You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by ro...@apache.org on 2022/04/06 10:31:12 UTC
[sling-org-apache-sling-xss] 02/03: SLING-11244 - Update Sling XSS tests to use data providers (or similar)
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git
commit c791635067098d1562b55fd30ba3fc5385558ece
Author: Robert Munteanu <ro...@apache.org>
AuthorDate: Mon Apr 4 13:06:41 2022 +0300
SLING-11244 - Update Sling XSS tests to use data providers (or similar)
Move to Junit 5. No functional changes, this is in preparation for splitting out
and using data providers/parameters.
---
pom.xml | 8 +--
.../apache/sling/xss/impl/AntiSamyPolicyTest.java | 45 +++++++++--------
.../org/apache/sling/xss/impl/XSSAPIImplTest.java | 59 +++++++++++-----------
.../apache/sling/xss/impl/XSSFilterImplTest.java | 45 +++++++++--------
.../xss/impl/XSSProtectionServiceImplTest.java | 9 ++--
5 files changed, 84 insertions(+), 82 deletions(-)
diff --git a/pom.xml b/pom.xml
index 534d9ec..2aeef25 100644
--- a/pom.xml
+++ b/pom.xml
@@ -295,8 +295,10 @@
<scope>provided</scope>
</dependency>
<dependency>
- <groupId>junit</groupId>
- <artifactId>junit</artifactId>
+ <groupId>org.junit.jupiter</groupId>
+ <artifactId>junit-jupiter</artifactId>
+ <version>5.8.2</version>
+ <scope>test</scope>
</dependency>
<dependency>
<groupId>org.mockito</groupId>
@@ -312,7 +314,7 @@
</dependency>
<dependency>
<groupId>org.apache.sling</groupId>
- <artifactId>org.apache.sling.testing.sling-mock.junit4</artifactId>
+ <artifactId>org.apache.sling.testing.sling-mock.junit5</artifactId>
<version>2.3.4</version>
<scope>test</scope>
</dependency>
diff --git a/src/test/java/org/apache/sling/xss/impl/AntiSamyPolicyTest.java b/src/test/java/org/apache/sling/xss/impl/AntiSamyPolicyTest.java
index a477fe4..b12db4c 100644
--- a/src/test/java/org/apache/sling/xss/impl/AntiSamyPolicyTest.java
+++ b/src/test/java/org/apache/sling/xss/impl/AntiSamyPolicyTest.java
@@ -18,15 +18,16 @@
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
package org.apache.sling.xss.impl;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
import org.apache.commons.lang3.StringUtils;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
import org.owasp.validator.html.AntiSamy;
import org.owasp.validator.html.Policy;
import org.owasp.validator.html.PolicyException;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
/**
* This test suite makes sure the customised {@code config.xml} policy shipped with this module is not exposed to attacks. The test strings
@@ -38,7 +39,7 @@ public class AntiSamyPolicyTest {
public static final String POLICY_FILE = "SLING-INF/content/config.xml";
private static AntiSamy antiSamy;
- @BeforeClass
+ @BeforeAll
public static void setup() throws PolicyException {
antiSamy = new AntiSamy(Policy.getInstance(AntiSamyPolicyTest.class.getClassLoader().getResourceAsStream(POLICY_FILE)));
}
@@ -200,24 +201,24 @@ public class AntiSamyPolicyTest {
}
}
-
+
/**
* Test to verify the fix for SLING-8771 - XSS Configuration should allow the HTML5 figure and figcaption tags
*/
@Test
public void testIssueSLING8771() throws Exception {
-
+
TestInput[] tests = new TestInput[]{
- new TestInput("<figure class=\"image\"><img src=\"/logo.jpg\"><figcaption>Caption Here</figcaption></figure>",
+ new TestInput("<figure class=\"image\"><img src=\"/logo.jpg\"><figcaption>Caption Here</figcaption></figure>",
"<figure", true),
- new TestInput("<figure class=\"image\"><img src=\"/logo.jpg\"><figcaption>Caption Here</figcaption></figure>",
+ new TestInput("<figure class=\"image\"><img src=\"/logo.jpg\"><figcaption>Caption Here</figcaption></figure>",
