1 files changed, 588 insertions, 0 deletions
diff --git a/id/server/idserverlib/src/test/java/test/at/gv/egovernment/moa/id/util/ParamValidatorUtilsTest.java b/id/server/idserverlib/src/test/java/test/at/gv/egovernment/moa/id/util/ParamValidatorUtilsTest.java
new file mode 100644
index 000000000..ad9e2c90e
--- /dev/null
+++ b/id/server/idserverlib/src/test/java/test/at/gv/egovernment/moa/id/util/ParamValidatorUtilsTest.java
@@ -0,0 +1,588 @@
+package test.at.gv.egovernment.moa.id.util;
+
+import java.io.BufferedReader;
+import java.io.IOException;
+import java.io.UnsupportedEncodingException;
+import java.security.Principal;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.Collection;
+import java.util.Enumeration;
+import java.util.List;
+import java.util.Locale;
+import java.util.Map;
+
+import javax.servlet.AsyncContext;
+import javax.servlet.DispatcherType;
+import javax.servlet.RequestDispatcher;
+import javax.servlet.ServletContext;
+import javax.servlet.ServletException;
+import javax.servlet.ServletInputStream;
+import javax.servlet.ServletRequest;
+import javax.servlet.ServletResponse;
+import javax.servlet.http.Cookie;
+import javax.servlet.http.HttpServletRequest;
+import javax.servlet.http.HttpServletResponse;
+import javax.servlet.http.HttpSession;
+import javax.servlet.http.Part;
+
+import org.junit.Assert;
+import org.junit.BeforeClass;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+import org.junit.runners.BlockJUnit4ClassRunner;
+
+import at.gv.egovernment.moa.id.config.auth.AuthConfigurationProviderFactory;
+import at.gv.egovernment.moa.id.config.auth.data.DummyAuthConfig;
+import at.gv.egovernment.moa.id.util.ParamValidatorUtils;
+
+@RunWith(BlockJUnit4ClassRunner.class)
+public class ParamValidatorUtilsTest {
+
+  private static DummyAuthConfig config;
+  
+  @BeforeClass
+  public static void classInitializer() {
+    config = new DummyAuthConfig();
+    AuthConfigurationProviderFactory.setAuthConfig(config);
+    config.setSlRequestTemplateUrls(new ArrayList<String>());    
+    
+  }
+  
+  @Test
+  public void templateStrictWhitelistFirst() {
+    
+    HttpServletRequest req = getDummyHttpRequest("junit.com");
+    String template = "https://aaaa.com/bbbb";
+    List<String> oaSlTemplates = Arrays.asList(
+        "http://aaaa.com/bbbb", 
+        "https://aaaa.com/bbbb", 
+        "file://aaaa.com/bbbb");
+    
+    Assert.assertTrue("Template should be valid", 
+        ParamValidatorUtils.isValidTemplate(req, template, oaSlTemplates, true));
+    
+  }
+
+  @Test
+  public void templateStrictWhitelistSecond() {
+    
+    HttpServletRequest req = getDummyHttpRequest("junit.com");
+    String template = "file://aaaa.com/ccc";
+    List<String> oaSlTemplates = Arrays.asList(
+        "http://aaaa.com/bbbb", 
+        "https://aaaa.com/bbbb", 
+        "file://aaaa.com/bbbb");
+    
+    Assert.assertFalse("Template should NOT be valid", 
+        ParamValidatorUtils.isValidTemplate(req, template, oaSlTemplates, true));
+    
+  }
+  
+  @Test
+  public void templateLazyWhitelistFirst() {
+    
+    HttpServletRequest req = getDummyHttpRequest("junit.com");
+    String template = "https://aaaa.com/bbbb";
+    List<String> oaSlTemplates = Arrays.asList(
+        "http://aaaa.com/bbbb", 
+        "https://aaaa.com/bbbb", 
+        "file://aaaa.com/bbbb");
+    
+    Assert.assertTrue("Template should be valid", 
+        ParamValidatorUtils.isValidTemplate(req, template, oaSlTemplates, false));
+    
+  }
+  
+  @Test
+  public void templateLaczWhitelistSecond() {
+    
+    HttpServletRequest req = getDummyHttpRequest("junit.com");
+    String template = "file://aaaa.com/ccc";
+    List<String> oaSlTemplates = Arrays.asList(
+        "http://aaaa.com/bbbb", 
+        "https://aaaa.com/bbbb", 
+        "file://aaaa.com/bbbb");
+    
+    Assert.assertFalse("Template should NOT be valid", 
+        ParamValidatorUtils.isValidTemplate(req, template, oaSlTemplates, false));
+    
+  }
+  
+  @Test
+  public void templateLaczWhitelistThird() {
+    
+    HttpServletRequest req = getDummyHttpRequest("junit.com");
+    String template = "https://aaaa.com/ccc";
+    List<String> oaSlTemplates = Arrays.asList(
+        "http://aaaa.com/bbbb", 
+        "https://aaaa.com/bbbb", 
+        "file://aaaa.com/bbbb");
+    
+    Assert.assertFalse("Template should NOT be valid", 
+        ParamValidatorUtils.isValidTemplate(req, template, oaSlTemplates, false));
+    
+  }
+  
+  @Test
+  public void templateLaczWhitelistFour() {
+    
+    HttpServletRequest req = getDummyHttpRequest("junit.com");
