Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add integration tests for signin #2363

Merged
merged 1 commit into from
Aug 23, 2017
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 11 additions & 4 deletions integrations/integration_test.go
Original file line number Diff line number Diff line change
Expand Up @@ -160,6 +160,13 @@ const userPassword = "password"

var loginSessionCache = make(map[string]*TestSession, 10)

func emptyTestSession(t testing.TB) *TestSession {
jar, err := cookiejar.New(nil)
assert.NoError(t, err)

return &TestSession{jar: jar}
}

func loginUser(t testing.TB, userName string) *TestSession {
if session, ok := loginSessionCache[userName]; ok {
return session
Expand All @@ -185,13 +192,13 @@ func loginUserWithPassword(t testing.TB, userName, password string) *TestSession
ch.Add("Cookie", strings.Join(resp.Headers["Set-Cookie"], ";"))
cr := http.Request{Header: ch}

jar, err := cookiejar.New(nil)
assert.NoError(t, err)
session := emptyTestSession(t)

baseURL, err := url.Parse(setting.AppURL)
assert.NoError(t, err)
jar.SetCookies(baseURL, cr.Cookies())
session.jar.SetCookies(baseURL, cr.Cookies())

return &TestSession{jar: jar}
return session
}

type TestResponseWriter struct {
Expand Down
60 changes: 60 additions & 0 deletions integrations/signin_test.go
Original file line number Diff line number Diff line change
@@ -0,0 +1,60 @@
// Copyright 2017 The Gitea Authors. All rights reserved.
// Use of this source code is governed by a MIT-style
// license that can be found in the LICENSE file.

package integrations

import (
"net/http"
"strings"
"testing"

"code.gitea.io/gitea/models"

"github.com/Unknwon/i18n"
"github.com/stretchr/testify/assert"
)

func testLoginFailed(t *testing.T, username, password, message string) {
session := emptyTestSession(t)
req := NewRequestWithValues(t, "POST", "/user/login", map[string]string{
"_csrf": GetCSRF(t, session, "/user/login"),
"user_name": username,
"password": password,
})
resp := session.MakeRequest(t, req, http.StatusOK)
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daviian For future reference, you can just use the MakeRequest(..) function, you don't need an empty session 😄

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ethantkoenig it is for reusing GetCSRF

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@lafriks You don't need a CSRF if you're unauthenticated 😄

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ethantkoenig you need otherwise login post will fail, at least it should fail

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daviian No, you don't need a CSRF for a sign-in post, since you aren't authenticated when you are making the request.

You can try it out for yourself! Comment out line 21, and run the integration tests locally; they should still pass (they passed for me)

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ethantkoenig first of all to prevent CSRF attack ;)
http://pico.ninja/gitea-login.html - try entering your try.gitea.io username/password :P (don't worry it's not logged just to demonstrate idea)

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But the CSRF attack will not succeed because noone's logged in yet.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@daviian but you will get logged in and if this is used in combination with other vulnerability it can be dangerous

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@lafriks @daviian If not requiring CSRF tokens for login is a problem, let's open a issue and continue the discussion there


htmlDoc := NewHTMLParser(t, resp.Body)
resultMsg := htmlDoc.doc.Find(".ui.message>p").Text()

assert.EqualValues(t, message, resultMsg)
}

func TestSignin(t *testing.T) {
prepareTestEnv(t)

user := models.AssertExistsAndLoadBean(t, &models.User{ID: 2}).(*models.User)

// add new user with user2's email
user.Name = "testuser"
user.LowerName = strings.ToLower(user.Name)
user.ID = 0
models.AssertSuccessfulInsert(t, user)

samples := []struct {
username string
password string
message string
}{
{username: "wrongUsername", password: "wrongPassword", message: i18n.Tr("en", "form.username_password_incorrect")},
{username: "wrongUsername", password: "password", message: i18n.Tr("en", "form.username_password_incorrect")},
{username: "user15", password: "wrongPassword", message: i18n.Tr("en", "form.username_password_incorrect")},
{username: "user1@example.com", password: "wrongPassword", message: i18n.Tr("en", "form.username_password_incorrect")},
// test for duplicate email
{username: "user2@example.com", password: "password", message: i18n.Tr("en", "form.email_been_used")},
}

for _, s := range samples {
testLoginFailed(t, s.username, s.password, s.message)
}
}