"<figcaption", true),
};
for (TestInput testInput : tests) {
testOutputContains(testInput.input, testInput.expectedPartialOutput, testInput.containsExpectedPartialOutput);
}
}
-
+
private void testOutputContains(String input, String containedString, boolean contains) throws Exception {
testOutputContains(input, containedString, contains, false);
}
@@ -231,29 +232,29 @@ public class AntiSamyPolicyTest {
String cleanDOMModeHTML = antiSamy.scan(input, AntiSamy.DOM).getCleanHTML();
String cleanSAXModeHTML = antiSamy.scan(input, AntiSamy.SAX).getCleanHTML();
if (!skipComparingInputWithOutput) {
- assertTrue(String.format("Test is not properly configured: input '%s' doesn't seem to contain '%s' (case-insensitive match).",
- input, containedString), input.toLowerCase().contains(containedString.toLowerCase()));
+ assertTrue(input.toLowerCase().contains(containedString.toLowerCase()), String.format("Test is not properly configured: input '%s' doesn't seem to contain '%s' (case-insensitive match).",
+ input, containedString));
}
if (contains) {
if (mode == Mode.DOM || mode == Mode.SAX_AND_DOM) {
assertTrue(
- String.format("Expected that DOM filtered output '%s' for input '%s' would contain '%s'.", cleanDOMModeHTML, input,
- containedString), antiSamy.scan(input, AntiSamy.DOM).getCleanHTML().contains(containedString));
+ antiSamy.scan(input, AntiSamy.DOM).getCleanHTML().contains(containedString), String.format("Expected that DOM filtered output '%s' for input '%s' would contain '%s'.", cleanDOMModeHTML, input,
+ containedString));
}
if (mode == Mode.SAX || mode == Mode.SAX_AND_DOM) {
- assertTrue(String.format("Expected that SAX filtered output '%s' for input '%s' would contain '%s'.", cleanSAXModeHTML,
+ assertTrue(antiSamy.scan(input, AntiSamy.SAX).getCleanHTML().contains(containedString), String.format("Expected that SAX filtered output '%s' for input '%s' would contain '%s'.", cleanSAXModeHTML,
input,
- containedString), antiSamy.scan(input, AntiSamy.SAX).getCleanHTML().contains(containedString));
+ containedString));
}
} else {
if (mode == Mode.DOM || mode == Mode.SAX_AND_DOM) {
- assertFalse(
+ assertFalse(antiSamy.scan(input, AntiSamy.DOM).getCleanHTML().contains(containedString),
String.format("Expected that DOM filtered output '%s' for input '%s', would NOT contain '%s'.", cleanDOMModeHTML,
- input, containedString), antiSamy.scan(input, AntiSamy.DOM).getCleanHTML().contains(containedString));
+ input, containedString));
}
if (mode == Mode.SAX || mode == Mode.SAX_AND_DOM) {
- assertFalse(String.format("Expected that SAX filtered output '%s' for input '%s' would NOT contain '%s'.", cleanSAXModeHTML,
- input, containedString), antiSamy.scan(input, AntiSamy.SAX).getCleanHTML().contains(containedString));
+ assertFalse(antiSamy.scan(input, AntiSamy.SAX).getCleanHTML().contains(containedString), String.format("Expected that SAX filtered output '%s' for input '%s' would NOT contain '%s'.", cleanSAXModeHTML,
+ input, containedString));
}
}
}
@@ -262,8 +263,8 @@ public class AntiSamyPolicyTest {
private void testOutpuIsEmpty(String input) throws Exception {
String cleanDOMModeHTML = antiSamy.scan(input, AntiSamy.DOM).getCleanHTML();
String cleanSAXModeHTML = antiSamy.scan(input, AntiSamy.SAX).getCleanHTML();
- assertTrue("Expected empty DOM filtered output for '" + input + "'.", StringUtils.isEmpty(cleanDOMModeHTML));
- assertTrue("Expected empty SAX filtered output for '" + input + "'.", StringUtils.isEmpty(cleanSAXModeHTML));
+ assertTrue(StringUtils.isEmpty(cleanDOMModeHTML), "Expected empty DOM filtered output for '" + input + "'.");
