You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@sling.apache.org by ro...@apache.org on 2022/04/04 10:07:45 UTC
[sling-org-apache-sling-xss] branch issue/SLING-11244 created (now 577fb86)
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a change to branch issue/SLING-11244
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git
at 577fb86 SLING-11244 - Update Sling XSS tests to use data providers (or similar)
This branch includes the following new commits:
new f482a58 build: remove version overrides that are the same as in the parent pom
new 577fb86 SLING-11244 - Update Sling XSS tests to use data providers (or similar)
The 2 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails. The revisions
listed as "add" were already present in the repository and have only
been added to this reference.
[sling-org-apache-sling-xss] 01/02: build: remove version overrides that are the same as in the parent pom
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to branch issue/SLING-11244
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git
commit f482a581d37e2ffb4111c4391540433ff6aff7e9
Author: Robert Munteanu <ro...@apache.org>
AuthorDate: Mon Apr 4 12:43:51 2022 +0300
build: remove version overrides that are the same as in the parent pom
---
pom.xml | 2 --
1 file changed, 2 deletions(-)
diff --git a/pom.xml b/pom.xml
index ccd8119..534d9ec 100644
--- a/pom.xml
+++ b/pom.xml
@@ -125,7 +125,6 @@
</plugin>
<plugin>
<artifactId>maven-resources-plugin</artifactId>
- <version>3.1.0</version>
<executions>
<execution>
<id>copy-resources</id>
@@ -263,7 +262,6 @@
<dependency>
<groupId>org.jetbrains</groupId>
<artifactId>annotations</artifactId>
- <version>16.0.2</version>
<scope>provided</scope>
</dependency>
<dependency>
[sling-org-apache-sling-xss] 02/02: SLING-11244 - Update Sling XSS tests to use data providers (or similar)
Posted by ro...@apache.org.
This is an automated email from the ASF dual-hosted git repository.
rombert pushed a commit to branch issue/SLING-11244
in repository https://gitbox.apache.org/repos/asf/sling-org-apache-sling-xss.git
commit 577fb8609dd51aedb3bbb681e0883cc6580a62f2
Author: Robert Munteanu <ro...@apache.org>
AuthorDate: Mon Apr 4 13:06:41 2022 +0300
SLING-11244 - Update Sling XSS tests to use data providers (or similar)
Move to Junit 5. No functional changes, this is in preparation for splitting out
and using data providers/parameters.
---
pom.xml | 8 +--
.../apache/sling/xss/impl/AntiSamyPolicyTest.java | 45 +++++++++--------
.../org/apache/sling/xss/impl/XSSAPIImplTest.java | 59 +++++++++++-----------
.../apache/sling/xss/impl/XSSFilterImplTest.java | 45 +++++++++--------
.../xss/impl/XSSProtectionServiceImplTest.java | 9 ++--
5 files changed, 84 insertions(+), 82 deletions(-)
diff --git a/pom.xml b/pom.xml
index 534d9ec..2aeef25 100644
--- a/pom.xml
+++ b/pom.xml
@@ -295,8 +295,10 @@
<scope>provided</scope>
</dependency>
<dependency>
- <groupId>junit</groupId>
- <artifactId>junit</artifactId>
+ <groupId>org.junit.jupiter</groupId>
+ <artifactId>junit-jupiter</artifactId>
+ <version>5.8.2</version>
+ <scope>test</scope>
</dependency>
<dependency>
<groupId>org.mockito</groupId>
@@ -312,7 +314,7 @@
</dependency>
<dependency>
<groupId>org.apache.sling</groupId>
- <artifactId>org.apache.sling.testing.sling-mock.junit4</artifactId>
+ <artifactId>org.apache.sling.testing.sling-mock.junit5</artifactId>
<version>2.3.4</version>
<scope>test</scope>
</dependency>
diff --git a/src/test/java/org/apache/sling/xss/impl/AntiSamyPolicyTest.java b/src/test/java/org/apache/sling/xss/impl/AntiSamyPolicyTest.java
index a477fe4..b12db4c 100644
--- a/src/test/java/org/apache/sling/xss/impl/AntiSamyPolicyTest.java
+++ b/src/test/java/org/apache/sling/xss/impl/AntiSamyPolicyTest.java
@@ -18,15 +18,16 @@
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
package org.apache.sling.xss.impl;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
import org.apache.commons.lang3.StringUtils;
-import org.junit.BeforeClass;
-import org.junit.Test;
+import org.junit.jupiter.api.BeforeAll;
+import org.junit.jupiter.api.Test;
