fix more selenium tests no need to wait server response for client side validation

git-svn-id: https://svn.apache.org/repos/asf/archiva/trunk@1172554 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/AppearanceTest.java b/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/AppearanceTest.java
index d912cae4b2d305db7278f78910f0d544173b0221..199bb3774ece978cf939d86c3b7eac59e06610bb 100644 (file)
--- a/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/AppearanceTest.java
+++ b/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/AppearanceTest.java
@@ -30,55 +30,67 @@ public class AppearanceTest
     {
         goToAppearancePage();
         clickLinkWithText( "Edit" );
-        addEditAppearance( "", "", "" );
+        addEditAppearance( "", "", "", false );
         assertTextPresent( "You must enter a name" );
     }
 
-    @Test( dependsOnMethods = { "testAddAppearanceEmptyValues" })
-       public void testAddAppearanceInvalidValues()
-       {
-               addEditAppearance( "<>~+[ ]'\"" , "/home/user/abcXYZ0129._/\\~:?!&=-<> ~+[ ]'\"" , "/home/user/abcXYZ0129._/\\~:?!&=-<> ~+[ ]'\"" );
-               assertTextPresent( "Organisation name must only contain alphanumeric characters, white-spaces(' '), equals(=), question-marks(?), exclamation-points(!), ampersands(&), forward-slashes(/), back-slashes(\\), underscores(_), dots(.), colons(:), tildes(~), and dashes(-)." );
+    @Test( dependsOnMethods = { "testAddAppearanceEmptyValues" } )
+    public void testAddAppearanceInvalidValues()
+    {
+        addEditAppearance( "<>~+[ ]'\"", "/home/user/abcXYZ0129._/\\~:?!&=-<> ~+[ ]'\"",
+                           "/home/user/abcXYZ0129._/\\~:?!&=-<> ~+[ ]'\"", false );
+        assertTextPresent(
+            "Organisation name must only contain alphanumeric characters, white-spaces(' '), equals(=), question-marks(?), exclamation-points(!), ampersands(&), forward-slashes(/), back-slashes(\\), underscores(_), dots(.), colons(:), tildes(~), and dashes(-)." );
         assertTextPresent( "You must enter a URL" );
-        assertXpathCount("//span[@class='errorMessage' and text()='You must enter a URL']", 2);
+        //assertXpathCount( "//tr errorfor='saveAppearance_organisationUrl'", 1 );
+        assertXpathCount( "//span[@class='errorMessage/text()='You must enter a URL']", 1 );
+        assertTextPresent( "You must enter a URL for your logo" );
+        assertXpathCount( "//span[@class='errorMessage/text()='You must enter a URL for your logo']", 1 );
+
     }
 
-    @Test( dependsOnMethods = { "testAddAppearanceInvalidValues" })
-       public void testAddAppearanceInvalidOrganisationName()
-       {
-               addEditAppearance( "<>~+[ ]'\"" , "http://www.apache.org/" , "http://www.apache.org/images/asf_logo_wide.gifs" );
-        assertTextPresent( "Organisation name must only contain alphanumeric characters, white-spaces(' '), equals(=), question-marks(?), exclamation-points(!), ampersands(&), forward-slashes(/), back-slashes(\\), underscores(_), dots(.), colons(:), tildes(~), and dashes(-)." );
-       }
+    @Test( dependsOnMethods = { "testAddAppearanceInvalidValues" } )
+    public void testAddAppearanceInvalidOrganisationName()
+    {
+        addEditAppearance( "<>~+[ ]'\"", "http://www.apache.org/", "http://www.apache.org/images/asf_logo_wide.gifs",
+                           false );
+        assertTextPresent(
+            "Organisation name must only contain alphanumeric characters, white-spaces(' '), equals(=), question-marks(?), exclamation-points(!), ampersands(&), forward-slashes(/), back-slashes(\\), underscores(_), dots(.), colons(:), tildes(~), and dashes(-)." );
+    }
 