+ assertTrue(StringUtils.isEmpty(cleanSAXModeHTML), "Expected empty SAX filtered output for '" + input + "'.");
}
private class TestInput {
diff --git a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
index ffb1701..068599d 100644
--- a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
+++ b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
@@ -16,6 +16,13 @@
******************************************************************************/
package org.apache.sling.xss.impl;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import static org.mockito.Matchers.anyString;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
import java.util.HashMap;
import java.util.regex.Pattern;
@@ -23,33 +30,25 @@ import org.apache.sling.api.resource.observation.ResourceChangeListener;
import org.apache.sling.commons.metrics.Counter;
import org.apache.sling.commons.metrics.MetricsService;
import org.apache.sling.serviceusermapping.ServiceUserMapped;
-import org.apache.sling.testing.mock.sling.junit.SlingContext;
+import org.apache.sling.testing.mock.sling.junit5.SlingContext;
+import org.apache.sling.testing.mock.sling.junit5.SlingContextExtension;
import org.apache.sling.xss.XSSAPI;
import org.apache.sling.xss.impl.status.XSSStatusService;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Rule;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
import org.osgi.framework.ServiceReference;
import org.owasp.validator.html.model.Attribute;
import org.powermock.reflect.Whitebox;
-import junit.framework.TestCase;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
-import static org.mockito.Matchers.anyString;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-
+@ExtendWith(SlingContextExtension.class)
public class XSSAPIImplTest {
private static final String RUBBISH = "rubbish";
private static final String RUBBISH_JSON = "[\"rubbish\"]";
private static final String RUBBISH_XML = "<rubbish/>";
- @Rule
public SlingContext context = new SlingContext();
private XSSAPI xssAPI;
@@ -66,7 +65,7 @@ public class XSSAPIImplTest {
xssAPI = context.getService(XSSAPI.class);
}
- @Before
+ @BeforeEach
public void before() {
MetricsService metricsService = mock(MetricsService.class);
when(metricsService.counter(anyString())).thenReturn(mock(Counter.class));
@@ -75,7 +74,7 @@ public class XSSAPIImplTest {
context.registerService(new XSSStatusService());
}
- @After
+ @AfterEach
public void tearDown() {
xssAPI = null;
}
@@ -100,7 +99,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
String expected = aTestData[1];
- TestCase.assertEquals("HTML Encoding '" + source + "'", expected, xssAPI.encodeForHTML(source));
+ assertEquals(expected, xssAPI.encodeForHTML(source), "HTML Encoding '" + source + "'");
}
}
@@ -123,7 +122,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
String expected = aTestData[1];
- TestCase.assertEquals("HTML Encoding '" + source + "'", expected, xssAPI.encodeForHTMLAttr(source));
+ assertEquals(expected, xssAPI.encodeForHTMLAttr(source), "HTML Encoding '" + source + "'");
}
}
@@ -146,7 +145,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
String expected = aTestData[1];
- TestCase.assertEquals("XML Encoding '" + source + "'", expected, xssAPI.encodeForXML(source));
+ assertEquals(expected, xssAPI.encodeForXML(source), "XML Encoding '" + source + "'");
}
}
@@ -170,7 +169,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
String expected = aTestData[1];
- TestCase.assertEquals("XML Encoding '" + source + "'", expected, xssAPI.encodeForXMLAttr(source));
+ assertEquals(expected, xssAPI.encodeForXMLAttr(source), "XML Encoding '" + source + "'");
