mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 19:26:48 +00:00
4ece22230e
The edit dialog of a secret was filled with its current value, so every readable secret's value was in the secrets page's HTML. A private secret, or one with no value yet, cannot be read: its field held the text "None", which is valid base64, and saving the dialog unchanged set the secret to the three bytes it decodes to. The dialog now only writes a new value: the field starts empty, is a password field and is required. The page no longer reads secret values, and get_secret_value, used only for that, is gone.
31 lines
1.6 KiB
Python
31 lines
1.6 KiB
Python
"""The secrets page never holds a secret's value: the edit dialog only
|
|
writes a new one."""
|
|
|
|
from unittest.mock import patch
|
|
|
|
from computes.models import Compute
|
|
from django.contrib.auth import get_user_model
|
|
from django.test import TestCase
|
|
from django.urls import reverse
|
|
from libvirt import VIR_SECRET_USAGE_TYPE_CEPH
|
|
from lxml import html
|
|
|
|
|
|
class SecretsPageTests(TestCase):
|
|
def test_the_page_holds_no_secret_value(self):
|
|
compute = Compute.objects.create(name="secrets-page", hostname="localhost", login="", password="", type=4)
|
|
self.client.force_login(get_user_model().objects.create_superuser("page", "page@example.com", "pw"))
|
|
with patch("virtsecrets.views.wvmSecrets") as conn:
|
|
conn.return_value.get_secrets.return_value = ["0e5b1f0a-8f3e-4c1a-9d2b-5c6d7e8f9a0b"]
|
|
secret = conn.return_value.get_secret.return_value
|
|
secret.usageID.return_value = "client.libvirt"
|
|
secret.UUIDString.return_value = "0e5b1f0a-8f3e-4c1a-9d2b-5c6d7e8f9a0b"
|
|
secret.usageType.return_value = VIR_SECRET_USAGE_TYPE_CEPH
|
|
secret.value.return_value = b"cephx key"
|
|
conn.return_value.get_secret_value.return_value = "Y2VwaHgga2V5"
|
|
response = self.client.get(reverse("virtsecrets", args=[compute.id]))
|
|
self.assertEqual(response.status_code, 200)
|
|
self.assertFalse(b"Y2VwaHgga2V5" in response.content, "the secret's value is on the page")
|
|
field = html.fromstring(response.content).get_element_by_id("secret_value_0e5b1f0a-8f3e-4c1a-9d2b-5c6d7e8f9a0b")
|
|
self.assertIsNone(field.get("value"))
|
|
self.assertEqual(field.get("type"), "password")
|