Mercurial > p > roundup > code

annotate test/test_userauditor.py @ 5726:e199d0ae4a25

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
issue2551033: prevent reverse engineering hidden data by using etags as an oracle to identify when the right data has been guessed. Identified by Joseph Myers who also suggested remediation methods. Implemented John Rouillard.
author John Rouillard <rouilj@ieee.org>
date Thu, 23 May 2019 18:56:57 -0400
parents d26921b851c3
children 5148e46dd314
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
rev   line source
3873
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
1 import os, unittest, shutil
5036
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
2
5388
d26921b851c3 Python 3 preparation: make relative imports explicit.
Joseph Myers <jsm@polyomino.org.uk>
parents: 5248
diff changeset
3 from .db_test_base import setupTracker
5036
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
4 from .test_dates import skip_pytz
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
5
3873
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
6
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
7 class UserAuditorTest(unittest.TestCase):
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
8 def setUp(self):
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
9 self.dirname = '_test_user_auditor'
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
10 self.instance = setupTracker(self.dirname)
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
11 self.db = self.instance.open('admin')
4781
6e9b9743de89 Implementation for:
John Rouillard <rouilj@ieee.org>
parents: 4570
diff changeset
12 self.db.tx_Source = "cli"
3873
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
13
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
14 self.db.user.create(username='kyle', address='kyle@example.com',
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
15 realname='Kyle Broflovski', roles='User')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
16
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
17 def tearDown(self):
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
18 self.db.close()
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
19 try:
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
20 shutil.rmtree(self.dirname)
5248
198b6e810c67 Use Python-3-compatible 'as' syntax for except statements
Eric S. Raymond <esr@thyrsus.com>
parents: 5105
diff changeset
21 except OSError as error:
3873
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
22 if error.errno not in (errno.ENOENT, errno.ESRCH): raise
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
23
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
24 def testBadTimezones(self):
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
25 self.assertRaises(ValueError, self.db.user.create, username='eric', timezone='24')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
26
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
27 userid = self.db.user.lookup('kyle')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
28
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
29 self.assertRaises(ValueError, self.db.user.set, userid, timezone='3000')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
30 self.assertRaises(ValueError, self.db.user.set, userid, timezone='24')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
31 self.assertRaises(ValueError, self.db.user.set, userid, timezone='-24')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
32 self.assertRaises(ValueError, self.db.user.set, userid, timezone='-3000')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
33
5036
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
34 @skip_pytz
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
35 def testBadTimezonesPyTZ(self):
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
36 userid = self.db.user.lookup('kyle')
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
37
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
38 try:
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
39 from pytz import UnknownTimeZoneError
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
40 except:
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
41 UnknownTimeZoneError = ValueError
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
42
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
43 self.assertRaises(UnknownTimeZoneError, self.db.user.set, userid,
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
44 timezone='MiddleOf/Nowhere')
3873
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
45
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
46 def testGoodTimezones(self):
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
47 self.db.user.create(username='test_user01', timezone='12')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
48
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
49 userid = self.db.user.lookup('kyle')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
50
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
51 # TODO: roundup should accept non-integer offsets since those are valid
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
52 # this is the offset for Tehran, Iran
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
53 #self.db.user.set(userid, timezone='3.5')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
54
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
55 self.db.user.set(userid, timezone='-23')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
56 self.db.user.set(userid, timezone='23')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
57 self.db.user.set(userid, timezone='0')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
58
5036
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
59 @skip_pytz
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
60 def testGoodTimezonesPyTZ(self):
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
61 userid = self.db.user.lookup('kyle')
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
62
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
63 self.db.user.create(username='test_user02', timezone='MST')
380d8d8b30a3 Replace existing run_tests.py script with a pytest script
John Kristensen <john@jerrykan.com>
parents: 4781
diff changeset
64 self.db.user.set(userid, timezone='US/Eastern')
3873
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
65
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
66 def testBadEmailAddresses(self):
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
67 userid = self.db.user.lookup('kyle')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
68 self.assertRaises(ValueError, self.db.user.set, userid, address='kyle @ example.com')
3902
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
69 self.assertRaises(ValueError, self.db.user.set, userid, address='one@example.com,two@example.com')
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
70 self.assertRaises(ValueError, self.db.user.set, userid, address='weird@@example.com')
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
71 self.assertRaises(ValueError, self.db.user.set, userid, address='embedded\nnewline@example.com')
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
72 # verify that we check alternates as well
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
73 self.assertRaises(ValueError, self.db.user.set, userid, alternate_addresses='kyle @ example.com')
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
74 # make sure we accept local style addresses
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
75 self.db.user.set(userid, address='kyle')
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
76 # verify we are case insensitive
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
77 self.db.user.set(userid, address='kyle@EXAMPLE.COM')
3873
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
78
3888
4fcf7a52767e fix [SF#611787]: ensure unique email addresses
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3874
diff changeset
79 def testUniqueEmailAddresses(self):
3902
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
80 self.db.user.create(username='kenny', address='kenny@example.com', alternate_addresses='sp_ken@example.com')
3888
4fcf7a52767e fix [SF#611787]: ensure unique email addresses
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3874
diff changeset
81 self.assertRaises(ValueError, self.db.user.create, username='test_user01', address='kenny@example.com')
4fcf7a52767e fix [SF#611787]: ensure unique email addresses
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3874
diff changeset
82 uid = self.db.user.create(username='eric', address='eric@example.com')
4fcf7a52767e fix [SF#611787]: ensure unique email addresses
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3874
diff changeset
83 self.assertRaises(ValueError, self.db.user.set, uid, address='kenny@example.com')
4fcf7a52767e fix [SF#611787]: ensure unique email addresses
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3874
diff changeset
84
3902
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
85 # make sure we check alternates
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
86 self.assertRaises(ValueError, self.db.user.set, uid, address='kenny@example.com')
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
87 self.assertRaises(ValueError, self.db.user.set, uid, address='sp_ken@example.com')
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
88 self.assertRaises(ValueError, self.db.user.set, uid, alternate_addresses='kenny@example.com')
21420ba64b0d fuller email validition (request [SF#216291])
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3888
diff changeset
89
3873
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
90 def testBadRoles(self):
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
91 userid = self.db.user.lookup('kyle')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
92 self.assertRaises(ValueError, self.db.user.set, userid, roles='BadRole')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
93 self.assertRaises(ValueError, self.db.user.set, userid, roles='User,BadRole')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
94
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
95 def testGoodRoles(self):
3874
4c8d853017f2 strip rolename & fix rolename unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3873
diff changeset
96 userid = self.db.user.lookup('kyle')
3873
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
97 # make sure we handle commas in weird places
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
98 self.db.user.set(userid, roles='User,')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
99 self.db.user.set(userid, roles=',User')
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
100 # make sure we strip whitespace
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
101 self.db.user.set(userid, roles=' User ')
3874
4c8d853017f2 strip rolename & fix rolename unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3873
diff changeset
102 # check for all-whitespace (treat as no role)
4c8d853017f2 strip rolename & fix rolename unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents: 3873
diff changeset
103 self.db.user.set(userid, roles=' ')
3873
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
104
4d1928ce993e more small userauditor changes and a unittest
Justus Pendleton <jpend@users.sourceforge.net>
parents:
diff changeset
105 # vim: filetype=python sts=4 sw=4 et si
Roundup Issue Tracker: http://roundup-tracker.org/