summaryrefslogtreecommitdiff
path: root/test/plugs
diff options
context:
space:
mode:
Diffstat (limited to 'test/plugs')
-rw-r--r--test/plugs/authentication_plug_test.exs31
-rw-r--r--test/plugs/http_signature_plug_test.exs18
-rw-r--r--test/plugs/mapped_identity_to_signature_plug_test.exs59
-rw-r--r--test/plugs/rate_limiter_test.exs80
4 files changed, 161 insertions, 27 deletions
diff --git a/test/plugs/authentication_plug_test.exs b/test/plugs/authentication_plug_test.exs
index 6158086ea..7ca045616 100644
--- a/test/plugs/authentication_plug_test.exs
+++ b/test/plugs/authentication_plug_test.exs
@@ -8,6 +8,9 @@ defmodule Pleroma.Plugs.AuthenticationPlugTest do
alias Pleroma.Plugs.AuthenticationPlug
alias Pleroma.User
+ import ExUnit.CaptureLog
+ import Mock
+
setup %{conn: conn} do
user = %User{
id: 1,
@@ -54,4 +57,32 @@ defmodule Pleroma.Plugs.AuthenticationPlugTest do
assert conn == ret_conn
end
+
+ describe "checkpw/2" do
+ test "check pbkdf2 hash" do
+ hash =
+ "$pbkdf2-sha512$160000$loXqbp8GYls43F0i6lEfIw$AY.Ep.2pGe57j2hAPY635sI/6w7l9Q9u9Bp02PkPmF3OrClDtJAI8bCiivPr53OKMF7ph6iHhN68Rom5nEfC2A"
+
+ assert AuthenticationPlug.checkpw("test-password", hash)
+ refute AuthenticationPlug.checkpw("test-password1", hash)
+ end
+
+ test "check sha512-crypt hash" do
+ hash =
+ "$6$9psBWV8gxkGOZWBz$PmfCycChoxeJ3GgGzwvhlgacb9mUoZ.KUXNCssekER4SJ7bOK53uXrHNb2e4i8yPFgSKyzaW9CcmrDXWIEMtD1"
+
+ with_mock :crypt, crypt: fn _password, password_hash -> password_hash end do
+ assert AuthenticationPlug.checkpw("password", hash)
+ end
+ end
+
+ test "it returns false when hash invalid" do
+ hash =
+ "psBWV8gxkGOZWBz$PmfCycChoxeJ3GgGzwvhlgacb9mUoZ.KUXNCssekER4SJ7bOK53uXrHNb2e4i8yPFgSKyzaW9CcmrDXWIEMtD1"
+
+ assert capture_log(fn ->
+ refute Pleroma.Plugs.AuthenticationPlug.checkpw("password", hash)
+ end) =~ "[error] Password hash not recognized"
+ end
+ end
end
diff --git a/test/plugs/http_signature_plug_test.exs b/test/plugs/http_signature_plug_test.exs
index efd811df7..d6fd9ea81 100644
--- a/test/plugs/http_signature_plug_test.exs
+++ b/test/plugs/http_signature_plug_test.exs
@@ -26,22 +26,4 @@ defmodule Pleroma.Web.Plugs.HTTPSignaturePlugTest do
assert called(HTTPSignatures.validate_conn(:_))
end
end
-
- test "bails out early if the signature isn't by the activity actor" do
- params = %{"actor" => "https://mst3k.interlinked.me/users/luciferMysticus"}
- conn = build_conn(:get, "/doesntmattter", params)
-
- with_mock HTTPSignatures, validate_conn: fn _ -> false end do
- conn =
- conn
- |> put_req_header(
- "signature",
- "keyId=\"http://mastodon.example.org/users/admin#main-key"
- )
- |> HTTPSignaturePlug.call(%{})
-
- assert conn.assigns.valid_signature == false
- refute called(HTTPSignatures.validate_conn(:_))
- end
- end
end
diff --git a/test/plugs/mapped_identity_to_signature_plug_test.exs b/test/plugs/mapped_identity_to_signature_plug_test.exs
new file mode 100644
index 000000000..bb45d9edf
--- /dev/null
+++ b/test/plugs/mapped_identity_to_signature_plug_test.exs
@@ -0,0 +1,59 @@
+# Pleroma: A lightweight social networking server
+# Copyright © 2017-2018 Pleroma Authors <https://pleroma.social/>
