Skip to content

Commit eb039c6

Browse files
ThoriumThorium
committed
Test to fix CI
1 parent 719fd46 commit eb039c6

1 file changed

Lines changed: 82 additions & 17 deletions

File tree

‎tests/Giraffe.Tests/SecurityTests.fs‎

Lines changed: 82 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -67,10 +67,17 @@ let ``redirectTo allows absolute URLs to same host`` () =
6767
[<Fact>]
6868
let ``redirectTo blocks open redirect to external domain`` () =
6969
let ctx = Substitute.For<HttpContext>()
70+
let loggerFactory = Substitute.For<ILoggerFactory>()
7071
let logger = Substitute.For<ILogger>()
72+
loggerFactory.CreateLogger(Arg.Any<string>()).Returns logger |> ignore
73+
let serviceProvider = Substitute.For<IServiceProvider>()
74+
75+
serviceProvider.GetService(typeof<ILoggerFactory>).Returns loggerFactory
76+
|> ignore
77+
78+
ctx.RequestServices.Returns serviceProvider |> ignore
7179
ctx.Response.Body <- new MemoryStream()
7280
ctx.Request.Host <- HostString "example.com"
73-
ctx.GetLogger(Arg.Any<string>()).Returns(logger) |> ignore
7481

7582
let app = redirectTo false "https://evil.com/phishing"
7683

@@ -97,10 +104,17 @@ let ``redirectTo blocks open redirect to external domain`` () =
97104
[<Fact>]
98105
let ``redirectTo blocks javascript protocol XSS attempt`` () =
99106
let ctx = Substitute.For<HttpContext>()
107+
let loggerFactory = Substitute.For<ILoggerFactory>()
100108
let logger = Substitute.For<ILogger>()
109+
loggerFactory.CreateLogger(Arg.Any<string>()).Returns logger |> ignore
110+
let serviceProvider = Substitute.For<IServiceProvider>()
111+
112+
serviceProvider.GetService(typeof<ILoggerFactory>).Returns loggerFactory
113+
|> ignore
114+
115+
ctx.RequestServices.Returns serviceProvider |> ignore
101116
ctx.Response.Body <- new MemoryStream()
102117
ctx.Request.Host <- HostString "example.com"
103-
ctx.GetLogger(Arg.Any<string>()).Returns(logger) |> ignore
104118

105119
let app = redirectTo false "javascript:alert('xss')"
106120

@@ -115,10 +129,17 @@ let ``redirectTo blocks javascript protocol XSS attempt`` () =
115129
[<Fact>]
116130
let ``redirectTo blocks empty or whitespace URLs`` () =
117131
let ctx = Substitute.For<HttpContext>()
132+
let loggerFactory = Substitute.For<ILoggerFactory>()
118133
let logger = Substitute.For<ILogger>()
134+
loggerFactory.CreateLogger(Arg.Any<string>()).Returns logger |> ignore
135+
let serviceProvider = Substitute.For<IServiceProvider>()
136+
137+
serviceProvider.GetService(typeof<ILoggerFactory>).Returns loggerFactory
138+
|> ignore
139+
140+
ctx.RequestServices.Returns serviceProvider |> ignore
119141
ctx.Response.Body <- new MemoryStream()
120142
ctx.Request.Host <- HostString "example.com"
121-
ctx.GetLogger(Arg.Any<string>()).Returns(logger) |> ignore
122143

123144
let app = redirectTo false " "
124145

@@ -154,8 +175,10 @@ let ``redirectTo with permanent flag calls Redirect with true`` () =
154175
let ``validateCsrfToken succeeds with valid token`` () =
155176
let ctx = Substitute.For<HttpContext>()
156177
let antiforgery = Substitute.For<IAntiforgery>()
178+
let serviceProvider = Substitute.For<IServiceProvider>()
179+
serviceProvider.GetService(typeof<IAntiforgery>).Returns antiforgery |> ignore
180+
ctx.RequestServices.Returns serviceProvider |> ignore
157181
ctx.Response.Body <- new MemoryStream()
158-
ctx.GetService<IAntiforgery>().Returns antiforgery |> ignore
159182

