Merge "Fix sql injection vulnerability"
[portal.git] / ecomp-portal-BE-common / src / test / java / org / onap / portalapp / portal / service / WidgetServiceImplTest.java
1 /*
2 * ============LICENSE_START=======================================================
3 * ONAP  PORTAL
4 * ================================================================================
5 * Copyright 2018 TechMahindra
6 *=================================================================================
7 * Licensed under the Apache License, Version 2.0 (the "License");
8 * you may not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 *     http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS,
15 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 * ============LICENSE_END=========================================================
19 */
20 package org.onap.portalapp.portal.service;
21
22 import java.util.ArrayList;
23 import java.util.List;
24
25 import javax.servlet.http.HttpServletRequest;
26 import javax.servlet.http.HttpServletResponse;
27
28 import org.hibernate.Session;
29 import org.hibernate.SessionFactory;
30 import org.hibernate.Transaction;
31 import org.hibernate.criterion.Criterion;
32 import org.hibernate.criterion.Restrictions;
33 import org.junit.Before;
34 import org.junit.Test;
35 import org.mockito.InjectMocks;
36 import org.mockito.Mock;
37 import org.mockito.Mockito;
38 import org.mockito.MockitoAnnotations;
39 import org.onap.portalapp.portal.core.MockEPUser;
40 import org.onap.portalapp.portal.domain.EPUser;
41 import org.onap.portalapp.portal.domain.EPUserApp;
42 import org.onap.portalapp.portal.domain.Widget;
43 import org.onap.portalapp.portal.framework.MockitoTestSuite;
44 import org.onap.portalapp.portal.transport.FieldsValidator;
45 import org.onap.portalapp.portal.transport.OnboardingWidget;
46 import org.onap.portalsdk.core.service.DataAccessService;
47
48 public class WidgetServiceImplTest {
49
50         @Mock
51         DataAccessService dataAccessService;
52         @Mock
53         AdminRolesService adminRolesService;
54         @Mock
55         SessionFactory sessionFactory;
56         @Mock
57         Session session;
58
59         @Mock
60         Transaction transaction;
61                 
62         @Before
63         public void setup() {
64                 MockitoAnnotations.initMocks(this);
65                 Mockito.when(sessionFactory.openSession()).thenReturn(session);
66                 Mockito.when(session.beginTransaction()).thenReturn(transaction);
67         }
68         
69         @InjectMocks
70         WidgetServiceImpl  widgetServiceImpl = new WidgetServiceImpl();
71         
72         
73         MockitoTestSuite mockitoTestSuite = new MockitoTestSuite();
74         HttpServletRequest mockedRequest = mockitoTestSuite.getMockedRequest();
75         HttpServletResponse mockedResponse = mockitoTestSuite.getMockedResponse();
76         NullPointerException nullPointerException = new NullPointerException();
77         MockEPUser mockUser = new MockEPUser();
78         
79         Long ACCOUNT_ADMIN_ROLE_ID = 99l;
80         Long LONG_ECOMP_APP_ID = 1l;
81         
82         
83         @Test
84         public void getOnboardingWidgetsTest_isSuperAdmin() {
85                 EPUser user = mockUser.mockEPUser();
86                 List<OnboardingWidget> onboardingWidgets = new ArrayList<>();
87                 OnboardingWidget widget = new OnboardingWidget();
88                 onboardingWidgets.add(widget);
89                 Mockito.when(adminRolesService.isSuperAdmin(user)).thenReturn(true);
90                 String sql = "SELECT widget.WIDGET_ID, widget.WDG_NAME, widget.APP_ID, app.APP_NAME, widget.WDG_WIDTH, widget.WDG_HEIGHT, widget.WDG_URL"
91                                 + "from FN_WIDGET widget join FN_APP app ON widget.APP_ID = app.APP_ID"+ " validAppsFilter ";
92                 
93                 widgetServiceImpl.getOnboardingWidgets(user, true);
94         }
95         
96         @Test
97         public void getOnboardingWidgetsTest_isAccountAdmin() {
98                 EPUser user = mockUser.mockEPUser();
99                 List<OnboardingWidget> onboardingWidgets = new ArrayList<>();
100                 OnboardingWidget widget = new OnboardingWidget();
101                 onboardingWidgets.add(widget);
102                 Mockito.when(adminRolesService.isSuperAdmin(null)).thenReturn(false);
103                 Mockito.when(adminRolesService.isAccountAdmin(user)).thenReturn(true);
104                 String sql = "SELECT widget.WIDGET_ID, widget.WDG_NAME, widget.APP_ID, app.APP_NAME, widget.WDG_WIDTH, widget.WDG_HEIGHT, widget.WDG_URL"
