Package net.shibboleth.idp.ui.csrf.impl

Class CSRFTokenFlowExecutionListenerTest

java.lang.Object

net.shibboleth.idp.ui.csrf.BaseCSRFTest

net.shibboleth.idp.ui.csrf.impl.CSRFTokenFlowExecutionListenerTest

public class CSRFTokenFlowExecutionListenerTest
extends BaseCSRFTest

Test the CSRFTokenFlowExecutionListener.

Nested Class Summary

Nested classes/interfaces inherited from class net.shibboleth.idp.ui.csrf.BaseCSRFTest

BaseCSRFTest.MockView, BaseCSRFTest.MockViewState

Field Summary

Fields

Modifier and Type	Field	Description
private final String	CSRF_PARAM_NAME	the HTTP request parameter name that holds the CSRF token.
private net.shibboleth.idp.ui.csrf.impl.CSRFTokenFlowExecutionListener	listener	The listener instance to test.
private Object	nullObj	Something to spoof the null checker.

Fields inherited from class net.shibboleth.idp.ui.csrf.BaseCSRFTest

EXCLUDED_VIEWSTATES_FIELDNAME, INCLUDE_ALL_VIEWSTATES_FIELDNAME, INCLUDED_VIEWSTATES_FIELDNAME

Constructor Summary

Constructors

Constructor	Description
CSRFTokenFlowExecutionListenerTest()

Method Summary

Modifier and Type	Method	Description
void	setup()
void	testAddingCsrfTokenToViewScopeOnRendering()	Test the listener adds the CSRF token to the viewScope on view rendering.
void	testDisabled()	Test the listener does not throw an InvalidCSRFTokenException even though the tokens do not match, because the listener is disabled.
void	testDoesNotAddTokenToNonViewState()	Test the listener gracefully (no exception) handles a non view-state.
void	testDoesNotTestTokenInNonViewState()	Test the listener does not test the CSRF token if called from in a non view-state.
void	testHttpRequestTokenException()	Test the listener throws an InvalidCSRFTokenException if no CSRF token is present in the Http request.
void	testInvalidToken()	Test the listener throws an InvalidCSRFTokenException if the viewScope and request token do not match.
void	testInvalidTokenUsingNewEventRequiresCSRFTokenValidationPredicate()	Test the listener does throw an InvalidCSRFTokenException as the tokens do not match.
void	testNoViewScopeTokenException()	Test the listener throws an InvalidCSRFTokenException if no CSRF token is present in the viewscope.
void	testSetCsrfTokenManager()	Test setting a CSRF token manager.
void	testSetEnabled()	Test setting the listener's enabled property.
void	testSetNullCsrfTokenManager()	Test setting a null CSRF token manager triggers a ConstraintViolationException.
void	testSetNullEventRequiresCSRFValidationPredicate()	Test setting a null event requires csrf validation predicate triggers a ConstraintViolationException.
void	testSetNullViewRequiresCSRFTokenPredicate()	Test setting a null view requires csrf token predicate triggers a ConstraintViolationException.
void	testTokenNotAddedToViewScopeOnRenderingWhenDisabled()	Test the listener does not add CSRF token to the viewScope on view rendering, as listener disabled.
void	testTokenWrongType()	Tests the InvalidCSRFTokenException is thrown when the view scoped token is the wrong type - String rather than CSRFToken.
(package private) void	testUnsetCsrfTokenManager()	Test an unset csrf token manager triggers an initialisation exception.
(package private) void	testUnsetEventRequiresCSRFValidationPredicate()	Test an unset ViewRequiresCSRFToken predicate triggers an initialisation exception.
(package private) void	testUnsetViewRequiresCSRFTokenPredicate()	Test an unset EventRequiresCSRFTokenValidation predicate triggers an initialisation exception.
void	testValidToken()	Test an InvalidCSRFTokenException is not thrown if the token in the request and viewscope matches.
void	testViewExcluded()	Test the listener does not thrown an InvalidCSRFTokenException.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

CSRF_PARAM_NAME

private final String CSRF_PARAM_NAME

the HTTP request parameter name that holds the CSRF token.

See Also:

• Constant Field Values

listener

private net.shibboleth.idp.ui.csrf.impl.CSRFTokenFlowExecutionListener listener

The listener instance to test.

nullObj

private Object nullObj

Something to spoof the null checker.

Constructor Details

CSRFTokenFlowExecutionListenerTest

public CSRFTokenFlowExecutionListenerTest()

Method Details

setup

@BeforeMethod
public void setup()
           throws ComponentInitializationException

Throws:

ComponentInitializationException

testAddingCsrfTokenToViewScopeOnRendering

public void testAddingCsrfTokenToViewScopeOnRendering()
                                               throws ComponentInitializationException

Test the listener adds the CSRF token to the viewScope on view rendering.

