You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@unomi.apache.org by jk...@apache.org on 2021/04/16 14:49:52 UTC
[unomi] branch unomi-1.5.x updated: UNOMI-463: Add integrations
test on top of input validations (#293)
This is an automated email from the ASF dual-hosted git repository.
jkevan pushed a commit to branch unomi-1.5.x
in repository https://gitbox.apache.org/repos/asf/unomi.git
The following commit(s) were added to refs/heads/unomi-1.5.x by this push:
new e4c8ed0 UNOMI-463: Add integrations test on top of input validations (#293)
e4c8ed0 is described below
commit e4c8ed0a3a0ba2d325b2b00ab6255f846d39682f
Author: kevan Jahanshahi <ke...@jahia.com>
AuthorDate: Fri Apr 16 16:32:26 2021 +0200
UNOMI-463: Add integrations test on top of input validations (#293)
---
.../apache/unomi/api/EventsCollectorRequest.java | 4 +-
.../test/java/org/apache/unomi/itests/AllITs.java | 1 +
.../org/apache/unomi/itests/InputValidationIT.java | 192 +++++++++++++++++++++
.../java/org/apache/unomi/itests/TestUtils.java | 6 +-
.../httpclient/HttpClientThatWaitsForUnomi.java | 11 +-
.../contextRequest_invalidProfileId.json | 11 ++
.../contextRequest_invalidSessionId.json | 11 ++
.../resources/validation/contextRequest_valid.json | 11 ++
.../validation/eventcollector_emptyEvents.json | 4 +
.../eventcollector_invalidSessionId.json | 17 ++
.../resources/validation/eventcollector_valid.json | 17 ++
11 files changed, 279 insertions(+), 6 deletions(-)
diff --git a/api/src/main/java/org/apache/unomi/api/EventsCollectorRequest.java b/api/src/main/java/org/apache/unomi/api/EventsCollectorRequest.java
index c7409ed..9eb4ee9 100644
--- a/api/src/main/java/org/apache/unomi/api/EventsCollectorRequest.java
+++ b/api/src/main/java/org/apache/unomi/api/EventsCollectorRequest.java
@@ -18,6 +18,7 @@
package org.apache.unomi.api;
import org.apache.unomi.api.utils.ValidationPattern;
+import org.hibernate.validator.constraints.NotEmpty;
import javax.validation.constraints.Pattern;
import java.util.List;
@@ -26,8 +27,9 @@ import java.util.List;
* A request for events to be processed.
*/
public class EventsCollectorRequest {
- private List<Event> events;
+ @NotEmpty
+ private List<Event> events;
@Pattern(regexp = ValidationPattern.TEXT_VALID_CHARACTERS_PATTERN)
private String sessionId;
diff --git a/itests/src/test/java/org/apache/unomi/itests/AllITs.java b/itests/src/test/java/org/apache/unomi/itests/AllITs.java
index 88be5c4..62bb231 100644
--- a/itests/src/test/java/org/apache/unomi/itests/AllITs.java
+++ b/itests/src/test/java/org/apache/unomi/itests/AllITs.java
@@ -42,6 +42,7 @@ import org.junit.runners.Suite.SuiteClasses;
EventServiceIT.class,
PropertiesUpdateActionIT.class,
IncrementPropertyIT.class,
+ InputValidationIT.class,
CopyPropertiesActionIT.class,
ModifyConsentIT.class,
PatchIT.class,
diff --git a/itests/src/test/java/org/apache/unomi/itests/InputValidationIT.java b/itests/src/test/java/org/apache/unomi/itests/InputValidationIT.java
new file mode 100644
index 0000000..a9a1d98
--- /dev/null
+++ b/itests/src/test/java/org/apache/unomi/itests/InputValidationIT.java
@@ -0,0 +1,192 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License
+ */
+package org.apache.unomi.itests;
+
+import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpGet;
+import org.apache.http.client.methods.HttpPost;
+import org.apache.http.client.methods.HttpUriRequest;
+import org.apache.http.entity.ContentType;
+import org.apache.http.entity.StringEntity;
+import org.apache.unomi.itests.tools.httpclient.HttpClientThatWaitsForUnomi;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.ops4j.pax.exam.junit.PaxExam;
