Mercurial > p > roundup > code
view roundup/test/mocknull.py @ 7155:89a59e46b3af
improve REST interface security
When using REST, we reflect the client's origin. If the wildcard '*'
is used in allowed_api_origins all origins are allowed. When this is
done, it also added an 'Access-Control-Allow-Credentials: true'
header.
This Credentials header should not be added if the site is matched
only by '*'. This header should be provided only for explicit origins
(e.g. https://example.org) not for the wildcard.
This is now fixed for CORS preflight OPTIONS request as well as normal
GET, PUT, DELETE, POST, PATCH and OPTIONS requests.
A missing Access-Control-Allow-Credentials will prevent the tracker
from being accessed using credentials. This prevents an unauthorized
third party web site from using a user's credentials to access
information in the tracker that is not publicly available.
Added test for this specific case.
In addition, allowed_api_origins can include explicit origins in
addition to '*'. '*' must be first in the list.
Also adapted numerous tests to work with these changes.
Doc updates.
| author | John Rouillard <rouilj@ieee.org> |
|---|---|
| date | Thu, 23 Feb 2023 12:01:33 -0500 |
| parents | f2c31f5ec50b |
| children | 617d85ce4ac3 |
line wrap: on
line source
class MockNull: def __init__(self, **kwargs): for key, value in kwargs.items(): self.__dict__[key] = value def __call__(self, *args, **kwargs): return MockNull() def __getattr__(self, name): # This allows assignments which assume all intermediate steps are Null # objects if they don't exist yet. # # For example (with just 'client' defined): # # client.db.config.TRACKER_WEB = 'BASE/' self.__dict__[name] = MockNull() return getattr(self, name) def __getitem__(self, key): return self def __bool__(self): return False # Python 2 compatibility: __nonzero__ = __bool__ def __contains__(self, key): return False def __eq__(self, rhs): return False def __ne__(self, rhs): return False def __str__(self): return '' def __repr__(self): return '<MockNull 0x%x>'%id(self) def gettext(self, str): return str _ = gettext def get(self, name, default=None): try: return self.__dict__[name.lower()] except KeyError: return default
