|
Lines 28-42
use Log::Log4perl;
Link Here
|
| 28 |
use t::lib::Mocks; |
28 |
use t::lib::Mocks; |
| 29 |
|
29 |
|
| 30 |
use Koha::Database; |
30 |
use Koha::Database; |
|
|
31 |
use Koha::ContentSecurityPolicy; |
| 31 |
|
32 |
|
| 32 |
my $schema = Koha::Database->new->schema; |
33 |
my $schema = Koha::Database->new->schema; |
| 33 |
my $t = Test::Mojo->new('Koha::REST::V1'); |
34 |
my $t = Test::Mojo->new('Koha::REST::V1'); |
| 34 |
|
35 |
|
| 35 |
t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 ); |
36 |
t::lib::Mocks::mock_preference( 'RESTBasicAuth', 1 ); |
|
|
37 |
t::lib::Mocks::mock_config( 'api_secret_passphrase', 'test' ); |
| 38 |
|
| 39 |
my $csp = Koha::ContentSecurityPolicy->new; |
| 36 |
|
40 |
|
| 37 |
subtest 'add() tests' => sub { |
41 |
subtest 'add() tests' => sub { |
| 38 |
|
42 |
|
| 39 |
plan tests => 7; |
43 |
plan tests => 16; |
| 40 |
|
44 |
|
| 41 |
$schema->storage->txn_begin; |
45 |
$schema->storage->txn_begin; |
| 42 |
|
46 |
|
|
Lines 57-68
subtest 'add() tests' => sub {
Link Here
|
| 57 |
} |
61 |
} |
| 58 |
}; |
62 |
}; |
| 59 |
|
63 |
|
| 60 |
# Anonymous request should work (browsers send these without auth) |
64 |
# Anonymous request requires token |
| 61 |
$t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
65 |
$t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
|
|
66 |
->status_is( 400, 'CSP report denied (400)' ) |
| 67 |
->content_like( qr/Missing property.*\/token"/, '...because of a missing token' ); |
| 68 |
|
| 69 |
# Anonymous request requires valid token |
| 70 |
$t->post_ok( '/api/v1/public/csp-reports?token=invalid' => { 'Content-Type' => 'application/csp-report' } => json => |
| 71 |
$csp_report )->status_is( 401, 'CSP report denied (401)' ) |
| 72 |
->json_is( '/error', 'Invalid token.', '...because of an invalid token' ); |
| 73 |
|
| 74 |
# Anonymous request requires a non-expired token |
| 75 |
my $expired_token = Mojo::JWT->new( |
| 76 |
claims => { |
| 77 |
type => 'csp-violation', |
| 78 |
timestamp => 0, |
| 79 |
}, |
| 80 |
expires => 0, |
| 81 |
secret => Digest::MD5::md5_base64( |
| 82 |
Encode::encode( 'UTF-8', C4::Context->config('api_secret_passphrase') || 'unsafe' ) |
| 83 |
) |
| 84 |
)->encode; |
| 85 |
|
| 86 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 87 |
. $expired_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 88 |
->status_is( 400, 'CSP report denied (400)' ) |
| 89 |
->json_is( '/error', 'This token has expired.', '...because of an expired token' ); |
| 90 |
|
| 91 |
# Anonymous request should work (browsers send these without auth) |
| 92 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 93 |
. $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 62 |
->status_is( 204, 'CSP report accepted' ); |
94 |
->status_is( 204, 'CSP report accepted' ); |
| 63 |
|
95 |
|
| 64 |
# Test with application/json content type (also valid) |
96 |
# Test with application/json content type (also valid) |
| 65 |
$t->post_ok( '/api/v1/public/csp-reports' => { 'Content-Type' => 'application/json' } => json => $csp_report ) |
97 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
|
|
98 |
. $csp->api_token => { 'Content-Type' => 'application/json' } => json => $csp_report ) |
| 66 |
->status_is( 204, 'CSP report accepted with application/json content type' ); |