-    @Test( dependsOnMethods = { "testAddAppearanceInvalidOrganisationName" })
-       public void testAddAppearanceInvalidOrganisationUrl()
-       {
-               addEditAppearance( "The Apache Software Foundation" , "/home/user/abcXYZ0129._/\\~:?!&=-<> ~+[ ]'\"" , "http://www.apache.org/images/asf_logo_wide.gifs" );
-               assertTextPresent( "You must enter a URL" );
-        assertXpathCount("//span[@class='errorMessage' and text()='You must enter a URL']", 1);
+    @Test( dependsOnMethods = { "testAddAppearanceInvalidOrganisationName" } )
+    public void testAddAppearanceInvalidOrganisationUrl()
+    {
+        addEditAppearance( "The Apache Software Foundation", "/home/user/abcXYZ0129._/\\~:?!&=-<> ~+[ ]'\"",
+                           "http://www.apache.org/images/asf_logo_wide.gifs", false );
+        assertTextPresent( "You must enter a URL" );
+        assertXpathCount( "//span[@class='errorMessage/text()='You must enter a URL']", 1 );
     }
 
-    @Test( dependsOnMethods = { "testAddAppearanceInvalidOrganisationUrl" })
-       public void testAddAppearanceInvalidOrganisationLogo()
-       {
-               addEditAppearance( "The Apache Software Foundation" , "http://www.apache.org/" , "/home/user/abcXYZ0129._/\\~:?!&=-<> ~+[ ]'\"" );
-               assertTextPresent( "You must enter a URL" );
-        assertXpathCount("//span[@class='errorMessage' and text()='You must enter a URL']", 1);
+    @Test( dependsOnMethods = { "testAddAppearanceInvalidOrganisationUrl" } )
+    public void testAddAppearanceInvalidOrganisationLogo()
+    {
+        addEditAppearance( "The Apache Software Foundation", "http://www.apache.org/",
+                           "/home/user/abcXYZ0129._/\\~:?!&=-<> ~+[ ]'\"", false );
+        assertTextPresent( "You must enter a URL" );
+        assertXpathCount( "//span[@class='errorMessage'/text()='You must enter a URL']", 1 );
+    }
+
+    @Test( dependsOnMethods = { "testAddAppearanceInvalidOrganisationLogo" } )
+    public void testAddAppearanceValidValues()
+    {
+        addEditAppearance( "The Apache Software Foundation", "http://www.apache.org/",
+                           "http://www.apache.org/images/asf_logo_wide.gifs", true );
+        assertTextPresent( "The Apache Software Foundation" );
     }
 
-       @Test( dependsOnMethods = { "testAddAppearanceInvalidOrganisationLogo" })
-       public void testAddAppearanceValidValues()
-       {
-               addEditAppearance( "The Apache Software Foundation" , "http://www.apache.org/" , "http://www.apache.org/images/asf_logo_wide.gifs" );
-               assertTextPresent( "The Apache Software Foundation" );
-       }
-       
-       @Test( dependsOnMethods = { "testAddAppearanceValidValues" })
-       public void testEditAppearance()
-       {
-               clickLinkWithText( "Edit" );
-               addEditAppearance( "Apache Software Foundation" , "http://www.apache.org/" , "http://www.apache.org/images/asf_logo_wide.gifs" );
-               assertTextPresent( "Apache Software Foundation" );
+    @Test( dependsOnMethods = { "testAddAppearanceValidValues" } )
+    public void testEditAppearance()
+    {
+        clickLinkWithText( "Edit" );
+        addEditAppearance( "Apache Software Foundation", "http://www.apache.org/",
+                           "http://www.apache.org/images/asf_logo_wide.gifs", true );
+        assertTextPresent( "Apache Software Foundation" );
     }
 