}
}
@@ -212,7 +211,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
String expected = aTestData[1];
- TestCase.assertEquals("Filtering '" + source + "'", expected, xssAPI.filterHTML(source));
+ assertEquals(expected, xssAPI.filterHTML(source), "Filtering '" + source + "'");
}
}
@@ -357,7 +356,7 @@ public class XSSAPIImplTest {
}
if (errors.length() > 0) {
errors.insert(0, "\n");
- TestCase.fail(errors.toString());
+ fail(errors.toString());
}
}
@@ -407,7 +406,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
Integer expected = (aTestData[1] != null) ? Integer.parseInt(aTestData[1]) : null;
- TestCase.assertEquals("Validating integer '" + source + "'", expected, xssAPI.getValidInteger(source, 123));
+ assertEquals(expected, xssAPI.getValidInteger(source, 123), "Validating integer '" + source + "'");
}
}
@@ -431,7 +430,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
Long expected = (aTestData[1] != null) ? Long.parseLong(aTestData[1]) : null;
- TestCase.assertEquals("Validating long '" + source + "'", expected, xssAPI.getValidLong(source, 123));
+ assertEquals(expected, xssAPI.getValidLong(source, 123), "Validating long '" + source + "'");
}
}
@@ -454,7 +453,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
Double expected = (aTestData[1] != null) ? Double.parseDouble(aTestData[1]) : null;
- TestCase.assertEquals("Validating double '" + source + "'", expected, xssAPI.getValidDouble(source, 123));
+ assertEquals(expected, xssAPI.getValidDouble(source, 123), "Validating double '" + source + "'");
}
}
@@ -485,7 +484,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
String expected = aTestData[1];
- TestCase.assertEquals("Validating dimension '" + source + "'", expected, xssAPI.getValidDimension(source, "123"));
+ assertEquals(expected, xssAPI.getValidDimension(source, "123"), "Validating dimension '" + source + "'");
}
}
@@ -511,7 +510,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
String expected = aTestData[1];
- TestCase.assertEquals("Encoding '" + source + "'", expected, xssAPI.encodeForJSString(source));
+ assertEquals(expected, xssAPI.encodeForJSString(source), "Encoding '" + source + "'");
}
}
@@ -544,7 +543,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
String expected = aTestData[1];
- TestCase.assertEquals("Validating Javascript token '" + source + "'", expected, xssAPI.getValidJSToken(source, RUBBISH));
+ assertEquals(expected, xssAPI.getValidJSToken(source, RUBBISH), "Validating Javascript token '" + source + "'");
}
}
@@ -565,7 +564,7 @@ public class XSSAPIImplTest {
String expected = aTestData[1];
String result = xssAPI.encodeForCSSString(source);
- TestCase.assertEquals("Encoding '" + source + "'", expected, result);
+ assertEquals(expected, result, "Encoding '" + source + "'");
}
}
diff --git a/src/test/java/org/apache/sling/xss/impl/XSSFilterImplTest.java b/src/test/java/org/apache/sling/xss/impl/XSSFilterImplTest.java
index 470b374..7099e31 100644
--- a/src/test/java/org/apache/sling/xss/impl/XSSFilterImplTest.java
+++ b/src/test/java/org/apache/sling/xss/impl/XSSFilterImplTest.java
@@ -18,38 +18,39 @@
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
package org.apache.sling.xss.impl;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Matchers.anyString;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
import org.apache.sling.commons.metrics.Counter;
import org.apache.sling.commons.metrics.MetricsService;
import org.apache.sling.serviceusermapping.ServiceUserMapped;
-import org.apache.sling.testing.mock.sling.junit.SlingContext;
+import org.apache.sling.testing.mock.sling.junit5.SlingContext;
