import os import sys import unittest sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload', 'user', 'remote_access', 'pager-webui')) import server def setUpModule(): __import__('importlib').reload(server) class FakeHandler: def __init__(self, path='/', headers=None, body=None): self.path = path self.headers = headers or {} self._body = body def read_body(self): return self._body if self._body is not None else {} class RouterTest(unittest.TestCase): def test_dispatch_matches_and_captures(self): server.ROUTER = server.Router() server.ROUTER.add('GET', r'/api/recon/scans/(\d+)', lambda ctx: (200, {'id': ctx.args[0]})) handler, groups = server.ROUTER.dispatch('GET', '/api/recon/scans/42') self.assertIsNotNone(handler) self.assertEqual(groups, ('42',)) def test_dispatch_returns_none_on_mismatch(self): server.ROUTER = server.Router() handler, groups = server.ROUTER.dispatch('POST', '/nope') self.assertIsNone(handler) class StaticTest(unittest.TestCase): def test_safe_join_rejects_traversal(self): self.assertFalse(server._safe_join(server.WWW_DIR, '../server.py')) def test_safe_join_accepts_subpath(self): p = server._safe_join(server.WWW_DIR, 'js/app.js') self.assertTrue(p.startswith(server.WWW_DIR)) class OriginTest(unittest.TestCase): def test_same_origin_accepts_matching_origin(self): self.assertTrue(server.same_origin({ 'host': '172.16.52.1:8080', 'origin': 'http://172.16.52.1:8080'})) def test_same_origin_rejects_cross_origin(self): self.assertFalse(server.same_origin({ 'host': '172.16.52.1:8080', 'origin': 'http://attacker.example'})) def test_same_origin_allows_non_browser_client(self): self.assertTrue(server.same_origin({'host': '172.16.52.1:8080'})) def test_same_origin_requires_host(self): self.assertFalse(server.same_origin({})) class DeviceRunTest(unittest.TestCase): def test_device_run_returns_triple(self): rc, out, err = server.device_run(['cmd', 'not', 'there']) self.assertIsInstance(rc, int) if __name__ == '__main__': unittest.main()