parse("2014-01-01T00:00:00Z"));
final XsrfTokenManager xsrfTokenManager = new XsrfTokenManager(clock, new FakeUserService());
@Before
public void setUp() throws Exception {
@ -111,7 +113,7 @@ public class RegistrarSettingsActionTestCase {
when(req.getMethod()).thenReturn("POST");
when(rsp.getWriter()).thenReturn(new PrintWriter(writer));
when(req.getContentType()).thenReturn("application/json");
when(req.getHeader(eq("X-CSRF-Token"))).thenReturn(generateToken("console"));
when(req.getHeader(eq("X-CSRF-Token"))).thenReturn(xsrfTokenManager.generateToken("console"));
when(req.getReader()).thenReturn(createJsonPayload(ImmutableMap.of("op", "read")));
when(sessionUtils.isLoggedIn()).thenReturn(true);
when(sessionUtils.checkRegistrarConsoleLogin(req)).thenReturn(true);