/src/test/java/org/owasp/esapi/reference/AccessControllerTest.java

http://owasp-esapi-java.googlecode.com/ · Java · 358 lines · 237 code · 42 blank · 79 comment · 6 complexity · f04850455c39119d5d42980f6f941cb2 MD5 · raw file 

    

  1. /**

    2. 

  2.  * OWASP Enterprise Security API (ESAPI)

    3. 

  3.  * 

    4. 

  4.  * This file is part of the Open Web Application Security Project (OWASP)

    5. 

  5.  * Enterprise Security API (ESAPI) project. For details, please see

    6. 

  6.  * <a href="http://www.owasp.org/index.php/ESAPI">http://www.owasp.org/index.php/ESAPI</a>.

    7. 

  7.  *

    8. 

  8.  * Copyright (c) 2007 - The OWASP Foundation

    9. 

  9.  * 

    10. 

  10.  * The ESAPI is published by OWASP under the BSD license. You should read and accept the

    11. 

  11.  * LICENSE before you use, modify, and/or redistribute this software.

    12. 

  12.  * 

    13. 

  13.  * @author Jeff Williams <a href="http://www.aspectsecurity.com">Aspect Security</a>

    14. 

  14.  * @created 2007

    15. 

  15.  */

    16. 

  16. package org.owasp.esapi.reference;

    17. 

  17. 

    18. 

  18. import junit.framework.Test;

    19. 

  19. import junit.framework.TestCase;

    20. 

  20. import junit.framework.TestSuite;

    21. 

  21. 

    22. 

  22. import org.owasp.esapi.ESAPI;

    23. 

  23. import org.owasp.esapi.AccessController;

    24. 

  24. import org.owasp.esapi.Authenticator;

    25. 

  25. import org.owasp.esapi.User;

    26. 

  26. import org.owasp.esapi.errors.AccessControlException;

    27. 

  27. 

    28. 

  28. 

    29. 

  29. /**

    30. 

  30.  * The Class AccessControllerTest.

    31. 

  31.  * 

    32. 

  32.  * @author Jeff Williams (jeff.williams@aspectsecurity.com)

    33. 

  33.  */

    34. 

  34. public class AccessControllerTest extends TestCase {

    35. 

  35. 

    36. 

  36. 	/**

    37. 

  37. 	 * Instantiates a new access controller test.

    38. 

  38. 	 * 

    39. 

  39. 	 * @param testName

    40. 

  40.      *            the test name

    41. 

  41.      * @throws Exception

    42. 

  42. 	 */

    43. 

  43. 	public AccessControllerTest(String testName) throws Exception {

    44. 

  44. 		super(testName);

    45. 

  45. 		

    46. 

  46. 		Authenticator authenticator = ESAPI.authenticator();

    47. 

  47. 		String password = authenticator.generateStrongPassword();

    48. 

  48. 

    49. 

  49. 		// create a user with the "user" role for this test

    50. 

  50. 		User alice = authenticator.getUser("testuser1");

    51. 

  51. 		if ( alice == null ) {

    52. 

  52. 			alice = authenticator.createUser( "testuser1", password, password);

    53. 

  53. 		}

    54. 

  54. 		alice.addRole("user");		

    55. 

  55. 

    56. 

  56. 		// create a user with the "admin" role for this test

    57. 

  57. 		User bob = authenticator.getUser("testuser2");

    58. 

  58. 		if ( bob == null ) {

    59. 

  59. 			bob = authenticator.createUser( "testuser2", password, password);

    60. 

  60. 		}

    61. 

  61. 		bob.addRole("admin");

    62. 

  62. 		

    63. 

  63. 		// create a user with the "user" and "admin" roles for this test

    64. 

  64. 		User mitch = authenticator.getUser("testuser3");

    65. 

  65. 		if ( mitch == null ) {

    66. 

  66. 			mitch = authenticator.createUser( "testuser3", password, password);

    67. 