import org.owasp.validator.html.AntiSamy;
import org.owasp.validator.html.Policy;
import org.owasp.validator.html.PolicyException;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertTrue;
/**
* This test suite makes sure the customised {@code config.xml} policy shipped with this module is not exposed to attacks. The test strings
@@ -38,7 +39,7 @@ public class AntiSamyPolicyTest {
public static final String POLICY_FILE = "SLING-INF/content/config.xml";
private static AntiSamy antiSamy;
- @BeforeClass
+ @BeforeAll
public static void setup() throws PolicyException {
antiSamy = new AntiSamy(Policy.getInstance(AntiSamyPolicyTest.class.getClassLoader().getResourceAsStream(POLICY_FILE)));
}
@@ -200,24 +201,24 @@ public class AntiSamyPolicyTest {
}
}
-
+
/**
* Test to verify the fix for SLING-8771 - XSS Configuration should allow the HTML5 figure and figcaption tags
*/
@Test
public void testIssueSLING8771() throws Exception {
-
+
TestInput[] tests = new TestInput[]{
- new TestInput("<figure class=\"image\"><img src=\"/logo.jpg\"><figcaption>Caption Here</figcaption></figure>",
+ new TestInput("<figure class=\"image\"><img src=\"/logo.jpg\"><figcaption>Caption Here</figcaption></figure>",
"<figure", true),
- new TestInput("<figure class=\"image\"><img src=\"/logo.jpg\"><figcaption>Caption Here</figcaption></figure>",
+ new TestInput("<figure class=\"image\"><img src=\"/logo.jpg\"><figcaption>Caption Here</figcaption></figure>",
"<figcaption", true),
};
for (TestInput testInput : tests) {
testOutputContains(testInput.input, testInput.expectedPartialOutput, testInput.containsExpectedPartialOutput);
}
}
-
+
private void testOutputContains(String input, String containedString, boolean contains) throws Exception {
testOutputContains(input, containedString, contains, false);
}
@@ -231,29 +232,29 @@ public class AntiSamyPolicyTest {
String cleanDOMModeHTML = antiSamy.scan(input, AntiSamy.DOM).getCleanHTML();
String cleanSAXModeHTML = antiSamy.scan(input, AntiSamy.SAX).getCleanHTML();
if (!skipComparingInputWithOutput) {
- assertTrue(String.format("Test is not properly configured: input '%s' doesn't seem to contain '%s' (case-insensitive match).",
- input, containedString), input.toLowerCase().contains(containedString.toLowerCase()));
+ assertTrue(input.toLowerCase().contains(containedString.toLowerCase()), String.format("Test is not properly configured: input '%s' doesn't seem to contain '%s' (case-insensitive match).",
+ input, containedString));
}
if (contains) {
if (mode == Mode.DOM || mode == Mode.SAX_AND_DOM) {
assertTrue(
- String.format("Expected that DOM filtered output '%s' for input '%s' would contain '%s'.", cleanDOMModeHTML, input,
- containedString), antiSamy.scan(input, AntiSamy.DOM).getCleanHTML().contains(containedString));
+ antiSamy.scan(input, AntiSamy.DOM).getCleanHTML().contains(containedString), String.format("Expected that DOM filtered output '%s' for input '%s' would contain '%s'.", cleanDOMModeHTML, input,
+ containedString));
}
if (mode == Mode.SAX || mode == Mode.SAX_AND_DOM) {
- assertTrue(String.format("Expected that SAX filtered output '%s' for input '%s' would contain '%s'.", cleanSAXModeHTML,
+ assertTrue(antiSamy.scan(input, AntiSamy.SAX).getCleanHTML().contains(containedString), String.format("Expected that SAX filtered output '%s' for input '%s' would contain '%s'.", cleanSAXModeHTML,
input,
- containedString), antiSamy.scan(input, AntiSamy.SAX).getCleanHTML().contains(containedString));
+ containedString));
}
} else {
if (mode == Mode.DOM || mode == Mode.SAX_AND_DOM) {
- assertFalse(
+ assertFalse(antiSamy.scan(input, AntiSamy.DOM).getCleanHTML().contains(containedString),
String.format("Expected that DOM filtered output '%s' for input '%s', would NOT contain '%s'.", cleanDOMModeHTML,
- input, containedString), antiSamy.scan(input, AntiSamy.DOM).getCleanHTML().contains(containedString));
+ input, containedString));
}
if (mode == Mode.SAX || mode == Mode.SAX_AND_DOM) {
- assertFalse(String.format("Expected that SAX filtered output '%s' for input '%s' would NOT contain '%s'.", cleanSAXModeHTML,
