|
1
|
|
|
# Licensed to the StackStorm, Inc ('StackStorm') under one or more |
|
2
|
|
|
# contributor license agreements. See the NOTICE file distributed with |
|
3
|
|
|
# this work for additional information regarding copyright ownership. |
|
4
|
|
|
# The ASF licenses this file to You under the Apache License, Version 2.0 |
|
5
|
|
|
# (the "License"); you may not use this file except in compliance with |
|
6
|
|
|
# the License. You may obtain a copy of the License at |
|
7
|
|
|
# |
|
8
|
|
|
# http://www.apache.org/licenses/LICENSE-2.0 |
|
9
|
|
|
# |
|
10
|
|
|
# Unless required by applicable law or agreed to in writing, software |
|
11
|
|
|
# distributed under the License is distributed on an "AS IS" BASIS, |
|
12
|
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
|
13
|
|
|
# See the License for the specific language governing permissions and |
|
14
|
|
|
# limitations under the License. |
|
15
|
|
|
|
|
16
|
|
|
import webtest |
|
17
|
|
|
|
|
18
|
|
|
|
|
19
|
|
|
SUPER_SECRET_PARAMETER = 'SUPER_SECRET_PARAMETER_THAT_SHOULD_NEVER_APPEAR_IN_RESPONSES_OR_LOGS' |
|
20
|
|
|
ANOTHER_SUPER_SECRET_PARAMETER = 'ANOTHER_SUPER_SECRET_PARAMETER_TO_TEST_OVERRIDING' |
|
21
|
|
|
|
|
22
|
|
|
|
|
23
|
|
|
class ResponseValidationError(ValueError): |
|
24
|
|
|
pass |
|
25
|
|
|
|
|
26
|
|
|
|
|
27
|
|
|
class ResponseLeakError(ValueError): |
|
28
|
|
|
pass |
|
29
|
|
|
|
|
30
|
|
|
|
|
31
|
|
|
class TestApp(webtest.TestApp): |
|
32
|
|
|
def do_request(self, req, **kwargs): |
|
33
|
|
|
res = super(TestApp, self).do_request(req, **kwargs) |
|
34
|
|
|
|
|
35
|
|
|
if res.headers.get('Warning', None): |
|
36
|
|
|
raise ResponseValidationError('Endpoint produced invalid response. Make sure the ' |
|
37
|
|
|
'response matches OpenAPI scheme for the endpoint.') |
|
38
|
|
|
|
|
39
|
|
|
if not kwargs.get('expect_errors', None): |
|
40
|
|
|
if SUPER_SECRET_PARAMETER in res.body or ANOTHER_SUPER_SECRET_PARAMETER in res.body: |
|
41
|
|
|
raise ResponseLeakError('Endpoint response contains secret parameter. ' |
|
42
|
|
|
'Find the leak.') |
|
43
|
|
|
|
|
44
|
|
|
if 'Access-Control-Allow-Origin' not in res.headers: |
|
45
|
|
|
raise ResponseValidationError('Response missing a required CORS header') |
|
46
|
|
|
|
|
47
|
|
|
if req.environ['REQUEST_METHOD'] != 'OPTIONS': |
|
48
|
|
|
# The request will then also be checked with do_request() method making sure OPTIONS |
|
49
|
|
|
# response also has proper headers set. |
|
50
|
|
|
self.options(req.environ['PATH_INFO']) |
|
51
|
|
|
|
|
52
|
|
|
return res |
|
53
|
|
|
|
Plexxi /
st2
