]> WPIA git - gigi.git/blob - tests/org/cacert/gigi/testUtils/ManagedTest.java
Implement CSRF check on "Assure someone"
[gigi.git] / tests / org / cacert / gigi / testUtils / ManagedTest.java
1 package org.cacert.gigi.testUtils;
2
3 import static org.junit.Assert.assertNotEquals;
4 import static org.junit.Assert.assertTrue;
5
6 import java.io.BufferedReader;
7 import java.io.DataOutputStream;
8 import java.io.FileInputStream;
9 import java.io.IOException;
10 import java.io.InputStreamReader;
11 import java.io.OutputStream;
12 import java.io.UnsupportedEncodingException;
13 import java.net.HttpURLConnection;
14 import java.net.InetSocketAddress;
15 import java.net.URL;
16 import java.net.URLConnection;
17 import java.net.URLEncoder;
18 import java.nio.file.Files;
19 import java.nio.file.Paths;
20 import java.sql.PreparedStatement;
21 import java.sql.ResultSet;
22 import java.sql.SQLException;
23 import java.util.Properties;
24 import java.util.regex.Matcher;
25 import java.util.regex.Pattern;
26
27 import org.cacert.gigi.DevelLauncher;
28 import org.cacert.gigi.database.DatabaseConnection;
29 import org.cacert.gigi.testUtils.TestEmailReciever.TestMail;
30 import org.cacert.gigi.util.DatabaseManager;
31 import org.junit.After;
32 import org.junit.AfterClass;
33 import org.junit.BeforeClass;
34
35 public class ManagedTest {
36         private final String registerService = "/register";
37
38         private static TestEmailReciever ter;
39         private static Process gigi;
40         private static String url = "localhost:4443";
41
42         public static String getServerName() {
43                 return url;
44         }
45         static Properties testProps = new Properties();
46         static {
47                 InitTruststore.run();
48                 HttpURLConnection.setFollowRedirects(false);
49         }
50
51         @BeforeClass
52         public static void connectToServer() {
53                 try {
54                         testProps.load(new FileInputStream("config/test.properties"));
55                         if (!DatabaseConnection.isInited()) {
56                                 DatabaseConnection.init(testProps);
57                         }
58                         System.out.println("... purging Database");
59                         DatabaseManager.run(new String[]{
60                                         testProps.getProperty("sql.driver"),
61                                         testProps.getProperty("sql.url"),
62                                         testProps.getProperty("sql.user"),
63                                         testProps.getProperty("sql.password")});
64
65                         String type = testProps.getProperty("type");
66                         if (type.equals("local")) {
67                                 url = testProps.getProperty("server");
68                                 String[] parts = testProps.getProperty("mail").split(":", 2);
69                                 ter = new TestEmailReciever(new InetSocketAddress(parts[0],
70                                                 Integer.parseInt(parts[1])));
71                                 return;
72                         }
73                         url = testProps.getProperty("name.www") + ":"
74                                         + testProps.getProperty("serverPort");
75                         gigi = Runtime.getRuntime().exec(testProps.getProperty("java"));
76                         DataOutputStream toGigi = new DataOutputStream(
77                                         gigi.getOutputStream());
78                         System.out.println("... starting server");
79                         Properties mainProps = new Properties();
80                         mainProps.setProperty("host", "127.0.0.1");
81                         mainProps.setProperty("name.secure", "sec");
82                         mainProps
83                                         .setProperty("name.www", testProps.getProperty("name.www"));
84                         mainProps.setProperty("name.static", "stat");
85
86                         mainProps.setProperty("port", testProps.getProperty("serverPort"));
87                         mainProps.setProperty("emailProvider",
88                                         "org.cacert.gigi.email.TestEmailProvider");
89                         mainProps.setProperty("emailProvider.port", "8473");
90                         mainProps.setProperty("sql.driver",
91                                         testProps.getProperty("sql.driver"));
92                         mainProps.setProperty("sql.url", testProps.getProperty("sql.url"));
93                         mainProps
94                                         .setProperty("sql.user", testProps.getProperty("sql.user"));
95                         mainProps.setProperty("sql.password",
96                                         testProps.getProperty("sql.password"));
97
98                         byte[] cacerts = Files
99                                         .readAllBytes(Paths.get("config/cacerts.jks"));
100                         byte[] keystore = Files.readAllBytes(Paths
101                                         .get("config/keystore.pkcs12"));
102
103                         DevelLauncher.writeGigiConfig(toGigi, "changeit".getBytes(),
104                                         "changeit".getBytes(), mainProps, cacerts, keystore);
105                         toGigi.flush();
106
107                         final BufferedReader br = new BufferedReader(new InputStreamReader(
108                                         gigi.getErrorStream()));
109                         String line;
110                         while ((line = br.readLine()) != null
111                                         && !line.contains("Server:main: Started")) {
112                                 System.err.println(line);
113                         }
114                         new Thread() {
115                                 @Override
116                                 public void run() {
117                                         String line;
118                                         try {
119                                                 while ((line = br.readLine()) != null) {
120                                                         System.err.println(line);
121                                                 }
122                                         } catch (IOException e) {
123                                                 e.printStackTrace();
124                                         }
125                                 }
126                         }.start();
127                         System.err.println(line);
128                         if (line == null) {
129                                 throw new Error("Server startup failed");
130                         }
131                         ter = new TestEmailReciever(
132                                         new InetSocketAddress("localhost", 8473));
133                 } catch (IOException e) {
134                         throw new Error(e);
135                 } catch (ClassNotFoundException e1) {
136                         e1.printStackTrace();
137                 } catch (SQLException e1) {
138                         e1.printStackTrace();