  67. 		}

    68. 

  68. 		mitch.addRole("admin");

    69. 

  69. 		mitch.addRole("user");

    70. 

  70. 	}

    71. 

  71. 

    72. 

  72.     /**

    73. 

  73.      * {@inheritDoc}

    74. 

  74.      *

    75. 

  75.      * @throws Exception

    76. 

  76.      */

    77. 

  77. 	protected void setUp() throws Exception {

    78. 

  78. 	}

    79. 

  79. 

    80. 

  80.     /**

    81. 

  81.      * {@inheritDoc}

    82. 

  82.      *

    83. 

  83.      * @throws Exception

    84. 

  84.      */

    85. 

  85. 	protected void tearDown() throws Exception {

    86. 

  86. 		// none

    87. 

  87. 	}

    88. 

  88. 

    89. 

  89. 	/**

    90. 

  90. 	 * Suite.

    91. 

  91. 	 * 

    92. 

  92. 	 * @return the test

    93. 

  93. 	 */

    94. 

  94. 	public static Test suite() {

    95. 

  95. 		TestSuite suite = new TestSuite(AccessControllerTest.class);

    96. 

  96. 		return suite;

    97. 

  97. 	}

    98. 

  98. 

    99. 

  99.     /**

    100. 

  100.      *

    101. 

  101.      */

    102. 

  102.     public void testMatchRule() {

    103. 

  103. 		ESAPI.authenticator().setCurrentUser(null);

    104. 

  104. 		assertFalse(ESAPI.accessController().isAuthorizedForURL("/nobody"));

    105. 

  105. 	}

    106. 

  106. 	

    107. 

  107. 	/**

    108. 

  108. 	 * Test of isAuthorizedForURL method, of class

    109. 

  109. 	 * org.owasp.esapi.AccessController.

    110. 

  110.      *

    111. 

  111.      * @throws Exception

    112. 

  112.      */

    113. 

  113. 	public void testIsAuthorizedForURL() throws Exception {

    114. 

  114. 		System.out.println("isAuthorizedForURL");

    115. 

  115. 		AccessController instance = ESAPI.accessController();

    116. 

  116. 		Authenticator auth = ESAPI.authenticator();

    117. 

  117. 		

    118. 

  118. 		auth.setCurrentUser( auth.getUser("testuser1") );

    119. 

  119. 		assertFalse(instance.isAuthorizedForURL("/nobody"));

    120. 

  120. 		assertFalse(instance.isAuthorizedForURL("/test/admin"));

    121. 

  121. 		assertTrue(instance.isAuthorizedForURL("/test/user"));

    122. 

  122. 		assertTrue(instance.isAuthorizedForURL("/test/all"));

    123. 

  123. 		assertFalse(instance.isAuthorizedForURL("/test/none"));

    124. 

  124. 		assertTrue(instance.isAuthorizedForURL("/test/none/test.gif"));

    125. 

  125. 		assertFalse(instance.isAuthorizedForURL("/test/none/test.exe"));

    126. 

  126. 		assertTrue(instance.isAuthorizedForURL("/test/none/test.png"));

    127. 

  127. 		assertFalse(instance.isAuthorizedForURL("/test/moderator"));

    128. 

  128. 		assertTrue(instance.isAuthorizedForURL("/test/profile"));

    129. 

  129. 		assertFalse(instance.isAuthorizedForURL("/upload"));

    130. 

  130. 

    131. 

  131. 		auth.setCurrentUser( auth.getUser("testuser2") );

    132. 

  132. 		assertFalse(instance.isAuthorizedForURL("/nobody"));

    133. 

  133. 		assertTrue(instance.isAuthorizedForURL("/test/admin"));

    134. 

  134. 		assertFalse(instance.isAuthorizedForURL("/test/user"));

    135. 

  135. 		assertTrue(instance.isAuthorizedForURL("/test/all"));

    136. 

  136. 		assertFalse(instance.isAuthorizedForURL("/test/none"));

    137. 