+import org.ops4j.pax.exam.spi.reactors.ExamReactorStrategy;
+import org.ops4j.pax.exam.spi.reactors.PerSuite;
+
+import java.io.IOException;
+import java.net.URLEncoder;
+import java.nio.charset.StandardCharsets;
+import java.util.HashMap;
+import java.util.Map;
+
+import static org.junit.Assert.assertEquals;
+import static org.junit.Assert.fail;
+
+@RunWith(PaxExam.class)
+@ExamReactorStrategy(PerSuite.class)
+public class InputValidationIT extends BaseIT {
+ private final static String EVENT_COLLECTOR_URL = "/eventcollector";
+ private final static String CONTEXT_JS_URL = "/context.js";
+ private final static String CONTEXT_JSON_URL = "/context.json";
+
+ @Test
+ public void test_param_EventsCollectorRequestNotNull() throws IOException {
+ doPOSTRequestTest(URL + EVENT_COLLECTOR_URL, null, null, 400);
+ doGETRequestTest(URL + EVENT_COLLECTOR_URL, null, null, 400);
+ }
+
+ @Test
+ public void test_param_EventsNotEmpty() throws IOException {
+ doPOSTRequestTest(URL + EVENT_COLLECTOR_URL, null, "/validation/eventcollector_emptyEvents.json", 400);
+ // TODO uncomment after fix: https://issues.apache.org/jira/browse/UNOMI-467
+ // doGETRequestTest(URL + EVENT_COLLECTOR_URL, null, "/validation/eventcollector_emptyEvents.json", 400);
+ }
+
+ @Test
+ public void test_param_SessionIDPattern() throws IOException {
+ doPOSTRequestTest(URL + EVENT_COLLECTOR_URL, null, "/validation/eventcollector_invalidSessionId.json", 400);
+ // TODO uncomment after fix: https://issues.apache.org/jira/browse/UNOMI-467
+ // doGETRequestTest(URL + EVENT_COLLECTOR_URL, null, "/validation/eventcollector_invalidSessionId.json", 400);
+ }
+
+ @Test
+ public void test_eventCollector_valid() throws IOException {
+ doPOSTRequestTest(URL + EVENT_COLLECTOR_URL, null, "/validation/eventcollector_valid.json", 200);
+ // TODO uncomment after fix: https://issues.apache.org/jira/browse/UNOMI-467
+ // doGETRequestTest(URL + EVENT_COLLECTOR_URL, null, "/validation/eventcollector_valid.json", 200);
+ }
+
+ @Test
+ public void test_contextRequest_SessionIDPattern() throws IOException {
+ doPOSTRequestTest(URL + CONTEXT_JSON_URL, null, "/validation/contextRequest_invalidSessionId.json", 400);
+ doPOSTRequestTest(URL + CONTEXT_JS_URL, null, "/validation/contextRequest_invalidSessionId.json", 400);
+ // TODO uncomment after fix: https://issues.apache.org/jira/browse/UNOMI-467
+ // doGETRequestTest(URL + CONTEXT_JSON_URL, null, "/validation/contextRequest_invalidSessionId.json", 400);
+ // doGETRequestTest(URL + CONTEXT_JS_URL, null, "/validation/contextRequest_invalidSessionId.json", 400);
+ }
+
+ @Test
+ public void test_contextRequest_ProfileIDPattern() throws IOException {
+ doPOSTRequestTest(URL + CONTEXT_JSON_URL, null, "/validation/contextRequest_invalidProfileId.json", 400);
+ doPOSTRequestTest(URL + CONTEXT_JS_URL, null, "/validation/contextRequest_invalidProfileId.json", 400);
+ // TODO uncomment after fix: https://issues.apache.org/jira/browse/UNOMI-467
+ // doGETRequestTest(URL + CONTEXT_JSON_URL, null, "/validation/contextRequest_invalidProfileId.json", 400);
+ // doGETRequestTest(URL + CONTEXT_JS_URL, null, "/validation/contextRequest_invalidProfileId.json", 400);
+ }
+
+ @Test
+ public void test_contextRequest_valid() throws IOException {
+ doPOSTRequestTest(URL + CONTEXT_JSON_URL, null, "/validation/contextRequest_valid.json", 200);
+ doPOSTRequestTest(URL + CONTEXT_JS_URL, null, "/validation/contextRequest_valid.json", 200);
+ // TODO uncomment after fix: https://issues.apache.org/jira/browse/UNOMI-467
