Skip to content

Commit

Permalink
Remove hacky test that doesn't work with fetch
Browse files Browse the repository at this point in the history
  • Loading branch information
@timja
timja committed May 7, 2023
1 parent b3384bb commit d8fd7f9
Showing 1 changed file with 0 additions and 102 deletions.
102 changes: 0 additions & 102 deletions test/src/test/java/hudson/tools/ZipExtractionInstallerTest.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,33 +24,16 @@

package hudson.tools;

import static org.hamcrest.MatcherAssert.assertThat;
import static org.hamcrest.Matchers.containsString;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.fail;

import com.gargoylesoftware.htmlunit.HttpMethod;
import com.gargoylesoftware.htmlunit.WebRequest;
import com.gargoylesoftware.htmlunit.html.HtmlPage;
import com.gargoylesoftware.htmlunit.html.HtmlTextInput;
import com.gargoylesoftware.htmlunit.javascript.JavaScriptEngine;
import com.gargoylesoftware.htmlunit.javascript.host.xml.XMLHttpRequest;
import edu.umd.cs.findbugs.annotations.NonNull;
import edu.umd.cs.findbugs.annotations.Nullable;
import hudson.model.JDK;
import hudson.model.User;
import hudson.util.FormValidation;
import java.lang.reflect.Field;
import java.net.HttpURLConnection;
import java.net.URL;
import java.net.URLDecoder;
import java.net.URLEncoder;
import java.nio.charset.StandardCharsets;
import java.util.ArrayList;
import java.util.List;
import jenkins.model.Jenkins;
import net.sourceforge.htmlunit.corejs.javascript.Function;
import net.sourceforge.htmlunit.corejs.javascript.Scriptable;
import org.junit.Rule;
import org.junit.Test;
import org.junit.rules.TemporaryFolder;
Expand Down Expand Up @@ -94,89 +77,4 @@ public void onlyAdminCanReachTheDoCheck() throws Exception {
userWc.login(USER);
assertEquals(HttpURLConnection.HTTP_FORBIDDEN, userWc.getPage(request).getWebResponse().getStatusCode());
}

@Test
@Issue("SECURITY-794")
public void roundtrip() throws Exception {
final String VALID_URL = "https://www.google.com";
final String INVALID_URL = "only-crappy-letters";

ZipExtractionInstaller installer = new ZipExtractionInstaller("", VALID_URL, "");

j.jenkins.getJDKs().add(new JDK("test", tmp.getRoot().getAbsolutePath(), List.of(
new InstallSourceProperty(List.of(installer)))));

JenkinsRule.WebClient wc = j.createWebClient();

SpyingJavaScriptEngine jsEngine = new SpyingJavaScriptEngine(wc, "ZipExtractionInstaller/checkUrl", HttpMethod.POST);
wc.setJavaScriptEngine(jsEngine);

HtmlPage page = wc.goTo("configureTools");

XMLHttpRequest lastRequest = jsEngine.getLastRequest();
String body = URLDecoder.decode(getPrivateWebRequestField(lastRequest).getRequestBody(), StandardCharsets.UTF_8);
assertThat(body, containsString(VALID_URL));
assertEquals(FormValidation.ok().renderHtml(), lastRequest.getResponseText());

HtmlTextInput urlInput = page.getDocumentElement().getOneHtmlElementByAttribute("input", "value", VALID_URL);
urlInput.setAttribute("value", INVALID_URL);
j.submit(page.getFormByName("config"));

JDK jdk = j.jenkins.getJDK("test");
InstallSourceProperty isp = jdk.getProperties().get(InstallSourceProperty.class);
assertEquals(1, isp.installers.size());
assertEquals(INVALID_URL, isp.installers.get(ZipExtractionInstaller.class).getUrl());

wc.goTo("configureTools");

lastRequest = jsEngine.getLastRequest();
body = URLDecoder.decode(getPrivateWebRequestField(lastRequest).getRequestBody(), StandardCharsets.UTF_8);
assertThat(body, containsString(INVALID_URL));
assertThat(lastRequest.getResponseText(), containsString(Messages.ZipExtractionInstaller_malformed_url()));
}

private static class SpyingJavaScriptEngine extends JavaScriptEngine {
private List<XMLHttpRequest> storedRequests = new ArrayList<>();
private String urlToMatch;
private HttpMethod method;

SpyingJavaScriptEngine(JenkinsRule.WebClient wc, @Nullable String urlToMatch, @Nullable HttpMethod method) {
super(wc);
this.urlToMatch = urlToMatch;
this.method = method;
}

@Override
public Object callFunction(HtmlPage page, Function function, Scriptable scope, Scriptable thisObject, Object[] args) {
if (thisObject instanceof XMLHttpRequest) {
try {
WebRequest request = getPrivateWebRequestField((XMLHttpRequest) thisObject);
boolean correctUrl = urlToMatch == null || request.getUrl().toString().contains(urlToMatch);
boolean correctMethod = method == null || request.getHttpMethod().equals(method);
if (correctUrl && correctMethod) {
if (((XMLHttpRequest) thisObject).getReadyState() == 4) {
storedRequests.add((XMLHttpRequest) thisObject);
}
}
} catch (NoSuchFieldException | IllegalAccessException e) {
throw new LinkageError(e.getMessage(), e);
}
}
return super.callFunction(page, function, scope, thisObject, args);
}

@NonNull
public XMLHttpRequest getLastRequest() {
if (storedRequests.isEmpty()) {
fail("There is no available requests for the proposed url/method");
}
return storedRequests.get(storedRequests.size() - 1);
}
}

private static WebRequest getPrivateWebRequestField(XMLHttpRequest xmlHttpRequest) throws NoSuchFieldException, IllegalAccessException {
Field webRequest_Field = XMLHttpRequest.class.getDeclaredField("webRequest_");
webRequest_Field.setAccessible(true);
return (WebRequest) webRequest_Field.get(xmlHttpRequest);
}
}

0 comments on commit d8fd7f9

Please sign in to comment.