mirror of
https://github.com/owncloud/ocis.git
synced 2026-10-23 23:29:02 +03:00
test: add test for public link brute-force protection Signed-off-by: Prajwol Amatya <prajwolamatya11@gmail.com>
478 lines
13 KiB
PHP
478 lines
13 KiB
PHP
<?php declare(strict_types=1);
|
|
/**
|
|
* ownCloud
|
|
*
|
|
* @author Artur Neumann <artur@jankaritech.com>
|
|
* @copyright Copyright (c) 2021 Artur Neumann artur@jankaritech.com
|
|
*
|
|
* This code is free software: you can redistribute it and/or modify
|
|
* it under the terms of the GNU Affero General Public License,
|
|
* as published by the Free Software Foundation;
|
|
* either version 3 of the License, or any later version.
|
|
*
|
|
* This program is distributed in the hope that it will be useful,
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
* GNU Affero General Public License for more details.
|
|
*
|
|
* You should have received a copy of the GNU Affero General Public License
|
|
* along with this program. If not, see <http://www.gnu.org/licenses/>
|
|
*
|
|
*/
|
|
|
|
use Behat\Behat\Context\Context;
|
|
use Behat\Behat\Hook\Scope\BeforeScenarioScope;
|
|
use Behat\Gherkin\Node\TableNode;
|
|
use GuzzleHttp\Exception\GuzzleException;
|
|
use TestHelpers\HttpRequestHelper;
|
|
use TestHelpers\BehatHelper;
|
|
use PHPUnit\Framework\Assert;
|
|
use Psr\Http\Message\ResponseInterface;
|
|
use splitbrain\PHPArchive\Tar;
|
|
use splitbrain\PHPArchive\Zip;
|
|
use splitbrain\PHPArchive\Archive;
|
|
use TestHelpers\WebDavHelper;
|
|
|
|
require_once 'bootstrap.php';
|
|
|
|
/**
|
|
* Context for Archiver specific steps
|
|
*/
|
|
class ArchiverContext implements Context {
|
|
/**
|
|
* @var FeatureContext
|
|
*/
|
|
private FeatureContext $featureContext;
|
|
private SpacesContext $spacesContext;
|
|
|
|
/**
|
|
* @BeforeScenario
|
|
*
|
|
* @param BeforeScenarioScope $scope
|
|
*
|
|
* @return void
|
|
*
|
|
* @throws Exception
|
|
*/
|
|
public function before(BeforeScenarioScope $scope): void {
|
|
// Get the environment
|
|
$environment = $scope->getEnvironment();
|
|
// Get all the contexts you need in this context
|
|
$this->featureContext = BehatHelper::getContext($scope, $environment, 'FeatureContext');
|
|
$this->spacesContext = BehatHelper::getContext($scope, $environment, 'SpacesContext');
|
|
}
|
|
|
|
/**
|
|
* @param string $query
|
|
*
|
|
* @return string
|
|
*/
|
|
public function getArchiverUrl(string $query): string {
|
|
return $this->featureContext->getBaseUrl() . '/archiver?' . $query;
|
|
}
|
|
|
|
/**
|
|
* @param string $type
|
|
*
|
|
* @return Archive
|
|
*/
|
|
public function getArchiveClass(string $type): Archive {
|
|
if ($type === 'zip') {
|
|
return new Zip();
|
|
} elseif ($type === 'tar') {
|
|
return new Tar();
|
|
}
|
|
throw new Exception('Unknown archive type: ' . $type);
|
|
}
|
|
|
|
/**
|
|
* @param string $dir
|
|
*
|
|
* @return void
|
|
*/
|
|
public function removeDir(string $dir): void {
|
|
$items = array_diff(scandir($dir), ['.', '..']);
|
|
foreach ($items as $item) {
|
|
$itemPath = $dir . DIRECTORY_SEPARATOR . $item;
|
|
if (\is_dir($itemPath)) {
|
|
$this->removeDir($itemPath);
|
|
} else {
|
|
\unlink($itemPath);
|
|
}
|
|
}
|
|
\rmdir($dir);
|
|
}
|
|
|
|
/**
|
|
* @param string $user
|
|
* @param string $resource
|
|
* @param string $addressType id|ids|path|paths
|
|
*
|
|
* @return string
|
|
*
|
|
* @throws Exception
|
|
*/
|
|
public function getArchiverQueryString(
|
|
string $user,
|
|
string $resource,
|
|
string $addressType,
|
|
): string {
|
|
switch ($addressType) {
|
|
case 'id':
|
|
case 'ids':
|
|
return 'id=' . $this->featureContext->getFileIdForPath($user, $resource);
|
|
case 'remoteItemIds':
|
|
return 'id=' . $this->spacesContext->getSharesRemoteItemId($user, $resource);
|
|
case 'path':
|
|
case 'paths':
|
|
return 'path=' . $resource;
|
|
default:
|
|
throw new Exception(
|
|
'"' . $addressType .