+ // doGETRequestTest(URL + CONTEXT_JSON_URL, null, "/validation/contextRequest_valid.json", 200);
+ // doGETRequestTest(URL + CONTEXT_JS_URL, null, "/validation/contextRequest_valid.json", 200);
+ }
+
+ @Test
+ public void test_contextJSON_SessionIDPattern() throws IOException {
+ String baseUrl = URL + CONTEXT_JS_URL;
+ String queryString = "?sessionId=" + URLEncoder.encode("<script>alert();</script>", StandardCharsets.UTF_8.toString());
+ doPOSTRequestTest(baseUrl + queryString, null, null, 400);
+ doGETRequestTest(baseUrl + queryString, null, null, 400);
+
+ baseUrl = URL + CONTEXT_JSON_URL;
+ doPOSTRequestTest(baseUrl + queryString, null, null, 400);
+ doGETRequestTest(baseUrl + queryString, null, null, 400);
+
+ baseUrl = URL + CONTEXT_JS_URL;
+ queryString = "?sessionId=" + URLEncoder.encode("dummy-session-id", StandardCharsets.UTF_8.toString());
+ doPOSTRequestTest(baseUrl + queryString, null, null, 200);
+ doGETRequestTest(baseUrl + queryString, null, null, 200);
+
+ baseUrl = URL + CONTEXT_JSON_URL;
+ doPOSTRequestTest(baseUrl + queryString, null, null, 200);
+ doGETRequestTest(baseUrl + queryString, null, null, 200);
+ }
+
+ @Test
+ public void test_contextJSON_PersonaIdPattern() throws IOException {
+ String baseUrl = URL + CONTEXT_JS_URL;
+ String queryString = "?personaId=" + URLEncoder.encode("<script>alert();</script>", StandardCharsets.UTF_8.toString());
+ doPOSTRequestTest(baseUrl + queryString, null, null, 400);
+ doGETRequestTest(baseUrl + queryString, null, null, 400);
+
+ baseUrl = URL + CONTEXT_JSON_URL;
+ doPOSTRequestTest(baseUrl + queryString, null, null, 400);
+ doGETRequestTest(baseUrl + queryString, null, null, 400);
+
+ baseUrl = URL + CONTEXT_JS_URL;
+ queryString = "?personaId=" + URLEncoder.encode("dummy-persona-id", StandardCharsets.UTF_8.toString());
+ doPOSTRequestTest(baseUrl + queryString, null, null, 200);
+ doGETRequestTest(baseUrl + queryString, null, null, 200);
+
+ baseUrl = URL + CONTEXT_JSON_URL;
+ doPOSTRequestTest(baseUrl + queryString, null,null, 200);
+ doGETRequestTest(baseUrl + queryString, null, null, 200);
+ }
+
+ @Test
+ public void test_cookie_profileIdPattern() throws IOException, InterruptedException {
+ Map<String, String> headers = new HashMap<>();
+ headers.put("Cookie", "context-profile-id=<script>alert();</script>");
+ doPOSTRequestTest(URL + CONTEXT_JSON_URL, headers, null, 400);
+ doPOSTRequestTest(URL + CONTEXT_JS_URL, headers, null, 400);
+ doGETRequestTest(URL + CONTEXT_JSON_URL, headers, null, 400);
+ doGETRequestTest(URL + CONTEXT_JS_URL, headers, null, 400);
+
+ headers.put("Cookie", "context-profile-id=dummy-profile-id");
+ doPOSTRequestTest(URL + CONTEXT_JSON_URL, headers, null, 200);
+ doPOSTRequestTest(URL + CONTEXT_JS_URL, headers, null, 200);
+ doGETRequestTest(URL + CONTEXT_JSON_URL, headers, null, 200);
+ doGETRequestTest(URL + CONTEXT_JS_URL, headers, null, 200);
+ }
+
+ private void doGETRequestTest(String url, Map<String, String> headers, String entityResourcePath, int expectedHTTPStatusCode) throws IOException {
+ if (entityResourcePath != null) {
+ String payload = getValidatedBundleJSON(entityResourcePath, new HashMap<>());
+ url += (url.contains("?") ? "&" : "?") + "payload=" + URLEncoder.encode(payload, StandardCharsets.UTF_8.toString());
+ }
+ performRequest(new HttpGet(url), headers, expectedHTTPStatusCode);
+ }
+
+ private void doPOSTRequestTest(String url, Map<String, String> headers, String entityResourcePath, int expectedHTTPStatusCode) throws IOException {
+ HttpPost request = new HttpPost(url);
+ if (entityResourcePath != null) {