+import org.apache.sling.testing.mock.sling.junit5.SlingContextExtension;
import org.apache.sling.xss.XSSFilter;
import org.apache.sling.xss.impl.status.XSSStatusService;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Rule;
-import org.junit.Test;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.mockito.Matchers.anyString;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+@ExtendWith(SlingContextExtension.class)
public class XSSFilterImplTest {
- @Rule
public SlingContext context = new SlingContext();
private XSSFilter xssFilter;
- @After
+ @AfterEach
public void tearDown() {
xssFilter = null;
}
- @Before
+ @BeforeEach
public void setUp() {
MetricsService metricsService = mock(MetricsService.class);
when(metricsService.counter(anyString())).thenReturn(mock(Counter.class));
@@ -66,8 +67,8 @@ public class XSSFilterImplTest {
xssFilter = context.getService(XSSFilter.class);
XSSFilterImpl xssFilterImpl = (XSSFilterImpl) xssFilter;
XSSFilterImpl.AntiSamyPolicy antiSamyPolicy = xssFilterImpl.getActivePolicy();
- assertFalse("Expected a Resource based policy.", antiSamyPolicy.isEmbedded());
- assertEquals("This is not the policy we're looking for.", "/libs/" + XSSFilterImpl.DEFAULT_POLICY_PATH, antiSamyPolicy.getPath());
+ assertFalse(antiSamyPolicy.isEmbedded(), "Expected a Resource based policy.");
+ assertEquals("/libs/" + XSSFilterImpl.DEFAULT_POLICY_PATH, antiSamyPolicy.getPath(), "This is not the policy we're looking for.");
}
@Test
@@ -76,8 +77,8 @@ public class XSSFilterImplTest {
xssFilter = context.getService(XSSFilter.class);
XSSFilterImpl xssFilterImpl = (XSSFilterImpl) xssFilter;
XSSFilterImpl.AntiSamyPolicy antiSamyPolicy = xssFilterImpl.getActivePolicy();
- assertTrue("Expected the default embedded policy.", antiSamyPolicy.isEmbedded());
- assertEquals("This is not the policy we're looking for.", XSSFilterImpl.EMBEDDED_POLICY_PATH, antiSamyPolicy.getPath());
+ assertTrue(antiSamyPolicy.isEmbedded(), "Expected the default embedded policy.");
+ assertEquals(XSSFilterImpl.EMBEDDED_POLICY_PATH, antiSamyPolicy.getPath(), "This is not the policy we're looking for.");
}
@Test
@@ -108,9 +109,9 @@ public class XSSFilterImplTest {
private void checkIsValid(String input, boolean valid) {
if (valid) {
- assertTrue("Expected valid href value for: " + input, xssFilter.isValidHref(input));
+ assertTrue(xssFilter.isValidHref(input), "Expected valid href value for: " + input);
} else {
- assertFalse("Expected invalid href value for: " + input, xssFilter.isValidHref(input));
+ assertFalse(xssFilter.isValidHref(input), "Expected invalid href value for: " + input);
}
}
diff --git a/src/test/java/org/apache/sling/xss/impl/XSSProtectionServiceImplTest.java b/src/test/java/org/apache/sling/xss/impl/XSSProtectionServiceImplTest.java
index c229970..4f5a27a 100644
--- a/src/test/java/org/apache/sling/xss/impl/XSSProtectionServiceImplTest.java
+++ b/src/test/java/org/apache/sling/xss/impl/XSSProtectionServiceImplTest.java
@@ -16,12 +16,11 @@
******************************************************************************/
package org.apache.sling.xss.impl;
-import static org.junit.Assert.fail;
-
-import org.junit.Before;
-import org.junit.Test;
+import static org.junit.jupiter.api.Assertions.fail;
import org.apache.sling.xss.ProtectionContext;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
/** Test the XSSProtectionServiceImpl with various strings.
*
@@ -41,7 +40,7 @@ public class XSSProtectionServiceImplTest {
private XSSFilterImpl xssFilter;
- @Before
+ @BeforeEach
public void setup() {
xssFilter = new XSSFilterImpl();
}