web/test/unittest_views_errorform.py
author David Douard <david.douard@logilab.fr>
Tue, 27 Nov 2012 14:48:03 +0100
branchstable
changeset 8605 797fc2e2fb78
child 8694 d901c36bcfce
permissions -rw-r--r--
[web] add a digital signature to error form (closes #2522526) Simple (and quite weak) implementation of a digital signature of the content to be submited by email in the error report view generated by ErrorView. The signature is a simple hmac hash computed using a secret key (generated at repository startup) and the "secret" form content to be included in the notification email. The controller can then check this content has not been modified or forged by a malicious user.
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
8605
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
     1
# copyright 2003-2012 LOGILAB S.A. (Paris, FRANCE), all rights reserved.
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
     2
# contact http://www.logilab.fr/ -- mailto:contact@logilab.fr
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
     3
#
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
     4
# This file is part of CubicWeb.
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
     5
#
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
     6
# CubicWeb is free software: you can redistribute it and/or modify it under the
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
     7
# terms of the GNU Lesser General Public License as published by the Free
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
     8
# Software Foundation, either version 2.1 of the License, or (at your option)
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
     9
# any later version.
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    10
#
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    11
# CubicWeb is distributed in the hope that it will be useful, but WITHOUT
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    12
# ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    13
# FOR A PARTICULAR PURPOSE.  See the GNU Lesser General Public License for more
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    14
# details.
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    15
#
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    16
# You should have received a copy of the GNU Lesser General Public License along
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    17
# with CubicWeb.  If not, see <http://www.gnu.org/licenses/>.
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    18
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    19
from __future__ import with_statement
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    20
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    21
from logilab.common.testlib import unittest_main
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    22
from logilab.mtconverter import html_unescape
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    23
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    24
from cubicweb import Forbidden, ValidationError
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    25
from cubicweb.devtools.testlib import CubicWebTC
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    26
from cubicweb.utils import json
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    27
from cubicweb.view import StartupView, TRANSITIONAL_DOCTYPE_NOEXT
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    28
from cubicweb.web import Redirect
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    29
from cubicweb.web.htmlwidgets import TableWidget
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    30
from cubicweb.web.views import vid_from_rset
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    31
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    32
import re
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    33
import hmac
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    34
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    35
class ErrorViewTC(CubicWebTC):
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    36
    def setUp(self):
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    37
        super(ErrorViewTC, self).setUp()
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    38
        self.req = self.request()
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    39
        self.vreg.config['submit-mail'] = "test@logilab.fr"
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    40
        self.vreg.config['print-traceback'] = "yes"
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    41
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    42
    def test_error_generation(self):
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    43
        """
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    44
        tests
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    45
        """
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    46
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    47
        class MyWrongView(StartupView):
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    48
            __regid__ = 'my-view'
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    49
            def call(self):
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    50
                raise ValueError('This is wrong')
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    51
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    52
        with self.temporary_appobjects(MyWrongView):
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    53
            try:
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    54
                self.view('my-view')
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    55
            except Exception, e:
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    56
                import sys
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    57
                self.req.data['excinfo'] = sys.exc_info()
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    58
                self.req.data['ex'] = e
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    59
                html = self.view('error', req=self.req)
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    60
                self.failUnless(re.search(r'^<input name="__signature" type="hidden" value="[0-9a-f]{32}" />$',
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    61
                                          html.source, re.M))
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    62
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    63
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    64
    def test_error_submit_nosig(self):
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    65
        """
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    66
        tests that the reportbug controller refuses submission if
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    67
        there is not content signature
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    68
        """
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    69
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    70
        self.req.form = {'description': u'toto',
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    71
                         }
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    72
        with self.assertRaises(Forbidden) as cm:
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    73
            self.ctrl_publish(self.req, 'reportbug')
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    74
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    75
    def test_error_submit_wrongsig(self):
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    76
        """
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    77
        tests that the reportbug controller refuses submission if the
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    78
        content signature is invalid
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    79
        """
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    80
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    81
        self.req.form = {'__signature': 'X',
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    82
                         'description': u'toto',
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    83
                         }
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    84
        with self.assertRaises(Forbidden) as cm:
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    85
            self.ctrl_publish(self.req, 'reportbug')
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    86
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    87
    def test_error_submit_ok(self):
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    88
        """
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    89
        tests that the reportbug controller accept the email submission if the
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    90
        content signature is valid
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    91
        """
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    92
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    93
        sign = self.vreg.config.sign_text('toto')
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    94
        self.req.form = {'__signature': sign,
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    95
                         'description': u'toto',
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    96
                         }
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    97
        with self.assertRaises(Redirect) as cm:
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    98
            self.ctrl_publish(self.req, 'reportbug')
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
    99
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
   100
if __name__ == '__main__':
797fc2e2fb78 [web] add a digital signature to error form (closes #2522526)
David Douard <david.douard@logilab.fr>
parents:
diff changeset
   101
    unittest_main()