105                                 + " from FN_WIDGET widget join FN_APP app ON widget.APP_ID = app.APP_ID" + " join FN_USER_ROLE ON FN_USER_ROLE.APP_ID = app.APP_ID where FN_USER_ROLE.USER_ID = " + 1l
106                                 + " AND FN_USER_ROLE.ROLE_ID = " + 99l + "validAppsFilter";
107                 widgetServiceImpl.getOnboardingWidgets(user, true);
108         }
109         
110         @Test
111         public void getOnboardingWidgetsTest_isUser() {
112                 EPUser user = mockUser.mockEPUser();
113                 List<OnboardingWidget> onboardingWidgets = new ArrayList<>();
114                 OnboardingWidget widget = new OnboardingWidget();
115                 onboardingWidgets.add(widget);
116                 Mockito.when(adminRolesService.isUser(user)).thenReturn(true);
117                 Mockito.when(adminRolesService.isAccountAdmin(null)).thenReturn(false);
118                 String sql = "SELECT DISTINCT widget.WIDGET_ID, widget.WDG_NAME, widget.APP_ID, app.APP_NAME, widget.WDG_WIDTH, widget.WDG_HEIGHT, widget.WDG_URL\"\r\n" + 
119                                 "                       + \" from FN_WIDGET widget join FN_APP app ON widget.APP_ID = app.APP_ID"
120                                 + " join FN_USER_ROLE ON FN_USER_ROLE.APP_ID = app.APP_ID where FN_USER_ROLE.USER_ID = "
121                                 + 99l + "validAppsFilter";
122                 widgetServiceImpl.getOnboardingWidgets(user, false);
123         }
124         
125                 
126         @Test
127         public void setOnboardingWidgetTest() {
128                 EPUser user = mockUser.mockEPUser();
129                 OnboardingWidget widget = new OnboardingWidget();
130                 widget.name = "test";
131                 widget.appId = 1l;
132                 widget.url = "demo";
133                 FieldsValidator fieldValidator = new FieldsValidator();
134                 fieldValidator.setHttpStatusCode(400l);
135                 widgetServiceImpl.setOnboardingWidget(user, widget);
136         }
137         
138         @Test
139         public void setOnboardingWidgetTest_updateOrSaveWidget() {
140                 EPUser user = mockUser.mockEPUser();
141                 OnboardingWidget widget = new OnboardingWidget();
142                 Mockito.when(adminRolesService.isSuperAdmin(null)).thenReturn(false);
143                 widget.name = "test";
144                 widget.appId = 9l;
145                 widget.url = "demo";
146                 widget.width = 1;
147                 widget.height = 1;
148                 FieldsValidator fieldValidator = new FieldsValidator();
149                 List<Criterion> restrictionsList = new ArrayList<Criterion>();
150                 Criterion userIdCriterion = Restrictions.eq("userId",1l);
151                 Criterion roleIDCriterion = Restrictions.eq("role.id",  99l);
152                 Criterion appIDCriterion  = Restrictions.eq("app.id",  2l);
153                 restrictionsList.add(Restrictions.and(userIdCriterion, roleIDCriterion,appIDCriterion));
154                 List<EPUserApp> userRoles = new ArrayList<>();
155                 EPUserApp app = new EPUserApp();
156                 userRoles.add(app);
157                 Mockito.when((List<EPUserApp>) dataAccessService.getList(EPUserApp.class, null, restrictionsList, null))
158                 .thenReturn(userRoles);
159                 fieldValidator.setHttpStatusCode(403l);
160                 widgetServiceImpl.setOnboardingWidget(user, widget);
161         }
162         
163         @Test
164         public void setOnboardingWidgetTest_updateOrSaveWidget_isSuperAdmin() {
165                 FieldsValidator fieldValidator = new FieldsValidator();
166                 EPUser user = mockUser.mockEPUser();
167                 Mockito.when(adminRolesService.isSuperAdmin(user)).thenReturn(true);
168                 user.setId(1l);
169                 OnboardingWidget onboardingWidget = new OnboardingWidget();
170                 onboardingWidget.name="test";
171                 onboardingWidget.url="demo";
172                 onboardingWidget.id = 2l;
173                 onboardingWidget.appId = 9l;
174                 onboardingWidget.width = 1;
175                 onboardingWidget.height = 1;
176                 Widget widget = new Widget();
177                 Mockito.when(dataAccessService.getDomainObject(Widget.class, 2l, null)).thenReturn(widget);
178                 widget.setId(1l);
179                 
