Persistent XSS vulnerability in basicAuthAccount form fix
[portal.git] / ecomp-portal-BE-common / src / test / java / org / onap / portalapp / portal / service / BasicAuthAccountServiceImplTest.java
1 /*
2 * ============LICENSE_START=======================================================
3 * ONAP  PORTAL
4 * ================================================================================
5 * Copyright 2018 TechMahindra
6 *=================================================================================
7 * Licensed under the Apache License, Version 2.0 (the "License");
8 * you may not use this file except in compliance with the License.
9 * You may obtain a copy of the License at
10 *
11 *     http://www.apache.org/licenses/LICENSE-2.0
12 *
13 * Unless required by applicable law or agreed to in writing, software
14 * distributed under the License is distributed on an "AS IS" BASIS,
15 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16 * See the License for the specific language governing permissions and
17 * limitations under the License.
18 * ============LICENSE_END=========================================================
19 */
20 package org.onap.portalapp.portal.service;
21
22
23 import java.util.ArrayList;
24 import java.util.HashMap;
25 import java.util.List;
26 import java.util.Map;
27
28 import javax.servlet.http.HttpServletRequest;
29 import javax.servlet.http.HttpServletResponse;
30 import org.hibernate.criterion.Criterion;
31 import org.hibernate.criterion.Restrictions;
32 import org.junit.Before;
33 import org.junit.Test;
34 import org.junit.runner.RunWith;
35 import org.mockito.InjectMocks;
36 import org.mockito.Mock;
37 import org.mockito.Mockito;
38 import org.mockito.MockitoAnnotations;
39 import org.onap.portalapp.portal.core.MockEPUser;
40 import org.onap.portalapp.portal.domain.BasicAuthCredentials;
41 import org.onap.portalapp.portal.domain.EPEndpoint;
42 import org.onap.portalapp.portal.domain.EPEndpointAccount;
43 import org.onap.portalapp.portal.framework.MockitoTestSuite;
44 import org.onap.portalsdk.core.onboarding.util.CipherUtil;
45 import org.onap.portalsdk.core.service.DataAccessService;
46 import org.onap.portalsdk.core.service.DataAccessServiceImpl;
47 import org.onap.portalsdk.core.util.SystemProperties;
48 import org.powermock.api.mockito.PowerMockito;
49 import org.powermock.core.classloader.annotations.PrepareForTest;
50 import org.powermock.modules.junit4.PowerMockRunner;
51
52
53 @RunWith(PowerMockRunner.class)
54 @PrepareForTest({ CipherUtil.class , SystemProperties.class})
55 public class BasicAuthAccountServiceImplTest {
56         @Mock
57         DataAccessService dataAccessService = new DataAccessServiceImpl();
58                 
59         @Before
60         public void setup() {
61                 MockitoAnnotations.initMocks(this);
62         }
63         
64         @InjectMocks
65         BasicAuthAccountServiceImpl  basicAuthAccountServiceImpl = new BasicAuthAccountServiceImpl();
66         
67         
68         MockitoTestSuite mockitoTestSuite = new MockitoTestSuite();
69         HttpServletRequest mockedRequest = mockitoTestSuite.getMockedRequest();
70         HttpServletResponse mockedResponse = mockitoTestSuite.getMockedResponse();
71         NullPointerException nullPointerException = new NullPointerException();
72         MockEPUser mockUser = new MockEPUser();
73         
74         @Test
75         public void saveBasicAuthAccountTest() throws Exception {
76                 BasicAuthCredentials basicAuthCredentials = new BasicAuthCredentials();
77                 basicAuthCredentials.setPassword(null);
78                 Mockito.doNothing().when(dataAccessService).saveDomainObject(basicAuthCredentials, null);
79                 basicAuthAccountServiceImpl.saveBasicAuthAccount(basicAuthCredentials);
80                 
81         }
82
83                 @Test(expected= Exception.class)
84         public void saveBasicAuthAccountValidTest() throws Exception {
85                                 BasicAuthCredentials basicAuthCredentials = new BasicAuthCredentials();
86                                 basicAuthCredentials.setPassword("<IMG SRC=\"jav\tascript:alert('XSS');\">");
87                                 Mockito.doNothing().when(dataAccessService).saveDomainObject(basicAuthCredentials, null);
88                                 basicAuthAccountServiceImpl.saveBasicAuthAccount(basicAuthCredentials);
89
90         }
91         
92         @Test
93         public void saveBasicAuthAccountTest_password() throws Exception{
94                 PowerMockito.mockStatic(CipherUtil.class);
95                 PowerMockito.mockStatic(SystemProperties.class);
96                 BasicAuthCredentials credentials = new BasicAuthCredentials();
97                 credentials.setPassword("password");
98                 String result = null;
99                 Mockito.when(CipherUtil.encryptPKC("password", SystemProperties.getProperty(SystemProperties.Decryption_Key))).thenReturn(result);
100                 basicAuthAccountServiceImpl.saveBasicAuthAccount(credentials);
101         }
102         
103         @Test
104         public void saveEndpointsTest() throws Exception {
105                 List<Criterion> restrictionsList = new ArrayList<Criterion>();
106                 Criterion NameCrit = Restrictions.eq("name", "test");
107                 restrictionsList.add(NameCrit);
