zydronium/google-nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus.git synced 2025-08-06 01:35:17 +02:00
Code Issues Projects Releases Packages Wiki Activity

Remove the web console EPP endpoint

Browse source 
This removes the "create Domain/Host/Contact" forms that were supposed to be used instead of regular EPPs for CC-TLD that wanted to support it.

We're removing it because we don't use it and want to reduce unneeded code for the registry 3.0 migration.

Also, this is a security risk, as it allowed to do "billable actions" (creating a new domain for example) with the only authentication being access to the registrar's G Suite account.

This bypassed the certificate, IP whitelist, and EPP password, which is bad.

PUBLIC:
Remove the web console EPP endpoint

This removes the "create Domain/Host/Contact" forms that were supposed to be used instead of regular EPPs for CC-TLD that wanted to support it.

We're removing it because we don't use it and want to reduce unneeded code for the registry 3.0 migration.

-------------
Created by MOE: https://github.com/google/moe
MOE_MIGRATED_REVID=236244195
This commit is contained in:
guyben 2019-02-28 19:37:30 -08:00 • committed by Weimin Yu
parent 193bd49406
commit 847795d58d
52 changed files with 58 additions and 3788 deletions
Download patch file Download diff file Expand all files Collapse all files

73
javatests/google/registry/flows/EppConsoleActionTest.java
View file

@ -1,73 +0,0 @@
// Copyright 2017 The Nomulus Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package google.registry.flows;
import static com.google.appengine.api.users.UserServiceFactory.getUserService;
import static com.google.common.truth.Truth.assertThat;
import static java.nio.charset.StandardCharsets.UTF_8;
import static org.mockito.Matchers.eq;
import static org.mockito.Mockito.mock;
import static org.mockito.Mockito.verify;
import com.google.common.collect.ImmutableSetMultimap;
import google.registry.request.auth.AuthenticatedRegistrarAccessor;
import google.registry.testing.AppEngineRule;
import google.registry.testing.FakeHttpSession;
import google.registry.testing.ShardableTestCase;
import google.registry.testing.UserInfo;
import org.junit.Rule;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.junit.runners.JUnit4;
import org.mockito.ArgumentCaptor;
/** Tests for {@link EppConsoleAction}. */
@RunWith(JUnit4.class)
public class EppConsoleActionTest extends ShardableTestCase {
private static final byte[] INPUT_XML_BYTES = "<xml>".getBytes(UTF_8);
@Rule
public final AppEngineRule appEngine = AppEngineRule.builder()
.withUserService(UserInfo.create("person@example.com", "12345"))
.build();
@Test
public void testAction() {
EppConsoleAction action = new EppConsoleAction();
action.inputXmlBytes = INPUT_XML_BYTES;
action.session = new FakeHttpSession();
action.clientId = "ClientIdentifier";
action.eppRequestHandler = mock(EppRequestHandler.class);
action.userService = getUserService();
action.registrarAccessor =
AuthenticatedRegistrarAccessor.createForTesting(ImmutableSetMultimap.of());
action.run();
ArgumentCaptor<TransportCredentials> credentialsCaptor =
ArgumentCaptor.forClass(TransportCredentials.class);
ArgumentCaptor<SessionMetadata> metadataCaptor = ArgumentCaptor.forClass(SessionMetadata.class);
verify(action.eppRequestHandler)
.executeEpp(
metadataCaptor.capture(),
credentialsCaptor.capture(),
eq(EppRequestSource.CONSOLE),
eq(false),
eq(false),
eq(INPUT_XML_BYTES));
assertThat(credentialsCaptor.getValue().toString()).contains("user=TestUserId");
assertThat(metadataCaptor.getValue().getClientId()).isEqualTo("ClientIdentifier");
}
}

61
javatests/google/registry/flows/EppLoginAdminUserTest.java
View file

@ -1,61 +0,0 @@
// Copyright 2017 The Nomulus Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package google.registry.flows;
import com.google.common.collect.ImmutableSetMultimap;
import google.registry.request.auth.AuthenticatedRegistrarAccessor;
import google.registry.testing.AppEngineRule;
import org.junit.Before;
import org.junit.Rule;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.junit.runners.JUnit4;
/** Test logging in with appengine admin user credentials. */
@RunWith(JUnit4.class)
public class EppLoginAdminUserTest extends EppTestCase {
@Rule
public final AppEngineRule appEngine = AppEngineRule.builder()
.withDatastore()
.build();
@Before
public void initTransportCredentials() {
setTransportCredentials(
new GaeUserCredentials(
AuthenticatedRegistrarAccessor.createForTesting(
ImmutableSetMultimap.of(
"TheRegistrar", AuthenticatedRegistrarAccessor.Role.ADMIN,
"NewRegistrar", AuthenticatedRegistrarAccessor.Role.ADMIN))));
}
@Test
public void testLoginLogout_wrongPasswordStillWorks() throws Exception {
// For user-based logins the password in the epp xml is ignored.
assertThatLoginSucceeds("NewRegistrar", "incorrect");
assertThatLogoutSucceeds();
}
@Test
public void testNonAuthedMultiLogin_succeedsAsAdmin() throws Exception {
// The admin can log in as different registrars.
assertThatLoginSucceeds("NewRegistrar", "foo-BAR2");
assertThatLogoutSucceeds();
assertThatLoginSucceeds("NewRegistrar", "foo-BAR2");
assertThatLogoutSucceeds();
assertThatLoginSucceeds("TheRegistrar", "password2");
}
}

