Rocket/contrib/lib/tests/helmet.rs

150 lines
5.2 KiB
Rust
Raw Normal View History

#[macro_use]
#[cfg(feature = "helmet")]
extern crate rocket;
#[cfg(feature = "helmet")]
mod helmet_tests {
use rocket::http::{Status, uri::Uri};
use rocket::local::blocking::{Client, LocalResponse};
2019-06-13 02:17:59 +00:00
use rocket_contrib::helmet::*;
use time::Duration;
#[get("/")] fn hello() { }
macro_rules! assert_header {
($response:ident, $name:expr, $value:expr) => {
match $response.headers().get_one($name) {
Some(value) => assert_eq!(value, $value),
None => panic!("missing header '{}' with value '{}'", $name, $value)
}
};
}
macro_rules! assert_no_header {
($response:ident, $name:expr) => {
if let Some(value) = $response.headers().get_one($name) {
panic!("unexpected header: '{}={}", $name, value);
}
};
}
macro_rules! dispatch {
($helmet:expr, $closure:expr) => {{
let rocket = rocket::ignite().mount("/", routes![hello]).attach($helmet);
Test 'secret_key' validation, now on pre-launch. Prior to this commit, it was not possible to test Rocket crates in production mode without setting a global secret key or bypassing secret key checking - the testing script did the latter. The consequence is that it became impossible to test secret key related failures because the tests passed regardless. This commit undoes this. As a consequence, all tests are now aware of the difference between debug and release configurations, the latter of which validates 'secret_key' by default. New 'Client::debug()' and 'Client::debug_with()' simplify creating an instance of 'Client' with configuration in debug mode to avoid undesired test failures. The summary of changes in this commit are: * Config 'secret_key' success and failure are now tested. * 'secret_key' validation was moved to pre-launch from 'Config:from()'. * 'Config::from()' only extracts the config. * Added 'Config::try_from()' for non-panicking extraction. * 'Config' now knows the profile it was extracted from. * The 'Config' provider sets a profile of 'Config.profile'. * 'Rocket', 'Client', 'Fairings', implement 'Debug'. * 'fairing::Info' implements 'Copy', 'Clone'. * 'Fairings' keeps track of, logs attach fairings. * 'Rocket::reconfigure()' was added to allow modifying a config. Internally, the testing script was refactored to properly test the codebase with the new changes. In particular, it no longer sets a rustc 'cfg' to avoid secret-key checking. Resolves #1543. Fixes #1564.
2021-03-09 08:07:43 +00:00
let client = Client::debug(rocket).unwrap();
let response = client.get("/").dispatch();
assert_eq!(response.status(), Status::Ok);
$closure(response)
}}
}
#[test]
fn default_headers_test() {
2019-06-13 02:17:59 +00:00
dispatch!(SpaceHelmet::default(), |response: LocalResponse<'_>| {
assert_header!(response, "X-XSS-Protection", "1");
assert_header!(response, "X-Frame-Options", "SAMEORIGIN");
assert_header!(response, "X-Content-Type-Options", "nosniff");
})
}
#[test]
fn disable_headers_test() {
let helmet = SpaceHelmet::default().disable::<XssFilter>();
2019-06-13 02:17:59 +00:00
dispatch!(helmet, |response: LocalResponse<'_>| {
assert_header!(response, "X-Frame-Options", "SAMEORIGIN");
assert_header!(response, "X-Content-Type-Options", "nosniff");
assert_no_header!(response, "X-XSS-Protection");
});
let helmet = SpaceHelmet::default().disable::<Frame>();
2019-06-13 02:17:59 +00:00
dispatch!(helmet, |response: LocalResponse<'_>| {
assert_header!(response, "X-XSS-Protection", "1");
assert_header!(response, "X-Content-Type-Options", "nosniff");
assert_no_header!(response, "X-Frame-Options");
});
let helmet = SpaceHelmet::default()
.disable::<Frame>()
.disable::<XssFilter>()
.disable::<NoSniff>();
2019-06-13 02:17:59 +00:00
dispatch!(helmet, |response: LocalResponse<'_>| {
assert_no_header!(response, "X-Frame-Options");
assert_no_header!(response, "X-XSS-Protection");
assert_no_header!(response, "X-Content-Type-Options");
});
2019-06-13 02:17:59 +00:00
dispatch!(SpaceHelmet::new(), |response: LocalResponse<'_>| {
assert_no_header!(response, "X-Frame-Options");
assert_no_header!(response, "X-XSS-Protection");
assert_no_header!(response, "X-Content-Type-Options");
});
}
#[test]
fn additional_headers_test() {
let helmet = SpaceHelmet::default()
.enable(Hsts::default())
.enable(ExpectCt::default())
.enable(Referrer::default());
2019-06-13 02:17:59 +00:00
dispatch!(helmet, |response: LocalResponse<'_>| {
assert_header!(
response,
"Strict-Transport-Security",
2020-03-25 21:39:55 +00:00
format!("max-age={}", Duration::weeks(52).whole_seconds())
);
assert_header!(
response,
"Expect-CT",
2020-03-25 21:39:55 +00:00
format!("max-age={}, enforce", Duration::days(30).whole_seconds())
);
assert_header!(response, "Referrer-Policy", "no-referrer");
})
}
#[test]
fn uri_test() {
let allow_uri = Uri::parse("https://www.google.com").unwrap();
let report_uri = Uri::parse("https://www.google.com").unwrap();
let enforce_uri = Uri::parse("https://www.google.com").unwrap();
let helmet = SpaceHelmet::default()
.enable(Frame::AllowFrom(allow_uri))
.enable(XssFilter::EnableReport(report_uri))
.enable(ExpectCt::ReportAndEnforce(Duration::seconds(30), enforce_uri));
2019-06-13 02:17:59 +00:00
dispatch!(helmet, |response: LocalResponse<'_>| {
assert_header!(response, "X-Frame-Options",
"ALLOW-FROM https://www.google.com");
assert_header!(response, "X-XSS-Protection",
"1; report=https://www.google.com");
assert_header!(response, "Expect-CT",
"max-age=30, enforce, report-uri=\"https://www.google.com\"");
});
}
#[test]
fn prefetch_test() {
let helmet = SpaceHelmet::default().enable(Prefetch::default());
dispatch!(helmet, |response: LocalResponse<'_>| {
assert_header!(response, "X-DNS-Prefetch-Control", "off");
});
let helmet = SpaceHelmet::default().enable(Prefetch::Off);
dispatch!(helmet, |response: LocalResponse<'_>| {
assert_header!(response, "X-DNS-Prefetch-Control", "off");
});
let helmet = SpaceHelmet::default().enable(Prefetch::On);
dispatch!(helmet, |response: LocalResponse<'_>| {
assert_header!(response, "X-DNS-Prefetch-Control", "on");
});
}
}