  137. 		assertTrue(instance.isAuthorizedForURL("/test/none/test.png"));

    138. 

  138. 		assertFalse(instance.isAuthorizedForURL("/test/moderator"));

    139. 

  139. 		assertTrue(instance.isAuthorizedForURL("/test/profile"));

    140. 

  140. 		assertFalse(instance.isAuthorizedForURL("/upload"));

    141. 

  141. 		

    142. 

  142. 		auth.setCurrentUser( auth.getUser("testuser3") );

    143. 

  143. 		assertFalse(instance.isAuthorizedForURL("/nobody"));

    144. 

  144. 		assertTrue(instance.isAuthorizedForURL("/test/admin"));

    145. 

  145. 		assertTrue(instance.isAuthorizedForURL("/test/user"));

    146. 

  146. 		assertTrue(instance.isAuthorizedForURL("/test/all"));

    147. 

  147. 		assertFalse(instance.isAuthorizedForURL("/test/none"));

    148. 

  148. 		assertTrue(instance.isAuthorizedForURL("/test/none/test.png"));

    149. 

  149. 		assertFalse(instance.isAuthorizedForURL("/test/moderator"));

    150. 

  150. 		assertTrue(instance.isAuthorizedForURL("/test/profile"));

    151. 

  151. 		assertFalse(instance.isAuthorizedForURL("/upload"));

    152. 

  152. 		

    153. 

  153. 		try {

    154. 

  154. 			instance.assertAuthorizedForURL("/test/admin");

    155. 

  155. 			instance.assertAuthorizedForURL( "/nobody" );

    156. 

  156. 			fail();

    157. 

  157. 		} catch ( AccessControlException e ) {

    158. 

  158. 			// expected

    159. 

  159. 		}

    160. 

  160. 	}

    161. 

  161. 

    162. 

  162. 	/**

    163. 

  163. 	 * Test of isAuthorizedForFunction method, of class

    164. 

  164. 	 * org.owasp.esapi.AccessController.

    165. 

  165. 	 */

    166. 

  166. 	public void testIsAuthorizedForFunction() {

    167. 

  167. 		System.out.println("isAuthorizedForFunction");

    168. 

  168. 		AccessController instance = ESAPI.accessController();

    169. 

  169. 		Authenticator auth = ESAPI.authenticator();

    170. 

  170. 		

    171. 

  171. 		auth.setCurrentUser( auth.getUser("testuser1") );

    172. 

  172. 		assertTrue(instance.isAuthorizedForFunction("/FunctionA"));

    173. 

  173. 		assertFalse(instance.isAuthorizedForFunction("/FunctionAdeny"));

    174. 

  174. 		assertFalse(instance.isAuthorizedForFunction("/FunctionB"));

    175. 

  175. 		assertFalse(instance.isAuthorizedForFunction("/FunctionBdeny"));

    176. 

  176. 		assertTrue(instance.isAuthorizedForFunction("/FunctionC"));

    177. 

  177. 		assertFalse(instance.isAuthorizedForFunction("/FunctionCdeny"));

    178. 

  178. 

    179. 

  179. 		auth.setCurrentUser( auth.getUser("testuser2") );

    180. 

  180. 		assertFalse(instance.isAuthorizedForFunction("/FunctionA"));

    181. 

  181. 		assertFalse(instance.isAuthorizedForFunction("/FunctionAdeny"));

    182. 

  182. 		assertTrue(instance.isAuthorizedForFunction("/FunctionB"));

    183. 

  183. 		assertFalse(instance.isAuthorizedForFunction("/FunctionBdeny"));

    184. 

  184. 		assertTrue(instance.isAuthorizedForFunction("/FunctionD"));

    185. 

  185. 		assertFalse(instance.isAuthorizedForFunction("/FunctionDdeny"));

    186. 

  186. 

    187. 

  187. 		auth.setCurrentUser( auth.getUser("testuser3") );

    188. 

