server/beego
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Fix Sonar Part2

Browse Source
This commit is contained in:
Ming Deng
2021-02-01 18:45:57 +08:00
parent 2c9cd98d03
commit 9c392a3a09
14 changed files with 320 additions and 462 deletions
Download Patch File Download Diff File Expand all files Collapse all files

84
adapter/plugins/authz/authz_test.go
View File

@@ -26,6 +26,11 @@ import (
"github.com/beego/beego/v2/adapter/plugins/auth"
)
const (
authCfg = "authz_model.conf"
authCsv = "authz_policy.csv"
)
func testRequest(t *testing.T, handler *beego.ControllerRegister, user string, path string, method string, code int) {
r, _ := http.NewRequest(method, path, nil)
r.SetBasicAuth(user, "123")
@@ -40,70 +45,79 @@ func testRequest(t *testing.T, handler *beego.ControllerRegister, user string, p
func TestBasic(t *testing.T) {
handler := beego.NewControllerRegister()
handler.InsertFilter("*", beego.BeforeRouter, auth.Basic("alice", "123"))
handler.InsertFilter("*", beego.BeforeRouter, NewAuthorizer(casbin.NewEnforcer("authz_model.conf", "authz_policy.csv")))
_ = handler.InsertFilter("*", beego.BeforeRouter, auth.Basic("alice", "123"))
_ = handler.InsertFilter("*", beego.BeforeRouter, NewAuthorizer(casbin.NewEnforcer(authCfg, authCsv)))
handler.Any("*", func(ctx *context.Context) {
ctx.Output.SetStatus(200)
})
testRequest(t, handler, "alice", "/dataset1/resource1", "GET", 200)
testRequest(t, handler, "alice", "/dataset1/resource1", "POST", 200)
testRequest(t, handler, "alice", "/dataset1/resource2", "GET", 200)
testRequest(t, handler, "alice", "/dataset1/resource2", "POST", 403)
const d1r1 = "/dataset1/resource1"
testRequest(t, handler, "alice", d1r1, "GET", 200)
testRequest(t, handler, "alice", d1r1, "POST", 200)
const d1r2 = "/dataset1/resource2"
testRequest(t, handler, "alice", d1r2, "GET", 200)
testRequest(t, handler, "alice", d1r2, "POST", 403)
}
func TestPathWildcard(t *testing.T) {
handler := beego.NewControllerRegister()
handler.InsertFilter("*", beego.BeforeRouter, auth.Basic("bob", "123"))
handler.InsertFilter("*", beego.BeforeRouter, NewAuthorizer(casbin.NewEnforcer("authz_model.conf", "authz_policy.csv")))
_ = handler.InsertFilter("*", beego.BeforeRouter, auth.Basic("bob", "123"))
_ = handler.InsertFilter("*", beego.BeforeRouter, NewAuthorizer(casbin.NewEnforcer(authCfg, authCsv)))
handler.Any("*", func(ctx *context.Context) {
ctx.Output.SetStatus(200)
})
testRequest(t, handler, "bob", "/dataset2/resource1", "GET", 200)
testRequest(t, handler, "bob", "/dataset2/resource1", "POST", 200)
testRequest(t, handler, "bob", "/dataset2/resource1", "DELETE", 200)
testRequest(t, handler, "bob", "/dataset2/resource2", "GET", 200)
testRequest(t, handler, "bob", "/dataset2/resource2", "POST", 403)
testRequest(t, handler, "bob", "/dataset2/resource2", "DELETE", 403)
const d2r1 = "/dataset2/resource1"
testRequest(t, handler, "bob", d2r1, "GET", 200)
testRequest(t, handler, "bob", d2r1, "POST", 200)
testRequest(t, handler, "bob", d2r1, "DELETE", 200)
const d2r2 = "/dataset2/resource2"
testRequest(t, handler, "bob", d2r2, "GET", 200)
testRequest(t, handler, "bob", d2r2, "POST", 403)