 }
\ No newline at end of file

diff --git a/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/XSSSecurityTest.java b/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/XSSSecurityTest.java
index 1b9cfa1d1a65ac96521f7c0f762cd9fcf468a3e2..3ebe5cec618a478fea947028343083d9a8ee5e80 100644 (file)
--- a/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/XSSSecurityTest.java
+++ b/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/XSSSecurityTest.java
@@ -19,8 +19,8 @@ package org.apache.archiva.web.test;
  * under the License.
  */
 
-import org.testng.annotations.Test;
 import org.apache.archiva.web.test.parent.AbstractArchivaTest;
+import org.testng.annotations.Test;
 
 /**
  * Test all actions affected with XSS security issue.
@@ -31,97 +31,125 @@ public class XSSSecurityTest
 {
     public void testDeleteArtifactImmunityToURLCrossSiteScripting()
     {
-        getSelenium().open( "/archiva/deleteArtifact!doDelete.action?groupId=\"/>1<script>alert('xss')</script>&artifactId=\"/>1<script>alert('xss')</script>&version=\"/>1<script>alert('xss')</script>&repositoryId=\"/>1<script>alert('xss')</script>");
+        getSelenium().open(
+            "/archiva/deleteArtifact!doDelete.action?groupId=\"/>1<script>alert('xss')</script>&artifactId=\"/>1<script>alert('xss')</script>&version=\"/>1<script>alert('xss')</script>&repositoryId=\"/>1<script>alert('xss')</script>" );
         assertDeleteArtifactPage();
         assertTextPresent( "Invalid version." );
-        assertTextPresent( "User is not authorized to delete artifacts in repository '\"/>1<script>alert('xss')</script>'." );
-        assertTextPresent( "Group id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Artifact id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Repository id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertElementValue("//input[@id='deleteArtifact_groupId']", "\"/>1<script>alert('xss')</script>");
-        assertElementValue("//input[@id='deleteArtifact_artifactId']", "\"/>1<script>alert('xss')</script>");
-        assertElementValue("//input[@id='deleteArtifact_version']", "\"/>1<script>alert('xss')</script>");
-        assertElementValue("//select[@id='deleteArtifact_repositoryId']", "internal");
+        assertTextPresent(
+            "User is not authorized to delete artifacts in repository '\"/>1<script>alert('xss')</script>'." );
+        assertTextPresent(
+            "Group id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Artifact id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Repository id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertElementValue( "//input[@id='deleteArtifact_groupId']", "\"/>1<script>alert('xss')</script>" );
+        assertElementValue( "//input[@id='deleteArtifact_artifactId']", "\"/>1<script>alert('xss')</script>" );
+        assertElementValue( "//input[@id='deleteArtifact_version']", "\"/>1<script>alert('xss')</script>" );
+        assertElementValue( "//select[@id='deleteArtifact_repositoryId']", "internal" );
     }
 
     public void testDeleteArtifactImmunityToEncodedURLCrossSiteScripting()
     {
-        getSelenium().open( "/archiva/deleteArtifact!doDelete.action?groupId=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E&artifactId=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E&version=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E&repositoryId=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E");
+        getSelenium().open(
+            "/archiva/deleteArtifact!doDelete.action?groupId=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E&artifactId=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E&version=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E&repositoryId=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E" );
         assertDeleteArtifactPage();
         assertTextPresent( "Invalid version." );
-        assertTextPresent( "User is not authorized to delete artifacts in repository '\"/>1<script>alert('xss')</script>'." );
-        assertTextPresent( "Group id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Artifact id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Repository id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertElementValue("//input[@id='deleteArtifact_groupId']", "\"/>1<script>alert('xss')</script>");
-        assertElementValue("//input[@id='deleteArtifact_artifactId']", "\"/>1<script>alert('xss')</script>");
-        assertElementValue("//input[@id='deleteArtifact_version']", "\"/>1<script>alert('xss')</script>");
-        assertElementValue("//select[@id='deleteArtifact_repositoryId']", "internal");
+        assertTextPresent(
+            "User is not authorized to delete artifacts in repository '\"/>1<script>alert('xss')</script>'." );
+        assertTextPresent(
+            "Group id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Artifact id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Repository id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertElementValue( "//input[@id='deleteArtifact_groupId']", "\"/>1<script>alert('xss')</script>" );
+        assertElementValue( "//input[@id='deleteArtifact_artifactId']", "\"/>1<script>alert('xss')</script>" );
+        assertElementValue( "//input[@id='deleteArtifact_version']", "\"/>1<script>alert('xss')</script>" );
+        assertElementValue( "//select[@id='deleteArtifact_repositoryId']", "internal" );
     }
 
