cubicweb/web/test/unittest_views_errorform.py
author Laurent Peuch <cortex@worlddomination.be>
Fri, 12 Apr 2019 12:31:14 +0200
changeset 12584 6eba53763482
parent 11057 0b59724cb3f2
permissions -rw-r--r--
Use secure hash algorithm in WebConfiguration.sign_text Fix: PendingDeprecationWarning: HMAC() without an explicit digestmod argument is deprecated. The default hash algorithm used by hmac.new is md5. As of today, md5 is so weak that it's the equivalent of plaintext and can't be considered to be secured at all. Therefor, we switch to a secure hash algorithm. The rational for choosing sha3_512 is: * the recommended algorithm is at least sha_256 * the stronger, the more secured and sha3_512 is the stronger available * thinking about the future this should keep this part of the code safe long enough before people think about checking it again You can read more about choosing a secure hash algorithm in the NIST recommendations https://csrc.nist.gov/Projects/Hash-Functions/NIST-Policy-on-Hash-Functions This code modification should normally be transparent since check_text_sign is exactly this code 'self.sign_text(text) == signature' and that sign_text is only used in combination with it. The only impact is that the hash is going to move from 32 char to 128 which might make html page a bit bigger and that sha3_512 is slow to compute (which is a good thing for security)
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
9809
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
     1
# copyright 2003-2014 LOGILAB S.A. (Paris, FRANCE), all rights reserved.
8605
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
     2
# contact http://www.logilab.fr/ -- mailto:contact@logilab.fr
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
     3
#
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
     4
# This file is part of CubicWeb.
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
     5
#
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
     6
# CubicWeb is free software: you can redistribute it and/or modify it under the
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
     7
# terms of the GNU Lesser General Public License as published by the Free
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
     8
# Software Foundation, either version 2.1 of the License, or (at your option)
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
     9
# any later version.
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    10
#
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    11
# CubicWeb is distributed in the hope that it will be useful, but WITHOUT
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    12
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    13
# FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    14
# details.
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    15
#
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    16
# You should have received a copy of the GNU Lesser General Public License along
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    17
# with CubicWeb.  If not, see <http://www.gnu.org/licenses/>.
9809
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    18
import re
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    19
import sys
8605
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    20
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    21
from logilab.common.testlib import unittest_main
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    22
9809
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    23
from cubicweb import Forbidden
8605
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    24
from cubicweb.devtools.testlib import CubicWebTC
9809
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    25
from cubicweb.view import StartupView
8605
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    26
from cubicweb.web import Redirect
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    27
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    28
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    29
class ErrorViewTC(CubicWebTC):
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    30
    def setUp(self):
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    31
        super(ErrorViewTC, self).setUp()
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    32
        self.vreg.config['submit-mail'] = "test@logilab.fr"
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    33
        self.vreg.config['print-traceback'] = "yes"
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    34
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    35
    def test_error_generation(self):
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    36
        """
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    37
        tests
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    38
        """
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    39
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    40
        class MyWrongView(StartupView):
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    41
            __regid__ = 'my-view'
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    42
            def call(self):
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    43
                raise ValueError('This is wrong')
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    44
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    45
        with self.temporary_appobjects(MyWrongView):
9809
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    46
            with self.admin_access.web_request() as req:
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    47
                try:
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    48
                    self.view('my-view', req=req)
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    49
                except Exception as e:
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    50
                    req.data['excinfo'] = sys.exc_info()
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    51
                    req.data['ex'] = e
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    52
                    html = self.view('error', req=req)
10785
e63fb79b32e0 [web/test] CubicWebTC.view returns bytes
Julien Cristau <julien.cristau@logilab.fr>
parents: 9809
diff changeset
    53
                    self.assertTrue(re.search(b'^<input name="__signature" type="hidden" '
12584
6eba53763482 Use secure hash algorithm in WebConfiguration.sign_text
Laurent Peuch <cortex@worlddomination.be>
parents: 11057
diff changeset
    54
                                              b'value="[0-9a-f]{128}" />$',
9809
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    55
                                              html.source, re.M))
8605
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    56
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    57
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    58
    def test_error_submit_nosig(self):
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    59
        """
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    60
        tests that the reportbug controller refuses submission if
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    61
        there is not content signature
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    62
        """
9809
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    63
        with self.admin_access.web_request() as req:
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    64
            req.form = {'description': u'toto'}
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    65
            with self.assertRaises(Forbidden) as cm:
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    66
                self.ctrl_publish(req, 'reportbug')
8605
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    67
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    68
    def test_error_submit_wrongsig(self):
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    69
        """
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    70
        tests that the reportbug controller refuses submission if the
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    71
        content signature is invalid
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    72
        """
9809
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    73
        with self.admin_access.web_request() as req:
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    74
            req.form = {'__signature': 'X',
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    75
                        'description': u'toto'}
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    76
            with self.assertRaises(Forbidden) as cm:
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    77
                self.ctrl_publish(req, 'reportbug')
8605
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    78
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    79
    def test_error_submit_ok(self):
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    80
        """
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    81
        tests that the reportbug controller accept the email submission if the
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    82
        content signature is valid
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    83
        """
9809
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    84
        with self.admin_access.web_request() as req:
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    85
            sign = self.vreg.config.sign_text('toto')
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    86
            req.form = {'__signature': sign,
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    87
                        'description': u'toto'}
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    88
            with self.assertRaises(Redirect) as cm:
29d52a785729 [webtests/views_errorform] use the new connection api
Aurelien Campeas <aurelien.campeas@logilab.fr>
parents: 8695
diff changeset
    89
                self.ctrl_publish(req, 'reportbug')
8605
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    90
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    91
if __name__ == '__main__':
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    92
    unittest_main()