139                 }
140
141         }
142         @AfterClass
143         public static void tearDownServer() {
144                 String type = testProps.getProperty("type");
145                 ter.destroy();
146                 if (type.equals("local")) {
147                         return;
148                 }
149                 gigi.destroy();
150         }
151         @After
152         public void removeMails() {
153                 ter.reset();
154         }
155
156         public TestMail waitForMail() {
157                 try {
158                         return ter.recieve();
159                 } catch (InterruptedException e) {
160                         throw new Error(e);
161                 }
162         }
163         public static TestEmailReciever getMailReciever() {
164                 return ter;
165         }
166         public String runRegister(String param) throws IOException {
167                 HttpURLConnection uc = (HttpURLConnection) new URL("https://"
168                                 + getServerName() + registerService).openConnection();
169                 uc.setDoOutput(true);
170                 uc.getOutputStream().write(param.getBytes());
171                 String d = IOUtils.readURL(uc);
172                 return d;
173         }
174         public String fetchStartErrorMessage(String d) throws IOException {
175                 String formFail = "<div class='formError'>";
176                 int idx = d.indexOf(formFail);
177                 assertNotEquals(-1, idx);
178                 String startError = d.substring(idx + formFail.length(), idx + 100)
179                                 .trim();
180                 return startError;
181         }
182
183         public void registerUser(String firstName, String lastName, String email,
184                         String password) {
185                 try {
186                         String query = "fname=" + URLEncoder.encode(firstName, "UTF-8")
187                                         + "&lname=" + URLEncoder.encode(lastName, "UTF-8")
188                                         + "&email=" + URLEncoder.encode(email, "UTF-8")
189                                         + "&pword1=" + URLEncoder.encode(password, "UTF-8")
190                                         + "&pword2=" + URLEncoder.encode(password, "UTF-8")
191                                         + "&day=1&month=1&year=1910&cca_agree=1";
192                         String data = fetchStartErrorMessage(runRegister(query));
193                         assertTrue(data, data.startsWith("</div>"));
194                 } catch (UnsupportedEncodingException e) {
195                         throw new Error(e);
196                 } catch (IOException e) {
197                         throw new Error(e);
198                 }
199         }
200         public int createVerifiedUser(String firstName, String lastName,
201                         String email, String password) {
202                 registerUser(firstName, lastName, email, password);
203                 try {
204                         TestMail tm = ter.recieve();
205                         String verifyLink = tm.extractLink();
206                         String[] parts = verifyLink.split("\\?");
207                         URL u = new URL("https://" + getServerName() + "/verify?"
208                                         + parts[1]);
209                         u.openStream().close();;
210                         PreparedStatement ps = DatabaseConnection.getInstance().prepare(
211                                         "SELECT id FROM users where email=?");
212                         ps.setString(1, email);
213                         ResultSet rs = ps.executeQuery();
214                         if (rs.next()) {
215                                 return rs.getInt(1);
216                         }
217                         throw new Error();
218                 } catch (InterruptedException e) {
219                         throw new Error(e);
220                 } catch (IOException e) {
221                         throw new Error(e);
222                 } catch (SQLException e) {
223                         throw new Error(e);
224                 }
225         }
226         /**
227          * Creates a new user with 100 Assurance points given by an (invalid)
228          * assurance.
229          * 
230          * @param firstName
231          *            the first name
232          * @param lastName
233          *            the last name
234          * @param email
235          *            the email
236          * @param password
237          *            the password
238          * @return a new userid.
239          */
240         public int createAssuranceUser(String firstName, String lastName,
241                         String email, String password) {
242                 int uid = createVerifiedUser(firstName, lastName, email, password);
243                 try {
244                         PreparedStatement ps = DatabaseConnection
245                                         .getInstance()
246                                         .prepare(
247                                                         "INSERT INTO `cats_passed` SET `user_id`=?, `variant_id`=?");
248                         ps.setInt(1, uid);
249                         ps.setInt(2, 0);
250                         ps.execute();
251                         ps = DatabaseConnection.getInstance().prepare(
252                                         "INSERT INTO `notary` SET `from`=?, `to`=?, points='100'");
253                         ps.setInt(1, uid);
254                         ps.setInt(2, uid);
255                         ps.execute();
256
257                 } catch (SQLException e) {
258                         throw new Error(e);
259                 }
260                 return uid;
261         }
262         static int count = 0;
263         public String createUniqueName() {
264                 return "test" + System.currentTimeMillis() + "a" + (count++);
265         }
266         public String login(String email, String pw) throws IOException {
267                 URL u = new URL("https://" + getServerName() + "/login");
268                 HttpURLConnection huc = (HttpURLConnection) u.openConnection();
269                 huc.setDoOutput(true);
270                 OutputStream os = huc.getOutputStream();
271                 String data = "username=" + URLEncoder.encode(email, "UTF-8")
272                                 + "&password=" + URLEncoder.encode(pw, "UTF-8");
273                 os.write(data.getBytes());
274                 os.flush();
275                 String headerField = huc.getHeaderField("Set-Cookie");
276                 headerField = headerField.substring(0, headerField.indexOf(';'));
277                 return headerField;
278         }
279
280         public String getCSRF(URLConnection u) throws IOException {
281                 String content = IOUtils.readURL(u);
282                 Pattern p = Pattern.compile("<input type='csrf' value='([^']+)'>");
283                 Matcher m = p.matcher(content);
284                 if (!m.find()) {
285                         throw new Error("New CSRF Token");
286                 }
287                 return m.group(1);
288         }
289 }