|
|
'" is not a legal value for $addressType, must be id|ids|remoteItemIds|path|paths',
|
|
);
|
|
}
|
|
}
|
|
|
|
/**
|
|
* @When /^user "([^"]*)" downloads the (zip|tar) archive of "([^"]*)" using the resource (id|ids|path|paths) and setting these headers:$/
|
|
*
|
|
* @param string $user
|
|
* @param string $archiveType
|
|
* @param string $resource
|
|
* @param string $addressType id|path
|
|
* @param TableNode $headersTable
|
|
*
|
|
* @return void
|
|
*
|
|
* @throws GuzzleException
|
|
* @throws Exception
|
|
*/
|
|
public function userDownloadsTheZipOrTarArchiveOfResourceUsingResourceIdOrPathAndSettingTheseHeaders(
|
|
string $user,
|
|
string $archiveType,
|
|
string $resource,
|
|
string $addressType,
|
|
TableNode $headersTable,
|
|
): void {
|
|
$this->featureContext->verifyTableNodeColumns(
|
|
$headersTable,
|
|
['header', 'value'],
|
|
);
|
|
$headers = [];
|
|
foreach ($headersTable as $row) {
|
|
$headers[$row['header']] = $row ['value'];
|
|
}
|
|
$this->featureContext->setResponse(
|
|
$this->downloadArchive($user, $resource, $addressType, $archiveType, null, $headers),
|
|
);
|
|
}
|
|
|
|
/**
|
|
* @When user :downloader downloads the archive of :item of user :owner using the resource :addressType
|
|
*
|
|
* @param string $downloader Who sends the request
|
|
* @param string $resource
|
|
* @param string $owner Who is the real owner of the file
|
|
* @param string $addressType id|path
|
|
*
|
|
* @return void
|
|
*
|
|
* @throws GuzzleException
|
|
* @throws Exception
|
|
*/
|
|
public function userDownloadsTheArchiveOfItemOfUser(
|
|
string $downloader,
|
|
string $resource,
|
|
string $owner,
|
|
string $addressType,
|
|
): void {
|
|
$this->featureContext->setResponse($this->downloadArchive($downloader, $resource, $addressType, null, $owner));
|
|
}
|
|
|
|
/**
|
|
* @param string $downloader
|
|
* @param string $resource
|
|
* @param string $addressType
|
|
* @param string|null $archiveType
|
|
* @param string|null $owner
|
|
* @param array|null $headers
|
|
*
|
|
* @return ResponseInterface
|
|
* @throws GuzzleException
|
|
* @throws JsonException
|
|
*/
|
|
public function downloadArchive(
|
|
string $downloader,
|
|
string $resource,
|
|
string $addressType,
|
|
?string $archiveType = null,
|
|
?string $owner = null,
|
|
?array $headers = null,
|
|
): ResponseInterface {
|
|
$owner = $owner ?? $downloader;
|
|
$downloader = $this->featureContext->getActualUsername($downloader);
|
|
$queryString = $this->getArchiverQueryString($owner, $resource, $addressType);
|
|
if ($archiveType !== null) {
|
|
$queryString .= '&output-format=' . $archiveType;
|
|
}
|
|
return HttpRequestHelper::get(
|
|
$this->getArchiverUrl($queryString),
|
|
$downloader,
|
|
$this->featureContext->getPasswordForUser($downloader),
|
|
$headers,
|
|
);
|
|
}
|
|
|
|
/**
|
|
* @When user :user downloads the archive of these items using the resource :addressType
|
|
* @When user :user tries to download the archive of these items using the resource :addressType
|
|
*
|
|
* @param string $user
|
|
* @param string $addressType ids|paths
|
|
* @param TableNode $items
|
|
*
|
|
* @return void
|
|
*
|
|
* @throws GuzzleException|Exception
|
|
*/
|
|
public function userDownloadsTheArchiveOfTheseItems(
|
|
string $user,
|
|
string $addressType,
|
|
TableNode $items,
|
|
): void {
|
|
$user = $this->featureContext->getActualUsername($user);
|
|
$queryString = [];
|
|
foreach ($items->getRows() as $item) {
|
|
$queryString[] = $this->getArchiverQueryString($user, $item[0], $addressType);
|
|
}
|
|
$queryString = \join('&', $queryString);
|
|
|
|
$this->featureContext->setResponse(
|
|
HttpRequestHelper::get(
|
|
$this->getArchiverUrl($queryString),
|
|
$user,
|
|
$this->featureContext->getPasswordForUser($user),
|
|
),
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Sends a PROPFIND request to the public WebDAV endpoint for the last created public link
|
|
* and extracts archive-related metadata from the XML response.