testRequest(t, handler, "bob", d2r2, "DELETE", 403)
testRequest(t, handler, "bob", "/dataset2/folder1/item1", "GET", 403)
testRequest(t, handler, "bob", "/dataset2/folder1/item1", "POST", 200)
testRequest(t, handler, "bob", "/dataset2/folder1/item1", "DELETE", 403)
testRequest(t, handler, "bob", "/dataset2/folder1/item2", "GET", 403)
testRequest(t, handler, "bob", "/dataset2/folder1/item2", "POST", 200)
testRequest(t, handler, "bob", "/dataset2/folder1/item2", "DELETE", 403)
const item1 = "/dataset2/folder1/item1"
testRequest(t, handler, "bob", item1, "GET", 403)
testRequest(t, handler, "bob", item1, "POST", 200)
testRequest(t, handler, "bob", item1, "DELETE", 403)
const item2 = "/dataset2/folder1/item2"
testRequest(t, handler, "bob", item2, "GET", 403)
testRequest(t, handler, "bob", item2, "POST", 200)
testRequest(t, handler, "bob", item2, "DELETE", 403)
}
func TestRBAC(t *testing.T) {
handler := beego.NewControllerRegister()
handler.InsertFilter("*", beego.BeforeRouter, auth.Basic("cathy", "123"))
e := casbin.NewEnforcer("authz_model.conf", "authz_policy.csv")
handler.InsertFilter("*", beego.BeforeRouter, NewAuthorizer(e))
_ = handler.InsertFilter("*", beego.BeforeRouter, auth.Basic("cathy", "123"))
e := casbin.NewEnforcer(authCfg, authCsv)
_ = handler.InsertFilter("*", beego.BeforeRouter, NewAuthorizer(e))
handler.Any("*", func(ctx *context.Context) {
ctx.Output.SetStatus(200)
})
// cathy can access all /dataset1/* resources via all methods because it has the dataset1_admin role.
testRequest(t, handler, "cathy", "/dataset1/item", "GET", 200)
testRequest(t, handler, "cathy", "/dataset1/item", "POST", 200)
testRequest(t, handler, "cathy", "/dataset1/item", "DELETE", 200)
testRequest(t, handler, "cathy", "/dataset2/item", "GET", 403)
testRequest(t, handler, "cathy", "/dataset2/item", "POST", 403)
testRequest(t, handler, "cathy", "/dataset2/item", "DELETE", 403)
const dataSet1 = "/dataset1/item"
testRequest(t, handler, "cathy", dataSet1, "GET", 200)
testRequest(t, handler, "cathy", dataSet1, "POST", 200)
testRequest(t, handler, "cathy", dataSet1, "DELETE", 200)
const dataSet2 = "/dataset2/item"
testRequest(t, handler, "cathy", dataSet2, "GET", 403)
testRequest(t, handler, "cathy", dataSet2, "POST", 403)
testRequest(t, handler, "cathy", dataSet2, "DELETE", 403)
// delete all roles on user cathy, so cathy cannot access any resources now.
e.DeleteRolesForUser("cathy")
testRequest(t, handler, "cathy", "/dataset1/item", "GET", 403)
testRequest(t, handler, "cathy", "/dataset1/item", "POST", 403)
testRequest(t, handler, "cathy", "/dataset1/item", "DELETE", 403)
testRequest(t, handler, "cathy", "/dataset2/item", "GET", 403)
testRequest(t, handler, "cathy", "/dataset2/item", "POST", 403)
testRequest(t, handler, "cathy", "/dataset2/item", "DELETE", 403)
testRequest(t, handler, "cathy", dataSet1, "GET", 403)
testRequest(t, handler, "cathy", dataSet1, "POST", 403)
testRequest(t, handler, "cathy", dataSet1, "DELETE", 403)
testRequest(t, handler, "cathy", dataSet2, "GET", 403)
testRequest(t, handler, "cathy", dataSet2, "POST", 403)
testRequest(t, handler, "cathy", dataSet2, "DELETE", 403)
}