skf.test_code_base_items() - Code Metrics - Inspection of "Update .scrutinizer.yml" - blabla1337/skf-flask - Measure and Improve Code Quality continuously with Scrutinizer

Completed

Push — dev-skf ( b5d67b...388b3e )

by Glenn

created 2015-12-16 18:54 UTC

skf.test_code_base_items() B

↳ Parent: Project

Complexity

Conditions

Size

Total Lines

Duplication

Lines	0
Ratio	0 %

Metric	Value
cc	6
dl	0
loc	9
rs	8

# -*- coding: utf-8 -*-
"""
    SKF Tests
    ~~~~~~~~~

"""

import pytest
import tempfile
import os 
import datetime
import skf


@pytest.fixture
def client(request):
    skf.app.config['TESTING'] = True
    client = skf.app.test_client()
    with skf.app.app_context():
        skf.init_db()
        skf.log = _log
        skf.check_token = _check_token

    def teardown():
        request.addfinalizer(teardown)

    return client

def _log(message, value, threat):
    print "SKF LOG entry Message: '"+message+"' Value: '"+value+"' Threat: '"+threat+"'"

def _check_token():
    """Checks the submitted CSRF token"""
    _log("User supplied not valid CSRF token", "FAIL", "HIGH")

def _login_token():
    """Checks the emailed login token for creation of account"""
    return "AAAA"

def first_login(client):
    return client.post('/create-account', data=dict(
        email="[email protected]",
        password="test-skf",
        password2="test-skf",
        token="1234"
    ), follow_redirects=True)

def login(client, username, password):
    first_login(client)
    return client.post('/login', data=dict(
        username=username,
        password=password,
        csrf_token="AAAA"
    ), follow_redirects=True)

def test_empty_db(client):
    """Start with a blank database."""
    rv = client.get('/')
    assert b'Security Knowledge Framework' in rv.data

def test_first_login(client):
    """Make sure login works"""
    rv = first_login(client)
    assert b'First login' in rv.data

def test_login(client):
    """Make sure login works"""
    rv = login(client, "admin", "test-skf")
    assert b'Start new project' in rv.data
    rv = login(client, "foobar", "X")
    assert b'login' in rv.data

def test_knowledge_base_items(client):
    """Make sure knowledge-base items are visible"""
    login(client, "admin", "test-skf")
    rv = client.get('/knowledge-base')
    assert b'Knowledge Base Security Vulnerabilities' in rv.data
    assert b'Filename injection Path traversel' in rv.data
    assert b'Repudiation attack' in rv.data
    assert b'Open forward' in rv.data
    assert b'Verify that the session id is never disclosed' in rv.data
    assert b'Logging guidelines' in rv.data

def test_manage_users(client):
    """Make sure manage users is working"""
    login(client, "admin", "test-skf")
    rv = client.get('/users-manage')
    assert b'admin' in rv.data
    assert b'edit:read:manage:delete' in rv.data

def test_add_user(client):
    """"Make sure we can add users """
    login(client, "admin", "test-skf")
    return client.post('/users-add', data=dict(
        addUser="Create user",
        email="test@localhost",
        privID="3",
        username="Test",
        csrf_token="AAAA"
    ), follow_redirects=True)
    assert b'test@localhost' in rv.data

def test_new_user_group(client):
    """Make sure we can create new user group"""
    login(client, "admin", "test-skf")
    rv = client.get('/group-manage')
    return client.post('/users-add', data=dict(
        groupName="Testing group",
        projectFormSubmit="Create group",
        csrf_token="AAAA"
    ), follow_redirects=True)
    assert b'Add users to groups' in rv.data

def test_add_new_user_group(client):
    """Make sure we can create new user group"""
    login(client, "admin", "test-skf")
    rv = client.get('/group-users')
    return client.post('/group-add-users', data=dict(
        groupName="2",
        test0="2--",
        submit='Add values',
        csrf_token="AAAA"
    ), follow_redirects=True)
    assert b'Test' in rv.data