  188. 		assertTrue(instance.isAuthorizedForFunction("/FunctionA"));

    189. 

  189. 		assertFalse(instance.isAuthorizedForFunction("/FunctionAdeny"));

    190. 

  190. 		assertTrue(instance.isAuthorizedForFunction("/FunctionB"));

    191. 

  191. 		assertFalse(instance.isAuthorizedForFunction("/FunctionBdeny"));

    192. 

  192. 		assertTrue(instance.isAuthorizedForFunction("/FunctionC"));

    193. 

  193. 		assertFalse(instance.isAuthorizedForFunction("/FunctionCdeny"));

    194. 

  194. 

    195. 

  195. 		try {

    196. 

  196. 			instance.assertAuthorizedForFunction("/FunctionA");

    197. 

  197. 			instance.assertAuthorizedForFunction( "/FunctionDdeny" );

    198. 

  198. 			fail();

    199. 

  199. 		} catch ( AccessControlException e ) {

    200. 

  200. 			// expected

    201. 

  201. 		}

    202. 

  202. 	}

    203. 

  203. 

    204. 

  204. 	/**

    205. 

  205. 	 * Test of isAuthorizedForData method, of class

    206. 

  206. 	 * org.owasp.esapi.AccessController.

    207. 

  207. 	 */

    208. 

  208. 	public void testIsAuthorizedForData() {

    209. 

  209. 		System.out.println("isAuthorizedForData");

    210. 

  210. 		AccessController instance = ESAPI.accessController();

    211. 

  211. 		Authenticator auth = ESAPI.authenticator();

    212. 

  212. 		

    213. 

  213. 		Class adminR = null;

    214. 

  214. 		Class adminRW = null;

    215. 

  215. 		Class userW = null;

    216. 

  216. 		Class userRW = null;

    217. 

  217. 		Class anyR = null;

    218. 

  218. 		Class userAdminR = null;

    219. 

  219. 		Class userAdminRW = null;

    220. 

  220. 		Class undefined = null;

    221. 

  221. 		

    222. 

  222. 		try{

    223. 

  223. 			adminR = Class.forName("java.util.ArrayList");

    224. 

  224. 			adminRW = Class.forName("java.lang.Math");

    225. 

  225. 			userW = Class.forName("java.util.Date");

    226. 

  226. 			userRW = Class.forName("java.lang.String");

    227. 

  227. 			anyR = Class.forName("java.io.BufferedReader");

    228. 

  228. 			userAdminR = Class.forName("java.util.Random");

    229. 

  229. 			userAdminRW = Class.forName("java.awt.event.MouseWheelEvent");

    230. 

  230. 			undefined = Class.forName("java.io.FileWriter");

    231. 

  231. 			

    232. 

  232. 		}catch(ClassNotFoundException cnf){

    233. 

  233. 			System.out.println("CLASS NOT FOUND.");

    234. 

  234. 			cnf.printStackTrace();

    235. 

  235. 		}

    236. 

  236. 		//test User

    237. 

  237. 		auth.setCurrentUser( auth.getUser("testuser1") );

    238. 

  238. 		assertTrue(instance.isAuthorizedForData("read", userRW));

    239. 

  239. 		assertFalse(instance.isAuthorizedForData("read", undefined));

    240. 

  240. 		assertFalse(instance.isAuthorizedForData("write", undefined));

    241. 

  241. 		assertFalse(instance.isAuthorizedForData("read", userW));

    242. 

  242. 		assertFalse(instance.isAuthorizedForData("read", adminRW));

    243. 

  243. 		assertTrue(instance.isAuthorizedForData("write", userRW));

    244. 

  244. 		assertTrue(instance.isAuthorizedForData("write", userW));

    245. 

  245. 		assertFalse(instance.isAuthorizedForData("write", anyR));

    246. 

  246. 		assertTrue(instance.isAuthorizedForData("read", anyR));

    247. 

