[MRM-1460] added selenium tests for CSRF fixes in affected pages

git-svn-id: https://svn.apache.org/repos/asf/archiva/branches/archiva-1.3.x@1090975 13f79535-47bb-0310-9956-ffa450edef68

diff --git a/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/CSRFSecurityTest.java b/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/CSRFSecurityTest.java
new file mode 100644 (file)
index 0000000..5135056
--- /dev/null
+++ b/archiva-modules/archiva-web/archiva-webapp-test/src/test/testng/org/apache/archiva/web/test/CSRFSecurityTest.java
@@ -0,0 +1,130 @@
+package org.apache.archiva.web.test;
+
+import org.apache.archiva.web.test.parent.AbstractArchivaTest;
+import org.testng.annotations.Test;
+
+/**
+ * Test all actions affected with CSRF security issue.
+ */
+@Test( groups = { "csrf" }, dependsOnMethods = { "testWithCorrectUsernamePassword" }, sequential = true )
+public class CSRFSecurityTest
+    extends AbstractArchivaTest
+{
+    public void testCSRFDeleteRepository()
+    {
+        getSelenium().open( baseUrl );
+        getSelenium().open( baseUrl + "/admin/deleteRepository.action?repoid=test&method%3AdeleteContents=Delete+Configuration+and+Contents" );
+        assertTextPresent( "Security Alert - Invalid Token Found" );
+        assertTextPresent( "Possible CSRF attack detected! Invalid token found in the request." );
+    }
+
+    public void testCSRFDeleteArtifact()
+    {
+        getSelenium().open( baseUrl );
+        getSelenium().open( baseUrl + "/deleteArtifact!doDelete.action?groupId=1&artifactId=1&version=1&repositoryId=snapshots" );
+        assertTextPresent( "Security Alert - Invalid Token Found" );
+        assertTextPresent( "Possible CSRF attack detected! Invalid token found in the request." );
+    }
+
+    public void testCSRFAddRepositoryGroup()
+    {
+        getSelenium().open( baseUrl );
+        getSelenium().open( baseUrl + "/admin/addRepositoryGroup.action?repositoryGroup.id=csrfgrp" );
+        assertTextPresent( "Security Alert - Invalid Token Found" );
+        assertTextPresent( "Possible CSRF attack detected! Invalid token found in the request." );    
+    }
+
+    public void testCSRFDeleteRepositoryGroup()
+    {
+        getSelenium().open( baseUrl );
+        getSelenium().open( baseUrl + "/admin/deleteRepositoryGroup.action?repoGroupId=test&method%3Adelete=Confirm" );
+        assertTextPresent( "Security Alert - Invalid Token Found" );
+        assertTextPresent( "Possible CSRF attack detected! Invalid token found in the request." );
+    }
+
+    public void testCSRFDisableProxyConnector()
+    {
+        getSelenium().open( baseUrl );
+        getSelenium().open( baseUrl + "/admin/disableProxyConnector!disable.action?target=maven2-repository.dev.java.net&source=internal" );
+        assertTextPresent( "Security Alert - Invalid Token Found" );
+        assertTextPresent( "Possible CSRF attack detected! Invalid token found in the request." );
+    }
+
+    public void testCSRFDeleteProxyConnector()
+    {
+        getSelenium().open( baseUrl );
+        getSelenium().open( baseUrl + "/admin/deleteProxyConnector!delete.action?target=maven2-repository.dev.java.net&source=snapshots" );
+        assertTextPresent( "Security Alert - Invalid Token Found" );
+        assertTextPresent( "Possible CSRF attack detected! Invalid token found in the request." );
+    }
+
+    public void testCSRFDeleteLegacyArtifactPath()
+    {
+        getSelenium().open( baseUrl );
+        getSelenium().open( baseUrl + "/admin/deleteLegacyArtifactPath.action?path=jaxen%2Fjars%2Fjaxen-1.0-FCS-full.jar" );
