AtlasCSRFPreventionFilter implements Filter { public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { final HttpServletRequest httpRequest = (HttpServletRequest) request; final HttpServletResponse httpResponse = (HttpServletResponse) response; AtlasResponseRequestWrapper responseWrapper = new AtlasResponseRequestWrapper(httpResponse); responseWrapper.setHeader("X-Frame-Options", "DENY"); if (isCSRF_ENABLED){ handleHttpInteraction(new ServletFilterHttpInteraction(httpRequest, httpResponse, chain)); }else{ chain.doFilter(request, response); } } AtlasCSRFPreventionFilter(); void init(FilterConfig filterConfig); void handleHttpInteraction(HttpInteraction httpInteraction); void doFilter(ServletRequest request, ServletResponse response, FilterChain chain); void destroy(); static final boolean isCSRF_ENABLED; static final String BROWSER_USER_AGENT_PARAM; static final String BROWSER_USER_AGENTS_DEFAULT; static final String CUSTOM_METHODS_TO_IGNORE_PARAM; static final String METHODS_TO_IGNORE_DEFAULT; static final String CUSTOM_HEADER_PARAM; static final String HEADER_DEFAULT; static final String HEADER_USER_AGENT; }
@Test public void testNoHeaderDefaultConfig_badRequest() throws ServletException, IOException { HttpServletRequest mockReq = Mockito.mock(HttpServletRequest.class); Mockito.when(mockReq.getHeader(AtlasCSRFPreventionFilter.HEADER_DEFAULT)).thenReturn(null); Mockito.when(mockReq.getHeader(AtlasCSRFPreventionFilter.HEADER_USER_AGENT)).thenReturn(userAgent); HttpServletResponse mockRes = Mockito.mock(HttpServletResponse.class); PrintWriter mockWriter = Mockito.mock(PrintWriter.class); Mockito.when(mockRes.getWriter()).thenReturn(mockWriter); FilterChain mockChain = Mockito.mock(FilterChain.class); AtlasCSRFPreventionFilter filter = new AtlasCSRFPreventionFilter(); filter.doFilter(mockReq, mockRes, mockChain); verify(mockRes, atLeastOnce()).setStatus(HttpServletResponse.SC_BAD_REQUEST); Mockito.verifyZeroInteractions(mockChain); }
@Test public void testHeaderPresentDefaultConfig_goodRequest() throws ServletException, IOException { HttpServletRequest mockReq = Mockito.mock(HttpServletRequest.class); Mockito.when(mockReq.getHeader(AtlasCSRFPreventionFilter.HEADER_DEFAULT)).thenReturn("valueUnimportant"); Mockito.when(mockReq.getHeader(AtlasCSRFPreventionFilter.HEADER_USER_AGENT)).thenReturn(userAgent); HttpServletResponse mockRes = Mockito.mock(HttpServletResponse.class); FilterChain mockChain = Mockito.mock(FilterChain.class); AtlasCSRFPreventionFilter filter = new AtlasCSRFPreventionFilter(); filter.doFilter(mockReq, mockRes, mockChain); Mockito.verify(mockChain).doFilter(mockReq, mockRes); }
@Test public void testHeaderPresentCustomHeaderConfig_goodRequest() throws ServletException, IOException { HttpServletRequest mockReq = Mockito.mock(HttpServletRequest.class); Mockito.when(mockReq.getHeader(X_CUSTOM_HEADER)).thenReturn("valueUnimportant"); HttpServletResponse mockRes = Mockito.mock(HttpServletResponse.class); FilterChain mockChain = Mockito.mock(FilterChain.class); AtlasCSRFPreventionFilter filter = new AtlasCSRFPreventionFilter(); filter.doFilter(mockReq, mockRes, mockChain); Mockito.verify(mockChain).doFilter(mockReq, mockRes); }
@Test public void testMissingHeaderWithCustomHeaderConfig_badRequest() throws ServletException, IOException { HttpServletRequest mockReq = Mockito.mock(HttpServletRequest.class); Mockito.when(mockReq.getHeader(X_CUSTOM_HEADER)).thenReturn(null); Mockito.when(mockReq.getHeader(AtlasCSRFPreventionFilter.HEADER_USER_AGENT)).thenReturn(userAgent); HttpServletResponse mockRes = Mockito.mock(HttpServletResponse.class); PrintWriter mockWriter = Mockito.mock(PrintWriter.class); Mockito.when(mockRes.getWriter()).thenReturn(mockWriter); FilterChain mockChain = Mockito.mock(FilterChain.class); AtlasCSRFPreventionFilter filter = new AtlasCSRFPreventionFilter(); filter.doFilter(mockReq, mockRes, mockChain); Mockito.verifyZeroInteractions(mockChain); }
@Test public void testMissingHeaderIgnoreGETMethodConfig_goodRequest() throws ServletException, IOException { HttpServletRequest mockReq = Mockito.mock(HttpServletRequest.class); Mockito.when(mockReq.getHeader(AtlasCSRFPreventionFilter.HEADER_DEFAULT)).thenReturn(null); Mockito.when(mockReq.getMethod()).thenReturn("GET"); Mockito.when(mockReq.getHeader(AtlasCSRFPreventionFilter.HEADER_USER_AGENT)).thenReturn(userAgent); HttpServletResponse mockRes = Mockito.mock(HttpServletResponse.class); FilterChain mockChain = Mockito.mock(FilterChain.class); AtlasCSRFPreventionFilter filter = new AtlasCSRFPreventionFilter(); filter.doFilter(mockReq, mockRes, mockChain); Mockito.verify(mockChain).doFilter(mockReq, mockRes); }
@Test public void testMissingHeaderMultipleIgnoreMethodsConfig_badRequest() throws ServletException, IOException { HttpServletRequest mockReq = Mockito.mock(HttpServletRequest.class); Mockito.when(mockReq.getHeader(AtlasCSRFPreventionFilter.HEADER_DEFAULT)) .thenReturn(null); Mockito.when(mockReq.getMethod()).thenReturn("PUT"); Mockito.when(mockReq.getHeader(AtlasCSRFPreventionFilter.HEADER_USER_AGENT)).thenReturn(userAgent); HttpServletResponse mockRes = Mockito.mock(HttpServletResponse.class); PrintWriter mockWriter = Mockito.mock(PrintWriter.class); Mockito.when(mockRes.getWriter()).thenReturn(mockWriter); FilterChain mockChain = Mockito.mock(FilterChain.class); AtlasCSRFPreventionFilter filter = new AtlasCSRFPreventionFilter(); filter.doFilter(mockReq, mockRes, mockChain); Mockito.verifyZeroInteractions(mockChain); }