- input, containedString), antiSamy.scan(input, AntiSamy.SAX).getCleanHTML().contains(containedString));
+ assertFalse(antiSamy.scan(input, AntiSamy.SAX).getCleanHTML().contains(containedString), String.format("Expected that SAX filtered output '%s' for input '%s' would NOT contain '%s'.", cleanSAXModeHTML,
+ input, containedString));
}
}
}
@@ -262,8 +263,8 @@ public class AntiSamyPolicyTest {
private void testOutpuIsEmpty(String input) throws Exception {
String cleanDOMModeHTML = antiSamy.scan(input, AntiSamy.DOM).getCleanHTML();
String cleanSAXModeHTML = antiSamy.scan(input, AntiSamy.SAX).getCleanHTML();
- assertTrue("Expected empty DOM filtered output for '" + input + "'.", StringUtils.isEmpty(cleanDOMModeHTML));
- assertTrue("Expected empty SAX filtered output for '" + input + "'.", StringUtils.isEmpty(cleanSAXModeHTML));
+ assertTrue(StringUtils.isEmpty(cleanDOMModeHTML), "Expected empty DOM filtered output for '" + input + "'.");
+ assertTrue(StringUtils.isEmpty(cleanSAXModeHTML), "Expected empty SAX filtered output for '" + input + "'.");
}
private class TestInput {
diff --git a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
index ffb1701..068599d 100644
--- a/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
+++ b/src/test/java/org/apache/sling/xss/impl/XSSAPIImplTest.java
@@ -16,6 +16,13 @@
******************************************************************************/
package org.apache.sling.xss.impl;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.junit.jupiter.api.Assertions.fail;
+import static org.mockito.Matchers.anyString;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
import java.util.HashMap;
import java.util.regex.Pattern;
@@ -23,33 +30,25 @@ import org.apache.sling.api.resource.observation.ResourceChangeListener;
import org.apache.sling.commons.metrics.Counter;
import org.apache.sling.commons.metrics.MetricsService;
import org.apache.sling.serviceusermapping.ServiceUserMapped;
-import org.apache.sling.testing.mock.sling.junit.SlingContext;
+import org.apache.sling.testing.mock.sling.junit5.SlingContext;
+import org.apache.sling.testing.mock.sling.junit5.SlingContextExtension;
import org.apache.sling.xss.XSSAPI;
import org.apache.sling.xss.impl.status.XSSStatusService;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Rule;
-import org.junit.Test;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
import org.osgi.framework.ServiceReference;
import org.owasp.validator.html.model.Attribute;
import org.powermock.reflect.Whitebox;
-import junit.framework.TestCase;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertTrue;
-import static org.junit.Assert.fail;
-import static org.mockito.Matchers.anyString;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
-
+@ExtendWith(SlingContextExtension.class)
public class XSSAPIImplTest {
private static final String RUBBISH = "rubbish";
private static final String RUBBISH_JSON = "[\"rubbish\"]";
private static final String RUBBISH_XML = "<rubbish/>";
- @Rule
public SlingContext context = new SlingContext();
private XSSAPI xssAPI;
@@ -66,7 +65,7 @@ public class XSSAPIImplTest {
xssAPI = context.getService(XSSAPI.class);
}
- @Before
+ @BeforeEach
public void before() {
MetricsService metricsService = mock(MetricsService.class);
when(metricsService.counter(anyString())).thenReturn(mock(Counter.class));
@@ -75,7 +74,7 @@ public class XSSAPIImplTest {
context.registerService(new XSSStatusService());
}
- @After
+ @AfterEach
public void tearDown() {
xssAPI = null;
}
@@ -100,7 +99,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
String expected = aTestData[1];
- TestCase.assertEquals("HTML Encoding '" + source + "'", expected, xssAPI.encodeForHTML(source));
+ assertEquals(expected, xssAPI.encodeForHTML(source), "HTML Encoding '" + source + "'");
}
}
@@ -123,7 +122,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
String expected = aTestData[1];
- TestCase.assertEquals("HTML Encoding '" + source + "'", expected, xssAPI.encodeForHTMLAttr(source));
+ assertEquals(expected, xssAPI.encodeForHTMLAttr(source), "HTML Encoding '" + source + "'");