+# SPDX-License-Identifier: AGPL-3.0-only
+
+defmodule Pleroma.Web.Plugs.MappedSignatureToIdentityPlugTest do
+ use Pleroma.Web.ConnCase
+ alias Pleroma.Web.Plugs.MappedSignatureToIdentityPlug
+
+ import Tesla.Mock
+ import Plug.Conn
+
+ setup do
+ mock(fn env -> apply(HttpRequestMock, :request, [env]) end)
+ :ok
+ end
+
+ defp set_signature(conn, key_id) do
+ conn
+ |> put_req_header("signature", "keyId=\"#{key_id}\"")
+ |> assign(:valid_signature, true)
+ end
+
+ test "it successfully maps a valid identity with a valid signature" do
+ conn =
+ build_conn(:get, "/doesntmattter")
+ |> set_signature("http://mastodon.example.org/users/admin")
+ |> MappedSignatureToIdentityPlug.call(%{})
+
+ refute is_nil(conn.assigns.user)
+ end
+
+ test "it successfully maps a valid identity with a valid signature with payload" do
+ conn =
+ build_conn(:post, "/doesntmattter", %{"actor" => "http://mastodon.example.org/users/admin"})
+ |> set_signature("http://mastodon.example.org/users/admin")
+ |> MappedSignatureToIdentityPlug.call(%{})
+
+ refute is_nil(conn.assigns.user)
+ end
+
+ test "it considers a mapped identity to be invalid when it mismatches a payload" do
+ conn =
+ build_conn(:post, "/doesntmattter", %{"actor" => "http://mastodon.example.org/users/admin"})
+ |> set_signature("https://niu.moe/users/rye")
+ |> MappedSignatureToIdentityPlug.call(%{})
+
+ assert %{valid_signature: false} == conn.assigns
+ end
+
+ @tag skip: "known breakage; the testsuite presently depends on it"
+ test "it considers a mapped identity to be invalid when the identity cannot be found" do
+ conn =
+ build_conn(:post, "/doesntmattter", %{"actor" => "http://mastodon.example.org/users/admin"})
+ |> set_signature("http://niu.moe/users/rye")
+ |> MappedSignatureToIdentityPlug.call(%{})
+
+ assert %{valid_signature: false} == conn.assigns
+ end
+end
diff --git a/test/plugs/rate_limiter_test.exs b/test/plugs/rate_limiter_test.exs
index f8251b5c7..395095079 100644
--- a/test/plugs/rate_limiter_test.exs
+++ b/test/plugs/rate_limiter_test.exs
@@ -10,12 +10,13 @@ defmodule Pleroma.Plugs.RateLimiterTest do
import Pleroma.Factory
- @limiter_name :testing
+ # Note: each example must work with separate buckets in order to prevent concurrency issues
test "init/1" do
- Pleroma.Config.put([:rate_limit, @limiter_name], {1, 1})
+ limiter_name = :test_init
+ Pleroma.Config.put([:rate_limit, limiter_name], {1, 1})
- assert {@limiter_name, {1, 1}} == RateLimiter.init(@limiter_name)
+ assert {limiter_name, {1, 1}, []} == RateLimiter.init(limiter_name)
assert nil == RateLimiter.init(:foo)
end
@@ -24,14 +25,15 @@ defmodule Pleroma.Plugs.RateLimiterTest do
end
test "it restricts by opts" do
+ limiter_name = :test_opts
scale = 1000
limit = 5
- Pleroma.Config.put([:rate_limit, @limiter_name], {scale, limit})
+ Pleroma.Config.put([:rate_limit, limiter_name], {scale, limit})
- opts = RateLimiter.init(@limiter_name)
+ opts = RateLimiter.init(limiter_name)
conn = conn(:get, "/")
- bucket_name = "#{@limiter_name}:#{RateLimiter.ip(conn)}"
+ bucket_name = "#{limiter_name}:#{RateLimiter.ip(conn)}"