+ request.setEntity(new StringEntity(getValidatedBundleJSON(entityResourcePath, new HashMap<>()), ContentType.create("application/json")));
+ }
+ performRequest(request, headers, expectedHTTPStatusCode);
+ }
+
+ private void performRequest(HttpUriRequest request, Map<String, String> headers, int expectedHTTPStatusCode) {
+ CloseableHttpResponse response;
+ if (headers != null && !headers.isEmpty()) {
+ for (Map.Entry<String, String> headerEntry : headers.entrySet()) {
+ request.addHeader(headerEntry.getKey(), headerEntry.getValue());
+ }
+ }
+ try {
+ response = HttpClientThatWaitsForUnomi.doRequest(request, expectedHTTPStatusCode);
+ } catch (Exception e) {
+ fail("Something went wrong with the request to Unomi that is unexpected: " + e.getMessage());
+ return;
+ }
+
+ assertEquals("Invalid response code", expectedHTTPStatusCode, response.getStatusLine().getStatusCode());
+ }
+}
diff --git a/itests/src/test/java/org/apache/unomi/itests/TestUtils.java b/itests/src/test/java/org/apache/unomi/itests/TestUtils.java
index 1045d12..7416d46 100644
--- a/itests/src/test/java/org/apache/unomi/itests/TestUtils.java
+++ b/itests/src/test/java/org/apache/unomi/itests/TestUtils.java
@@ -21,7 +21,9 @@ import com.fasterxml.jackson.databind.ObjectMapper;
import org.apache.http.HttpEntity;
import org.apache.http.HttpResponse;
import org.apache.http.client.methods.CloseableHttpResponse;
+import org.apache.http.client.methods.HttpGet;
import org.apache.http.client.methods.HttpPost;
+import org.apache.http.client.methods.HttpUriRequest;
import org.apache.http.entity.ContentType;
import org.apache.http.util.EntityUtils;
import org.apache.unomi.api.ContextResponse;
@@ -63,8 +65,8 @@ public class TestUtils {
return null;
}
- public static RequestResponse executeContextJSONRequest(HttpPost request, String sessionId) throws IOException {
- try (CloseableHttpResponse response = HttpClientThatWaitsForUnomi.doPost(request)) {
+ public static RequestResponse executeContextJSONRequest(HttpUriRequest request, String sessionId) throws IOException {
+ try (CloseableHttpResponse response = HttpClientThatWaitsForUnomi.doRequest(request)) {
// validate mimeType
HttpEntity entity = response.getEntity();
String mimeType = ContentType.getOrDefault(entity).getMimeType();
diff --git a/itests/src/test/java/org/apache/unomi/itests/tools/httpclient/HttpClientThatWaitsForUnomi.java b/itests/src/test/java/org/apache/unomi/itests/tools/httpclient/HttpClientThatWaitsForUnomi.java
index c0bb18b..14c1ba5 100644
--- a/itests/src/test/java/org/apache/unomi/itests/tools/httpclient/HttpClientThatWaitsForUnomi.java
+++ b/itests/src/test/java/org/apache/unomi/itests/tools/httpclient/HttpClientThatWaitsForUnomi.java
@@ -19,7 +19,7 @@ package org.apache.unomi.itests.tools.httpclient;
import org.apache.http.HttpStatus;
import org.apache.http.client.methods.CloseableHttpResponse;
-import org.apache.http.client.methods.HttpPost;
+import org.apache.http.client.methods.HttpUriRequest;
import org.apache.http.impl.client.HttpClientBuilder;
import java.io.IOException;
@@ -29,12 +29,17 @@ public class HttpClientThatWaitsForUnomi {
private static final long TIMER = 1000L;
private static final int MAX_TRIES = 10;
- public static CloseableHttpResponse doPost(HttpPost request) throws IOException {
+ public static CloseableHttpResponse doRequest(HttpUriRequest request) throws IOException {
+ return doRequest(request, -1);
+ }
+
+ public static CloseableHttpResponse doRequest(HttpUriRequest request, int expectedStatusCode) throws IOException {
int count = 0;
while (true) {