def test_new_user_login(client):
    """Make sure we cant login with the new user"""
    login(client, "Test", "x")
    rv = client.get('/group-users')
    assert b'bad password' in rv.data

def test_access_new_user_group(client):
    """Make sure we can create new user group"""
    login(client, "admin", "test-skf")
    rv = client.get('/users-manage')
    return client.post('/user-access', data=dict(
        access="true",
        userID="2",
        csrf_token="AAAA"
    ), follow_redirects=True)
    login(client, "Test", "test-skf")
    assert b'Start new project' in rv.data

def test_first_login_post(client):
    """Make sure we setup new user """
    rv = client.get('/first-login')
    return client.post('/create-account', data=dict(
        email="test@localhost",
        password="test-skf",
        password2='test-skf',
        token="AAAA"
    ), follow_redirects=True)
    assert b'bad password' in rv.data

def test_knowledge_base_item(client):
    """Make sure knowledge-base item content works"""
    login(client, "admin", "test-skf")
    rv = client.post('/kb-item', data=dict(
        id=144
    ), follow_redirects=True)
    assert rv.status_code == 200

    rv = client.post('/kb-item', data=dict(
        id=61
    ), follow_redirects=True)
    assert rv.status_code == 200

    rv = client.post('/kb-item', data=dict(
        id=122
    ), follow_redirects=True)
    assert rv.status_code == 200

    rv = client.post('/kb-item', data=dict(
        id=97
    ), follow_redirects=True)
    assert rv.status_code == 200

def test_code_base_items(client):
    """Make sure code-example items are visible"""
    login(client, "admin", "test-skf")
    rv = client.get('/code-examples')
    assert b'Knowledge Base Code Examples' in rv.data
    assert b'File upload' in rv.data
    assert b'Input validation' in rv.data
    assert b'Debug enabling' in rv.data
    assert b'Anti caching headers' in rv.data

def test_code_base_item(client):
    """Make sure code-example item content works"""
    login(client, "admin", "test-skf")
    rv = client.post('/code-item', data=dict(
        id=1
    ), follow_redirects=True)
    assert rv.status_code == 200

    rv = client.post('/code-item', data=dict(
        id=4
    ), follow_redirects=True)
    assert rv.status_code == 200

    rv = client.post('/code-item', data=dict(
        id=6
    ), follow_redirects=True)
    assert rv.status_code == 200

    rv = client.post('/code-item', data=dict(
        id=7
    ), follow_redirects=True)
    assert rv.status_code == 200

    rv = client.post('/code-item', data=dict(
        id=9
    ), follow_redirects=True)
    assert rv.status_code == 200

def test_create_project(client):
    """Make sure skf is able to create new project and shows in listhttps://localhost:5443/project-checklists/1"""
    login(client, "admin", "test-skf")
    rv = client.get('/project-new')
    assert b'Create new project' in rv.data
    rv = client.post('/project-add', data=dict(
        inputDesc="This is a test Description.",
        inputName="SKF Project",
        projectFormSubmit="Create Project", 
        inputVersion="4.1.1",
        csrf_token="AAAA"
    ), follow_redirects=True)
    assert b'is a test Description' in rv.data
    assert b'4.1.1' in rv.data
    assert b'SKF Project' in rv.data

def test_create_project_function(client):
    """Make sure skf is able to create new project functions"""
    login(client, "admin", "test-skf")
    rv = client.get('/project-new')
    rv = client.post('/project-add', data=dict(
        inputDesc="This is a test Description.",
        inputName="SKF Project",
        inputVersion="4.1.1",
        csrf_token="AAAA"
    ), follow_redirects=True)
    rv = client.get('/project-functions/1')
    rv = client.post('/project-function-add', data=dict(
        functionDesc="This is a test Description for the selected release.",
        functionName="SKF Phase 1",
        project_id="1",
        test0="158--24",
        test1="157--22",
        test2="154--20",
        csrf_token="AAAA"
    ), follow_redirects=True)
    rv = client.get('/project-functions/1')
    assert b'Sessions' in rv.data
    assert b'User registration' in rv.data
    assert b'sub-domains' in rv.data
    rv = client.get('/results-functions')
    assert b'SKF Phase' in rv.data
    rv = client.get('/results-function-report/1')
    assert b'Sessions' in rv.data
    assert b'User registration' in rv.data
    assert b'sub-domains' in rv.data
    rv = client.get('/results-function-docx/1')
    assert b'attachment' in rv.headers['Content-Disposition']