Throws:

ComponentInitializationException - ...

testInvalidToken

public void testInvalidToken()
                      throws ComponentInitializationException

Test the listener throws an InvalidCSRFTokenException if the viewScope and request token do not match. View is not excluded.

Throws:

ComponentInitializationException - ...

testValidToken

public void testValidToken()
                    throws ComponentInitializationException

Test an InvalidCSRFTokenException is not thrown if the token in the request and viewscope matches.

Throws:

ComponentInitializationException - ...

testViewExcluded

public void testViewExcluded()
                      throws ComponentInitializationException

Test the listener does not thrown an InvalidCSRFTokenException. The tokens do not match, but the specific view is excluded.

Throws:

ComponentInitializationException - ...

testDisabled

public void testDisabled()
                  throws ComponentInitializationException

Test the listener does not throw an InvalidCSRFTokenException even though the tokens do not match, because the listener is disabled.

Throws:

ComponentInitializationException - ...

testDoesNotAddTokenToNonViewState

public void testDoesNotAddTokenToNonViewState()
                                       throws ComponentInitializationException

Test the listener gracefully (no exception) handles a non view-state. Note this should really not happen in production, as SWF should not call the viewRendering method unless in a view-state.

Throws:

ComponentInitializationException - ...

testDoesNotTestTokenInNonViewState

public void testDoesNotTestTokenInNonViewState()
                                        throws ComponentInitializationException

Test the listener does not test the CSRF token if called from in a non view-state. No exception should be thrown. Note, if it did test the tokens, as none are present, an exception would be thrown - which is undesirable.

Throws:

ComponentInitializationException - ...

testHttpRequestTokenException

public void testHttpRequestTokenException()
                                   throws ComponentInitializationException

Test the listener throws an InvalidCSRFTokenException if no CSRF token is present in the Http request.

Throws:

ComponentInitializationException - ...

testInvalidTokenUsingNewEventRequiresCSRFTokenValidationPredicate

public void testInvalidTokenUsingNewEventRequiresCSRFTokenValidationPredicate()
                                                                       throws ComponentInitializationException

Test the listener does throw an InvalidCSRFTokenException as the tokens do not match. A new BiPredicate is created to match by eventId.

Throws:

ComponentInitializationException - ...

testNoViewScopeTokenException

public void testNoViewScopeTokenException()
                                   throws ComponentInitializationException

Test the listener throws an InvalidCSRFTokenException if no CSRF token is present in the viewscope.

Throws:

ComponentInitializationException - ...

testSetCsrfTokenManager

public void testSetCsrfTokenManager()
                             throws ComponentInitializationException

Test setting a CSRF token manager.

Throws:

ComponentInitializationException - ...

testSetEnabled

public void testSetEnabled()

Test setting the listener's enabled property.

testTokenNotAddedToViewScopeOnRenderingWhenDisabled

public void testTokenNotAddedToViewScopeOnRenderingWhenDisabled()
                                                         throws ComponentInitializationException

Test the listener does not add CSRF token to the viewScope on view rendering, as listener disabled.

Throws:

ComponentInitializationException - ...

testSetNullCsrfTokenManager

public void testSetNullCsrfTokenManager()

Test setting a null CSRF token manager triggers a ConstraintViolationException.

testSetNullEventRequiresCSRFValidationPredicate

public void testSetNullEventRequiresCSRFValidationPredicate()

Test setting a null event requires csrf validation predicate triggers a ConstraintViolationException.

testSetNullViewRequiresCSRFTokenPredicate

public void testSetNullViewRequiresCSRFTokenPredicate()

Test setting a null view requires csrf token predicate triggers a ConstraintViolationException.

testTokenWrongType

public void testTokenWrongType()
                        throws ComponentInitializationException

Tests the InvalidCSRFTokenException is thrown when the view scoped token is the wrong type - String rather than CSRFToken.

Throws:

ComponentInitializationException - ...

testUnsetCsrfTokenManager

void testUnsetCsrfTokenManager()
                        throws ComponentInitializationException

Test an unset csrf token manager triggers an initialisation exception.

Throws:

ComponentInitializationException - ...

testUnsetEventRequiresCSRFValidationPredicate

void testUnsetEventRequiresCSRFValidationPredicate()
                                            throws ComponentInitializationException

Test an unset ViewRequiresCSRFToken predicate triggers an initialisation exception.

Throws:

ComponentInitializationException - ...

testUnsetViewRequiresCSRFTokenPredicate

void testUnsetViewRequiresCSRFTokenPredicate()
                                      throws ComponentInitializationException

Test an unset EventRequiresCSRFTokenValidation predicate triggers an initialisation exception.

Throws:

ComponentInitializationException - ...