180                 fieldValidator.setHttpStatusCode(404l);
181                 widgetServiceImpl.setOnboardingWidget(user, onboardingWidget);
182         }
183         
184         @Test
185         public void setOnboardingWidgetTest_applyOnboardingWidget() {
186                 FieldsValidator fieldValidator = new FieldsValidator();
187                 EPUser user = mockUser.mockEPUser();
188                 fieldValidator.setHttpStatusCode(200l);
189                 OnboardingWidget onboardingWidget = new OnboardingWidget();
190                 onboardingWidget.name="test";
191                 onboardingWidget.url="demo";
192                 onboardingWidget.id = 2l;
193                 onboardingWidget.appId = 9l;
194                 onboardingWidget.width = 1;
195                 onboardingWidget.height = 1;
196                 Widget widget = new Widget();
197                 widget.setAppId(onboardingWidget.appId);
198                 widget.setName(onboardingWidget.name);
199                 widget.setWidth(onboardingWidget.width);
200                 widget.setHeight(onboardingWidget.height);
201                 widget.setUrl("demo");
202                 widgetServiceImpl.setOnboardingWidget(user, onboardingWidget);
203         }
204         
205         @Test
206         public void setOnboardingWidgetTest_validateOnboardingWidget() {
207                 EPUser user = mockUser.mockEPUser();
208                 user.setId(1l);
209                 FieldsValidator fieldsValidator = new FieldsValidator();
210                 Mockito.when(adminRolesService.isSuperAdmin(user)).thenReturn(true);
211                 OnboardingWidget onboardingWidget = new OnboardingWidget();
212                 onboardingWidget.name="test";
213                 onboardingWidget.url="demo";
214                 onboardingWidget.appId = 9l;
215                 onboardingWidget.width = 1;
216                 onboardingWidget.height = 1;
217                 onboardingWidget.id = null;
218                 List<Widget> listWidget = new ArrayList<>();
219                 List<Criterion> restrictionsList = new ArrayList<Criterion>();
220                 Criterion urlCriterion = Restrictions.eq("url", onboardingWidget.url);
221                 Criterion nameCriterion = Restrictions.eq("name", onboardingWidget.name);
222                 restrictionsList.add(Restrictions.or(urlCriterion, nameCriterion));
223                 Mockito.when((List<Widget>) dataAccessService.getList(Widget.class, null, restrictionsList, null))
224                 .thenReturn(listWidget);
225                 Widget widget = new Widget();
226                 widget.setName("test");
227                 widget.setAppId(9l);
228                 boolean dublicatedName = true;
229                 boolean dublicatedUrl= true;
230                 fieldsValidator.addProblematicFieldName("demo");
231                 fieldsValidator.addProblematicFieldName("test");
232                 fieldsValidator.setHttpStatusCode(409l);
233                 widgetServiceImpl.setOnboardingWidget(user, onboardingWidget);
234         }
235         
236         @Test
237         public void deleteOnboardingWidgetTest() {
238                 EPUser user = mockUser.mockEPUser();
239                 OnboardingWidget onboardingWidget = new OnboardingWidget();
240                 FieldsValidator fieldValidator = new FieldsValidator();
241                 Widget widget = new Widget();
242                 Mockito.when(dataAccessService.getDomainObject(Widget.class, 1l, null)).thenReturn(widget);
243                 widget.setId(1l);
244                 List<Criterion> restrictionsList = new ArrayList<Criterion>();
245                 Criterion userIdCriterion = Restrictions.eq("userId",1l);
246                 Criterion roleIDCriterion = Restrictions.eq("role.id",  99l);
247                 Criterion appIDCriterion  = Restrictions.eq("app.id",  2l);
248                 restrictionsList.add(Restrictions.and(userIdCriterion, roleIDCriterion,appIDCriterion));
249                 List<EPUserApp> userRoles = new ArrayList<>();
250                 EPUserApp app = new EPUserApp();
251                 userRoles.add(app);
252                 Mockito.when((List<EPUserApp>) dataAccessService.getList(EPUserApp.class, null, restrictionsList, null))
253                 .thenReturn(userRoles);
254                 Mockito.when(adminRolesService.isSuperAdmin(user)).thenReturn(true);
255                 fieldValidator.setHttpStatusCode(403l);
256                 widgetServiceImpl.deleteOnboardingWidget(user, 1l);
257         }
258
259 }