debian-mirror-gitlab/spec/lib/gitlab/request_forgery_protection_spec.rb

Ignoring revisions in .git-blame-ignore-revs. Click here to bypass and see the normal blame view.

97 lines
2.3 KiB
Ruby
Raw Normal View History

2019-12-04 20:38:33 +05:30
# frozen_string_literal: true
2017-09-10 17:25:29 +05:30
require 'spec_helper'
2020-07-28 23:09:34 +05:30
RSpec.describe Gitlab::RequestForgeryProtection, :allow_forgery_protection do
2017-09-10 17:25:29 +05:30
let(:csrf_token) { SecureRandom.base64(ActionController::RequestForgeryProtection::AUTHENTICITY_TOKEN_LENGTH) }
let(:env) do
{
'rack.input' => '',
'rack.session' => {
_csrf_token: csrf_token
}
}
end
describe '.call' do
context 'when the request method is GET' do
before do
env['REQUEST_METHOD'] = 'GET'
end
it 'does not raise an exception' do
expect { described_class.call(env) }.not_to raise_exception
end
end
context 'when the request method is POST' do
before do
env['REQUEST_METHOD'] = 'POST'
end
context 'when the CSRF token is valid' do
before do
env['HTTP_X_CSRF_TOKEN'] = csrf_token
end
it 'does not raise an exception' do
expect { described_class.call(env) }.not_to raise_exception
end
end
context 'when the CSRF token is invalid' do
before do
env['HTTP_X_CSRF_TOKEN'] = 'foo'
end
it 'raises an ActionController::InvalidAuthenticityToken exception' do
expect { described_class.call(env) }.to raise_exception(ActionController::InvalidAuthenticityToken)
end
end
end
end
describe '.verified?' do
2021-03-11 19:13:27 +05:30
it 'does not modify the env' do
env['REQUEST_METHOD'] = "GET"
expect { described_class.verified?(env) }.not_to change { env }
end
2017-09-10 17:25:29 +05:30
context 'when the request method is GET' do
before do
env['REQUEST_METHOD'] = 'GET'
end
it 'returns true' do
expect(described_class.verified?(env)).to be_truthy
end
end
context 'when the request method is POST' do
before do
env['REQUEST_METHOD'] = 'POST'
end
context 'when the CSRF token is valid' do
before do
env['HTTP_X_CSRF_TOKEN'] = csrf_token
end
it 'returns true' do
expect(described_class.verified?(env)).to be_truthy
end
end
context 'when the CSRF token is invalid' do
before do
env['HTTP_X_CSRF_TOKEN'] = 'foo'
end
it 'returns false' do
expect(described_class.verified?(env)).to be_falsey
end
end
end
end
end