Reflected XSS vulnerability in saveNotification form fix.
[portal.git] / ecomp-portal-BE-common / src / test / java / org / onap / portalapp / portal / controller / ExternalAppsRestfulControllerTest.java
1 /*-
2  * ============LICENSE_START==========================================
3  * ONAP Portal
4  * ===================================================================
5  * Copyright (C) 2017 AT&T Intellectual Property. All rights reserved.
6  * ===================================================================
7  *  Modifications Copyright (c) 2019 Samsung
8  * ===================================================================
9  *
10  * Unless otherwise specified, all software contained herein is licensed
11  * under the Apache License, Version 2.0 (the "License");
12  * you may not use this software except in compliance with the License.
13  * You may obtain a copy of the License at
14  *
15  *             http://www.apache.org/licenses/LICENSE-2.0
16  *
17  * Unless required by applicable law or agreed to in writing, software
18  * distributed under the License is distributed on an "AS IS" BASIS,
19  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
20  * See the License for the specific language governing permissions and
21  * limitations under the License.
22  *
23  * Unless otherwise specified, all documentation contained herein is licensed
24  * under the Creative Commons License, Attribution 4.0 Intl. (the "License");
25  * you may not use this documentation except in compliance with the License.
26  * You may obtain a copy of the License at
27  *
28  *             https://creativecommons.org/licenses/by/4.0/
29  *
30  * Unless required by applicable law or agreed to in writing, documentation
31  * distributed under the License is distributed on an "AS IS" BASIS,
32  * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
33  * See the License for the specific language governing permissions and
34  * limitations under the License.
35  *
36  * ============LICENSE_END============================================
37  *
38  * 
39  */
40 package org.onap.portalapp.portal.controller;
41
42 import static org.junit.Assert.assertEquals;
43 import static org.junit.Assert.assertNotNull;
44 import static org.junit.Assert.assertNull;
45 import static org.mockito.Matchers.any;
46
47 import java.util.ArrayList;
48 import java.util.Calendar;
49 import java.util.Date;
50 import java.util.HashMap;
51 import java.util.List;
52 import java.util.Map;
53
54 import javax.servlet.http.HttpServletRequest;
55 import javax.servlet.http.HttpServletResponse;
56
57 import org.junit.Before;
58 import org.junit.Test;
59 import org.junit.runner.RunWith;
60 import org.mockito.ArgumentCaptor;
61 import org.mockito.InjectMocks;
62 import org.mockito.Mock;
63 import org.mockito.Mockito;
64 import org.mockito.MockitoAnnotations;
65 import org.onap.portalapp.portal.core.MockEPUser;
66 import org.onap.portalapp.portal.domain.EPApp;
67 import org.onap.portalapp.portal.domain.EPRole;
68 import org.onap.portalapp.portal.domain.EPUser;
69 import org.onap.portalapp.portal.framework.MockitoTestSuite;
70 import org.onap.portalapp.portal.service.AdminRolesService;
71 import org.onap.portalapp.portal.service.AdminRolesServiceImpl;
72 import org.onap.portalapp.portal.service.EPLoginService;
73 import org.onap.portalapp.portal.service.EPLoginServiceImpl;
74 import org.onap.portalapp.portal.service.EPRoleService;
75 import org.onap.portalapp.portal.service.EPRoleServiceImpl;
76 import org.onap.portalapp.portal.service.FunctionalMenuService;
77 import org.onap.portalapp.portal.service.FunctionalMenuServiceImpl;
78 import org.onap.portalapp.portal.service.UserNotificationService;
79 import org.onap.portalapp.portal.service.UserNotificationServiceImpl;
80 import org.onap.portalapp.portal.transport.EpNotificationItem;
81 import org.onap.portalapp.portal.transport.FavoritesFunctionalMenuItemJson;
82 import org.onap.portalapp.portal.transport.FunctionalMenuItem;
83 import org.onap.portalapp.portal.utils.EPCommonSystemProperties;
84 import org.onap.portalapp.portal.utils.EcompPortalUtils;
85 import org.onap.portalsdk.core.onboarding.crossapi.PortalAPIResponse;
86 import org.onap.portalsdk.core.service.DataAccessService;
87 import org.onap.portalsdk.core.service.DataAccessServiceImpl;