+        assertTextPresent( "Security Alert - Invalid Token Found" );
+        assertTextPresent( "Possible CSRF attack detected! Invalid token found in the request." );      
+    }
+
+    public void testCSRFSaveNetworkProxy()
+    {
+        getSelenium().open( baseUrl );
+        getSelenium().open( baseUrl + "/admin/saveNetworkProxy.action?mode=add&proxy.id=ntwrk&proxy.protocol=http&" +
+            "proxy.host=test&proxy.port=8080&proxy.username=&proxy.password=" );
+        assertTextPresent( "Security Alert - Invalid Token Found" );
+        assertTextPresent( "Possible CSRF attack detected! Invalid token found in the request." );
+    }
+
+    public void testCSRFDeleteNetworkProxy()
+    {
+        getSelenium().open( baseUrl );
+        getSelenium().open( baseUrl + "/admin/deleteNetworkProxy!delete.action?proxyid=myproxy" );
+        assertTextPresent( "Security Alert - Invalid Token Found" );
+        assertTextPresent( "Possible CSRF attack detected! Invalid token found in the request." );    
+    }
+
+    public void testCSRFAddFileTypePattern()
+    {
+        getSelenium().open( baseUrl );
+        getSelenium().open( baseUrl + "/admin/repositoryScanning!addFiletypePattern.action?pattern=**%2F*.rum&fileTypeId=artifacts" );
+        assertTextPresent( "Security Alert - Invalid Token Found" );
+        assertTextPresent( "Possible CSRF attack detected! Invalid token found in the request." );
+    }
+
+    public void testCSRFRemoveFileTypePattern()
+    {
+        getSelenium().open( baseUrl );
+        getSelenium().open( baseUrl + "/admin/repositoryScanning!removeFiletypePattern.action?pattern=**%2F*.rum&fileTypeId=artifacts" );
+        assertTextPresent( "Security Alert - Invalid Token Found" );
+        assertTextPresent( "Possible CSRF attack detected! Invalid token found in the request." );    
+    }
+
+    public void testCSRFUpdateKnownConsumers()
+    {
+        getSelenium().open( baseUrl );
+        getSelenium().open( baseUrl + "/admin/repositoryScanning!updateKnownConsumers.action?enabledKnownContentConsumers=auto-remove&" +
+            "enabledKnownContentConsumers=auto-rename&enabledKnownContentConsumers=create-missing-checksums&" +
+            "enabledKnownContentConsumers=index-content&enabledKnownContentConsumers=metadata-updater&" +
+            "enabledKnownContentConsumers=repository-purge&enabledKnownContentConsumers=update-db-artifact&" +
+            "enabledKnownContentConsumers=validate-checksums" );
+        assertTextPresent( "Security Alert - Invalid Token Found" );
+        assertTextPresent( "Possible CSRF attack detected! Invalid token found in the request." );
+    }
+
+    public void testCSRFUpdateUnprocessedConsumers()
+    {
+        getSelenium().open( baseUrl );
+        getSelenium().open( baseUrl + "/admin/database!updateUnprocessedConsumers.action?enabledUnprocessedConsumers=update-db-project" );
+        assertTextPresent( "Security Alert - Invalid Token Found" );
+        assertTextPresent( "Possible CSRF attack detected! Invalid token found in the request." );
+    }
+
+    public void testCSRFUpdateCleanupConsumers()
+    {
+        getSelenium().open( baseUrl );
+        getSelenium().open( baseUrl + "/admin/database!updateCleanupConsumers.action?enabledCleanupConsumers=not-present-remove-db-artifact&" +
+            "enabledCleanupConsumers=not-present-remove-db-project&enabledCleanupConsumers=not-present-remove-indexed" );
+        assertTextPresent( "Security Alert - Invalid Token Found" );
+        assertTextPresent( "Possible CSRF attack detected! Invalid token found in the request." );    
+    }
+}