}
}
@@ -146,7 +145,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
String expected = aTestData[1];
- TestCase.assertEquals("XML Encoding '" + source + "'", expected, xssAPI.encodeForXML(source));
+ assertEquals(expected, xssAPI.encodeForXML(source), "XML Encoding '" + source + "'");
}
}
@@ -170,7 +169,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
String expected = aTestData[1];
- TestCase.assertEquals("XML Encoding '" + source + "'", expected, xssAPI.encodeForXMLAttr(source));
+ assertEquals(expected, xssAPI.encodeForXMLAttr(source), "XML Encoding '" + source + "'");
}
}
@@ -212,7 +211,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
String expected = aTestData[1];
- TestCase.assertEquals("Filtering '" + source + "'", expected, xssAPI.filterHTML(source));
+ assertEquals(expected, xssAPI.filterHTML(source), "Filtering '" + source + "'");
}
}
@@ -357,7 +356,7 @@ public class XSSAPIImplTest {
}
if (errors.length() > 0) {
errors.insert(0, "\n");
- TestCase.fail(errors.toString());
+ fail(errors.toString());
}
}
@@ -407,7 +406,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
Integer expected = (aTestData[1] != null) ? Integer.parseInt(aTestData[1]) : null;
- TestCase.assertEquals("Validating integer '" + source + "'", expected, xssAPI.getValidInteger(source, 123));
+ assertEquals(expected, xssAPI.getValidInteger(source, 123), "Validating integer '" + source + "'");
}
}
@@ -431,7 +430,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
Long expected = (aTestData[1] != null) ? Long.parseLong(aTestData[1]) : null;
- TestCase.assertEquals("Validating long '" + source + "'", expected, xssAPI.getValidLong(source, 123));
+ assertEquals(expected, xssAPI.getValidLong(source, 123), "Validating long '" + source + "'");
}
}
@@ -454,7 +453,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
Double expected = (aTestData[1] != null) ? Double.parseDouble(aTestData[1]) : null;
- TestCase.assertEquals("Validating double '" + source + "'", expected, xssAPI.getValidDouble(source, 123));
+ assertEquals(expected, xssAPI.getValidDouble(source, 123), "Validating double '" + source + "'");
}
}
@@ -485,7 +484,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
String expected = aTestData[1];
- TestCase.assertEquals("Validating dimension '" + source + "'", expected, xssAPI.getValidDimension(source, "123"));
+ assertEquals(expected, xssAPI.getValidDimension(source, "123"), "Validating dimension '" + source + "'");
}
}
@@ -511,7 +510,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
String expected = aTestData[1];
- TestCase.assertEquals("Encoding '" + source + "'", expected, xssAPI.encodeForJSString(source));
+ assertEquals(expected, xssAPI.encodeForJSString(source), "Encoding '" + source + "'");
}
}
@@ -544,7 +543,7 @@ public class XSSAPIImplTest {
String source = aTestData[0];
String expected = aTestData[1];
- TestCase.assertEquals("Validating Javascript token '" + source + "'", expected, xssAPI.getValidJSToken(source, RUBBISH));
+ assertEquals(expected, xssAPI.getValidJSToken(source, RUBBISH), "Validating Javascript token '" + source + "'");
}
}
@@ -565,7 +564,7 @@ public class XSSAPIImplTest {
String expected = aTestData[1];
String result = xssAPI.encodeForCSSString(source);
- TestCase.assertEquals("Encoding '" + source + "'", expected, result);
+ assertEquals(expected, result, "Encoding '" + source + "'");
}
}
diff --git a/src/test/java/org/apache/sling/xss/impl/XSSFilterImplTest.java b/src/test/java/org/apache/sling/xss/impl/XSSFilterImplTest.java
index 470b374..7099e31 100644
--- a/src/test/java/org/apache/sling/xss/impl/XSSFilterImplTest.java
+++ b/src/test/java/org/apache/sling/xss/impl/XSSFilterImplTest.java
@@ -18,38 +18,39 @@
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~*/
package org.apache.sling.xss.impl;
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertFalse;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+import static org.mockito.Matchers.anyString;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.when;
+
import org.apache.sling.commons.metrics.Counter;
