View Javadoc
1   /*
2    * Licensed to the Apache Software Foundation (ASF) under one
3    * or more contributor license agreements.  See the NOTICE file
4    * distributed with this work for additional information
5    * regarding copyright ownership.  The ASF licenses this file
6    * to you under the Apache License, Version 2.0 (the
7    * "License"); you may not use this file except in compliance
8    * with the License.  You may obtain a copy of the License at
9    *
10   *   http://www.apache.org/licenses/LICENSE-2.0
11   *
12   * Unless required by applicable law or agreed to in writing,
13   * software distributed under the License is distributed on an
14   * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
15   * KIND, either express or implied.  See the License for the
16   * specific language governing permissions and limitations
17   * under the License.
18   */
19  
20  package org.apache.myfaces.tobago.internal.config;
21  
22  import org.junit.Assert;
23  import org.junit.Test;
24  import org.xml.sax.SAXException;
25  
26  import javax.xml.parsers.ParserConfigurationException;
27  import java.io.IOException;
28  import java.net.URISyntaxException;
29  import java.net.URL;
30  import java.util.ArrayList;
31  import java.util.List;
32  import java.util.Map;
33  
34  public class TobagoConfigMergingUnitTest {
35  
36    @Test
37    public void testPreventFrameAttacksCascadingDefault()
38        throws IOException, SAXException, ParserConfigurationException, URISyntaxException {
39  
40      final TobagoConfigImpl config = loadAndMerge(
41          "tobago-config-merge-0.xml",
42          "tobago-config-merge-1.xml");
43  
44      Assert.assertFalse(config.isPreventFrameAttacks());
45    }
46  
47    @Test
48    public void testPreventFrameAttacks()
49        throws IOException, SAXException, ParserConfigurationException, URISyntaxException {
50  
51      final TobagoConfigImpl config = loadAndMerge("tobago-config-merge-0.xml");
52  
53      Assert.assertFalse(config.isPreventFrameAttacks());
54    }
55  
56    @Test
57    public void testPreventFrameAttacksDefault()
58        throws IOException, SAXException, ParserConfigurationException, URISyntaxException {
59  
60      final TobagoConfigImpl config = loadAndMerge("tobago-config-merge-1.xml");
61  
62      Assert.assertTrue(config.isPreventFrameAttacks());
63    }
64  
65    @Test
66    public void testContentSecurityPolicy()
67        throws IOException, SAXException, ParserConfigurationException, URISyntaxException {
68  
69      final TobagoConfigImpl config = loadAndMerge(
70          "tobago-config-merge-0.xml");
71  
72      Assert.assertTrue(config.getContentSecurityPolicy().getMode() == ContentSecurityPolicy.Mode.ON);
73      final Map<String, String> directiveMap = config.getContentSecurityPolicy().getDirectiveMap();
74      Assert.assertEquals(1, directiveMap.size());
75      Assert.assertEquals("'self'", directiveMap.get("default-src"));
76    }
77  
78    @Test
79    public void testContentSecurityPolicyExtend()
80        throws IOException, SAXException, ParserConfigurationException, URISyntaxException {
81  
82      final TobagoConfigImpl config = loadAndMerge(
83          "tobago-config-merge-0.xml",
84          "tobago-config-merge-1.xml");
85  
86      Assert.assertTrue(config.getContentSecurityPolicy().getMode() == ContentSecurityPolicy.Mode.REPORT_ONLY);
87      final Map<String, String> directiveMap = config.getContentSecurityPolicy().getDirectiveMap();
88      Assert.assertEquals(2, directiveMap.size());
89      Assert.assertEquals("'self'", directiveMap.get("default-src"));
90      Assert.assertEquals("http://apache.org", directiveMap.get("image-src"));
91    }
92  
93    @Test
94    public void testContentSecurityPolicyOff()
95        throws IOException, SAXException, ParserConfigurationException, URISyntaxException {
96  
97      final TobagoConfigImpl config = loadAndMerge(
98          "tobago-config-merge-0.xml",
99          "tobago-config-merge-1.xml",
100         "tobago-config-merge-2.xml");
101 
102     Assert.assertTrue(config.getContentSecurityPolicy().getMode() == ContentSecurityPolicy.Mode.OFF);
103     Assert.assertEquals(2, config.getContentSecurityPolicy().getDirectiveMap().size());
104   }
105 
106   @Test
107   public void testContentSecurityPolicyNameAttribute()
108       throws IOException, SAXException, ParserConfigurationException, URISyntaxException {
109 
110     final TobagoConfigImpl config = loadAndMerge(
111         "tobago-config-merge-0.xml",
112         "tobago-config-merge-3.xml");
113 
114     Assert.assertTrue(config.getContentSecurityPolicy().getMode() == ContentSecurityPolicy.Mode.ON);
115     final Map<String, String> directiveMap = config.getContentSecurityPolicy().getDirectiveMap();
116     Assert.assertEquals(1, directiveMap.size());
117     Assert.assertEquals("'self' https:", directiveMap.get("default-src"));
118   }
119 
120   @Test
121   public void testMimeTypes()
122       throws IOException, SAXException, ParserConfigurationException, URISyntaxException {
123 
124     final TobagoConfigImpl config = loadAndMerge(
125         "tobago-config-merge-0.xml",
126         "tobago-config-merge-1.xml",
127         "tobago-config-merge-2.xml");
128 
129     final Map<String, String> mimeTypes = config.getMimeTypes();
130     Assert.assertTrue(mimeTypes.size() == 3);
131     Assert.assertEquals("test/one", mimeTypes.get("test-1"));
132     Assert.assertEquals("test/zwei", mimeTypes.get("test-2"));
133     Assert.assertEquals("test/three", mimeTypes.get("test-3"));
134   }
135 
136   public static TobagoConfigImpl loadAndMerge(final String... names)
137       throws IOException, SAXException, ParserConfigurationException, URISyntaxException {
138 
139     final List<TobagoConfigFragment> list = new ArrayList<>();
140 
141     for (final String name : names) {
142       final URL url = TobagoConfigMergingUnitTest.class.getClassLoader().getResource(name);
143       final TobagoConfigParser parser = new TobagoConfigParser();
144       list.add(parser.parse(url));
145     }
146 
147     final TobagoConfigSorter sorter = new TobagoConfigSorter(list);
148     sorter.sort();
149     return sorter.merge();
150   }
151 }