108                 List<EPEndpoint> tempList = new ArrayList<>();
109                 EPEndpoint endpoint = new EPEndpoint();
110                 endpoint.setId(1l);
111                 endpoint.setName("name");
112                 tempList.add(endpoint);
113                 Mockito.when((List<EPEndpoint>) dataAccessService.getList(EPEndpoint.class, null, restrictionsList, null))
114                 .thenReturn(tempList);
115                 EPEndpoint epEndpoint= new EPEndpoint();
116                 Mockito.doNothing().when(dataAccessService).saveDomainObject(epEndpoint,  null);
117                 basicAuthAccountServiceImpl.saveEndpoints(epEndpoint);
118         }
119         
120         @Test(expected= NullPointerException.class)
121         public void saveEndpointAccountTest() throws Exception {
122                 EPEndpointAccount record = new EPEndpointAccount();
123                 record.setAccount_id(1l);
124                 record.setEp_id(2l);
125                 Mockito.doNothing().when(dataAccessService).saveDomainObject(record,  null);
126                 basicAuthAccountServiceImpl.saveEndpointAccount(1l, 2l);
127         }
128         
129         @Test
130         public void updateBasicAuthAccountTest() throws Exception {
131                 BasicAuthCredentials basicAuthCredentials = new BasicAuthCredentials();
132                 Mockito.doNothing().when(dataAccessService).saveDomainObject(basicAuthCredentials, null);
133                 List<EPEndpoint> endpoints = new ArrayList<>();
134                 EPEndpoint epEndpoint = new  EPEndpoint();
135                 epEndpoint.setId(1l);
136                 epEndpoint.setName("name");
137                 endpoints.add(epEndpoint);
138                 basicAuthCredentials.setEndpoints(endpoints);
139                 List<EPEndpointAccount> list = null;
140                 Map<String, Long> params = new HashMap<>();
141                 params.put("account_id", 1l);
142                 Mockito.when(dataAccessService.executeNamedQuery("getEPEndpointAccountByAccountId", null, null)).thenReturn(list);
143                 EPEndpoint temp_ep = new EPEndpoint();
144                 temp_ep.setId(1l);
145                 boolean flag = false;
146                 Map<String, String> params1 = new HashMap<String, String>();
147                 params1.put("accountId", Long.toString(1l));
148                 params1.put("epId", Long.toString(1l));
149                 Mockito.when(dataAccessService.executeNamedQuery("deleteAccountEndpointRecord", params1, null)).thenReturn(null);
150                 basicAuthAccountServiceImpl.updateBasicAuthAccount(1l, basicAuthCredentials);
151         }
152         
153                 
154         @Test
155         public void getAccountDataTest() throws Exception {
156                 List<BasicAuthCredentials> list = new ArrayList<>();
157                 BasicAuthCredentials basicAuthCredentials = new BasicAuthCredentials();
158                 Mockito.when((List<BasicAuthCredentials>) dataAccessService.getList(BasicAuthCredentials.class, null))
159                 .thenReturn(list);
160                 basicAuthAccountServiceImpl.getAccountData();
161         }
162         
163         @Test
164         public void getAccountDataTest_password() throws Exception {
165                 PowerMockito.mockStatic(CipherUtil.class);
166                 PowerMockito.mockStatic(SystemProperties.class);
167                 List<BasicAuthCredentials> list = new ArrayList<>();
168                 BasicAuthCredentials basicAuthCredentials = new BasicAuthCredentials();
169                 basicAuthCredentials.setPassword("password");
170                 list.add(basicAuthCredentials);
171                 Mockito.when((List<BasicAuthCredentials>) dataAccessService.getList(BasicAuthCredentials.class, null))
172                 .thenReturn(list);
173                 String result = null;
174                 Mockito.when(CipherUtil.decryptPKC("password", SystemProperties.getProperty(SystemProperties.Decryption_Key))).thenReturn(result);
175                 
176         }
177
178         @Test
179         public void deleteEndpointAccoutTest() throws Exception {
180                 Map<String, String> params = new HashMap<String, String>();
181                 params.put("accountId", Long.toString(1l));
182                 Mockito.when(dataAccessService.executeNamedQuery("deleteAccountEndpoint", params, null)).thenReturn(null);
183                 Mockito.when(dataAccessService.executeNamedQuery("deleteBasicAuthAccount", params, null)).thenReturn(null);
184                 basicAuthAccountServiceImpl.deleteEndpointAccout(1l);
185                 
186         }
187         
188         @Test
189         public void getBasicAuthCredentialsById() throws Exception{
190                 List<BasicAuthCredentials> list = new ArrayList<>();
191                 BasicAuthCredentials basicAuthCredentials = new BasicAuthCredentials();
192                 basicAuthCredentials.setPassword("password");
193                 basicAuthCredentials.setId(1l);
194                 list.add(basicAuthCredentials);
195                 Mockito.when((List<BasicAuthCredentials>) dataAccessService.getList(BasicAuthCredentials.class, null))
196                 .thenReturn(list);
197                 basicAuthAccountServiceImpl.getBasicAuthCredentialsById(1l);
198                 
199         }
200 }