mirror of
https://github.com/retspen/webvirtcloud
synced 2026-11-08 11:16:47 +00:00
bdc8a6755c
Tests that build vrtManager objects and touch no view, form or model of an app lived in that app; vrtManager/tests already holds such tests, so the convention was split. They move to vrtManager/tests: the firmware, CPU mode and PCIe port definitions of a new VM (test_create), USB and PCI host devices, the console listener, host CPU reads, interface reads, deletes and XML, network filters, PCI passthrough rules, node devices, network changes, addresses and leases, pool XML, secrets, and the live tests that use vrtManager only (disk resize, ISO, snapshots, XML, live clone). livetest.py, the live-test helper six apps import, and the network test driver move with them. Others go to their app: the quota with a host down to instances, the 401/403 Logs rows (webvirtcloud's middleware) to webvirtcloud, the VM page's tab script test to instances, novncd's own tests out of the console views tests, the compute lock and input validation tests out of the computes views tests, the interface views out of the forms tests. instances/tests/test_views.py, entirely live, is test_live_views.py. Test modules imported fixtures from each other; shared ones are now in vrtManager/tests/fakes.py (migration fakes, node devices, IOMMU groups, leases, a NAT network, a Ceph secret), interfaces/tests/fakes.py, console/tests/daemons.py (novncd loaded once), livetest.wait_for and instances/tests/create_page.BODY. Every live test checks livetest.enabled(). The suite runs the same 2097 tests.
87 lines
3.4 KiB
Python
87 lines
3.4 KiB
Python
"""A compute's hostname and login go unquoted into libvirt connection URIs
|
|
and an ssh command line; they are validated so neither can inject a URI
|
|
parameter (e.g. ?command=, ?no_verify=) or an ssh option."""
|
|
|
|
import unittest
|
|
|
|
from django.core.exceptions import ValidationError
|
|
|
|
from computes.validators import validate_hostname, validate_login
|
|
from django.test import TestCase
|
|
|
|
|
|
class HostnameValidatorTestCase(unittest.TestCase):
|
|
def test_accepts_ipv4_and_host_names(self):
|
|
for value in ("192.0.2.10", "localhost", "host.example.com", "a-b.example.", "host1"):
|
|
with self.subTest(value=value):
|
|
validate_hostname(value)
|
|
|
|
def test_rejects_uri_and_option_injection(self):
|
|
for value in (
|
|
"-x",
|
|
"a b;c",
|
|
"host:2222",
|
|
"192.0.2.1/system?command=/evil.sh&a=",
|
|
"host/system?no_verify=1",
|
|
"qemu+ssh://host/system",
|
|
"2001:db8::1",
|
|
"",
|
|
"host name",
|
|
):
|
|
with self.subTest(value=value):
|
|
with self.assertRaises(ValidationError):
|
|
validate_hostname(value)
|
|
|
|
|
|
class LoginValidatorTestCase(unittest.TestCase):
|
|
def test_accepts_plain_logins_and_empty(self):
|
|
# empty: TCP falls back to server auth, the socket transport ignores it
|
|
for value in ("", "root", "libvirt.user", "user-1", "_svc"):
|
|
with self.subTest(value=value):
|
|
validate_login(value)
|
|
|
|
def test_rejects_option_and_delimiter_injection(self):
|
|
for value in ("-oProxyCommand=x", "u@realm", "a/b", "a b", "a\\b", "a%b"):
|
|
with self.subTest(value=value):
|
|
with self.assertRaises(ValidationError):
|
|
validate_login(value)
|
|
|
|
|
|
class ComputeInputValidationTestCase(TestCase):
|
|
"""hostname and login reach libvirt URIs and ssh unquoted; the form and
|
|
the API reject values that would inject a URI parameter or an ssh option."""
|
|
|
|
def test_form_rejects_injecting_hostname(self):
|
|
from computes.forms import SshComputeForm
|
|
|
|
form = SshComputeForm(
|
|
data={"name": "c", "hostname": "192.0.2.1/system?command=/evil", "login": "root", "type": 2}
|
|
)
|
|
self.assertFalse(form.is_valid())
|
|
self.assertIn("hostname", form.errors)
|
|
|
|
def test_api_rejects_injecting_hostname_and_login(self):
|
|
from computes.api.serializers import ComputeSerializer
|
|
|
|
for field, data in (
|
|
("hostname", {"name": "c", "hostname": "192.0.2.1/system?command=/evil&a=", "login": "root", "type": 2}),
|
|
("login", {"name": "c", "hostname": "192.0.2.1", "login": "-oProxyCommand=x", "type": 2}),
|
|
):
|
|
with self.subTest(field=field):
|
|
serializer = ComputeSerializer(data=data)
|
|
self.assertFalse(serializer.is_valid())
|
|
self.assertIn(field, serializer.errors)
|
|
|
|
def test_api_accepts_valid_values(self):
|
|
from computes.api.serializers import ComputeSerializer
|
|
|
|
serializer = ComputeSerializer(
|
|
data={"name": "c", "hostname": "host.example.com", "login": "root", "type": 2}
|
|
)
|
|
self.assertTrue(serializer.is_valid(), serializer.errors)
|
|
|
|
def test_api_accepts_empty_login_for_tcp(self):
|
|
from computes.api.serializers import ComputeSerializer
|
|
|
|
serializer = ComputeSerializer(data={"name": "c", "hostname": "192.0.2.1", "login": "", "type": 1})
|
|
self.assertTrue(serializer.is_valid(), serializer.errors)
|