|
|
*
|
|
* The returned data includes:
|
|
* - fileIds: IDs of all files included in the public link
|
|
* - signature: signature required for archive download
|
|
* - expiration: expiration timestamp required for archive download
|
|
*
|
|
* @param string $password
|
|
*
|
|
* @return array {
|
|
* fileIds: string[],
|
|
* signature: string|null,
|
|
* expiration: string|null
|
|
* }
|
|
*
|
|
* @throws GuzzleException
|
|
*/
|
|
private function fetchPublicLinkArchiveData(string $password = ''): array {
|
|
$token = $this->featureContext->isUsingSharingNG()
|
|
? $this->featureContext->shareNgGetLastCreatedLinkShareToken()
|
|
: $this->featureContext->getLastCreatedPublicShareToken();
|
|
$password = $this->featureContext->getActualPassword($password);
|
|
$response = WebDavHelper::propfind(
|
|
$this->featureContext->getBaseUrl(),
|
|
null,
|
|
(string) $password,
|
|
(string) $token,
|
|
['oc:public-link-item-type', 'oc:fileid', 'oc:downloadURL', 'oc:signature-auth'],
|
|
null,
|
|
null,
|
|
"public-files",
|
|
);
|
|
$xmlDocument = HttpRequestHelper::getResponseXml($response);
|
|
|
|
$fileIds = [];
|
|
$signature = null;
|
|
$expiration = null;
|
|
|
|
foreach ($xmlDocument->xpath('//d:response') as $responseNode) {
|
|
$type = $responseNode->xpath('.//oc:public-link-item-type');
|
|
$fileId = $responseNode->xpath('.//oc:fileid');
|
|
|
|
$sig = $responseNode->xpath('.//oc:signature-auth/oc:signature');
|
|
$exp = $responseNode->xpath('.//oc:signature-auth/oc:expiration');
|
|
|
|
if (!empty($type) && (string)$type[0] === 'file' && !empty($fileId)) {
|
|
$fileIds[] = (string)$fileId[0];
|
|
}
|
|
|
|
if ($signature === null && !empty($sig)) {
|
|
$signature = (string)$sig[0];
|
|
}
|
|
|
|
if ($expiration === null && !empty($exp)) {
|
|
$expiration = (string)$exp[0];
|
|
}
|
|
}
|
|
|
|
return [
|
|
'fileIds' => $fileIds,
|
|
'signature' => $signature,
|
|
'expiration' => $expiration,
|
|
];
|
|
}
|
|
|
|
/**
|
|
* @var array
|
|
*/
|
|
private array $publicLinkArchiveData = [];
|
|
|
|
/**
|
|
* @param string $password
|
|
*
|
|
* @return array
|
|
* @throws GuzzleException
|
|
*/
|
|
private function getPublicLinkArchiveData(string $password): array {
|
|
if ($this->publicLinkArchiveData === []) {
|
|
$this->publicLinkArchiveData = $this->fetchPublicLinkArchiveData($password);
|
|
}
|
|
return $this->publicLinkArchiveData;
|
|
}
|
|
|
|
/**
|
|
* @When /^the public downloads the archive of the last created public link with password "([^"]*)"$/
|
|
*
|
|
* @param string $password
|
|
*
|
|
* @return void
|
|
*
|
|
* @throws GuzzleException|Exception
|
|
*/
|
|
public function publicDownloadsTheArchiveOfTheLastCreatedPublicLink(string $password = ""): void {
|
|
$data = $this->getPublicLinkArchiveData($password);
|
|
$fileIds = $data['fileIds'];
|
|
$signature = $data['signature'];
|
|
$expiration = $data['expiration'];
|
|
|
|
$token = $this->featureContext->isUsingSharingNG()
|
|
? $this->featureContext->shareNgGetLastCreatedLinkShareToken()
|
|
: $this->featureContext->getLastCreatedPublicShareToken();
|
|
$password = $this->featureContext->getActualPassword($password);
|
|
$queryParts = [];
|
|
$queryParts[] = "public-token=" . urlencode($token);
|
|
|
|
foreach ($fileIds as $fileId) {
|
|
$queryParts[] = "id=" . urlencode($fileId);
|
|
}
|
|
|
|
$queryParts[] = "signature=" . urlencode($signature);
