add integration test for injection, fix wps-off test

52n-wps-webapp/src/main/webapp/R/scripts/test_echo.R

@@ -0,0 +1,7 @@
+# wps.des: test.echo, title = dummy echo process, abstract = you get what you put in;
+
+# wps.in: id = inputVariable, type = string, title = input variable, minOccurs = 1, maxOccurs = 1;
+
+outputVariable <- inputVariable
+
+#wps.out: id = outputVariable, type = string, title = returning input variable;

52n-wps-webapp/src/main/webapp/R/scripts/test_wps-off.R

@@ -13,7 +13,7 @@ c = 3
 out <- a + b + c
 
 #wps.off;
-out <- 42
+out <- 17
 #wps.on;
 
 #wps.out: id = out, type = integer, title = sum of inputs;

52n-wps-webapp/src/test/java/org/n52/wps/test/Wps4rIT.java

@@ -256,7 +256,8 @@ else if (opString.equals("*"))
         String response = PostClient.sendRequest(wpsUrl, payload);
 
         assertThat(AllTestsIT.parseXML(response), is(not(nullValue())));
-        assertThat(response, containsString(Integer.toString(result)));
+        String expected = "dataType=\"xs:double\">" + Integer.toString(result) + ".0";
+        assertThat(response, containsString(expected));
     }
 
     @Test
@@ -271,7 +272,7 @@ public void wpsOffAnnotationWorks() throws XmlException, IOException {
                    response,
                    containsString(expected));
     }
-    
+
     @Test
     public void defaultValuesAreLoaded() throws XmlException, IOException {
         URL resource = Wps4rIT.class.getResource("/R/ExecuteTestDefaults.xml");
@@ -285,4 +286,28 @@ public void defaultValuesAreLoaded() throws XmlException, IOException {
                    containsString(expected));
     }
 
+    @Test
+    public void exceptionsOnIllegalInputs() throws XmlException, IOException {
+        String[] illegalCommands = new String[] {"unlink(getwd())",
+                                                 "\"\";quit(\"no\");",
+                                                 "q();",
+                                                 "quit()",
+                                                 "system('format hardisk')"};
+
+        URL resource = Wps4rIT.class.getResource("/R/ExecuteTestInjection.xml");
+        XmlObject xmlPayload = XmlObject.Factory.parse(resource);
+
+        for (String cmd : illegalCommands) {
+            String payload = xmlPayload.toString();
+            payload = payload.replace("@@@cmd@@@", cmd);
+
+            String response = PostClient.sendRequest(wpsUrl, payload);
+
+            String expected = "Illegal command";
+            assertThat("Response is an exception", response, containsString("ExceptionReport"));
+            assertThat("Response containts the keyphrase '" + expected + "'", response, containsString(expected));
+            assertThat("Response contains the illegal input", response, containsString(cmd));
+        }
+    }
+
 }

52n-wps-webapp/src/test/resources/R/ExecuteTestInjection.xml

@@ -0,0 +1,23 @@
+<?xml version="1.0" encoding="UTF-8" standalone="yes"?>
+<wps:Execute service="WPS" version="1.0.0"
+	xmlns:wps="http://www.opengis.net/wps/1.0.0" xmlns:ows="http://www.opengis.net/ows/1.1"
+	xmlns:xlink="http://www.w3.org/1999/xlink" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+	xsi:schemaLocation="http://www.opengis.net/wps/1.0.0
+	http://schemas.opengis.net/wps/1.0.0/wpsExecute_request.xsd">
+	<ows:Identifier>org.n52.wps.server.r.test.echo</ows:Identifier>
+	<wps:DataInputs>
+		<wps:Input>
+			<ows:Identifier>inputVariable</ows:Identifier>
+			<wps:Data>
+				<wps:LiteralData>@@@cmd@@@</wps:LiteralData>
+			</wps:Data>
+		</wps:Input>
+	</wps:DataInputs>
+	<wps:ResponseForm>
+		<wps:ResponseDocument storeExecuteResponse="false">
+			<wps:Output asReference="false">
+				<ows:Identifier>outputVariable</ows:Identifier>
+			</wps:Output>
+		</wps:ResponseDocument>
+	</wps:ResponseForm>
+</wps:Execute>