160183
antiforgery.IsRequestValidAsync(ctx).Returns(System.Threading.Tasks.Task.FromResult(true))
161184
|> ignore
@@ -181,11 +204,18 @@ let ``validateCsrfToken succeeds with valid token`` () =
181204
let ``validateCsrfToken fails with invalid token`` () =
182205
let ctx = Substitute.For<HttpContext>()
183206
let antiforgery = Substitute.For<IAntiforgery>()
207+
let loggerFactory = Substitute.For<ILoggerFactory>()
184208
let logger = Substitute.For<ILogger>()
209+
loggerFactory.CreateLogger(Arg.Any<string>()).Returns logger |> ignore
210+
let serviceProvider = Substitute.For<IServiceProvider>()
211+
serviceProvider.GetService(typeof<IAntiforgery>).Returns antiforgery |> ignore
212+
213+
serviceProvider.GetService(typeof<ILoggerFactory>).Returns loggerFactory
214+
|> ignore
215+
216+
ctx.RequestServices.Returns serviceProvider |> ignore
185217
ctx.Response.Body <- new MemoryStream()
186218
ctx.Request.Path <- PathString("/test")
187-
ctx.GetService<IAntiforgery>().Returns antiforgery |> ignore
188-
ctx.GetLogger(Arg.Any<string>()).Returns logger |> ignore
189219

190220
antiforgery.IsRequestValidAsync(ctx).Returns(System.Threading.Tasks.Task.FromResult false)
191221
|> ignore
@@ -211,11 +241,18 @@ let ``validateCsrfToken fails with invalid token`` () =
211241
let ``validateCsrfToken fails on exception`` () =
212242
let ctx = Substitute.For<HttpContext>()
213243
let antiforgery = Substitute.For<IAntiforgery>()
244+
let loggerFactory = Substitute.For<ILoggerFactory>()
214245
let logger = Substitute.For<ILogger>()
246+
loggerFactory.CreateLogger(Arg.Any<string>()).Returns logger |> ignore
247+
let serviceProvider = Substitute.For<IServiceProvider>()
248+
serviceProvider.GetService(typeof<IAntiforgery>).Returns antiforgery |> ignore
249+
250+
serviceProvider.GetService(typeof<ILoggerFactory>).Returns loggerFactory
251+
|> ignore
252+
253+
ctx.RequestServices.Returns serviceProvider |> ignore
215254
ctx.Response.Body <- new MemoryStream()
216255
ctx.Request.Path <- PathString "/test"
217-
ctx.GetService<IAntiforgery>().Returns antiforgery |> ignore
218-
ctx.GetLogger(Arg.Any<string>()).Returns logger |> ignore
219256

220257
antiforgery
221258
.IsRequestValidAsync(ctx)
@@ -247,9 +284,11 @@ let ``generateCsrfToken stores token in context items`` () =
247284
let tokens =
248285
AntiforgeryTokenSet("test-request-token", "test-cookie-token", "form-field", "X-CSRF-TOKEN")
249286

287+
let serviceProvider = Substitute.For<IServiceProvider>()
288+
serviceProvider.GetService(typeof<IAntiforgery>).Returns antiforgery |> ignore
289+
ctx.RequestServices.Returns serviceProvider |> ignore
250290
ctx.Response.Body <- new MemoryStream()
251291
ctx.Items <- Dictionary<obj, obj>() :> IDictionary<obj, obj>
252-
ctx.GetService<IAntiforgery>().Returns antiforgery |> ignore
253292
antiforgery.GetAndStoreTokens(ctx).Returns tokens |> ignore
254293

255294
let mutable nextCalled = false
@@ -280,9 +319,15 @@ let ``csrfTokenJson returns token as JSON`` () =
280319
let tokens =
281320
AntiforgeryTokenSet("test-token-value", "cookie-value", "form-field", "X-CSRF-TOKEN")
282321

283-
mockJson ctx
322+
let serviceProvider = Substitute.For<IServiceProvider>()
323+
serviceProvider.GetService(typeof<IAntiforgery>).Returns antiforgery |> ignore
324+
let jsonSerializer = Json.Serializer(Json.Serializer.DefaultOptions)
325+
326+
serviceProvider.GetService(typeof<Json.ISerializer>).Returns jsonSerializer
327+
|> ignore
328+
329+
ctx.RequestServices.Returns serviceProvider |> ignore
284330
ctx.Response.Body <- new MemoryStream()
285-
ctx.GetService<IAntiforgery>().Returns antiforgery |> ignore
286331
antiforgery.GetAndStoreTokens(ctx).Returns tokens |> ignore
287332

288333
task {
@@ -305,8 +350,10 @@ let ``csrfTokenHtml returns token as hidden input`` () =
305350
let tokens =
306351
AntiforgeryTokenSet("test-token-value", "cookie-value", "form-field", "X-CSRF-TOKEN")
307352

