RangerCSRFPreventionFilter implements Filter { public void doFilter(ServletRequest request, ServletResponse response, FilterChain chain) throws IOException, ServletException { if (IS_CSRF_ENABLED) { final HttpServletRequest httpRequest = (HttpServletRequest)request; final HttpServletResponse httpResponse = (HttpServletResponse)response; handleHttpInteraction(new ServletFilterHttpInteraction(httpRequest, httpResponse, chain)); }else{ chain.doFilter(request, response); } } RangerCSRFPreventionFilter(); void init(FilterConfig filterConfig); void handleHttpInteraction(HttpInteraction httpInteraction); void doFilter(ServletRequest request, ServletResponse response, FilterChain chain); void destroy(); static final String BROWSER_USER_AGENT_PARAM; static final String BROWSER_USER_AGENTS_DEFAULT; static final String CUSTOM_METHODS_TO_IGNORE_PARAM; static final String METHODS_TO_IGNORE_DEFAULT; static final String CUSTOM_HEADER_PARAM; static final String HEADER_DEFAULT; static final String HEADER_USER_AGENT; }
@Test public void testNoHeaderDefaultConfig_badRequest() throws ServletException, IOException { HttpServletRequest mockReq = Mockito.mock(HttpServletRequest.class); Mockito.when(mockReq.getHeader(RangerCSRFPreventionFilter.HEADER_DEFAULT)).thenReturn(null); Mockito.when(mockReq.getHeader(RangerCSRFPreventionFilter.HEADER_USER_AGENT)).thenReturn(userAgent); HttpServletResponse mockRes = Mockito.mock(HttpServletResponse.class); FilterChain mockChain = Mockito.mock(FilterChain.class); RangerCSRFPreventionFilter filter = new RangerCSRFPreventionFilter(); filter.doFilter(mockReq, mockRes, mockChain); Mockito.verify(mockRes, atLeastOnce()).sendError(HttpServletResponse.SC_BAD_REQUEST, EXPECTED_MESSAGE); Mockito.verifyZeroInteractions(mockChain); }
@Test public void testHeaderPresentDefaultConfig_goodRequest() throws ServletException, IOException { HttpServletRequest mockReq = Mockito.mock(HttpServletRequest.class); Mockito.when(mockReq.getHeader(RangerCSRFPreventionFilter.HEADER_DEFAULT)).thenReturn("valueUnimportant"); Mockito.when(mockReq.getHeader(RangerCSRFPreventionFilter.HEADER_USER_AGENT)).thenReturn(userAgent); HttpServletResponse mockRes = Mockito.mock(HttpServletResponse.class); FilterChain mockChain = Mockito.mock(FilterChain.class); RangerCSRFPreventionFilter filter = new RangerCSRFPreventionFilter(); filter.doFilter(mockReq, mockRes, mockChain); Mockito.verify(mockChain).doFilter(mockReq, mockRes); }
@Test public void testHeaderPresentCustomHeaderConfig_goodRequest() throws ServletException, IOException { HttpServletRequest mockReq = Mockito.mock(HttpServletRequest.class); Mockito.when(mockReq.getHeader(X_CUSTOM_HEADER)).thenReturn("valueUnimportant"); HttpServletResponse mockRes = Mockito.mock(HttpServletResponse.class); FilterChain mockChain = Mockito.mock(FilterChain.class); RangerCSRFPreventionFilter filter = new RangerCSRFPreventionFilter(); filter.doFilter(mockReq, mockRes, mockChain); Mockito.verify(mockChain).doFilter(mockReq, mockRes); }
@Test public void testMissingHeaderWithCustomHeaderConfig_badRequest() throws ServletException, IOException { HttpServletRequest mockReq = Mockito.mock(HttpServletRequest.class); Mockito.when(mockReq.getHeader(X_CUSTOM_HEADER)).thenReturn(null); Mockito.when(mockReq.getHeader(RangerCSRFPreventionFilter.HEADER_USER_AGENT)).thenReturn(userAgent); HttpServletResponse mockRes = Mockito.mock(HttpServletResponse.class); FilterChain mockChain = Mockito.mock(FilterChain.class); RangerCSRFPreventionFilter filter = new RangerCSRFPreventionFilter(); filter.doFilter(mockReq, mockRes, mockChain); Mockito.verifyZeroInteractions(mockChain); }
@Test public void testMissingHeaderIgnoreGETMethodConfig_goodRequest() throws ServletException, IOException { HttpServletRequest mockReq = Mockito.mock(HttpServletRequest.class); Mockito.when(mockReq.getHeader(RangerCSRFPreventionFilter.HEADER_DEFAULT)).thenReturn(null); Mockito.when(mockReq.getMethod()).thenReturn("GET"); Mockito.when(mockReq.getHeader(RangerCSRFPreventionFilter.HEADER_USER_AGENT)).thenReturn(userAgent); HttpServletResponse mockRes = Mockito.mock(HttpServletResponse.class); FilterChain mockChain = Mockito.mock(FilterChain.class); RangerCSRFPreventionFilter filter = new RangerCSRFPreventionFilter(); filter.doFilter(mockReq, mockRes, mockChain); Mockito.verify(mockChain).doFilter(mockReq, mockRes); }
@Test public void testMissingHeaderMultipleIgnoreMethodsConfig_badRequest() throws ServletException, IOException { HttpServletRequest mockReq = Mockito.mock(HttpServletRequest.class); Mockito.when(mockReq.getHeader(RangerCSRFPreventionFilter.HEADER_DEFAULT)) .thenReturn(null); Mockito.when(mockReq.getMethod()).thenReturn("PUT"); Mockito.when(mockReq.getHeader(RangerCSRFPreventionFilter.HEADER_USER_AGENT)).thenReturn(userAgent); HttpServletResponse mockRes = Mockito.mock(HttpServletResponse.class); FilterChain mockChain = Mockito.mock(FilterChain.class); RangerCSRFPreventionFilter filter = new RangerCSRFPreventionFilter(); filter.doFilter(mockReq, mockRes, mockChain); Mockito.verifyZeroInteractions(mockChain); }