def test_create_project_checklist2(client):
    """Make sure skf is able to create, read, download new project checklist"""
    login(client, "admin", "test-skf")
    rv = client.get('/project-new')
    rv = client.post('/project-add', data=dict(
        inputDesc="This is a test Description.",
        inputName="SKF Project",
        inputVersion="4.1.1",
        projectFormSubmit="Create Project", 
        csrf_token="AAAA"
    ), follow_redirects=True)
    rv = client.get('/project-checklists/1')
    #add ASVS level-1 list and check if works
    rv = client.post('/project-checklist-add', data=dict(
        answer1="na",
        answer2="no",
        csrf_token="AAAA",
        listID1="",
        listID2="", 
        projectID="1",
        projectName="1",
        questionID1="431",
        questionID2="432",
        submit="",
        vulnID1="1",
        vulnID2="14"
    ), follow_redirects=True)
    print rv.data
    assert b'SKF Project' in rv.data
    date = datetime.datetime.now().strftime("%Y-%m-%d %H:%M")
    rv = client.get('/results-checklist-report/'+date)
    assert b'Version management' in rv.data
    rv = client.get('/results-checklist-docx/'+date)
    assert b'attachment' in rv.headers['Content-Disposition']


1			# -- coding: utf-8 --
2			"""
3			SKF Tests
4			~~~~~~~~~
5
6			"""
7
8			import pytest
9			import tempfile
10			import os
11			import datetime
12			import skf
13
14
15			@pytest.fixture
16			def client(request):
17			skf.app.config['TESTING'] = True
18			client = skf.app.test_client()
19			with skf.app.app_context():
20			skf.init_db()
21			skf.log = _log
22			skf.check_token = _check_token
23
24			def teardown():
25			request.addfinalizer(teardown)
26
27			return client
28
29			def _log(message, value, threat):
30			print "SKF LOG entry Message: '"+message+"' Value: '"+value+"' Threat: '"+threat+"'"
31
32			def _check_token():
33			"""Checks the submitted CSRF token"""
34			_log("User supplied not valid CSRF token", "FAIL", "HIGH")
35
36			def _login_token():
37			"""Checks the emailed login token for creation of account"""
38			return "AAAA"
39
40			def first_login(client):
41			return client.post('/create-account', data=dict(
42			email="[email protected]",
43			password="test-skf",
44			password2="test-skf",
45			token="1234"
46			), follow_redirects=True)
47
48			def login(client, username, password):
49			first_login(client)
50			return client.post('/login', data=dict(
51			username=username,
52			password=password,
53			csrf_token="AAAA"
54			), follow_redirects=True)
55
56			def test_empty_db(client):
57			"""Start with a blank database."""
58			rv = client.get('/')
59			assert b'Security Knowledge Framework' in rv.data
60
61			def test_first_login(client):
62			"""Make sure login works"""
63			rv = first_login(client)
64			assert b'First login' in rv.data
65
66			def test_login(client):
67			"""Make sure login works"""
68			rv = login(client, "admin", "test-skf")
69			assert b'Start new project' in rv.data
70			rv = login(client, "foobar", "X")
71			assert b'login' in rv.data
72
73			def test_knowledge_base_items(client):
74			"""Make sure knowledge-base items are visible"""
75			login(client, "admin", "test-skf")
76			rv = client.get('/knowledge-base')
77			assert b'Knowledge Base Security Vulnerabilities' in rv.data
78			assert b'Filename injection Path traversel' in rv.data
79			assert b'Repudiation attack' in rv.data
80			assert b'Open forward' in rv.data
81			assert b'Verify that the session id is never disclosed' in rv.data
82			assert b'Logging guidelines' in rv.data
83
84			def test_manage_users(client):
85			"""Make sure manage users is working"""
86			login(client, "admin", "test-skf")
87			rv = client.get('/users-manage')