353+
let serviceProvider = Substitute.For<IServiceProvider>()
354+
serviceProvider.GetService(typeof<IAntiforgery>).Returns antiforgery |> ignore
355+
ctx.RequestServices.Returns serviceProvider |> ignore
308356
ctx.Response.Body <- new MemoryStream()
309-
ctx.GetService<IAntiforgery>().Returns antiforgery |> ignore
310357
antiforgery.GetAndStoreTokens(ctx).Returns tokens |> ignore
311358

312359
task {
@@ -473,10 +520,17 @@ let ``redirectToExt allows custom error handler for invalid redirects`` () =
473520
[<Fact>]
474521
let ``redirectToExt with None handler uses default behavior`` () =
475522
let ctx = Substitute.For<HttpContext>()
523+
let loggerFactory = Substitute.For<ILoggerFactory>()
476524
let logger = Substitute.For<ILogger>()
525+
loggerFactory.CreateLogger(Arg.Any<string>()).Returns logger |> ignore
526+
let serviceProvider = Substitute.For<IServiceProvider>()
527+
528+
serviceProvider.GetService(typeof<ILoggerFactory>).Returns loggerFactory
529+
|> ignore
530+
531+
ctx.RequestServices.Returns serviceProvider |> ignore
477532
ctx.Response.Body <- new MemoryStream()
478533
ctx.Request.Host <- HostString("example.com")
479-
ctx.GetLogger(Arg.Any<string>()).Returns logger |> ignore
480534

481535
let app = redirectToExt false "https://evil.com/phishing" None
482536

@@ -505,9 +559,11 @@ let ``isValidRedirectUrl correctly validates safe URLs`` () =
505559
let ``validateCsrfTokenExt allows custom error handler for invalid tokens`` () =
506560
let ctx = Substitute.For<HttpContext>()
507561
let antiforgery = Substitute.For<IAntiforgery>()
562+
let serviceProvider = Substitute.For<IServiceProvider>()
563+
serviceProvider.GetService(typeof<IAntiforgery>).Returns antiforgery |> ignore
564+
ctx.RequestServices.Returns serviceProvider |> ignore
508565
ctx.Response.Body <- new MemoryStream()
509566
ctx.Request.Path <- PathString "/test"
510-
ctx.GetService<IAntiforgery>().Returns antiforgery |> ignore
511567

512568
antiforgery.IsRequestValidAsync(ctx).Returns(System.Threading.Tasks.Task.FromResult false)
513569
|> ignore
@@ -538,11 +594,18 @@ let ``validateCsrfTokenExt allows custom error handler for invalid tokens`` () =
538594
let ``validateCsrfTokenExt with None handler uses default behavior`` () =
539595
let ctx = Substitute.For<HttpContext>()
540596
let antiforgery = Substitute.For<IAntiforgery>()
597+
let loggerFactory = Substitute.For<ILoggerFactory>()
541598
let logger = Substitute.For<ILogger>()
599+
loggerFactory.CreateLogger(Arg.Any<string>()).Returns logger |> ignore
600+
let serviceProvider = Substitute.For<IServiceProvider>()
601+
serviceProvider.GetService(typeof<IAntiforgery>).Returns antiforgery |> ignore
602+
603+
serviceProvider.GetService(typeof<ILoggerFactory>).Returns loggerFactory
604+
|> ignore
605+
606+
ctx.RequestServices.Returns serviceProvider |> ignore
542607
ctx.Response.Body <- new MemoryStream()
543608
ctx.Request.Path <- PathString "/test"
544-
ctx.GetService<IAntiforgery>().Returns antiforgery |> ignore
545-
ctx.GetLogger(Arg.Any<string>()).Returns logger |> ignore
546609

547610
antiforgery.IsRequestValidAsync(ctx).Returns(System.Threading.Tasks.Task.FromResult false)
548611
|> ignore
@@ -568,8 +631,10 @@ let ``validateCsrfTokenExt with None handler uses default behavior`` () =
568631
let ``requireAntiforgeryTokenExt is alias for validateCsrfTokenExt`` () =
569632
let ctx = Substitute.For<HttpContext>()
570633
let antiforgery = Substitute.For<IAntiforgery>()
634+
let serviceProvider = Substitute.For<IServiceProvider>()
635+
serviceProvider.GetService(typeof<IAntiforgery>).Returns antiforgery |> ignore
636+
ctx.RequestServices.Returns serviceProvider |> ignore
571637
ctx.Response.Body <- new MemoryStream()
572-
ctx.GetService<IAntiforgery>().Returns antiforgery |> ignore
573638

574639
antiforgery.IsRequestValidAsync(ctx).Returns(System.Threading.Tasks.Task.FromResult true)
575640
|> ignore

0 commit comments

Comments
 (0)