STRLCPY/tsunami-security-scanner

Extend `sendAsIs` method to support more HTTP methods. This fixes #92.

PiperOrigin-RevId: 415056841
Change-Id: I3c00078cd719ba4f4b9d68d4d9277d8e783d15d3

Tsunami Team committed with Copybara-Service 2 years ago

3c2cbb1c

1 parent b570bb14

Revision indexing in progress... (symbol navigation in revisions will be accurate after indexed)

Total 2 files Show one by one

■ ■ ■ ■ ■ ■

common/src/main/java/com/google/tsunami/common/net/http/HttpClient.java

		skipped 20 lines
21	21		import static com.google.common.util.concurrent.MoreExecutors.directExecutor;
22	22
23	23		import com.google.common.base.Ascii;
	24	+	import com.google.common.collect.ImmutableSet;
24	25		import com.google.common.flogger.GoogleLogger;
	26	+	import com.google.common.io.ByteSource;
25	27		import com.google.common.util.concurrent.ListenableFuture;
26	28		import com.google.common.util.concurrent.SettableFuture;
27	29		import com.google.protobuf.ByteString;
		skipped 48 lines
76	78		* @throws IOException if an I/O error occurs during the HTTP request.
77	79		*/
78	80		public HttpResponse sendAsIs(HttpRequest httpRequest) throws IOException {
79		-	if (!httpRequest.method().equals(HttpMethod.GET)) {
80		-	throw new IllegalArgumentException("sendAsIs method should only be used for GET method.");
81		-	}
82		-
83	81		HttpURLConnection connection = connectionFactory.openConnection(httpRequest.url());
84	82		connection.setRequestMethod(httpRequest.method().toString());
85	83		httpRequest.headers().names().stream()
		skipped 7 lines
93	91		headerValue -> connection.setRequestProperty(headerName, headerValue)));
94	92		connection.setRequestProperty(USER_AGENT, TSUNAMI_USER_AGENT);
95	93
96		-	connection.connect();
	94	+	if (ImmutableSet.of(HttpMethod.POST, HttpMethod.PUT, HttpMethod.DELETE)
	95	+	.contains(httpRequest.method())) {
	96	+	connection.setDoOutput(true);
	97	+	ByteSource.wrap(httpRequest.requestBody().orElse(ByteString.EMPTY).toByteArray())
	98	+	.copyTo(connection.getOutputStream());
	99	+	}
97	100
98	101		int responseCode = connection.getResponseCode();
99	102		HttpHeaders.Builder responseHeadersBuilder = HttpHeaders.builder();
		skipped 253 lines