88			assert b'admin' in rv.data
89			assert b'edit:read:manage:delete' in rv.data
90
91			def test_add_user(client):
92			""""Make sure we can add users """
93			login(client, "admin", "test-skf")
94			return client.post('/users-add', data=dict(
95			addUser="Create user",
96			email="test@localhost",
97			privID="3",
98			username="Test",
99			csrf_token="AAAA"
100			), follow_redirects=True)
101			assert b'test@localhost' in rv.data
102
103			def test_new_user_group(client):
104			"""Make sure we can create new user group"""
105			login(client, "admin", "test-skf")
106			rv = client.get('/group-manage')
107			return client.post('/users-add', data=dict(
108			groupName="Testing group",
109			projectFormSubmit="Create group",
110			csrf_token="AAAA"
111			), follow_redirects=True)
112			assert b'Add users to groups' in rv.data
113
114			def test_add_new_user_group(client):
115			"""Make sure we can create new user group"""
116			login(client, "admin", "test-skf")
117			rv = client.get('/group-users')
118			return client.post('/group-add-users', data=dict(
119			groupName="2",
120			test0="2--",
121			submit='Add values',
122			csrf_token="AAAA"
123			), follow_redirects=True)
124			assert b'Test' in rv.data
125
126			def test_new_user_login(client):
127			"""Make sure we cant login with the new user"""
128			login(client, "Test", "x")
129			rv = client.get('/group-users')
130			assert b'bad password' in rv.data
131
132			def test_access_new_user_group(client):
133			"""Make sure we can create new user group"""
134			login(client, "admin", "test-skf")
135			rv = client.get('/users-manage')
136			return client.post('/user-access', data=dict(
137			access="true",
138			userID="2",
139			csrf_token="AAAA"
140			), follow_redirects=True)
141			login(client, "Test", "test-skf")
142			assert b'Start new project' in rv.data
143
144			def test_first_login_post(client):
145			"""Make sure we setup new user """
146			rv = client.get('/first-login')
147			return client.post('/create-account', data=dict(
148			email="test@localhost",
149			password="test-skf",
150			password2='test-skf',
151			token="AAAA"
152			), follow_redirects=True)
153			assert b'bad password' in rv.data
154
155			def test_knowledge_base_item(client):
156			"""Make sure knowledge-base item content works"""
157			login(client, "admin", "test-skf")
158			rv = client.post('/kb-item', data=dict(
159			id=144
160			), follow_redirects=True)
161			assert rv.status_code == 200
162
163			rv = client.post('/kb-item', data=dict(
164			id=61
165			), follow_redirects=True)
166			assert rv.status_code == 200
167
168			rv = client.post('/kb-item', data=dict(
169			id=122
170			), follow_redirects=True)
171			assert rv.status_code == 200
172
173			rv = client.post('/kb-item', data=dict(
174			id=97
175			), follow_redirects=True)
176			assert rv.status_code == 200
177
178			def test_code_base_items(client):
179			"""Make sure code-example items are visible"""
180			login(client, "admin", "test-skf")
181			rv = client.get('/code-examples')
182			assert b'Knowledge Base Code Examples' in rv.data
183			assert b'File upload' in rv.data
184			assert b'Input validation' in rv.data
185			assert b'Debug enabling' in rv.data
186			assert b'Anti caching headers' in rv.data
187
188			def test_code_base_item(client):
189			"""Make sure code-example item content works"""
190			login(client, "admin", "test-skf")
191			rv = client.post('/code-item', data=dict(
192			id=1
193			), follow_redirects=True)
194			assert rv.status_code == 200
195
196			rv = client.post('/code-item', data=dict(
197			id=4
198			), follow_redirects=True)
199			assert rv.status_code == 200
200
201			rv = client.post('/code-item', data=dict(