88 import org.powermock.api.mockito.PowerMockito;
89 import org.powermock.core.classloader.annotations.PrepareForTest;
90 import org.powermock.modules.junit4.PowerMockRunner;
91 import org.slf4j.MDC;
92
93 @RunWith(PowerMockRunner.class)
94 @PrepareForTest({ MDC.class, EPCommonSystemProperties.class ,EPApp.class})
95 public class ExternalAppsRestfulControllerTest {
96
97         @InjectMocks
98         ExternalAppsRestfulController externalAppsRestfulController = new ExternalAppsRestfulController();
99         @Mock
100         FunctionalMenuService functionalMenuService = new FunctionalMenuServiceImpl();
101
102         @Mock
103         EPLoginService epLoginService = new EPLoginServiceImpl();
104
105         @Mock
106         AdminRolesService adminRolesService = new AdminRolesServiceImpl();
107
108         @Mock
109         UserNotificationService userNotificationService = new UserNotificationServiceImpl();
110
111         @Mock
112         EPRoleService epRoleService = new EPRoleServiceImpl();
113
114         @Mock
115         EcompPortalUtils EcompPortalUtils = new EcompPortalUtils();
116         
117         @Mock
118         DataAccessService DataAccessService = new DataAccessServiceImpl();
119
120         @Before
121         public void setup() {
122                 MockitoAnnotations.initMocks(this);
123         }
124
125         MockitoTestSuite mockitoTestSuite = new MockitoTestSuite();
126
127         HttpServletRequest mockedRequest = mockitoTestSuite.getMockedRequest();
128         HttpServletResponse mockedResponse = mockitoTestSuite.getMockedResponse();
129         NullPointerException nullPointerException = new NullPointerException();
130
131         MockEPUser mockUser = new MockEPUser();
132         
133         public EPApp mockApp() {
134                 EPApp app = new EPApp();
135                 app.setName("Test");
136                 app.setImageUrl("test");
137                 app.setNameSpace("com.test.app");
138                 app.setCentralAuth(true);
139                 app.setDescription("test");
140                 app.setNotes("test");
141                 app.setUrl("test");
142                 app.setId((long) 10);
143                 app.setAppRestEndpoint("test");
144                 app.setAlternateUrl("test");
145                 app.setName("test");
146                 app.setMlAppName("test");
147                 app.setMlAppAdminId("test");
148                 app.setUsername("test");
149                 app.setAppPassword("test");
150                 app.setOpen(false);
151                 app.setEnabled(true);
152                 app.setUebKey("test");
153                 app.setUebSecret("test");
154                 app.setUebTopicName("test");
155                 app.setAppType(1);
156                 return app;
157         }
158
159          @Test(expected = Exception.class)
160          public void getFunctionalMenuItemsForUserIfUSerNullTest() throws
161          Exception
162          {
163          PowerMockito.mockStatic(EPCommonSystemProperties.class);
164          PowerMockito.mockStatic(MDC.class);
165          EPUser epUser = null;
166          String loginId = "guestT";
167          Mockito.when(MDC.get(EPCommonSystemProperties.PARTNER_NAME)).thenReturn("Test");
168          Mockito.when(epLoginService.findUserWithoutPwd(loginId)).thenReturn(epUser);
169          externalAppsRestfulController.getFunctionalMenuItemsForUser(mockedRequest,
170          mockedResponse);
171          }
172         
173         @Test
174         public void getFunctionalMenuItemsForUserIfSuperAdminTest() throws Exception {
175                 PowerMockito.mockStatic(EPCommonSystemProperties.class);
176                 PowerMockito.mockStatic(MDC.class);
177                 EPUser epUser = mockUser.mockEPUser();
178                 epUser.setId((long) 1);
179                 epUser.setLoginId("guestT");
180                 String loginId = "guestT";
181                 Mockito.when(MDC.get(EPCommonSystemProperties.PARTNER_NAME)).thenReturn("Test");
182                 Mockito.when(epLoginService.findUserWithoutPwd(loginId)).thenReturn(epUser);
183                 List<FunctionalMenuItem> expectedList = new ArrayList<FunctionalMenuItem>();
184                 FunctionalMenuItem functionalMenuItem = new FunctionalMenuItem();