  247. 		assertTrue(instance.isAuthorizedForData("read", userAdminR));

    248. 

  248. 		assertTrue(instance.isAuthorizedForData("write", userAdminRW));

    249. 

  249. 		

    250. 

  250. 		//test Admin

    251. 

  251. 		auth.setCurrentUser( auth.getUser("testuser2") );

    252. 

  252. 		assertTrue(instance.isAuthorizedForData("read", adminRW));

    253. 

  253. 		assertFalse(instance.isAuthorizedForData("read", undefined));

    254. 

  254. 		assertFalse(instance.isAuthorizedForData("write", undefined));

    255. 

  255. 		assertFalse(instance.isAuthorizedForData("read", userRW));

    256. 

  256. 		assertTrue(instance.isAuthorizedForData("write", adminRW));

    257. 

  257. 		assertFalse(instance.isAuthorizedForData("write", anyR));

    258. 

  258. 		assertTrue(instance.isAuthorizedForData("read", anyR));

    259. 

  259. 		assertTrue(instance.isAuthorizedForData("read", userAdminR));

    260. 

  260. 		assertTrue(instance.isAuthorizedForData("write", userAdminRW));

    261. 

  261. 		

    262. 

  262. 		//test User/Admin

    263. 

  263. 		auth.setCurrentUser( auth.getUser("testuser3") );

    264. 

  264. 		assertTrue(instance.isAuthorizedForData("read", userRW));

    265. 

  265. 		assertFalse(instance.isAuthorizedForData("read", undefined));

    266. 

  266. 		assertFalse(instance.isAuthorizedForData("write", undefined));

    267. 

  267. 		assertFalse(instance.isAuthorizedForData("read", userW));

    268. 

  268. 		assertTrue(instance.isAuthorizedForData("read", adminR));

    269. 

  269. 		assertTrue(instance.isAuthorizedForData("write", userRW));

    270. 

  270. 		assertTrue(instance.isAuthorizedForData("write", userW));

    271. 

  271. 		assertFalse(instance.isAuthorizedForData("write", anyR));

    272. 

  272. 		assertTrue(instance.isAuthorizedForData("read", anyR));

    273. 

  273. 		assertTrue(instance.isAuthorizedForData("read", userAdminR));

    274. 

  274. 		assertTrue(instance.isAuthorizedForData("write", userAdminRW));

    275. 

  275. 		try {

    276. 

  276. 			instance.assertAuthorizedForData("read", userRW);

    277. 

  277. 			instance.assertAuthorizedForData( "write", adminR );

    278. 

  278. 			fail();

    279. 

  279. 		} catch ( AccessControlException e ) {

    280. 

  280. 			// expected

    281. 

  281. 		}

    282. 

  282. 		

    283. 

  283. 	}

    284. 

  284. 

    285. 

  285. 	/**

    286. 

  286. 	 * Test of isAuthorizedForFile method, of class

    287. 

  287. 	 * org.owasp.esapi.AccessController.

    288. 

  288. 	 */

    289. 

  289. 	public void testIsAuthorizedForFile() {

    290. 

  290. 		System.out.println("isAuthorizedForFile");

    291. 

  291. 		AccessController instance = ESAPI.accessController();

    292. 

  292. 		Authenticator auth = ESAPI.authenticator();

    293. 

  293. 		

    294. 

  294. 		auth.setCurrentUser( auth.getUser("testuser1") );

    295. 

  295. 		assertTrue(instance.isAuthorizedForFile("/Dir/File1"));

    296. 

  296. 		assertFalse(instance.isAuthorizedForFile("/Dir/File2"));

    297. 

  297. 		assertTrue(instance.isAuthorizedForFile("/Dir/File3"));

    298. 

  298. 		assertFalse(instance.isAuthorizedForFile("/Dir/ridiculous"));

    299. 

  299. 

    300. 

  300. 		auth.setCurrentUser( auth.getUser("testuser2") );

    301. 