202			id=6
203			), follow_redirects=True)
204			assert rv.status_code == 200
205
206			rv = client.post('/code-item', data=dict(
207			id=7
208			), follow_redirects=True)
209			assert rv.status_code == 200
210
211			rv = client.post('/code-item', data=dict(
212			id=9
213			), follow_redirects=True)
214			assert rv.status_code == 200
215
216			def test_create_project(client):
217			"""Make sure skf is able to create new project and shows in listhttps://localhost:5443/project-checklists/1"""
218			login(client, "admin", "test-skf")
219			rv = client.get('/project-new')
220			assert b'Create new project' in rv.data
221			rv = client.post('/project-add', data=dict(
222			inputDesc="This is a test Description.",
223			inputName="SKF Project",
224			projectFormSubmit="Create Project",
225			inputVersion="4.1.1",
226			csrf_token="AAAA"
227			), follow_redirects=True)
228			assert b'is a test Description' in rv.data
229			assert b'4.1.1' in rv.data
230			assert b'SKF Project' in rv.data
231
232			def test_create_project_function(client):
233			"""Make sure skf is able to create new project functions"""
234			login(client, "admin", "test-skf")
235			rv = client.get('/project-new')
236			rv = client.post('/project-add', data=dict(
237			inputDesc="This is a test Description.",
238			inputName="SKF Project",
239			inputVersion="4.1.1",
240			csrf_token="AAAA"
241			), follow_redirects=True)
242			rv = client.get('/project-functions/1')
243			rv = client.post('/project-function-add', data=dict(
244			functionDesc="This is a test Description for the selected release.",
245			functionName="SKF Phase 1",
246			project_id="1",
247			test0="158--24",
248			test1="157--22",
249			test2="154--20",
250			csrf_token="AAAA"
251			), follow_redirects=True)
252			rv = client.get('/project-functions/1')
253			assert b'Sessions' in rv.data
254			assert b'User registration' in rv.data
255			assert b'sub-domains' in rv.data
256			rv = client.get('/results-functions')
257			assert b'SKF Phase' in rv.data
258			rv = client.get('/results-function-report/1')
259			assert b'Sessions' in rv.data
260			assert b'User registration' in rv.data
261			assert b'sub-domains' in rv.data
262			rv = client.get('/results-function-docx/1')
263			assert b'attachment' in rv.headers['Content-Disposition']
264
265			def test_create_project_checklist2(client):
266			"""Make sure skf is able to create, read, download new project checklist"""
267			login(client, "admin", "test-skf")
268			rv = client.get('/project-new')
269			rv = client.post('/project-add', data=dict(
270			inputDesc="This is a test Description.",
271			inputName="SKF Project",
272			inputVersion="4.1.1",
273			projectFormSubmit="Create Project",
274			csrf_token="AAAA"
275			), follow_redirects=True)
276			rv = client.get('/project-checklists/1')
277			#add ASVS level-1 list and check if works
278			rv = client.post('/project-checklist-add', data=dict(
279			answer1="na",
280			answer2="no",
281			csrf_token="AAAA",
282			listID1="",
283			listID2="",
284			projectID="1",
285			projectName="1",
286			questionID1="431",
287			questionID2="432",
288			submit="",
289			vulnID1="1",
290			vulnID2="14"
291			), follow_redirects=True)
292			print rv.data
293			assert b'SKF Project' in rv.data
294			date = datetime.datetime.now().strftime("%Y-%m-%d %H:%M")
295			rv = client.get('/results-checklist-report/'+date)
296			assert b'Version management' in rv.data
297			rv = client.get('/results-checklist-docx/'+date)
298			assert b'attachment' in rv.headers['Content-Disposition']
299

blabla1337 / skf-flask

Push — dev-skf ( b5d67b...388b3e )

skf.test_code_base_items() B

Complexity

Size

Duplication

Duplication Side-by-Side

Filter issues like