import org.apache.sling.commons.metrics.MetricsService;
import org.apache.sling.serviceusermapping.ServiceUserMapped;
-import org.apache.sling.testing.mock.sling.junit.SlingContext;
+import org.apache.sling.testing.mock.sling.junit5.SlingContext;
+import org.apache.sling.testing.mock.sling.junit5.SlingContextExtension;
import org.apache.sling.xss.XSSFilter;
import org.apache.sling.xss.impl.status.XSSStatusService;
-import org.junit.After;
-import org.junit.Before;
-import org.junit.Rule;
-import org.junit.Test;
-
-import static org.junit.Assert.assertEquals;
-import static org.junit.Assert.assertFalse;
-import static org.junit.Assert.assertNotNull;
-import static org.junit.Assert.assertTrue;
-import static org.mockito.Matchers.anyString;
-import static org.mockito.Mockito.mock;
-import static org.mockito.Mockito.when;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+@ExtendWith(SlingContextExtension.class)
public class XSSFilterImplTest {
- @Rule
public SlingContext context = new SlingContext();
private XSSFilter xssFilter;
- @After
+ @AfterEach
public void tearDown() {
xssFilter = null;
}
- @Before
+ @BeforeEach
public void setUp() {
MetricsService metricsService = mock(MetricsService.class);
when(metricsService.counter(anyString())).thenReturn(mock(Counter.class));
@@ -66,8 +67,8 @@ public class XSSFilterImplTest {
xssFilter = context.getService(XSSFilter.class);
XSSFilterImpl xssFilterImpl = (XSSFilterImpl) xssFilter;
XSSFilterImpl.AntiSamyPolicy antiSamyPolicy = xssFilterImpl.getActivePolicy();
- assertFalse("Expected a Resource based policy.", antiSamyPolicy.isEmbedded());
- assertEquals("This is not the policy we're looking for.", "/libs/" + XSSFilterImpl.DEFAULT_POLICY_PATH, antiSamyPolicy.getPath());
+ assertFalse(antiSamyPolicy.isEmbedded(), "Expected a Resource based policy.");
+ assertEquals("/libs/" + XSSFilterImpl.DEFAULT_POLICY_PATH, antiSamyPolicy.getPath(), "This is not the policy we're looking for.");
}
@Test
@@ -76,8 +77,8 @@ public class XSSFilterImplTest {
xssFilter = context.getService(XSSFilter.class);
XSSFilterImpl xssFilterImpl = (XSSFilterImpl) xssFilter;
XSSFilterImpl.AntiSamyPolicy antiSamyPolicy = xssFilterImpl.getActivePolicy();
- assertTrue("Expected the default embedded policy.", antiSamyPolicy.isEmbedded());
- assertEquals("This is not the policy we're looking for.", XSSFilterImpl.EMBEDDED_POLICY_PATH, antiSamyPolicy.getPath());
+ assertTrue(antiSamyPolicy.isEmbedded(), "Expected the default embedded policy.");
+ assertEquals(XSSFilterImpl.EMBEDDED_POLICY_PATH, antiSamyPolicy.getPath(), "This is not the policy we're looking for.");
}
@Test
@@ -108,9 +109,9 @@ public class XSSFilterImplTest {
private void checkIsValid(String input, boolean valid) {
if (valid) {
- assertTrue("Expected valid href value for: " + input, xssFilter.isValidHref(input));
+ assertTrue(xssFilter.isValidHref(input), "Expected valid href value for: " + input);
} else {
- assertFalse("Expected invalid href value for: " + input, xssFilter.isValidHref(input));
+ assertFalse(xssFilter.isValidHref(input), "Expected invalid href value for: " + input);
}
}
diff --git a/src/test/java/org/apache/sling/xss/impl/XSSProtectionServiceImplTest.java b/src/test/java/org/apache/sling/xss/impl/XSSProtectionServiceImplTest.java
index c229970..4f5a27a 100644
--- a/src/test/java/org/apache/sling/xss/impl/XSSProtectionServiceImplTest.java
+++ b/src/test/java/org/apache/sling/xss/impl/XSSProtectionServiceImplTest.java
@@ -16,12 +16,11 @@
******************************************************************************/
package org.apache.sling.xss.impl;
-import static org.junit.Assert.fail;
-
-import org.junit.Before;
-import org.junit.Test;
+import static org.junit.jupiter.api.Assertions.fail;
import org.apache.sling.xss.ProtectionContext;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
/** Test the XSSProtectionServiceImpl with various strings.
*
@@ -41,7 +40,7 @@ public class XSSProtectionServiceImplTest {
private XSSFilterImpl xssFilter;
- @Before
+ @BeforeEach
public void setup() {
xssFilter = new XSSFilterImpl();
}