Example #1
0
func TestSessionCreate(t *testing.T) {
	logrus.SetLevel(logrus.PanicLevel)

	mongo, dbName, err := tests.RandomTestMongoUp()
	if err != nil {
		t.Fatal(err)
	}
	defer tests.RandomTestMongoDown(mongo, dbName)

	mgr := manager.New(mongo.DB(dbName))
	err = loadFixtures(mgr)
	if err != nil {
		t.Fatal(err)
	}

	// create and auth user
	sess := filters.NewSession()
	u, err := mgr.Users.Create(&user.User{})
	if err != nil {
		t.Fatal(err)
	}
	sess.Set(filters.SessionUserKey, u.Id.Hex())

	scanService := New(services.New(mgr, nil, scheduler.NewFake()))
	wsContainer := restful.NewContainer()
	wsContainer.Router(restful.CurlyRouter{})
	wsContainer.Filter(filters.SessionFilterMock(sess))
	scanService.Register(wsContainer)

	marshalSession := func(s *scan.Session) []byte {
		data, err := json.Marshal(s)
		if err != nil {
			t.Fatal(err)
		}
		return data
	}

	ts := httptest.NewServer(wsContainer)
	defer ts.Close()

	c.Convey("Given base scan with sessions", t, func() {

		baseScan, err := mgr.Scans.Create(&scan.Scan{
			Status:  scan.StatusWorking,
			Plan:    mgr.NewId(),
			Target:  mgr.NewId(),
			Owner:   mgr.NewId(),
			Project: mgr.NewId(),
			Sessions: []*scan.Session{
				&scan.Session{
					Id:     mgr.NewId(),
					Status: scan.StatusWorking,
					Plugin: mgr.NewId(),
				},
			},
		})
		c.So(err, c.ShouldBeNil)
		scanId := mgr.FromId(baseScan.Id)

		parentSession := baseScan.Sessions[0]

		baseScan.Sessions = append(baseScan.Sessions, parentSession)

		sess := &scan.Session{
			Step: &plan.WorkflowStep{
				Plugin: "barbudo/wappalyzer:0.0.2",
			},
			Scan:   baseScan.Id,
			Parent: parentSession.Id,
		}

		c.Convey("When create session with empty body", func() {
			res := sessionCreate(t, ts.URL, scanId, nil)
			shouldBeBadRequest(t, res, services.CodeWrongEntity, "wrong entity")
		})

		c.Convey("When create session with bad body", func() {
			res := sessionCreate(t, ts.URL, scanId, []byte("{'}"))
			shouldBeBadRequest(t, res, services.CodeWrongEntity, "wrong entity")
		})

		c.Convey("When create session without step", func() {
			res := sessionCreate(t, ts.URL, scanId, marshalSession(&scan.Session{}))
			shouldBeBadRequest(t, res, services.CodeWrongData, "step is required")
		})

		c.Convey("When create session with empty step.plugin", func() {
			sess.Step.Plugin = ""
			res := sessionCreate(t, ts.URL, scanId, marshalSession(sess))
			shouldBeBadRequest(t, res, services.CodeWrongData, "step.plugin is required")
		})

		c.Convey("When create session with wrong scan", func() {
			sess.Scan = mgr.NewId()
			res := sessionCreate(t, ts.URL, scanId, marshalSession(sess))
			shouldBeBadRequest(t, res, services.CodeWrongData, "wrong scan id")
		})

		c.Convey("When scan is not in working state", func() {
			baseScan.Status = scan.StatusFinished
			if err := mgr.Scans.Update(baseScan); err != nil {
				t.Fatal(err)
				return
			}
			res := sessionCreate(t, ts.URL, scanId, marshalSession(sess))
			shouldBeBadRequest(t, res, services.CodeWrongData, "scan should have working status")
		})

		c.Convey("When parent is empty", func() {
			sess.Parent = ""
			res := sessionCreate(t, ts.URL, scanId, marshalSession(sess))
			shouldBeBadRequest(t, res, services.CodeWrongData, "parent field is required")
		})

		c.Convey("When parent is not existed", func() {
			sess.Parent = mgr.NewId()
			res := sessionCreate(t, ts.URL, scanId, marshalSession(sess))
			shouldBeBadRequest(t, res, services.CodeWrongData, "parent not found")
		})

		c.Convey("When parent doesn't have working status", func() {
			parentSession.Status = scan.StatusFinished
			mgr.Scans.UpdateSession(baseScan, parentSession)
			res := sessionCreate(t, ts.URL, scanId, marshalSession(sess))
			shouldBeBadRequest(t, res, services.CodeWrongData, "parent should have working status")
		})

		c.Convey("When plugin has wrong name", func() {
			sess.Step.Plugin = "bad_name"
			res := sessionCreate(t, ts.URL, scanId, marshalSession(sess))
			shouldBeBadRequest(t, res, services.CodeWrongData, "plugin bad_name is not found")
		})

		c.Convey("When everything is ok", func() {
			res := sessionCreate(t, ts.URL, scanId, marshalSession(sess))

