tests/org/cacert/gigi/pages/wot/TestAssurance.java

   1 package org.cacert.gigi.pages.wot;
   2
   3 import java.io.IOException;
   4 import java.io.UnsupportedEncodingException;
   5 import java.net.HttpURLConnection;
   6 import java.net.MalformedURLException;
   7 import java.net.URL;
   8 import java.net.URLConnection;
   9 import java.net.URLEncoder;
  10 import java.sql.PreparedStatement;
  11 import java.sql.SQLException;
  12 import java.text.SimpleDateFormat;
  13 import java.util.Date;
  14
  15 import org.cacert.gigi.database.DatabaseConnection;
  16 import org.cacert.gigi.testUtils.IOUtils;
  17 import org.cacert.gigi.testUtils.ManagedTest;
  18 import org.junit.Before;
  19 import org.junit.Test;
  20
  21 import static org.junit.Assert.*;
  22
  23 public class TestAssurance extends ManagedTest {
  24         private String assurerM;
  25         private String assureeM;
  26         private int assurer;
  27         private int assuree;
  28         private String cookie;
  29
  30         @Before
  31         public void setup() throws IOException {
  32                 assurerM = createUniqueName() + "@cacert-test.org";
  33                 assureeM = createUniqueName() + "@cacert-test.org";
  34                 assurer = createAssuranceUser("a", "b", assurerM, TEST_PASSWORD);
  35                 assuree = createAssuranceUser("a", "c", assureeM, TEST_PASSWORD);
  36                 cookie = login(assurerM, TEST_PASSWORD);
  37
  38         }
  39
  40         @Test
  41         public void testAssureSearch() throws IOException {
  42                 String loc = search("email=" + URLEncoder.encode(assureeM, "UTF-8") + "&day=1&month=1&year=1910");
  43                 assertTrue(loc, loc.endsWith(AssurePage.PATH + "/" + assuree));
  44         }
  45
  46         @Test
  47         public void testAssureSearchEmail() throws IOException {
  48                 String loc = search("email=1" + URLEncoder.encode(assureeM, "UTF-8") + "&day=1&month=1&year=1910");
  49                 assertNull(loc);
  50         }
  51
  52         @Test
  53         public void testAssureSearchDob() throws IOException {
  54                 String loc = search("email=" + URLEncoder.encode(assureeM, "UTF-8") + "&day=2&month=1&year=1910");
  55                 assertNull(loc);
  56                 loc = search("email=" + URLEncoder.encode(assureeM, "UTF-8") + "&day=1&month=2&year=1910");
  57                 assertNull(loc);
  58                 loc = search("email=" + URLEncoder.encode(assureeM, "UTF-8") + "&day=1&month=1&year=1911");
  59                 assertNull(loc);
  60         }
  61
  62         private String search(String query) throws MalformedURLException, IOException, UnsupportedEncodingException {
  63                 URL u = new URL("https://" + getServerName() + AssurePage.PATH);
  64                 URLConnection uc = u.openConnection();
  65                 uc.setDoOutput(true);
  66                 uc.addRequestProperty("Cookie", cookie);
  67                 uc.getOutputStream().write((query).getBytes());
  68                 uc.getOutputStream().flush();
  69
  70                 String loc = uc.getHeaderField("Location");
  71                 return loc;
  72         }
  73
  74         @Test
  75         public void testAssureForm() throws IOException {
  76                 String error = getError("date=2000-01-01&location=testcase&certify=1&rules=1&CCAAgreed=1&assertion=1&points=10");
  77                 assertTrue(error, error.startsWith("</div>"));
  78         }
  79
  80         @Test
  81         public void testAssureFormNoCSRF() throws IOException {
  82                 // override csrf
  83                 HttpURLConnection uc = (HttpURLConnection) buildupAssureFormConnection(false);
  84                 uc.getOutputStream().write(
  85                         ("date=2000-01-01&location=testcase&certify=1&rules=1&CCAAgreed=1&assertion=1&points=10").getBytes());
  86                 uc.getOutputStream().flush();
  87                 assertEquals(500, uc.getResponseCode());
  88         }
  89
  90         @Test
  91         public void testAssureFormWrongCSRF() throws IOException {
  92                 // override csrf
  93                 HttpURLConnection uc = (HttpURLConnection) buildupAssureFormConnection(false);
  94                 uc.getOutputStream().write(
  95                         ("date=2000-01-01&location=testcase&certify=1&rules=1&CCAAgreed=1&assertion=1&points=10&csrf=aragc")
  96                                 .getBytes());