+    String template = "http://aaaa.com/ccc";
+    List<String> oaSlTemplates = Arrays.asList(
+        "http://aaaa.com/bbbb", 
+        "https://aaaa.com/bbbb", 
+        "file://aaaa.com/bbbb");
+    
+    Assert.assertFalse("Template should NOT be valid", 
+        ParamValidatorUtils.isValidTemplate(req, template, oaSlTemplates, false));
+    
+  }
+  
+  @Test
+  public void templateLaczWhitelistFife() {
+    
+    HttpServletRequest req = getDummyHttpRequest("junit.com");
+    String template = "http://junit.com/ccc";
+    List<String> oaSlTemplates = Arrays.asList(
+        "http://aaaa.com/bbbb", 
+        "https://aaaa.com/bbbb", 
+        "file://aaaa.com/bbbb");
+    
+    Assert.assertTrue("Template should be valid", 
+        ParamValidatorUtils.isValidTemplate(req, template, oaSlTemplates, false));
+    
+  }
+  
+  @Test
+  public void templateLaczWhitelistSix() {
+    
+    HttpServletRequest req = getDummyHttpRequest("junit.com");
+    String template = "https://junit.com/ccc";
+    List<String> oaSlTemplates = Arrays.asList(
+        "http://aaaa.com/bbbb", 
+        "https://aaaa.com/bbbb", 
+        "file://aaaa.com/bbbb");
+    
+    Assert.assertTrue("Template should be valid", 
+        ParamValidatorUtils.isValidTemplate(req, template, oaSlTemplates, false));
+    
+  }
+  
+  @Test
+  public void templateLaczWhitelistSeven() {
+    
+    HttpServletRequest req = getDummyHttpRequest("junit.com");
+    String template = "file://junit.com/ccc";
+    List<String> oaSlTemplates = Arrays.asList(
+        "http://aaaa.com/bbbb", 
+        "https://aaaa.com/bbbb", 
+        "file://aaaa.com/bbbb");
+    
+    Assert.assertFalse("Template should Not be valid", 
+        ParamValidatorUtils.isValidTemplate(req, template, oaSlTemplates, false));
+    
+  }
+  
+  private HttpServletRequest getDummyHttpRequest(final String serverName) {
+    return new HttpServletRequest() {
+      
+      @Override
+      public AsyncContext startAsync(ServletRequest servletRequest, ServletResponse servletResponse)
+          throws IllegalStateException {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public AsyncContext startAsync() throws IllegalStateException {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public void setCharacterEncoding(String env) throws UnsupportedEncodingException {
+        // TODO Auto-generated method stub
+        
+      }
+      
+      @Override
+      public void setAttribute(String name, Object o) {
+        // TODO Auto-generated method stub
+        
+      }
+      
+      @Override
+      public void removeAttribute(String name) {
+        // TODO Auto-generated method stub
+        
+      }
+      
+      @Override
+      public boolean isSecure() {
+        // TODO Auto-generated method stub
+        return false;
+      }
+      
+      @Override
+      public boolean isAsyncSupported() {
+        // TODO Auto-generated method stub
+        return false;
+      }
+      
+      @Override
+      public boolean isAsyncStarted() {
+        // TODO Auto-generated method stub
+        return false;
+      }
+      
+      @Override
+      public ServletContext getServletContext() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public int getServerPort() {
+        // TODO Auto-generated method stub
+        return 0;
+      }
+      
+      @Override
+      public String getServerName() {
+        return serverName;
+        
+      }
+      
+      @Override
+      public String getScheme() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public RequestDispatcher getRequestDispatcher(String path) {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public int getRemotePort() {
+        // TODO Auto-generated method stub
+        return 0;
+      }
+      
+      @Override
+      public String getRemoteHost() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String getRemoteAddr() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String getRealPath(String path) {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public BufferedReader getReader() throws IOException {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String getProtocol() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String[] getParameterValues(String name) {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public Enumeration<String> getParameterNames() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public Map<String, String[]> getParameterMap() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String getParameter(String name) {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public Enumeration<Locale> getLocales() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public Locale getLocale() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public int getLocalPort() {
