inteligr8/SearchServices
1
0
Fork 0
mirror of https://github.com/Alfresco/SearchServices.git synced 2026-09-16 18:12:56 +00:00
Code Issues Packages Projects Releases Wiki Activity

REPO-2112 / MNT-17545: HTTP Header Injection in ContentStreamer

Browse Source 
Added support for getNodeContent and tests for REPO-2112
This commit is contained in:
Mihaela Popa
2017-03-07 10:27:56 +02:00
parent 7bf3756c6e
commit 13c9cf183e
1 changed files with 52 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
e2e-test/java/org/alfresco/rest/nodes/NodesContentTests.java
+52
View File
@@ -0,0 +1,52 @@
package org.alfresco.rest.nodes;
import org.alfresco.dataprep.CMISUtil.DocumentType;
import org.alfresco.rest.RestTest;
import org.alfresco.utility.model.FileModel;
import org.alfresco.utility.model.FileType;
import org.alfresco.utility.model.SiteModel;
import org.alfresco.utility.model.TestGroup;
import org.alfresco.utility.model.UserModel;
import org.alfresco.utility.report.Bug;
import org.alfresco.utility.testrail.ExecutionType;
import org.alfresco.utility.testrail.annotation.TestRail;
import org.springframework.http.HttpStatus;
import org.testng.annotations.Test;
/**
*
* @author mpopa
*
*/
public class NodesContentTests extends RestTest
{
@TestRail(section = { TestGroup.REST_API,TestGroup.NODES }, executionType = ExecutionType.SANITY,
description = "Verify file name in Content-Disposition header")
@Test(groups = { TestGroup.REST_API, TestGroup.NODES, TestGroup.SANITY})
public void checkFileNameWithRegularCharsInHeader() throws Exception
{
UserModel user = dataUser.createRandomTestUser();
SiteModel site = dataSite.usingUser(user).createPublicRandomSite();
FileModel file = dataContent.usingUser(user).usingSite(site).createContent(DocumentType.TEXT_PLAIN);
restClient.authenticateUser(user).withCoreAPI().usingNode(file).usingParams("attachment=false").getNodeContent();
restClient.assertStatusCodeIs(HttpStatus.OK);
restClient.assertHeaderValueContains("Content-Disposition", String.format("filename=\"%s\"", file.getName()));
}
@Bug(id="REPO-2112")
@TestRail(section = { TestGroup.REST_API,TestGroup.NODES }, executionType = ExecutionType.REGRESSION,
description = "Verify file name with special chars is escaped in Content-Disposition header")
@Test(groups = { TestGroup.REST_API, TestGroup.NODES, TestGroup.CORE})
public void checkFileNameWithSpecialCharsInHeader() throws Exception
{
char c1 = 127;
char c2 = 31;
char c3 = 256;
UserModel user = dataUser.createRandomTestUser();
SiteModel site = dataSite.usingUser(user).createPublicRandomSite();
FileModel file = dataContent.usingUser(user).usingSite(site).createContent(new FileModel("\ntest\""+c1+c2+c3,FileType.TEXT_PLAIN));
restClient.authenticateUser(user).withCoreAPI().usingNode(file).usingParams("attachment=false").getNodeContent();
restClient.assertStatusCodeIs(HttpStatus.OK);
restClient.assertHeaderValueContains("Content-Disposition","filename=\" test .txt\"");
}
}