  97                 uc.getOutputStream().flush();
  98                 assertEquals(500, uc.getResponseCode());
  99         }
 100
 101         @Test
 102         public void testAssureFormRace() throws IOException, SQLException {
 103                 URLConnection uc = buildupAssureFormConnection(true);
 104                 PreparedStatement ps = DatabaseConnection.getInstance()
 105                         .prepare("UPDATE `users` SET email='changed' WHERE id=?");
 106                 ps.setInt(1, assuree);
 107                 ps.execute();
 108                 uc.getOutputStream().write(
 109                         ("date=2000-01-01&location=testcase&certify=1&rules=1&CCAAgreed=1&assertion=1&points=10").getBytes());
 110                 uc.getOutputStream().flush();
 111                 String error = fetchStartErrorMessage(IOUtils.readURL(uc));
 112                 assertTrue(error, !error.startsWith("</div>"));
 113         }
 114
 115         @Test
 116         public void testAssureFormFuture() throws IOException {
 117                 SimpleDateFormat sdf = new SimpleDateFormat("YYYY");
 118                 int year = Integer.parseInt(sdf.format(new Date(System.currentTimeMillis()))) + 2;
 119                 String error = getError("date=" + year
 120                         + "-01-01&location=testcase&certify=1&rules=1&CCAAgreed=1&assertion=1&points=10");
 121                 assertTrue(error, !error.startsWith("</div>"));
 122         }
 123
 124         @Test
 125         public void testAssureFormNoLoc() throws IOException {
 126                 String error = getError("date=2000-01-01&location=a&certify=1&rules=1&CCAAgreed=1&assertion=1&points=10");
 127                 assertTrue(error, !error.startsWith("</div>"));
 128                 error = getError("date=2000-01-01&location=&certify=1&rules=1&CCAAgreed=1&assertion=1&points=10");
 129                 assertTrue(error, !error.startsWith("</div>"));
 130         }
 131
 132         @Test
 133         public void testAssureFormInvalDate() throws IOException {
 134                 String error = getError("date=20000101&location=testcase&certify=1&rules=1&CCAAgreed=1&assertion=1&points=10");
 135                 assertTrue(error, !error.startsWith("</div>"));
 136                 error = getError("date=&location=testcase&certify=1&rules=1&CCAAgreed=1&assertion=1&points=10");
 137                 assertTrue(error, !error.startsWith("</div>"));
 138         }
 139
 140         @Test
 141         public void testAssureFormBoxes() throws IOException {
 142                 String error = getError("date=2000-01-01&location=testcase&certify=0&rules=1&CCAAgreed=1&assertion=1&points=10");
 143                 assertTrue(error, !error.startsWith("</div>"));
 144                 error = getError("date=2000-01-01&location=testcase&certify=1&rules=&CCAAgreed=1&assertion=1&points=10");
 145                 assertTrue(error, !error.startsWith("</div>"));
 146                 error = getError("date=2000-01-01&location=testcase&certify=1&rules=1&CCAAgreed=a&assertion=1&points=10");
 147                 assertTrue(error, !error.startsWith("</div>"));
 148                 error = getError("date=2000-01-01&location=testcase&certify=1&rules=1&CCAAgreed=1&assertion=z&points=10");
 149                 assertTrue(error, !error.startsWith("</div>"));
 150         }
 151
 152         private String getError(String query) throws MalformedURLException, IOException {
 153                 URLConnection uc = buildupAssureFormConnection(true);
 154                 uc.getOutputStream().write((query).getBytes());
 155                 uc.getOutputStream().flush();
 156                 String error = fetchStartErrorMessage(IOUtils.readURL(uc));
 157                 return error;
 158         }
 159
 160         private URLConnection buildupAssureFormConnection(boolean doCSRF) throws MalformedURLException, IOException {
 161                 URL u = new URL("https://" + getServerName() + AssurePage.PATH + "/" + assuree);
 162                 URLConnection uc = u.openConnection();
 163                 uc.addRequestProperty("Cookie", cookie);
 164                 String csrf = getCSRF(uc);
 165                 uc = u.openConnection();
 166                 uc.addRequestProperty("Cookie", cookie);
 167                 uc.setDoOutput(true);
 168                 if (doCSRF) {
 169                         uc.getOutputStream().write(("csrf=" + csrf + "&").getBytes());
 170                 }
 171                 return uc;
 172         }
 173
 174 }