CloseableHttpResponse response = HttpClientBuilder.create().build().execute(request);
final int statusCode = response.getStatusLine().getStatusCode();
- if (statusCode < HttpStatus.SC_BAD_REQUEST) {
+
+ if ((expectedStatusCode > 0 && expectedStatusCode == statusCode) || statusCode < HttpStatus.SC_BAD_REQUEST) {
return response;
}
if (count++ > MAX_TRIES || statusCode >= HttpStatus.SC_INTERNAL_SERVER_ERROR) {
diff --git a/itests/src/test/resources/validation/contextRequest_invalidProfileId.json b/itests/src/test/resources/validation/contextRequest_invalidProfileId.json
new file mode 100644
index 0000000..052af59
--- /dev/null
+++ b/itests/src/test/resources/validation/contextRequest_invalidProfileId.json
@@ -0,0 +1,11 @@
+{
+ "source": {
+ "itemId": "CMSServer",
+ "itemType": "custom",
+ "scope": "acme",
+ "version": null,
+ "properties": {}
+ },
+ "sessionId": "dummy-session-id",
+ "profileId": "<script>alert();</script>"
+}
\ No newline at end of file
diff --git a/itests/src/test/resources/validation/contextRequest_invalidSessionId.json b/itests/src/test/resources/validation/contextRequest_invalidSessionId.json
new file mode 100644
index 0000000..ef9813a
--- /dev/null
+++ b/itests/src/test/resources/validation/contextRequest_invalidSessionId.json
@@ -0,0 +1,11 @@
+{
+ "source": {
+ "itemId": "CMSServer",
+ "itemType": "custom",
+ "scope": "acme",
+ "version": null,
+ "properties": {}
+ },
+ "sessionId": "<script>alert();</script>",
+ "profileId": "dummy-profile-id"
+}
\ No newline at end of file
diff --git a/itests/src/test/resources/validation/contextRequest_valid.json b/itests/src/test/resources/validation/contextRequest_valid.json
new file mode 100644
index 0000000..27b8f57
--- /dev/null
+++ b/itests/src/test/resources/validation/contextRequest_valid.json
@@ -0,0 +1,11 @@
+{
+ "source": {
+ "itemId": "CMSServer",
+ "itemType": "custom",
+ "scope": "acme",
+ "version": null,
+ "properties": {}
+ },
+ "sessionId": "dummy-session-id",
+ "profileId": "dummy-profile-id"
+}
\ No newline at end of file
diff --git a/itests/src/test/resources/validation/eventcollector_emptyEvents.json b/itests/src/test/resources/validation/eventcollector_emptyEvents.json
new file mode 100644
index 0000000..34fa342
--- /dev/null
+++ b/itests/src/test/resources/validation/eventcollector_emptyEvents.json
@@ -0,0 +1,4 @@
+{
+ "sessionId": "dummy-session-id",
+ "events": []
+}
\ No newline at end of file
diff --git a/itests/src/test/resources/validation/eventcollector_invalidSessionId.json b/itests/src/test/resources/validation/eventcollector_invalidSessionId.json
new file mode 100644
index 0000000..bdea163
--- /dev/null
+++ b/itests/src/test/resources/validation/eventcollector_invalidSessionId.json
@@ -0,0 +1,17 @@
+{
+ "sessionId": "<script>alert();</script>",
+ "events":[
+ {
+ "eventType":"dummy_event_type",
+ "scope":"dummy_scope",
+ "source":{
+ "itemType":"pageView",
+ "scope":"dummy_scope",
+ "itemId":"pageView",
+ "properties":{
+ "myProperty":"myValue"
+ }
+ }
+ }
+ ]
+}
\ No newline at end of file
diff --git a/itests/src/test/resources/validation/eventcollector_valid.json b/itests/src/test/resources/validation/eventcollector_valid.json
new file mode 100644
index 0000000..29a39cf
--- /dev/null
+++ b/itests/src/test/resources/validation/eventcollector_valid.json
@@ -0,0 +1,17 @@
+{
+ "sessionId": "dummy-session-id",
+ "events":[
+ {
+ "eventType":"dummy_event_type",
+ "scope":"dummy_scope",
+ "source":{
+ "itemType":"pageView",
+ "scope":"dummy_scope",
+ "itemId":"pageView",
+ "properties":{
+ "myProperty":"myValue"
+ }
+ }
+ }
+ ]
+}
\ No newline at end of file