release: Mark VIII 1.0

tests/test_core.py

@@ -0,0 +1,71 @@
+import os
+import sys
+import unittest
+
+sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload', 'user', 'remote_access', 'pager-webui'))
+import server
+
+
+def setUpModule():
+    __import__('importlib').reload(server)
+
+
+class FakeHandler:
+    def __init__(self, path='/', headers=None, body=None):
+        self.path = path
+        self.headers = headers or {}
+        self._body = body
+
+    def read_body(self):
+        return self._body if self._body is not None else {}
+
+
+class RouterTest(unittest.TestCase):
+    def test_dispatch_matches_and_captures(self):
+        server.ROUTER = server.Router()
+        server.ROUTER.add('GET', r'/api/recon/scans/(\d+)', lambda ctx: (200, {'id': ctx.args[0]}))
+        handler, groups = server.ROUTER.dispatch('GET', '/api/recon/scans/42')
+        self.assertIsNotNone(handler)
+        self.assertEqual(groups, ('42',))
+
+    def test_dispatch_returns_none_on_mismatch(self):
+        server.ROUTER = server.Router()
+        handler, groups = server.ROUTER.dispatch('POST', '/nope')
+        self.assertIsNone(handler)
+
+
+class StaticTest(unittest.TestCase):
+    def test_safe_join_rejects_traversal(self):
+        self.assertFalse(server._safe_join(server.WWW_DIR, '../server.py'))
+
+    def test_safe_join_accepts_subpath(self):
+        p = server._safe_join(server.WWW_DIR, 'js/app.js')
+        self.assertTrue(p.startswith(server.WWW_DIR))
+
+
+class OriginTest(unittest.TestCase):
+    def test_same_origin_accepts_matching_origin(self):
+        self.assertTrue(server.same_origin({
+            'host': '172.16.52.1:8080',
+            'origin': 'http://172.16.52.1:8080'}))
+
+    def test_same_origin_rejects_cross_origin(self):
+        self.assertFalse(server.same_origin({
+            'host': '172.16.52.1:8080',
+            'origin': 'http://attacker.example'}))
+
+    def test_same_origin_allows_non_browser_client(self):
+        self.assertTrue(server.same_origin({'host': '172.16.52.1:8080'}))
+
+    def test_same_origin_requires_host(self):
+        self.assertFalse(server.same_origin({}))
+
+
+class DeviceRunTest(unittest.TestCase):
+    def test_device_run_returns_triple(self):
+        rc, out, err = server.device_run(['cmd', 'not', 'there'])
+        self.assertIsInstance(rc, int)
+
+
+if __name__ == '__main__':
+    unittest.main()