Bugzilla – Attachment 186690 Details for
Bug 40847
OAuth endpoint missing some validations
Home
|
New
|
Browse
|
Search
|
[?]
|
Reports
|
Help
|
New Account
|
Log In
[x]
|
Forgot Password
Login:
[x]
[patch]
Bug 40847: Add input validation tests for OAuth login
Bug-40847-Add-input-validation-tests-for-OAuth-log.patch (text/plain), 2.91 KB, created by
Tomás Cohen Arazi (tcohen)
on 2025-09-22 13:22:25 UTC
(
hide
)
Description:
Bug 40847: Add input validation tests for OAuth login
Filename:
MIME Type:
Creator:
Tomás Cohen Arazi (tcohen)
Created:
2025-09-22 13:22:25 UTC
Size:
2.91 KB
patch
obsolete
>From 9be29d6fec3c21a412f8d59b185c584ec7684446 Mon Sep 17 00:00:00 2001 >From: =?UTF-8?q?Tom=C3=A1s=20Cohen=20Arazi?= <tomascohen@theke.io> >Date: Mon, 22 Sep 2025 09:56:17 -0300 >Subject: [PATCH] Bug 40847: Add input validation tests for OAuth login > >This patch adds tests to document the current behavior of OAuth login >endpoint with missing or invalid parameters. > >Valitation is added for the interface parameter on the spec. > >Test plan: >1. Apply patch >2. Run: > $ ktd --shell > k$ prove t/db_dependent/api/v1/oauth.t >=> SUCCESS: Tests pass! Current behavior documented >3. Sign off :-D >--- > api/v1/swagger/paths/oauth.yaml | 3 +++ > t/db_dependent/api/v1/oauth.t | 26 +++++++++++++++++++++++++- > 2 files changed, 28 insertions(+), 1 deletion(-) > >diff --git a/api/v1/swagger/paths/oauth.yaml b/api/v1/swagger/paths/oauth.yaml >index 27e08379fc..3cc4c86848 100644 >--- a/api/v1/swagger/paths/oauth.yaml >+++ b/api/v1/swagger/paths/oauth.yaml >@@ -63,6 +63,9 @@ > description: Name of the interface this login is for > required: true > type: string >+ enum: >+ - opac >+ - staff > - name: code > in: query > description: Code returned from OAuth server for Authorization Code grant >diff --git a/t/db_dependent/api/v1/oauth.t b/t/db_dependent/api/v1/oauth.t >index 185f4b40ff..105ac579af 100755 >--- a/t/db_dependent/api/v1/oauth.t >+++ b/t/db_dependent/api/v1/oauth.t >@@ -37,7 +37,7 @@ my $schema = Koha::Database->new->schema; > my $builder = t::lib::TestBuilder->new(); > > if ( can_load( modules => { 'Net::OAuth2::AuthorizationServer' => undef } ) ) { >- plan tests => 3; >+ plan tests => 4; > } else { > plan skip_all => 'Net::OAuth2::AuthorizationServer not available'; > } >@@ -113,6 +113,30 @@ subtest 'Net::OAuth2::AuthorizationServer missing tests' => sub { > $schema->storage->txn_rollback; > }; > >+subtest 'OAuth login input validation tests' => sub { >+ plan tests => 6; >+ >+ $schema->storage->txn_begin; >+ >+ # Mock system preferences >+ t::lib::Mocks::mock_preference( 'OPACBaseURL', 'http://opac.example.com' ); >+ t::lib::Mocks::mock_preference( 'staffClientBaseURL', 'http://staff.example.com' ); >+ t::lib::Mocks::mock_preference( 'OpacPublic', 1 ); >+ >+ # Test invalid interface parameter (should be validated by OpenAPI enum) >+ $t->get_ok('/api/v1/oauth/login/test_provider/invalid') >+ ->status_is( 400, 'Invalid interface returns 400 due to OpenAPI enum validation' ); >+ >+ # Test non-existent provider (should redirect with error) >+ $t->get_ok('/api/v1/oauth/login/nonexistent_provider/opac') >+ ->status_is( 302, 'Non-existent provider redirects with error' ); >+ >+ # Test missing provider_code and interface are handled by OpenAPI (404) >+ $t->get_ok('/api/v1/oauth/login//opac')->status_is( 404, 'Missing provider_code returns 404' ); >+ >+ $schema->storage->txn_rollback; >+}; >+ > sub run_oauth_tests { > my ($test_case) = @_; > >-- >2.51.0
You cannot view the attachment while viewing its details because your browser does not support IFRAMEs.
View the attachment on a separate page
.
View Attachment As Diff
View Attachment As Raw
Actions:
View
|
Diff
|
Splinter Review
Attachments on
bug 40847
: 186690