185                 expectedList.add(functionalMenuItem);
186                 Mockito.when(mockedRequest.getHeader("LoginId")).thenReturn("guestT");
187                 Mockito.when(adminRolesService.isSuperAdmin(epUser)).thenReturn(true);
188                 Mockito.when(functionalMenuService.getFunctionalMenuItems()).thenReturn(expectedList);
189                 List<FunctionalMenuItem> actualList = externalAppsRestfulController.getFunctionalMenuItemsForUser(mockedRequest,
190                                 mockedResponse);
191                 assertNull(actualList.get(0).menuId);
192         }
193
194         @Test
195         public void getFunctionalMenuItemsForUserTest() throws Exception {
196                 PowerMockito.mockStatic(EPCommonSystemProperties.class);
197                 PowerMockito.mockStatic(MDC.class);
198                 EPUser epUser = mockUser.mockEPUser();
199                 epUser.setId((long) 1);
200                 epUser.setLoginId("guestT");
201                 String loginId = "guestT";
202                 Mockito.when(MDC.get(EPCommonSystemProperties.PARTNER_NAME)).thenReturn("Test");
203                 Mockito.when(epLoginService.findUserWithoutPwd(loginId)).thenReturn(epUser);
204                 List<FunctionalMenuItem> expectedList = new ArrayList<FunctionalMenuItem>();
205                 FunctionalMenuItem functionalMenuItem = new FunctionalMenuItem();
206                 expectedList.add(functionalMenuItem);
207                 Mockito.when(mockedRequest.getHeader("LoginId")).thenReturn("guestT");
208                 Mockito.when(adminRolesService.isSuperAdmin(epUser)).thenReturn(false);
209                 Mockito.when(functionalMenuService.getFunctionalMenuItemsForUser(epUser.getOrgUserId()))
210                                 .thenReturn(expectedList);
211                 List<FunctionalMenuItem> actualList = externalAppsRestfulController.getFunctionalMenuItemsForUser(mockedRequest,
212                                 mockedResponse);
213                 assertNull(actualList.get(0).menuId);
214         }
215
216         @Test(expected = Exception.class)
217         public void getFavoritesForUserIfUserNullTest() throws Exception {
218                 List<FavoritesFunctionalMenuItemJson> favorites = new ArrayList<FavoritesFunctionalMenuItemJson>();
219                 FavoritesFunctionalMenuItemJson favoritesFunctionalMenuItemJson = new FavoritesFunctionalMenuItemJson();
220                 favorites.add(favoritesFunctionalMenuItemJson);
221                 PowerMockito.mockStatic(EPCommonSystemProperties.class);
222                 PowerMockito.mockStatic(MDC.class);
223                 Mockito.when(mockedRequest.getHeader(EPCommonSystemProperties.MDC_LOGIN_ID)).thenReturn("Login_URL");
224                 Mockito.when(MDC.get(EPCommonSystemProperties.PARTNER_NAME)).thenReturn("Test");
225                 EPUser epUser = null;
226                 externalAppsRestfulController.getFavoritesForUser(mockedRequest, mockedResponse);
227         }
228
229         @Test
230         public void getFavoritesForUserTest() throws Exception {
231                 PowerMockito.mockStatic(EPCommonSystemProperties.class);
232                 PowerMockito.mockStatic(MDC.class);
233                 EPUser epUser = mockUser.mockEPUser();
234                 epUser.setId((long) 1);
235                 epUser.setLoginId("guestT");
236                 String loginId = "guestT";
237                 Mockito.when(MDC.get(EPCommonSystemProperties.PARTNER_NAME)).thenReturn("Test");
238                 List<FavoritesFunctionalMenuItemJson> favorites = new ArrayList<FavoritesFunctionalMenuItemJson>();
239                 FavoritesFunctionalMenuItemJson favoritesFunctionalMenuItemJson = new FavoritesFunctionalMenuItemJson();
240                 favorites.add(favoritesFunctionalMenuItemJson);
241                 Mockito.when(mockedRequest.getHeader(EPCommonSystemProperties.MDC_LOGIN_ID)).thenReturn("Login_URL");
242                 Mockito.when(MDC.get(EPCommonSystemProperties.PARTNER_NAME)).thenReturn("Test");
243                 Mockito.when(epLoginService.findUserWithoutPwd("Login_URL")).thenReturn(epUser);
244                 Mockito.when(functionalMenuService.getFavoriteItems(epUser.getId())).thenReturn(favorites);