     public void testEditAppearanceImmunityToURLCrossSiteScripting()
     {
-        getSelenium().open( "/archiva/admin/configureAppearance.action?organisationName=<script>alert('xss')</script>&organisationUrl=<script>alert('xss')</script>&organisationLogo=<script>alert('xss')</script>");
+        getSelenium().open(
+            "/archiva/admin/configureAppearance.action?organisationName=<script>alert('xss')</script>&organisationUrl=<script>alert('xss')</script>&organisationLogo=<script>alert('xss')</script>" );
         assertAppearancePage();
-        assertXpathCount("//td[text()=\"<script>alert('xss')</script>\"]", 1);
-        assertXpathCount("//code[text()=\"<script>alert('xss')</script>\"]", 2);
+        assertXpathCount( "//td[text()=\"<script>alert('xss')</script>\"]", 1 );
+        assertXpathCount( "//code[text()=\"<script>alert('xss')</script>\"]", 2 );
 
     }
 
     public void testEditAppearanceImmunityToEncodedURLCrossSiteScripting()
     {
-        getSelenium().open( "/archiva/admin/configureAppearance.action?organisationName=%3Cscript%3Ealert('xss')%3C%2Fscript%3E&organisationUrl=%3Cscript%3Ealert('xss')%3C%2Fscript%3E&organisationLogo=%3Cscript%3Ealert('xss')%3C%2Fscript%3E");
+        getSelenium().open(
+            "/archiva/admin/configureAppearance.action?organisationName=%3Cscript%3Ealert('xss')%3C%2Fscript%3E&organisationUrl=%3Cscript%3Ealert('xss')%3C%2Fscript%3E&organisationLogo=%3Cscript%3Ealert('xss')%3C%2Fscript%3E" );
         assertAppearancePage();
-        assertXpathCount("//td[text()=\"<script>alert('xss')</script>\"]", 1);
-        assertXpathCount("//code[text()=\"<script>alert('xss')</script>\"]", 2);
+        assertXpathCount( "//td[text()=\"<script>alert('xss')</script>\"]", 1 );
+        assertXpathCount( "//code[text()=\"<script>alert('xss')</script>\"]", 2 );
     }
 
