v0.25.1
This commit is contained in:
Mateusz Gruszczyński committed
1 parent
87e571c170
commit
fa7abc9e53
308 files changed
+49746
-50237
No files matched your search
@@ -0,0 +1,172 @@
|
||||
#[tokio::test]
|
||||
async fn docs_require_the_same_session_and_do_not_redirect_schema_fetches() {
|
||||
let (router, store, _dir, secret, _) = fixture().await;
|
||||
for path in ["/docs", "/docs/"] {
|
||||
let response = router
|
||||
.clone()
|
||||
.oneshot(request(path).body(Body::empty()).unwrap())
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(response.status(), StatusCode::SEE_OTHER);
|
||||
assert_eq!(response.headers()["location"], "/?next=docs");
|
||||
}
|
||||
let cookie = format!("{}={secret}", auth::COOKIE_NAME);
|
||||
for path in [
|
||||
"/",
|
||||
"/docs",
|
||||
"/docs/",
|
||||
"/docs/init.js",
|
||||
"/docs/style.css",
|
||||
"/docs/swagger-ui-bundle.js",
|
||||
"/docs/swagger-ui.css",
|
||||
"/docs/licenses.txt",
|
||||
"/docs/content.json",
|
||||
"/assets/app.js",
|
||||
] {
|
||||
let response = router
|
||||
.clone()
|
||||
.oneshot(
|
||||
request(path)
|
||||
.header("cookie", &cookie)
|
||||
.body(Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(response.status(), StatusCode::OK, "{path}");
|
||||
assert_eq!(response.headers()["x-frame-options"], "DENY");
|
||||
assert_eq!(response.headers()["cache-control"], "no-store");
|
||||
}
|
||||
let response = router
|
||||
.clone()
|
||||
.oneshot(
|
||||
request("/docs/openapi.json")
|
||||
.header("cookie", &cookie)
|
||||
.body(Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
let spec = json_body(response).await;
|
||||
assert_eq!(spec["openapi"], "3.0.3");
|
||||
assert_eq!(spec["info"]["version"], env!("CARGO_PKG_VERSION"));
|
||||
assert_eq!(
|
||||
spec["components"]["securitySchemes"]["AdminSession"]["in"],
|
||||
"cookie"
|
||||
);
|
||||
assert!(spec["paths"].get("/api/config").is_some());
|
||||
let response = router
|
||||
.clone()
|
||||
.oneshot(
|
||||
request("/docs/content.json")
|
||||
.header("cookie", &cookie)
|
||||
.body(Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
let docs = json_body(response).await;
|
||||
let documents = docs["documents"].as_array().expect("documentation bundle");
|
||||
assert!(documents.iter().any(|document| document["path"] == "docs/README.md"));
|
||||
assert!(documents.iter().any(|document| document["path"] == "docs/WEB_SERVER.md"));
|
||||
assert!(documents.iter().any(|document| document["path"] == "docs/PHP_FPM.md"));
|
||||
assert!(documents.iter().any(|document| document["path"] == "docs/V0.25.0_AUDIT.md"));
|
||||
assert!(documents.iter().any(|document| document["path"] == "docs/V0.25.0_SECURITY_PREPROD_AUDIT.md"));
|
||||
store.close().await;
|
||||
}
|
||||
#[tokio::test]
|
||||
async fn credentials_in_query_or_duplicate_cookies_cannot_authorize() {
|
||||
let (router, store, _dir, secret, _) = fixture().await;
|
||||
for cookie in [
|
||||
String::new(),
|
||||
format!("{}=invalid", auth::COOKIE_NAME),
|
||||
format!(
|
||||
"{}={secret}; {}={secret}",
|
||||
auth::COOKIE_NAME,
|
||||
auth::COOKIE_NAME
|
||||
),
|
||||
] {
|
||||
let path = format!("/api/config?token={secret}&session={secret}");
|
||||
let response = router
|
||||
.clone()
|
||||
.oneshot(
|
||||
request(&path)
|
||||
.header("cookie", cookie)
|
||||
.header("authorization", format!("Bearer {secret}"))
|
||||
.body(Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(response.status(), StatusCode::UNAUTHORIZED);
|
||||
}
|
||||
store.close().await;
|
||||
}
|
||||
#[tokio::test]
|
||||
async fn duplicate_csrf_or_marker_is_rejected_and_session_survives() {
|
||||
let (router, store, _dir, secret, csrf) = fixture().await;
|
||||
let cookie = format!("{}={secret}", auth::COOKIE_NAME);
|
||||
for duplicate in ["x-csrf-token", "x-rustproxy-request"] {
|
||||
let response = router
|
||||
.clone()
|
||||
.oneshot(
|
||||
request("/api/auth/logout")
|
||||
.method("POST")
|
||||
.header("cookie", &cookie)
|
||||
.header("origin", "http://127.0.0.1:9090")
|
||||
.header("x-rustproxy-request", "1")
|
||||
.header("x-csrf-token", &csrf)
|
||||
.header(
|
||||
duplicate,
|
||||
if duplicate == "x-csrf-token" {
|
||||
csrf.as_str()
|
||||
} else {
|
||||
"1"
|
||||
},
|
||||
)
|
||||
.body(Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(response.status(), StatusCode::FORBIDDEN);
|
||||
}
|
||||
let response = router
|
||||
.oneshot(
|
||||
request("/api/auth/session")
|
||||
.header("cookie", cookie)
|
||||
.body(Body::empty())
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
store.close().await;
|
||||
}
|
||||
#[tokio::test]
|
||||
async fn malformed_anonymous_json_never_reflects_submitted_values() {
|
||||
let (router, store, _dir, _, _) = fixture().await;
|
||||
for path in ["/api/auth/login", "/api/auth/setup"] {
|
||||
let response = router
|
||||
.clone()
|
||||
.oneshot(
|
||||
request(path)
|
||||
.method("POST")
|
||||
.header("origin", "http://127.0.0.1:9090")
|
||||
.header("x-rustproxy-request", "1")
|
||||
.header("content-type", "application/json")
|
||||
.body(Body::from(
|
||||
r#"{"username":{"untrusted":"DO_NOT_REFLECT_ME"}}"#,
|
||||
))
|
||||
.unwrap(),
|
||||
)
|
||||
.await
|
||||
.unwrap();
|
||||
assert_eq!(response.status(), StatusCode::BAD_REQUEST);
|
||||
assert_eq!(
|
||||
json_body(response).await,
|
||||
json!({"error":"auth.invalid_request"})
|
||||
);
|
||||
}
|
||||
store.close().await;
|
||||
}
|
||||
Reference in new issue
Block a user