245                 List<FavoritesFunctionalMenuItemJson> actaulFavorites = externalAppsRestfulController
246                                 .getFavoritesForUser(mockedRequest, mockedResponse);
247                 assertEquals(actaulFavorites.size(), 1);
248         }
249
250
251     @Test
252     public void publishNotificationTest_Success() throws Exception {
253         // input
254         EpNotificationItem notificationItem = new EpNotificationItem();
255         List<Long> roleList = new ArrayList<Long>();
256         Long role1 = 1L;
257         roleList.add(role1);
258         notificationItem.setRoleIds(roleList);
259         notificationItem.setPriority(1L);
260         notificationItem.setMsgHeader("testHeader");
261         notificationItem.setMsgDescription("Test Description");
262         Date currentDate = new Date();
263         Calendar c = Calendar.getInstance();
264         c.setTime(currentDate);
265         c.add(Calendar.DATE, 1);
266         Date currentDatePlusOne = c.getTime();
267         notificationItem.setStartTime(currentDate);
268         notificationItem.setEndTime(currentDatePlusOne);
269
270         // mock calls
271         Mockito.when(mockedRequest.getHeader("uebkey")).thenReturn("RxH3983AHiyBOQmj");
272         Map<String, String> params = new HashMap<>();
273         params.put("appKey", "RxH3983AHiyBOQmj");
274         List<EPApp> apps = new ArrayList<>();
275         EPApp app = new EPApp();
276         app.setId(123L);
277         apps.add(app);
278         Mockito.when(DataAccessService.executeNamedQuery("getMyAppDetailsByUebKey", params, null)).thenReturn(apps);
279         EPRole role = new EPRole();
280         role.setId(543L);
281         Mockito.when(epRoleService.getRole(123L, 1L)).thenReturn(role);
282
283         // run
284         Mockito.when(userNotificationService.saveNotification(notificationItem)).thenReturn("Test");
285         PortalAPIResponse response = externalAppsRestfulController.publishNotification(mockedRequest, notificationItem);
286         // verify answer
287         assertNotNull(response);
288         assertEquals("ok", response.getStatus());
289         assertEquals("success", response.getMessage());
290         ArgumentCaptor<EpNotificationItem> capture = ArgumentCaptor.forClass(EpNotificationItem.class);
291         Mockito.verify(userNotificationService).saveNotification(capture.capture());
292         assertNotNull(capture.getValue());
293         EpNotificationItem createdNofification = capture.getValue();
294         assertNotNull(createdNofification.getRoleIds());
295         assertEquals(1, createdNofification.getRoleIds().size());
296         assertEquals(543L, createdNofification.getRoleIds().get(0).longValue());
297     }
298
299         @Test
300         public void publishNotificationXSSTest() throws Exception {
301                 // input
302                 EpNotificationItem notificationItem = new EpNotificationItem();
303                 List<Long> roleList = new ArrayList<Long>();
304                 Long role1 = 1L;
305                 roleList.add(role1);
306                 notificationItem.setRoleIds(roleList);
307                 notificationItem.setPriority(1L);
308                 notificationItem.setMsgHeader("<script>alert(‘XSS’)</script>");
309                 notificationItem.setMsgDescription("Test Description");
310                 Date currentDate = new Date();
311                 Calendar c = Calendar.getInstance();
312                 c.setTime(currentDate);
313                 c.add(Calendar.DATE, 1);
314                 Date currentDatePlusOne = c.getTime();
315                 notificationItem.setStartTime(currentDate);
316                 notificationItem.setEndTime(currentDatePlusOne);
317
318                 // mock calls
319                 Mockito.when(mockedRequest.getHeader("uebkey")).thenReturn("RxH3983AHiyBOQmj");
320                 Map<String, String> params = new HashMap<>();
321                 params.put("appKey", "RxH3983AHiyBOQmj");
322                 List<EPApp> apps = new ArrayList<>();
323                 EPApp app = new EPApp();
324                 app.setId(123L);
325                 apps.add(app);
326                 Mockito.when(DataAccessService.executeNamedQuery("getMyAppDetailsByUebKey", params, null)).thenReturn(apps);