     public void testAddLegacyArtifactImmunityToURLCrossSiteScripting()
     {
-        getSelenium().open( "/archiva/admin/addLegacyArtifactPath!commit.action?legacyArtifactPath.path=\"/>1<script>alert('xss')</script>&groupId=\"/>1<script>alert('xss')</script>&artifactId=\"/>1<script>alert('xss')</script>&version=\"/>1<script>alert('xss')</script>&classifier=\"/>1<script>alert('xss')</script>&type=\"/>1<script>alert('xss')</script>");
+        getSelenium().open(
+            "/archiva/admin/addLegacyArtifactPath!commit.action?legacyArtifactPath.path=\"/>1<script>alert('xss')</script>&groupId=\"/>1<script>alert('xss')</script>&artifactId=\"/>1<script>alert('xss')</script>&version=\"/>1<script>alert('xss')</script>&classifier=\"/>1<script>alert('xss')</script>&type=\"/>1<script>alert('xss')</script>" );
         assertAddLegacyArtifactPathPage();
-        assertTextPresent( "Legacy path must only contain alphanumeric characters, forward-slashes(/), back-slashes(\\), underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Group id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Artifact id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Version must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Classifier must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Legacy path must only contain alphanumeric characters, forward-slashes(/), back-slashes(\\), underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Group id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Artifact id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Version must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Classifier must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
         assertTextPresent( "Type must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertElementValue("//input[@id='addLegacyArtifactPath_legacyArtifactPath_path']", "\"/>1<script>alert('xss')</script>");
-        assertElementValue("//input[@id='addLegacyArtifactPath_artifactId']", "\"/>1<script>alert('xss')</script>");
-        assertElementValue("//input[@id='addLegacyArtifactPath_version']", "\"/>1<script>alert('xss')</script>");
-        assertElementValue("//input[@id='addLegacyArtifactPath_groupId']", "\"/>1<script>alert('xss')</script>");
-        assertElementValue("//input[@id='addLegacyArtifactPath_classifier']", "\"/>1<script>alert('xss')</script>");
-        assertElementValue("//input[@id='addLegacyArtifactPath_type']", "\"/>1<script>alert('xss')</script>");
+        assertElementValue( "//input[@id='addLegacyArtifactPath_legacyArtifactPath_path']",
+                            "\"/>1<script>alert('xss')</script>" );
+        assertElementValue( "//input[@id='addLegacyArtifactPath_artifactId']", "\"/>1<script>alert('xss')</script>" );
+        assertElementValue( "//input[@id='addLegacyArtifactPath_version']", "\"/>1<script>alert('xss')</script>" );
+        assertElementValue( "//input[@id='addLegacyArtifactPath_groupId']", "\"/>1<script>alert('xss')</script>" );
+        assertElementValue( "//input[@id='addLegacyArtifactPath_classifier']", "\"/>1<script>alert('xss')</script>" );
+        assertElementValue( "//input[@id='addLegacyArtifactPath_type']", "\"/>1<script>alert('xss')</script>" );
     }
 
     public void testAddLegacyArtifactImmunityToEncodedURLCrossSiteScripting()
     {
-        getSelenium().open( "/archiva/admin/addLegacyArtifactPath!commit.action?legacyArtifactPath.path=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E&groupId=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E&artifactId=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E&version=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E&classifier=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E&type=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E");
+        getSelenium().open(
+            "/archiva/admin/addLegacyArtifactPath!commit.action?legacyArtifactPath.path=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E&groupId=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E&artifactId=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E&version=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E&classifier=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E&type=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E" );
         assertAddLegacyArtifactPathPage();
-        assertTextPresent( "Legacy path must only contain alphanumeric characters, forward-slashes(/), back-slashes(\\), underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Group id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Artifact id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Version must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Classifier must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Legacy path must only contain alphanumeric characters, forward-slashes(/), back-slashes(\\), underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Group id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Artifact id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Version must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Classifier must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
         assertTextPresent( "Type must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertElementValue("//input[@id='addLegacyArtifactPath_legacyArtifactPath_path']", "\"/>1<script>alert('xss')</script>");
-        assertElementValue("//input[@id='addLegacyArtifactPath_artifactId']", "\"/>1<script>alert('xss')</script>");
-        assertElementValue("//input[@id='addLegacyArtifactPath_version']", "\"/>1<script>alert('xss')</script>");
-        assertElementValue("//input[@id='addLegacyArtifactPath_groupId']", "\"/>1<script>alert('xss')</script>");
-        assertElementValue("//input[@id='addLegacyArtifactPath_classifier']", "\"/>1<script>alert('xss')</script>");
-        assertElementValue("//input[@id='addLegacyArtifactPath_type']", "\"/>1<script>alert('xss')</script>");
+        assertElementValue( "//input[@id='addLegacyArtifactPath_legacyArtifactPath_path']",
+                            "\"/>1<script>alert('xss')</script>" );
+        assertElementValue( "//input[@id='addLegacyArtifactPath_artifactId']", "\"/>1<script>alert('xss')</script>" );
+        assertElementValue( "//input[@id='addLegacyArtifactPath_version']", "\"/>1<script>alert('xss')</script>" );
+        assertElementValue( "//input[@id='addLegacyArtifactPath_groupId']", "\"/>1<script>alert('xss')</script>" );
+        assertElementValue( "//input[@id='addLegacyArtifactPath_classifier']", "\"/>1<script>alert('xss')</script>" );
+        assertElementValue( "//input[@id='addLegacyArtifactPath_type']", "\"/>1<script>alert('xss')</script>" );
     }
 
