forked from jenkinsci/jenkins
-
Notifications
You must be signed in to change notification settings - Fork 3
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
1 parent
86d39dd
commit de45096
Showing
2 changed files
with
82 additions
and
1 deletion.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,62 @@ | ||
package hudson.cli; | ||
|
||
import static org.hamcrest.CoreMatchers.is; | ||
import static org.hamcrest.MatcherAssert.assertThat; | ||
|
||
import java.io.IOException; | ||
import java.net.URL; | ||
import java.util.Arrays; | ||
import java.util.List; | ||
import org.htmlunit.HttpMethod; | ||
import org.htmlunit.Page; | ||
import org.htmlunit.WebRequest; | ||
import org.junit.Rule; | ||
import org.junit.Test; | ||
import org.junit.runner.RunWith; | ||
import org.junit.runners.Parameterized; | ||
import org.jvnet.hudson.test.FlagRule; | ||
import org.jvnet.hudson.test.JenkinsRule; | ||
|
||
@RunWith(Parameterized.class) | ||
public class Security3315Test { | ||
@Rule | ||
public JenkinsRule j = new JenkinsRule(); | ||
|
||
@Rule | ||
public FlagRule<Boolean> escapeHatch; | ||
|
||
private final Boolean allowWs; | ||
|
||
@Parameterized.Parameters | ||
public static List<String> escapeHatchValues() { | ||
return Arrays.asList(null, "true", "false"); | ||
} | ||
|
||
public Security3315Test(String allowWs) { | ||
this.allowWs = allowWs == null ? null : Boolean.valueOf(allowWs); | ||
this.escapeHatch = new FlagRule<>(() -> CLIAction.ALLOW_WEBSOCKET, v -> { CLIAction.ALLOW_WEBSOCKET = v; }, this.allowWs); | ||
} | ||
|
||
@Test | ||
public void test() throws IOException { | ||
try (JenkinsRule.WebClient wc = j.createWebClient().withThrowExceptionOnFailingStatusCode(false)) { | ||
// HTTP 400 is WebSocket "success" (HTMLUnit doesn't support it) | ||
final URL jenkinsUrl = j.getURL(); | ||
WebRequest request = new WebRequest(new URL(jenkinsUrl.toString() + "cli/ws"), HttpMethod.GET); | ||
Page page = wc.getPage(request); | ||
assertThat(page.getWebResponse().getStatusCode(), is(allowWs == Boolean.TRUE ? 400 : 403)); // no Origin header | ||
|
||
request.setAdditionalHeader("Origin", jenkinsUrl.getProtocol() + "://example.org:" + jenkinsUrl.getPort()); | ||
page = wc.getPage(request); | ||
assertThat(page.getWebResponse().getStatusCode(), is(allowWs == Boolean.TRUE ? 400 : 403)); // Wrong Origin host | ||
|
||
request.setAdditionalHeader("Origin", jenkinsUrl.getProtocol() + "://" + jenkinsUrl.getHost()); | ||
page = wc.getPage(request); | ||
assertThat(page.getWebResponse().getStatusCode(), is(allowWs == Boolean.TRUE ? 400 : 403)); // Wrong Origin port | ||
|
||
request.setAdditionalHeader("Origin", jenkinsUrl.getProtocol() + "://" + jenkinsUrl.getHost() + ":" + jenkinsUrl.getPort()); | ||
page = wc.getPage(request); | ||
assertThat(page.getWebResponse().getStatusCode(), is(allowWs == Boolean.FALSE ? 403 : 400)); // Reject correct Origin if ALLOW_WS is explicitly false | ||
} | ||
} | ||
} |