327                 EPRole role = new EPRole();
328                 role.setId(543L);
329                 Mockito.when(epRoleService.getRole(123L, 1L)).thenReturn(role);
330
331                 // run
332                 Mockito.when(userNotificationService.saveNotification(notificationItem)).thenReturn("Test");
333                 PortalAPIResponse response = externalAppsRestfulController.publishNotification(mockedRequest, notificationItem);
334                 // verify answer
335                 assertNotNull(response);
336                 assertEquals("error", response.getStatus());
337                 assertEquals("failed", response.getMessage());
338         }
339
340     @Test
341     public void publishNotificationTest_EmptyAppHeader() throws Exception {
342         // input
343         EpNotificationItem notificationItem = new EpNotificationItem();
344         List<Long> roleList = new ArrayList<Long>();
345         Long role1 = 1L;
346         roleList.add(role1);
347         notificationItem.setRoleIds(roleList);
348         notificationItem.setPriority(1L);
349         notificationItem.setMsgHeader("testHeader");
350         notificationItem.setMsgDescription("Test Description");
351         Date currentDate = new Date();
352         Calendar c = Calendar.getInstance();
353         c.setTime(currentDate);
354         c.add(Calendar.DATE, 1);
355         Date currentDatePlusOne = c.getTime();
356         notificationItem.setStartTime(currentDate);
357         notificationItem.setEndTime(currentDatePlusOne);
358
359         Mockito.when(mockedRequest.getHeader("uebkey")).thenReturn(null);
360         final Map<String, String> params = new HashMap<>();
361         params.put("appKey", null);
362         Mockito.when(DataAccessService.executeNamedQuery("getMyAppDetailsByUebKey", params, null))
363             .thenThrow(NullPointerException.class);
364
365         PortalAPIResponse response = externalAppsRestfulController.publishNotification(mockedRequest, notificationItem);
366         assertNotNull(response);
367         assertEquals("ok", response.getStatus());
368         assertEquals("success", response.getMessage());
369         ArgumentCaptor<EpNotificationItem> capture = ArgumentCaptor.forClass(EpNotificationItem.class);
370         Mockito.verify(userNotificationService).saveNotification(capture.capture());
371         assertNotNull(capture.getValue());
372         EpNotificationItem createdNofification = capture.getValue();
373         assertNotNull(createdNofification.getRoleIds());
374         assertEquals(0, createdNofification.getRoleIds().size());
375     }
376
377     @Test
378     public void publishNotificationTest_ErrorResponse() throws Exception {
379         // input
380         EpNotificationItem notificationItem = new EpNotificationItem();
381         List<Long> roleList = new ArrayList<Long>();
382         Long role1 = 1L;
383         roleList.add(role1);
384         notificationItem.setRoleIds(roleList);
385         notificationItem.setPriority(1L);
386         notificationItem.setMsgHeader("testHeader");
387         notificationItem.setMsgDescription("Test Description");
388         Date currentDate = new Date();
389         Calendar c = Calendar.getInstance();
390         c.setTime(currentDate);
391         c.add(Calendar.DATE, 1);
392         Date currentDatePlusOne = c.getTime();
393         notificationItem.setStartTime(currentDate);
394         notificationItem.setEndTime(currentDatePlusOne);
395
396         Mockito.when(mockedRequest.getHeader("uebkey")).thenReturn(null);
397         final Map<String, String> params = new HashMap<>();
398         params.put("appKey", null);
399         Mockito.when(DataAccessService.executeNamedQuery("getMyAppDetailsByUebKey", params, null))
400             .thenThrow(NullPointerException.class);
401         Mockito.when(userNotificationService.saveNotification(any(EpNotificationItem.class))).
402             thenThrow(new NullPointerException("expected message"));
403
404         PortalAPIResponse response = externalAppsRestfulController.publishNotification(mockedRequest, notificationItem);
405         assertNotNull(response);
406         assertEquals("error", response.getStatus());
407         assertEquals("expected message", response.getMessage());
408     }
409
410 }