     public void testDeleteNetworkProxyImmunityToURLCrossSiteScripting()
     {
-        getSelenium().open( "/archiva/admin/deleteNetworkProxy!confirm.action?proxyid=\"/>1<script>alert('xss')</script>");
+        getSelenium().open(
+            "/archiva/admin/deleteNetworkProxy!confirm.action?proxyid=\"/>1<script>alert('xss')</script>" );
         assertTextPresent( "Security Alert - Invalid Token Found" );
         assertTextPresent( "Possible CSRF attack detected! Invalid token found in the request." );
     }
 
     public void testDeleteNetworkProxyImmunityToEncodedURLCrossSiteScripting()
     {
-        getSelenium().open( "/archiva/admin/deleteNetworkProxy!confirm.action?proxyid=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E");
+        getSelenium().open(
+            "/archiva/admin/deleteNetworkProxy!confirm.action?proxyid=%22%2F%3E1%3Cscript%3Ealert('xss')%3C%2Fscript%3E" );
         assertTextPresent( "Security Alert - Invalid Token Found" );
         assertTextPresent( "Possible CSRF attack detected! Invalid token found in the request." );
     }
@@ -130,61 +158,83 @@ public class XSSSecurityTest
     {
         goToRepositoriesPage();
         getSelenium().open( "/archiva/admin/addRepository.action" );
-       addManagedRepository( "test\"><script>alert('xss')</script>", "test\"><script>alert('xss')</script>" , "test\"><script>alert('xss')</script>" , "test\"><script>alert('xss')</script>", "Maven 2.x Repository", "", "-1", "101" );
+        addManagedRepository( "test\"><script>alert('xss')</script>", "test\"><script>alert('xss')</script>",
+                              "test\"><script>alert('xss')</script>", "test\"><script>alert('xss')</script>",
+                              "Maven 2.x Repository", "", "-1", "101" );
         // xss inputs are blocked by validation.
-       assertTextPresent( "Identifier must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-       assertTextPresent( "Directory must only contain alphanumeric characters, equals(=), question-marks(?), exclamation-points(!), ampersands(&), forward-slashes(/), back-slashes(\\), underscores(_), dots(.), colons(:), tildes(~), and dashes(-)." );
-       assertTextPresent( "Repository Name must only contain alphanumeric characters, white-spaces(' '), forward-slashes(/), open-parenthesis('('), close-parenthesis(')'), underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Index directory must only contain alphanumeric characters, equals(=), question-marks(?), exclamation-points(!), ampersands(&), forward-slashes(/), back-slashes(\\), underscores(_), dots(.), colons(:), tildes(~), and dashes(-)." );
-        assertTextPresent( "Repository Purge By Retention Count needs to be between 1 and 100.");
-        assertTextPresent( "Repository Purge By Days Older Than needs to be larger than 0.");
-       assertTextPresent( "Invalid cron expression." );
+        assertTextPresent(
+            "Identifier must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Directory must only contain alphanumeric characters, equals(=), question-marks(?), exclamation-points(!), ampersands(&), forward-slashes(/), back-slashes(\\), underscores(_), dots(.), colons(:), tildes(~), and dashes(-)." );
+        assertTextPresent(
+            "Repository Name must only contain alphanumeric characters, white-spaces(' '), forward-slashes(/), open-parenthesis('('), close-parenthesis(')'), underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Index directory must only contain alphanumeric characters, equals(=), question-marks(?), exclamation-points(!), ampersands(&), forward-slashes(/), back-slashes(\\), underscores(_), dots(.), colons(:), tildes(~), and dashes(-)." );
+        assertTextPresent( "Repository Purge By Retention Count needs to be between 1 and 100." );
+        assertTextPresent( "Repository Purge By Days Older Than needs to be larger than 0." );
+        assertTextPresent( "Invalid cron expression." );
     }
 