81
javatests/google/registry/flows/EppLoginUserTest.java
View file

@ -1,81 +0,0 @@
// Copyright 2017 The Nomulus Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package google.registry.flows;
import com.google.common.collect.ImmutableMap;
import com.google.common.collect.ImmutableSetMultimap;
import google.registry.request.auth.AuthenticatedRegistrarAccessor;
import google.registry.testing.AppEngineRule;
import org.junit.Before;
import org.junit.Rule;
import org.junit.Test;
import org.junit.runner.RunWith;
import org.junit.runners.JUnit4;
/** Test logging in with appengine user credentials, such as via the console. */
@RunWith(JUnit4.class)
public class EppLoginUserTest extends EppTestCase {
@Rule
public final AppEngineRule appEngine = AppEngineRule.builder()
.withDatastore()
.build();
@Before
public void initTest() {
setTransportCredentials(
new GaeUserCredentials(
AuthenticatedRegistrarAccessor.createForTesting(
ImmutableSetMultimap.of(
"NewRegistrar", AuthenticatedRegistrarAccessor.Role.OWNER))));
}
@Test
public void testLoginLogout() throws Exception {
assertThatLoginSucceeds("NewRegistrar", "foo-BAR2");
assertThatLogoutSucceeds();
}
@Test
public void testNonAuthedLogin_fails() throws Exception {
assertThatLogin("TheRegistrar", "password2")
.hasResponse(
"response_error.xml",
ImmutableMap.of(
"CODE", "2200",
"MSG", "TestUserId doesn't have access to registrar TheRegistrar"));
}
@Test
public void testMultiLogin() throws Exception {
assertThatLoginSucceeds("NewRegistrar", "foo-BAR2");
assertThatLogoutSucceeds();
assertThatLoginSucceeds("NewRegistrar", "foo-BAR2");
assertThatLogoutSucceeds();
assertThatLogin("TheRegistrar", "password2")
.hasResponse(
"response_error.xml",
ImmutableMap.of(
"CODE", "2200",
"MSG", "TestUserId doesn't have access to registrar TheRegistrar"));
}
@Test
public void testLoginLogout_wrongPasswordStillWorks() throws Exception {
// For user-based logins the password in the epp xml is ignored.
assertThatLoginSucceeds("NewRegistrar", "incorrect");
assertThatLogoutSucceeds();
}
}

12
javatests/google/registry/flows/FlowRunnerTest.java
View file

@ -26,14 +26,12 @@ import static org.mockito.Mockito.verify;
import com.google.common.base.Joiner;
import com.google.common.base.Splitter;
import com.google.common.collect.ImmutableSet;
import com.google.common.collect.ImmutableSetMultimap;
import com.google.common.flogger.LoggerConfig;
import com.google.common.testing.TestLogHandler;
import google.registry.model.eppcommon.Trid;
import google.registry.model.eppoutput.EppOutput.ResponseOrGreeting;
import google.registry.model.eppoutput.EppResponse;
import google.registry.monitoring.whitebox.EppMetric;
import google.registry.request.auth.AuthenticatedRegistrarAccessor;
import google.registry.testing.AppEngineRule;
import google.registry.testing.FakeClock;
import google.registry.testing.FakeHttpSession;
@ -140,16 +138,6 @@ public class FlowRunnerTest extends ShardableTestCase {
+ "{clientId=TheRegistrar, failedLoginAttempts=0, serviceExtensionUris=}");
}
@Test
public void testRun_loggingStatement_gaeUserCredentials() throws Exception {
flowRunner.credentials =
new GaeUserCredentials(AuthenticatedRegistrarAccessor.createForTesting(
ImmutableSetMultimap.of()));
flowRunner.run(eppMetricBuilder);
assertThat(findFirstLogMessageByPrefix(handler, "EPP Command\n\t"))
.contains("user=TestUserId");
}
@Test
public void testRun_loggingStatement_tlsCredentials() throws Exception {
flowRunner.credentials = new TlsCredentials(true, "abc123def", Optional.of("127.0.0.1"));

58
javatests/google/registry/flows/session/LoginFlowViaConsoleTest.java
View file

@ -1,58 +0,0 @@
// Copyright 2017 The Nomulus Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package google.registry.flows.session;
import com.google.common.collect.ImmutableSetMultimap;
import google.registry.flows.GaeUserCredentials;
import google.registry.flows.GaeUserCredentials.UserForbiddenException;
import google.registry.request.auth.AuthenticatedRegistrarAccessor;
import org.junit.Test;
/**
* Unit tests for {@link LoginFlow} when accessed via a web frontend
* transport, i.e. with GAIA ids.
*/
public class LoginFlowViaConsoleTest extends LoginFlowTestCase {
@Test
public void testSuccess_withAccess() throws Exception {
credentials =
new GaeUserCredentials(
AuthenticatedRegistrarAccessor.createForTesting(
ImmutableSetMultimap.of(
"NewRegistrar", AuthenticatedRegistrarAccessor.Role.OWNER)));
doSuccessfulTest("login_valid.xml");
}
@Test
public void testFailure_withoutAccess() {
credentials =
new GaeUserCredentials(
AuthenticatedRegistrarAccessor.createForTesting(
ImmutableSetMultimap.of()));
doFailingTest("login_valid.xml", UserForbiddenException.class);
}
@Test
public void testFailure_withAccessToDifferentRegistrar() {
credentials =
new GaeUserCredentials(
AuthenticatedRegistrarAccessor.createForTesting(
ImmutableSetMultimap.of(
"TheRegistrar", AuthenticatedRegistrarAccessor.Role.OWNER)));
doFailingTest("login_valid.xml", UserForbiddenException.class);
}
}