72 lines
2.2 KiB
Python
72 lines
2.2 KiB
Python
import os
|
|
import sys
|
|
import unittest
|
|
|
|
sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', 'payload', 'user', 'remote_access', 'pager-webui'))
|
|
import server
|
|
|
|
|
|
def setUpModule():
|
|
__import__('importlib').reload(server)
|
|
|
|
|
|
class FakeHandler:
|
|
def __init__(self, path='/', headers=None, body=None):
|
|
self.path = path
|
|
self.headers = headers or {}
|
|
self._body = body
|
|
|
|
def read_body(self):
|
|
return self._body if self._body is not None else {}
|
|
|
|
|
|
class RouterTest(unittest.TestCase):
|
|
def test_dispatch_matches_and_captures(self):
|
|
server.ROUTER = server.Router()
|
|
server.ROUTER.add('GET', r'/api/recon/scans/(\d+)', lambda ctx: (200, {'id': ctx.args[0]}))
|
|
handler, groups = server.ROUTER.dispatch('GET', '/api/recon/scans/42')
|
|
self.assertIsNotNone(handler)
|
|
self.assertEqual(groups, ('42',))
|
|
|
|
def test_dispatch_returns_none_on_mismatch(self):
|
|
server.ROUTER = server.Router()
|
|
handler, groups = server.ROUTER.dispatch('POST', '/nope')
|
|
self.assertIsNone(handler)
|
|
|
|
|
|
class StaticTest(unittest.TestCase):
|
|
def test_safe_join_rejects_traversal(self):
|
|
self.assertFalse(server._safe_join(server.WWW_DIR, '../server.py'))
|
|
|
|
def test_safe_join_accepts_subpath(self):
|
|
p = server._safe_join(server.WWW_DIR, 'js/app.js')
|
|
self.assertTrue(p.startswith(server.WWW_DIR))
|
|
|
|
|
|
class OriginTest(unittest.TestCase):
|
|
def test_same_origin_accepts_matching_origin(self):
|
|
self.assertTrue(server.same_origin({
|
|
'host': '172.16.52.1:8080',
|
|
'origin': 'http://172.16.52.1:8080'}))
|
|
|
|
def test_same_origin_rejects_cross_origin(self):
|
|
self.assertFalse(server.same_origin({
|
|
'host': '172.16.52.1:8080',
|
|
'origin': 'http://attacker.example'}))
|
|
|
|
def test_same_origin_allows_non_browser_client(self):
|
|
self.assertTrue(server.same_origin({'host': '172.16.52.1:8080'}))
|
|
|
|
def test_same_origin_requires_host(self):
|
|
self.assertFalse(server.same_origin({}))
|
|
|
|
|
|
class DeviceRunTest(unittest.TestCase):
|
|
def test_device_run_returns_triple(self):
|
|
rc, out, err = server.device_run(['cmd', 'not', 'there'])
|
|
self.assertIsInstance(rc, int)
|
|
|
|
|
|
if __name__ == '__main__':
|
|
unittest.main()
|