     public void testEditAppearanceImmunityToInputFieldCrossSiteScripting()
     {
         goToAppearancePage();
         clickLinkWithText( "Edit" );
-        addEditAppearance( "test<script>alert('xss')</script>" , "test<script>alert('xss')</script>" , "test<script>alert('xss')</script>" );
+        addEditAppearance( "test<script>alert('xss')</script>", "test<script>alert('xss')</script>",
+                           "test<script>alert('xss')</script>", false );
         // xss inputs are blocked by validation.
-        assertTextPresent( "Organisation name must only contain alphanumeric characters, white-spaces(' '), equals(=), question-marks(?), exclamation-points(!), ampersands(&), forward-slashes(/), back-slashes(\\), underscores(_), dots(.), colons(:), tildes(~), and dashes(-)." );
+        assertTextPresent(
+            "Organisation name must only contain alphanumeric characters, white-spaces(' '), equals(=), question-marks(?), exclamation-points(!), ampersands(&), forward-slashes(/), back-slashes(\\), underscores(_), dots(.), colons(:), tildes(~), and dashes(-)." );
         assertTextPresent( "You must enter a URL" );
-        assertXpathCount("//span[@class='errorMessage' and text()='You must enter a URL']", 2);
+        assertXpathCount( "//span[@class='errorMessage' and text()='You must enter a URL']", 2 );
     }
 
     public void testEditAppearanceImmunityToCrossSiteScriptingRendering()
     {
         goToAppearancePage();
         clickLinkWithText( "Edit" );
-        addEditAppearance( "xss" , "http://\">test<script>alert(\"xss\")</script>" , "http://\">test<script>alert(\"xss\")</script>" );
+        addEditAppearance( "xss", "http://\">test<script>alert(\"xss\")</script>",
+                           "http://\">test<script>alert(\"xss\")</script>", false );
         // escaped html/url prevents cross-site scripting exploits
-        assertXpathCount("//td[text()=\"xss\"]", 1);
-        assertXpathCount("//code[text()='http://\">test<script>alert(\"xss\")</script>']", 2);
+        assertXpathCount( "//td[text()=\"xss\"]", 1 );
+        assertXpathCount( "//code[text()='http://\">test<script>alert(\"xss\")</script>']", 2 );
     }
 
     public void testAddLegacyArtifactPathImmunityToInputFieldCrossSiteScripting()
     {
         goToLegacySupportPage();
-       clickLinkWithText( "Add" );
-        addLegacyArtifactPath( "test<script>alert('xss')</script>" , "test<script>alert('xss')</script>" , "test<script>alert('xss')</script>" , "test<script>alert('xss')</script>" , "test<script>alert('xss')</script>" , "test<script>alert('xss')</script>");
-       // xss inputs are blocked by validation.
-        assertTextPresent( "Legacy path must only contain alphanumeric characters, forward-slashes(/), back-slashes(\\), underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Group id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Artifact id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Version must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Classifier must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        clickLinkWithText( "Add" );
+        addLegacyArtifactPath( "test<script>alert('xss')</script>", "test<script>alert('xss')</script>",
+                               "test<script>alert('xss')</script>", "test<script>alert('xss')</script>",
+                               "test<script>alert('xss')</script>", "test<script>alert('xss')</script>" );
+        // xss inputs are blocked by validation.
+        assertTextPresent(
+            "Legacy path must only contain alphanumeric characters, forward-slashes(/), back-slashes(\\), underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Group id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Artifact id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Version must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Classifier must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
         assertTextPresent( "Type must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
     }
 