■ ■ ■ ■ ■ ■

common/src/test/java/com/google/tsunami/common/net/http/HttpClientTest.java

		skipped 83 lines
84	84		@Test
85	85		public void sendAsIs_always_returnsExpectedHttpResponse()
86	86		throws IOException, InterruptedException {
87		-	String responseBody = "test response";
88		-	mockWebServer.enqueue(
89		-	new MockResponse()
90		-	.setResponseCode(HttpStatus.OK.code())
91		-	.setHeader(CONTENT_TYPE, MediaType.PLAIN_TEXT_UTF_8.toString())
92		-	.setBody(responseBody));
	87	+	mockWebServer.setDispatcher(new SendAsIsTestDispatcher());
93	88		mockWebServer.start();
	89	+	String expectedResponseBody = SendAsIsTestDispatcher.buildBody("GET", "");
94	90
95	91		HttpUrl baseUrl = mockWebServer.url("/");
96	92		String requestUrl =
97		-	new URL(baseUrl.scheme(), baseUrl.host(), baseUrl.port(), "/%2e%2e/%2e%2e/etc/passwd")
	93	+	new URL(
	94	+	baseUrl.scheme(),
	95	+	baseUrl.host(),
	96	+	baseUrl.port(),
	97	+	"/send-as-is/%2e%2e/%2e%2e/etc/passwd")
98	98		.toString();
99	99
100	100		HttpResponse response = httpClient.sendAsIs(get(requestUrl).withEmptyHeaders().build());
101	101
102		-	assertThat(mockWebServer.takeRequest().getPath()).isEqualTo("/%2e%2e/%2e%2e/etc/passwd");
	102	+	assertThat(mockWebServer.takeRequest().getPath())
	103	+	.isEqualTo("/send-as-is/%2e%2e/%2e%2e/etc/passwd");
103	104		assertThat(response)
104	105		.isEqualTo(
105	106		HttpResponse.builder()
		skipped 2 lines
108	109		HttpHeaders.builder()
109	110		.addHeader(CONTENT_TYPE, MediaType.PLAIN_TEXT_UTF_8.toString())
110	111		// MockWebServer always adds this response header.
111		-	.addHeader(CONTENT_LENGTH, String.valueOf(responseBody.length()))
	112	+	.addHeader(CONTENT_LENGTH, String.valueOf(expectedResponseBody.length()))
112	113		.build())
113		-	.setBodyBytes(ByteString.copyFrom(responseBody, UTF_8))
	114	+	.setBodyBytes(ByteString.copyFrom(expectedResponseBody, UTF_8))
114	115		.build());
115	116		}
116	117
117	118		@Test
118		-	public void sendAsIs_withNonGetRequest_throws() throws IOException, InterruptedException {
	119	+	public void sendAsIs_withPostRequest_returnsExpectedHttpResponse()
	120	+	throws IOException, InterruptedException {
	121	+	mockWebServer.setDispatcher(new SendAsIsTestDispatcher());
119	122		mockWebServer.start();
	123	+	String requestBody = "POST BODY";
	124	+	String expectedResponseBody = SendAsIsTestDispatcher.buildBody("POST", requestBody);
120	125
121	126		HttpUrl baseUrl = mockWebServer.url("/");
122	127		String requestUrl =
123		-	new URL(baseUrl.scheme(), baseUrl.host(), baseUrl.port(), "/%2e%2e/%2e%2e/etc/passwd")
	128	+	new URL(baseUrl.scheme(), baseUrl.host(), baseUrl.port(), "/send-as-is/%2e%2e/%2e%2e/path")
124	129		.toString();
125	130
126		-	assertThrows(
127		-	IllegalArgumentException.class,
128		-	() -> httpClient.sendAsIs(post(requestUrl).withEmptyHeaders().build()));
	131	+	HttpResponse response =
	132	+	httpClient.sendAsIs(
	133	+	post(requestUrl)
	134	+	.setRequestBody(ByteString.copyFrom(requestBody, UTF_8))
	135	+	.withEmptyHeaders()
	136	+	.build());
	137	+
	138	+	assertThat(mockWebServer.takeRequest().getPath()).isEqualTo("/send-as-is/%2e%2e/%2e%2e/path");
	139	+	assertThat(response)
	140	+	.isEqualTo(
	141	+	HttpResponse.builder()
	142	+	.setStatus(HttpStatus.OK)
	143	+	.setHeaders(
	144	+	HttpHeaders.builder()
	145	+	.addHeader(CONTENT_TYPE, MediaType.PLAIN_TEXT_UTF_8.toString())
	146	+	// MockWebServer always adds this response header.
	147	+	.addHeader(CONTENT_LENGTH, String.valueOf(expectedResponseBody.length()))
	148	+	.build())
	149	+	.setBodyBytes(ByteString.copyFrom(expectedResponseBody, UTF_8))
	150	+	.build());
129	151		}
130	152
131	153		@Test
		skipped 627 lines
759	781		public MockResponse dispatch(RecordedRequest recordedRequest) {
760	782		if (nullToEmpty(recordedRequest.getHeader(HOST)).startsWith(expectedHost)) {
761	783		return new MockResponse().setResponseCode(HttpStatus.OK.code());
	784	+	}
	785	+	return new MockResponse().setResponseCode(HttpStatus.NOT_FOUND.code());
	786	+	}
	787	+	}
	788	+
	789	+	static final class SendAsIsTestDispatcher extends Dispatcher {
	790	+	static final String SEND_AS_IS_PATH = "/send-as-is/";
	791	+
	792	+	static String buildBody(String method, String requestBody) {
	793	+	return String.format("Method: %s\nRequest Body: %s", method, requestBody);
	794	+	}
	795	+
	796	+	@Override
	797	+	public MockResponse dispatch(RecordedRequest recordedRequest) {
	798	+	if (recordedRequest.getPath().startsWith(SEND_AS_IS_PATH)) {
	799	+	return new MockResponse()
	800	+	.setHeader(CONTENT_TYPE, MediaType.PLAIN_TEXT_UTF_8.toString())
	801	+	.setBody(buildBody(recordedRequest.getMethod(), recordedRequest.getBody().readUtf8()))
	802	+	.setResponseCode(HttpStatus.OK.code());
762	803		}
763	804		return new MockResponse().setResponseCode(HttpStatus.NOT_FOUND.code());
764	805		}
		skipped 3 lines