			c.Convey("Session returns and updated into db", func() {
				c.So(res.StatusCode, c.ShouldEqual, http.StatusCreated)
				baseScan, err := mgr.Scans.GetById(baseScan.Id)
				c.So(err, c.ShouldBeNil)
				c.So(len(baseScan.Sessions), c.ShouldEqual, 1)
				c.So(len(baseScan.Sessions[0].Children), c.ShouldEqual, 1)
				child := baseScan.Sessions[0].Children[0]
				c.So(child.Parent, c.ShouldEqual, parentSession.Id)
				c.So(child.Status, c.ShouldEqual, scan.StatusCreated)
				c.So(child.Scan, c.ShouldEqual, baseScan.Id)
			})
		})

	})
}
Example #2
0
func TestChangePassword(t *testing.T) {
	logrus.SetLevel(logrus.PanicLevel)

	mongo, dbName, err := tests.RandomTestMongoUp()
	if err != nil {
		t.Fatal(err)
	}
	defer tests.RandomTestMongoDown(mongo, dbName)

	mgr := manager.New(mongo.DB(dbName))

	passCtx := passlib.NewContext()

	// create and auth user
	sess := filters.NewSession()
	service := New(services.New(mgr, passCtx, scheduler.NewFake()))
	wsContainer := restful.NewContainer()
	wsContainer.Router(restful.CurlyRouter{})
	wsContainer.Filter(filters.SessionFilterMock(sess))
	service.Register(wsContainer)

	ts := httptest.NewServer(wsContainer)
	defer ts.Close()

	c.Convey("Given authorized user with password - password", t, func() {
		pass, err := passCtx.Encrypt("password")
		if err != nil {
			t.Fatal(err)
		}
		u, err := mgr.Users.Create(&user.User{
			Password: pass,
		})
		if err != nil {
			t.Fatal(err)
		}
		sess.Set(filters.SessionUserKey, u.Id.Hex())

		c.Convey("Change password with wrong entity", func() {
			err, resp, sErr := changePassword(ts.URL, map[string]int{"old": 1})
			c.So(err, c.ShouldBeNil)
			c.So(resp.StatusCode, c.ShouldEqual, http.StatusBadRequest)
			c.So(sErr, c.ShouldNotBeNil)
			c.So(sErr.Code, c.ShouldEqual, services.CodeWrongEntity)
		})

		c.Convey("Change password with wrong old password", func() {
			err, resp, sErr := changePassword(ts.URL, map[string]string{"old": "bad"})
			c.So(err, c.ShouldBeNil)
			c.So(resp.StatusCode, c.ShouldEqual, http.StatusBadRequest)
			c.So(sErr, c.ShouldNotBeNil)
			c.So(sErr.Code, c.ShouldEqual, services.CodeWrongData)
		})

		c.Convey("Change password with right old password, but new is short", func() {
			err, resp, sErr := changePassword(ts.URL, map[string]string{"old": "password", "new": "short"})
			c.So(err, c.ShouldBeNil)
			c.So(resp.StatusCode, c.ShouldEqual, http.StatusBadRequest)
			c.So(sErr, c.ShouldNotBeNil)
			c.So(sErr.Code, c.ShouldEqual, services.CodeWrongData)
		})

		c.Convey("Change password with right old password, and good new password", func() {
			err, resp, sErr := changePassword(ts.URL, map[string]string{"old": "password", "new": "password2"})
			c.So(err, c.ShouldBeNil)
			c.So(resp.StatusCode, c.ShouldEqual, http.StatusOK)
			c.So(sErr, c.ShouldBeNil)

			modified, err := mgr.Users.GetById(u.Id)
			if err != nil {
				t.Fatal(err)
			}
			verified, err := passCtx.Verify("password2", modified.Password)
			if err != nil {
				t.Fatal(err)
			}
			c.So(verified, c.ShouldBeTrue)
		})
	})
}
Example #3
0
func TestSessionCreate(t *testing.T) {
	mongo, dbName, err := tests.RandomTestMongoUp()
	if err != nil {
		t.Fatal(err)
	}
	defer tests.RandomTestMongoDown(mongo, dbName)

	mgr := manager.New(mongo.DB(dbName))