conn = RateLimiter.call(conn, opts)
assert {1, 4, _, _, _} = ExRated.inspect_bucket(bucket_name, scale, limit)
@@ -65,18 +67,78 @@ defmodule Pleroma.Plugs.RateLimiterTest do
refute conn.halted
end
+ test "`bucket_name` option overrides default bucket name" do
+ limiter_name = :test_bucket_name
+ scale = 1000
+ limit = 5
+
+ Pleroma.Config.put([:rate_limit, limiter_name], {scale, limit})
+ base_bucket_name = "#{limiter_name}:group1"
+ opts = RateLimiter.init({limiter_name, bucket_name: base_bucket_name})
+
+ conn = conn(:get, "/")
+ default_bucket_name = "#{limiter_name}:#{RateLimiter.ip(conn)}"
+ customized_bucket_name = "#{base_bucket_name}:#{RateLimiter.ip(conn)}"
+
+ RateLimiter.call(conn, opts)
+ assert {1, 4, _, _, _} = ExRated.inspect_bucket(customized_bucket_name, scale, limit)
+ assert {0, 5, _, _, _} = ExRated.inspect_bucket(default_bucket_name, scale, limit)
+ end
+
+ test "`params` option appends specified params' values to bucket name" do
+ limiter_name = :test_params
+ scale = 1000
+ limit = 5
+
+ Pleroma.Config.put([:rate_limit, limiter_name], {scale, limit})
+ opts = RateLimiter.init({limiter_name, params: ["id"]})
+ id = "1"
+
+ conn = conn(:get, "/?id=#{id}")
+ conn = Plug.Conn.fetch_query_params(conn)
+
+ default_bucket_name = "#{limiter_name}:#{RateLimiter.ip(conn)}"
+ parametrized_bucket_name = "#{limiter_name}:#{id}:#{RateLimiter.ip(conn)}"
+
+ RateLimiter.call(conn, opts)
+ assert {1, 4, _, _, _} = ExRated.inspect_bucket(parametrized_bucket_name, scale, limit)
+ assert {0, 5, _, _, _} = ExRated.inspect_bucket(default_bucket_name, scale, limit)
+ end
+
+ test "it supports combination of options modifying bucket name" do
+ limiter_name = :test_options_combo
+ scale = 1000
+ limit = 5
+
+ Pleroma.Config.put([:rate_limit, limiter_name], {scale, limit})
+ base_bucket_name = "#{limiter_name}:group1"
+ opts = RateLimiter.init({limiter_name, bucket_name: base_bucket_name, params: ["id"]})
+ id = "100"
+
+ conn = conn(:get, "/?id=#{id}")
+ conn = Plug.Conn.fetch_query_params(conn)
+
+ default_bucket_name = "#{limiter_name}:#{RateLimiter.ip(conn)}"
+ parametrized_bucket_name = "#{base_bucket_name}:#{id}:#{RateLimiter.ip(conn)}"
+
+ RateLimiter.call(conn, opts)
+ assert {1, 4, _, _, _} = ExRated.inspect_bucket(parametrized_bucket_name, scale, limit)
+ assert {0, 5, _, _, _} = ExRated.inspect_bucket(default_bucket_name, scale, limit)
+ end
+
test "optional limits for authenticated users" do
+ limiter_name = :test_authenticated
Ecto.Adapters.SQL.Sandbox.checkout(Pleroma.Repo)
scale = 1000
limit = 5
- Pleroma.Config.put([:rate_limit, @limiter_name], [{1, 10}, {scale, limit}])
+ Pleroma.Config.put([:rate_limit, limiter_name], [{1, 10}, {scale, limit}])
- opts = RateLimiter.init(@limiter_name)
+ opts = RateLimiter.init(limiter_name)
user = insert(:user)
conn = conn(:get, "/") |> assign(:user, user)
- bucket_name = "#{@limiter_name}:#{user.id}"
+ bucket_name = "#{limiter_name}:#{user.id}"
conn = RateLimiter.call(conn, opts)
assert {1, 4, _, _, _} = ExRated.inspect_bucket(bucket_name, scale, limit)
generated by cgit v1.2.3 (git 2.25.1) at 2025-05-30 16:36:03 +0000