99 |
->status_is( 204, 'CSP report accepted with application/json content type' ); |
| 67 |
|
100 |
|
| 68 |
# Test with minimal report |
101 |
# Test with minimal report |
|
Lines 74-80
subtest 'add() tests' => sub {
Link Here
|
| 74 |
} |
107 |
} |
| 75 |
}; |
108 |
}; |
| 76 |
|
109 |
|
| 77 |
$t->post_ok( '/api/v1/public/csp-reports' => json => $minimal_report ) |
110 |
$t->post_ok( '/api/v1/public/csp-reports?token=' . $csp->api_token => json => $minimal_report ) |
| 78 |
->status_is( 204, 'Minimal CSP report accepted' ); |
111 |
->status_is( 204, 'Minimal CSP report accepted' ); |
| 79 |
|
112 |
|
| 80 |
subtest 'make sure log entries are being written' => sub { |
113 |
subtest 'make sure log entries are being written' => sub { |
|
Lines 114-121
subtest 'add() tests' => sub {
Link Here
|
| 114 |
is( $appender->buffer, '', 'Nothing in log buffer yet' ); |
147 |
is( $appender->buffer, '', 'Nothing in log buffer yet' ); |
| 115 |
is( $appenderplack->buffer, '', 'Nothing in plack log buffer yet' ); |
148 |
is( $appenderplack->buffer, '', 'Nothing in plack log buffer yet' ); |
| 116 |
|
149 |
|
| 117 |
$t->post_ok( |
150 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 118 |
'/api/v1/public/csp-reports' => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
151 |
. $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 119 |
->status_is( 204, 'CSP report accepted' ); |
152 |
->status_is( 204, 'CSP report accepted' ); |
| 120 |
|
153 |
|
| 121 |
my $expected_log_entry = sprintf( |
154 |
my $expected_log_entry = sprintf( |
|
Lines 137-144
subtest 'add() tests' => sub {
Link Here
|
| 137 |
$appender->clear(); |
170 |
$appender->clear(); |
| 138 |
|
171 |
|
| 139 |
$ENV{'plack.is.enabled.for.this.test'} = 1; # tricking C4::Context->psgi_env |
172 |
$ENV{'plack.is.enabled.for.this.test'} = 1; # tricking C4::Context->psgi_env |
| 140 |
$t->post_ok( |
173 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 141 |
'/api/v1/public/csp-reports' => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
174 |
. $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 142 |
->status_is( 204, 'CSP report accepted' ); |
175 |
->status_is( 204, 'CSP report accepted' ); |
| 143 |
like( |
176 |
like( |
| 144 |
$appenderplack->buffer, qr/$expected_log_entry/ |
177 |
$appenderplack->buffer, qr/$expected_log_entry/ |
|
Lines 157-164
log4perl.appender.API.utf8=1
Link Here
|
| 157 |
HERE |
190 |
HERE |
| 158 |
); |
191 |
); |
| 159 |
$appender = Log::Log4perl->appenders()->{API}; |
192 |
$appender = Log::Log4perl->appenders()->{API}; |
| 160 |
$t->post_ok( |
193 |
$t->post_ok( '/api/v1/public/csp-reports?token=' |
| 161 |
'/api/v1/public/csp-reports' => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
194 |
. $csp->api_token => { 'Content-Type' => 'application/csp-report' } => json => $csp_report ) |
| 162 |
->status_is( 204, 'CSP report returns 204 even when no CSP loggers are defined' ); |
195 |
->status_is( 204, 'CSP report returns 204 even when no CSP loggers are defined' ); |
| 163 |
is( $appender->buffer, '', 'Nothing in the only defined log buffer, because it is unrelated to CSP' ); |
196 |
is( $appender->buffer, '', 'Nothing in the only defined log buffer, because it is unrelated to CSP' ); |
| 164 |
|
197 |
|
| 165 |
- |
|
|