	// create and auth user
	sess := filters.NewSession()
	u, err := mgr.Users.Create(&user.User{})
	if err != nil {
		t.Fatal(err)
	}
	sess.Set(filters.SessionUserKey, u.Id.Hex())

	service := New(services.New(mgr, nil, scheduler.NewFake()))
	wsContainer := restful.NewContainer()
	wsContainer.Router(restful.CurlyRouter{})
	wsContainer.Filter(filters.SessionFilterMock(sess))
	service.Register(wsContainer)

	ts := httptest.NewServer(wsContainer)
	defer ts.Close()

	c.Convey("Given empty issues collections", t, func() {
		_, err = mongo.DB(dbName).C("issues").RemoveAll(bson.M{})
		c.So(err, c.ShouldBeNil)
		projectObj, err := mgr.Projects.Create(&project.Project{
			Name:  "default",
			Owner: u.Id,
		})
		c.So(err, c.ShouldBeNil)
		targetObj, err := mgr.Targets.Create(&target.Target{
			Project: projectObj.Id,
			Type:    target.TypeWeb,
		})
		c.So(err, c.ShouldBeNil)

		c.Convey("Get list of all issues", func() {
			res, issues := getIssues(t, ts.URL, nil)
			c.Convey("Response should be empty", func() {
				c.So(res.StatusCode, c.ShouldEqual, http.StatusOK)
				c.So(issues.Count, c.ShouldEqual, 0)
				c.So(len(issues.Results), c.ShouldEqual, 0)
			})
		})

		c.Convey("Given target issue", func() {
			targetIssue, err := mgr.Issues.Create(&issue.TargetIssue{
				Target:  targetObj.Id,
				Project: projectObj.Id,
				Issue: issue.Issue{
					UniqId: "1",
				},
				Status: issue.Status{
					Confirmed: true,
				},
			})
			c.So(err, c.ShouldBeNil)
			c.So(targetIssue.Confirmed, c.ShouldEqual, true)
			c.So(targetIssue.Muted, c.ShouldEqual, false)
			c.So(targetIssue.False, c.ShouldEqual, false)
			c.So(targetIssue.Resolved, c.ShouldEqual, false)

			c.Convey("Get list of all issues", func() {
				res, issues := getIssues(t, ts.URL, nil)
				c.Convey("Response should have a new issue", func() {
					c.So(res.StatusCode, c.ShouldEqual, http.StatusOK)
					c.So(issues.Count, c.ShouldEqual, 1)
					c.So(len(issues.Results), c.ShouldEqual, 1)
					c.So(issues.Results[0].Id, c.ShouldEqual, targetIssue.Id)
				})
			})

			c.Convey("Set issue status confirmed", func() {
				res, issue := updateIssue(t, ts.URL, mgr.FromId(targetIssue.Id), &TargetIssueEntity{
					Status: Status{
						Confirmed: utils.BoolP(false),
					},
				})
				c.So(res.StatusCode, c.ShouldEqual, http.StatusOK)
				c.So(issue.Confirmed, c.ShouldEqual, false)
				c.So(issue.Muted, c.ShouldEqual, false)
				c.So(issue.False, c.ShouldEqual, false)
				c.So(issue.Resolved, c.ShouldEqual, false)
			})

			c.Convey("Set issue status muted", func() {
				res, issue := updateIssue(t, ts.URL, mgr.FromId(targetIssue.Id), &TargetIssueEntity{
					Status: Status{
						Muted: utils.BoolP(true),
					},
				})
				c.So(res.StatusCode, c.ShouldEqual, http.StatusOK)
				c.So(issue.Confirmed, c.ShouldEqual, true)
				c.So(issue.Muted, c.ShouldEqual, true)
				c.So(issue.False, c.ShouldEqual, false)
				c.So(issue.Resolved, c.ShouldEqual, false)
			})

			c.Convey("Set issue status false", func() {
				res, issue := updateIssue(t, ts.URL, mgr.FromId(targetIssue.Id), &TargetIssueEntity{
					Status: Status{
						False: utils.BoolP(true),
					},
				})
				c.So(res.StatusCode, c.ShouldEqual, http.StatusOK)
				c.So(issue.Confirmed, c.ShouldEqual, true)
				c.So(issue.Muted, c.ShouldEqual, false)
				c.So(issue.False, c.ShouldEqual, true)
				c.So(issue.Resolved, c.ShouldEqual, false)
			})

			c.Convey("Set issue status resolved", func() {
				res, issue := updateIssue(t, ts.URL, mgr.FromId(targetIssue.Id), &TargetIssueEntity{
					Status: Status{
						Resolved: utils.BoolP(true),
					},
				})
				c.So(res.StatusCode, c.ShouldEqual, http.StatusOK)
				c.So(issue.Confirmed, c.ShouldEqual, true)
				c.So(issue.Muted, c.ShouldEqual, false)
				c.So(issue.False, c.ShouldEqual, false)
				c.So(issue.Resolved, c.ShouldEqual, true)
			})

			c.Convey("Set all issue status", func() {
				res, issue := updateIssue(t, ts.URL, mgr.FromId(targetIssue.Id), &TargetIssueEntity{
					Status: Status{
						Muted:     utils.BoolP(true),
						Resolved:  utils.BoolP(true),
						False:     utils.BoolP(true),
						Confirmed: utils.BoolP(false),
					},
				})
				c.So(res.StatusCode, c.ShouldEqual, http.StatusOK)
				c.So(issue.Confirmed, c.ShouldEqual, false)
				c.So(issue.Muted, c.ShouldEqual, true)
				c.So(issue.False, c.ShouldEqual, true)
				c.So(issue.Resolved, c.ShouldEqual, true)
			})

		})

	})

}