  301. 		assertFalse(instance.isAuthorizedForFile("/Dir/File1"));

    302. 

  302. 		assertTrue(instance.isAuthorizedForFile("/Dir/File2"));

    303. 

  303. 		assertTrue(instance.isAuthorizedForFile("/Dir/File4"));

    304. 

  304. 		assertFalse(instance.isAuthorizedForFile("/Dir/ridiculous"));

    305. 

  305. 

    306. 

  306. 		auth.setCurrentUser( auth.getUser("testuser3") );

    307. 

  307. 		assertTrue(instance.isAuthorizedForFile("/Dir/File1"));

    308. 

  308. 		assertTrue(instance.isAuthorizedForFile("/Dir/File2"));

    309. 

  309. 		assertFalse(instance.isAuthorizedForFile("/Dir/File5"));

    310. 

  310. 		assertFalse(instance.isAuthorizedForFile("/Dir/ridiculous"));

    311. 

  311. 

    312. 

  312. 		try {

    313. 

  313. 			instance.assertAuthorizedForFile("/Dir/File1");

    314. 

  314. 			instance.assertAuthorizedForFile( "/Dir/File6" );

    315. 

  315. 			fail();

    316. 

  316. 		} catch ( AccessControlException e ) {

    317. 

  317. 			// expected

    318. 

  318. 		}

    319. 

  319. 	}

    320. 

  320. 

    321. 

  321. 	/**

    322. 

  322. 	 * Test of isAuthorizedForService method, of class

    323. 

  323. 	 * org.owasp.esapi.AccessController.

    324. 

  324. 	 */

    325. 

  325. 	public void testIsAuthorizedForService() {

    326. 

  326. 		System.out.println("isAuthorizedForService");

    327. 

  327. 		AccessController instance = ESAPI.accessController();

    328. 

  328. 		Authenticator auth = ESAPI.authenticator();

    329. 

  329. 		

    330. 

  330. 		auth.setCurrentUser( auth.getUser("testuser1") );

    331. 

  331. 		assertTrue(instance.isAuthorizedForService("/services/ServiceA"));

    332. 

  332. 		assertFalse(instance.isAuthorizedForService("/services/ServiceB"));

    333. 

  333. 		assertTrue(instance.isAuthorizedForService("/services/ServiceC"));

    334. 

  334. 		

    335. 

  335. 		assertFalse(instance.isAuthorizedForService("/test/ridiculous"));

    336. 

  336. 

    337. 

  337. 		auth.setCurrentUser( auth.getUser("testuser2") );

    338. 

  338. 		assertFalse(instance.isAuthorizedForService("/services/ServiceA"));

    339. 

  339. 		assertTrue(instance.isAuthorizedForService("/services/ServiceB"));

    340. 

  340. 		assertFalse(instance.isAuthorizedForService("/services/ServiceF"));

    341. 

  341. 		assertFalse(instance.isAuthorizedForService("/test/ridiculous"));

    342. 

  342. 

    343. 

  343. 		auth.setCurrentUser( auth.getUser("testuser3") );

    344. 

  344. 		assertTrue(instance.isAuthorizedForService("/services/ServiceA"));

    345. 

  345. 		assertTrue(instance.isAuthorizedForService("/services/ServiceB"));

    346. 

  346. 		assertFalse(instance.isAuthorizedForService("/services/ServiceE"));

    347. 

  347. 		assertFalse(instance.isAuthorizedForService("/test/ridiculous"));

    348. 

  348. 

    349. 

  349. 		try {

    350. 

  350. 			instance.assertAuthorizedForService("/services/ServiceD");

    351. 

  351. 			instance.assertAuthorizedForService( "/test/ridiculous" );

    352. 

  352. 			fail();

    353. 

  353. 		} catch ( AccessControlException e ) {

    354. 

  354. 			// expected

    355. 

  355. 		}

    356. 

  356. 	}

    357. 

  357. 

    358. 

  358. }
    359.