+        // TODO Auto-generated method stub
+        return 0;
+      }
+      
+      @Override
+      public String getLocalName() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String getLocalAddr() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public ServletInputStream getInputStream() throws IOException {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public DispatcherType getDispatcherType() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String getContentType() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public int getContentLength() {
+        // TODO Auto-generated method stub
+        return 0;
+      }
+      
+      @Override
+      public String getCharacterEncoding() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public Enumeration<String> getAttributeNames() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public Object getAttribute(String name) {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public AsyncContext getAsyncContext() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public void logout() throws ServletException {
+        // TODO Auto-generated method stub
+        
+      }
+      
+      @Override
+      public void login(String username, String password) throws ServletException {
+        // TODO Auto-generated method stub
+        
+      }
+      
+      @Override
+      public boolean isUserInRole(String role) {
+        // TODO Auto-generated method stub
+        return false;
+      }
+      
+      @Override
+      public boolean isRequestedSessionIdValid() {
+        // TODO Auto-generated method stub
+        return false;
+      }
+      
+      @Override
+      public boolean isRequestedSessionIdFromUrl() {
+        // TODO Auto-generated method stub
+        return false;
+      }
+      
+      @Override
+      public boolean isRequestedSessionIdFromURL() {
+        // TODO Auto-generated method stub
+        return false;
+      }
+      
+      @Override
+      public boolean isRequestedSessionIdFromCookie() {
+        // TODO Auto-generated method stub
+        return false;
+      }
+      
+      @Override
+      public Principal getUserPrincipal() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public HttpSession getSession(boolean create) {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public HttpSession getSession() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String getServletPath() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String getRequestedSessionId() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public StringBuffer getRequestURL() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String getRequestURI() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String getRemoteUser() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String getQueryString() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String getPathTranslated() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String getPathInfo() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public Collection<Part> getParts() throws IOException, ServletException {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public Part getPart(String name) throws IOException, ServletException {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String getMethod() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public int getIntHeader(String name) {
+        // TODO Auto-generated method stub
+        return 0;
+      }
+      
+      @Override
+      public Enumeration<String> getHeaders(String name) {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public Enumeration<String> getHeaderNames() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String getHeader(String name) {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public long getDateHeader(String name) {
+        // TODO Auto-generated method stub
+        return 0;
+      }
+      
+      @Override
+      public Cookie[] getCookies() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String getContextPath() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public String getAuthType() {
+        // TODO Auto-generated method stub
+        return null;
+      }
+      
+      @Override
+      public boolean authenticate(HttpServletResponse response) throws IOException, ServletException {
+        // TODO Auto-generated method stub
+        return false;
+      }
+    };
+  }
+}