     public void testAddNetworkProxyImmunityToInputFieldCrossSiteScripting()
     {
         goToNetworkProxiesPage();
-       addNetworkProxy( "test<script>alert('xss')</script>", "test<script>alert('xss')</script>", "test<script>alert('xss')</script>", "test<script>alert('xss')</script>", "test<script>alert('xss')</script>", "");
-       // xss inputs are blocked by validation.
-        assertTextPresent( "Proxy id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
-        assertTextPresent( "Protocol must only contain alphanumeric characters, forward-slashes(/), back-slashes(\\), dots(.), colons(:), and dashes(-)." );
-        assertTextPresent( "Host must only contain alphanumeric characters, equals(=), question-marks(?), exclamation-points(!), ampersands(&), forward-slashes(/), back-slashes(\\), underscores(_), dots(.), colons(:), tildes(~), and dashes(-)." );
+        addNetworkProxy( "test<script>alert('xss')</script>", "test<script>alert('xss')</script>",
+                         "test<script>alert('xss')</script>", "test<script>alert('xss')</script>",
+                         "test<script>alert('xss')</script>", "" );
+        // xss inputs are blocked by validation.
+        assertTextPresent(
+            "Proxy id must only contain alphanumeric characters, underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Protocol must only contain alphanumeric characters, forward-slashes(/), back-slashes(\\), dots(.), colons(:), and dashes(-)." );
+        assertTextPresent(
+            "Host must only contain alphanumeric characters, equals(=), question-marks(?), exclamation-points(!), ampersands(&), forward-slashes(/), back-slashes(\\), underscores(_), dots(.), colons(:), tildes(~), and dashes(-)." );
         assertTextPresent( "Invalid field value for field \"proxy.port\"." );
-        assertTextPresent( "Username must only contain alphanumeric characters, at's(@), forward-slashes(/), back-slashes(\\), underscores(_), dots(.), and dashes(-)." );
+        assertTextPresent(
+            "Username must only contain alphanumeric characters, at's(@), forward-slashes(/), back-slashes(\\), underscores(_), dots(.), and dashes(-)." );
     }
 }
\ No newline at end of file

diff --git a/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/parent/AbstractArchivaTest.java b/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/parent/AbstractArchivaTest.java
index 9a4bb625ad1d5651d7ba1a415cef797c1a935bd9..e838e0b27d736d55770e5d987b65206ba55b8d46 100644 (file)
--- a/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/parent/AbstractArchivaTest.java
+++ b/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/parent/AbstractArchivaTest.java
@@ -480,12 +480,12 @@ public abstract class AbstractArchivaTest
         assertLinkPresent( "Change your appearance" );
     }
 
-    public void addEditAppearance( String name, String url, String logoUrl )
+    public void addEditAppearance( String name, String url, String logoUrl, boolean wait)
     {
         setFieldValue( "organisationName", name );
         setFieldValue( "organisationUrl", url );
         setFieldValue( "organisationLogo", logoUrl );
-        clickButtonWithValue( "Save" );
+        clickButtonWithValue( "Save", wait );
     }
 
     public void goToHomePage()

diff --git a/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/parent/AbstractSeleniumTest.java b/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/parent/AbstractSeleniumTest.java
index f855b5332dfc7e529537162bf3cf1c29ebb48d21..a36db0234534eb7213f738ac9b932f40e570a53d 100644 (file)
--- a/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/parent/AbstractSeleniumTest.java
+++ b/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/parent/AbstractSeleniumTest.java
@@ -431,7 +431,8 @@ public abstract class AbstractSeleniumTest
 
     public void assertXpathCount( String locator, int expectedCount )
     {
-        Assert.assertEquals( getSelenium().getXpathCount( locator ).intValue(), expectedCount );
+        int count = getSelenium().getXpathCount( locator ).intValue();
+        Assert.assertEquals( count, expectedCount );
     }
 
     public void assertElementValue( String locator, String expectedValue )