|
|
$queryParts[] = "expiration=" . urlencode($expiration);
|
|
$queryString = implode('&', $queryParts);
|
|
$url = $this->featureContext->getBaseUrl() . "/archiver?" . $queryString;
|
|
|
|
$this->featureContext->setResponse(
|
|
HttpRequestHelper::get($url, 'public', $password),
|
|
);
|
|
}
|
|
|
|
/**
|
|
* @When the public downloads the archive of the last created public link with incorrect password :password
|
|
*
|
|
* @param string $password
|
|
*
|
|
* @return void
|
|
* @throws GuzzleException
|
|
*/
|
|
public function publicDownloadsTheArchiveOfTheLastCreatedPublicLinkUsingBasicAuth(string $password): void {
|
|
$data = $this->getPublicLinkArchiveData('%public%');
|
|
$fileIds = $data['fileIds'];
|
|
|
|
$token = $this->featureContext->isUsingSharingNG()
|
|
? $this->featureContext->shareNgGetLastCreatedLinkShareToken()
|
|
: $this->featureContext->getLastCreatedPublicShareToken();
|
|
|
|
$queryParts = ['public-token=' . urlencode($token)];
|
|
foreach ($fileIds as $fileId) {
|
|
$queryParts[] = "id=" . urlencode($fileId);
|
|
}
|
|
|
|
$this->featureContext->setResponse(
|
|
HttpRequestHelper::get(
|
|
$this->getArchiverUrl(\implode('&', $queryParts)),
|
|
'public',
|
|
$password,
|
|
),
|
|
);
|
|
}
|
|
|
|
/**
|
|
* @Then the downloaded :type archive should contain these files:
|
|
*
|
|
* @param string $type
|
|
* @param TableNode $expectedFiles
|
|
*
|
|
* @return void
|
|
*
|
|
* @throws Exception
|
|
*/
|
|
public function theDownloadedArchiveShouldContainTheseFiles(string $type, TableNode $expectedFiles): void {
|
|
$this->featureContext->verifyTableNodeColumns($expectedFiles, ['name', 'content']);
|
|
$contents = $this->featureContext->getResponse()->getBody()->getContents();
|
|
$tempFile = \tempnam(\sys_get_temp_dir(), 'OcAcceptanceTests_');
|
|
$tempExtractFolder = $tempFile;
|
|
\unlink($tempFile); // we only need the name
|
|
$tempFile = $tempFile . '.' . $type; // it needs the extension
|
|
\file_put_contents($tempFile, $contents);
|
|
|
|
// open the archive
|
|
$tar = $this->getArchiveClass($type);
|
|
$tar->open($tempFile);
|
|
$archiveData = $tar->contents();
|
|
|
|
// extract the archive
|
|
$tar->open($tempFile);
|
|
$tar->extract($tempExtractFolder);
|
|
$tar->close();
|
|
|
|
foreach ($expectedFiles->getHash() as $expectedItem) {
|
|
$expectedPath = trim($expectedItem['name'], "/");
|
|
$found = false;
|
|
foreach ($archiveData as $info) {
|
|
// get only the parent folder path for the given item
|
|
$actualPath = $info->getPath();
|
|
|
|
if ($expectedPath === $actualPath) {
|
|
if (!$info->getIsdir()) {
|
|
$fileFullPath = "$tempExtractFolder/$actualPath";
|
|
$fileMimeType = \mime_content_type($fileFullPath);
|
|
|
|
if ($fileMimeType === "text/plain") {
|
|
$fileContent = \file_get_contents($fileFullPath);
|
|
Assert::assertEquals(
|
|
$expectedItem['content'],
|
|
$fileContent,
|
|
__METHOD__ . " content of '" . $expectedPath . "' not as expected",
|
|
);
|
|
} else {
|
|
Assert::assertFileExists(
|
|
$fileFullPath,
|
|
__METHOD__ . " File '" . $expectedPath . "' is not in the downloaded archive.",
|
|
);
|
|
}
|
|
}
|
|
$found = true;
|
|
break;
|
|
}
|
|
}
|
|
if (!$found) {
|
|
Assert::fail("Resource '" . $expectedPath . "' is not in the downloaded archive.");
|
|
}
|
|
}
|
|
\unlink($tempFile);
|
|
$this->removeDir($tempExtractFolder);
|
|
}
|
|
}
|