Grasscutters/mitmproxy
3
0
Fork 0
mirror of https://github.com/Grasscutters/mitmproxy.git synced 2024-11-26 10:16:27 +00:00
Code Issues Projects Releases Wiki Activity

[test/xss_scanner] add fixtures in tests

Browse Source 
The previous version of that script made a repetitive use
of the  pytest builtin fixture, with always
the same arguments.

This is a small refactoring and cleanup, mainly adding the 'function'
scope to ensure proper cleaning and using the @pytest.fixture
decorator where I could.
This commit is contained in:
David Kremer 2018-08-15 18:49:22 +02:00
parent e46e064df3
commit dcd8ba34ab
1 changed files with 40 additions and 35 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

75
test/examples/test_xss_scanner.py
View File

@ -252,8 +252,7 @@ class TestXSSScanner():
self.text = html self.text = html
return MockResponse("<html></html>") return MockResponse("<html></html>")
def test_test_end_of_url_injection(self, monkeypatch): def test_test_end_of_url_injection(self, get_request_vuln):
monkeypatch.setattr(requests, 'get', self.mocked_requests_vuln)
xss_info = xss.test_end_of_URL_injection("<html></html>", "https://example.com/index.html", {})[0] xss_info = xss.test_end_of_URL_injection("<html></html>", "https://example.com/index.html", {})[0]
expected_xss_info = xss.XSSData('https://example.com/index.html/1029zxcs\'d"ao<ac>so[sb]po(pc)se;sl/bsl\\eq=3847asd', expected_xss_info = xss.XSSData('https://example.com/index.html/1029zxcs\'d"ao<ac>so[sb]po(pc)se;sl/bsl\\eq=3847asd',
'End of URL', 'End of URL',
@ -263,8 +262,7 @@ class TestXSSScanner():
assert xss_info == expected_xss_info assert xss_info == expected_xss_info
assert sqli_info is None assert sqli_info is None
def test_test_referer_injection(self, monkeypatch): def test_test_referer_injection(self, get_request_vuln):
monkeypatch.setattr(requests, 'get', self.mocked_requests_vuln)
xss_info = xss.test_referer_injection("<html></html>", "https://example.com/", {})[0] xss_info = xss.test_referer_injection("<html></html>", "https://example.com/", {})[0]
expected_xss_info = xss.XSSData('https://example.com/', expected_xss_info = xss.XSSData('https://example.com/',
'Referer', 'Referer',
@ -274,8 +272,7 @@ class TestXSSScanner():
assert xss_info == expected_xss_info assert xss_info == expected_xss_info
assert sqli_info is None assert sqli_info is None
def test_test_user_agent_injection(self, monkeypatch): def test_test_user_agent_injection(self, get_request_vuln):
monkeypatch.setattr(requests, 'get', self.mocked_requests_vuln)
xss_info = xss.test_user_agent_injection("<html></html>", "https://example.com/", {})[0] xss_info = xss.test_user_agent_injection("<html></html>", "https://example.com/", {})[0]
expected_xss_info = xss.XSSData('https://example.com/', expected_xss_info = xss.XSSData('https://example.com/',
'User Agent', 'User Agent',
@ -285,8 +282,8 @@ class TestXSSScanner():
assert xss_info == expected_xss_info assert xss_info == expected_xss_info
assert sqli_info is None assert sqli_info is None
def test_test_query_injection(self, monkeypatch): def test_test_query_injection(self, get_request_vuln):
monkeypatch.setattr(requests, 'get', self.mocked_requests_vuln)
xss_info = xss.test_query_injection("<html></html>", "https://example.com/vuln.php?cmd=ls", {})[0] xss_info = xss.test_query_injection("<html></html>", "https://example.com/vuln.php?cmd=ls", {})[0]
expected_xss_info = xss.XSSData('https://example.com/vuln.php?cmd=1029zxcs\'d"ao<ac>so[sb]po(pc)se;sl/bsl\\eq=3847asd', expected_xss_info = xss.XSSData('https://example.com/vuln.php?cmd=1029zxcs\'d"ao<ac>so[sb]po(pc)se;sl/bsl\\eq=3847asd',
'Query', 'Query',
@ -296,16 +293,8 @@ class TestXSSScanner():
assert xss_info == expected_xss_info assert xss_info == expected_xss_info
assert sqli_info is None assert sqli_info is None
def mocked_socket_gethostbyname(domain): @pytest.fixture(scope='function')
claimed_domains = ["google.com"] def logger(self, monkeypatch):
if domain not in claimed_domains:
from socket import gaierror
raise gaierror("[Errno -2] Name or service not known")
else:
return '216.58.221.46'
@pytest.fixture
def logger(self):
class Logger(): class Logger():
def __init__(self): def __init__(self):
self.args = [] self.args = []
@ -315,12 +304,32 @@ class TestXSSScanner():
def error(self, str): def error(self, str):
self.args.append(str) self.args.append(str)
return Logger()
def test_find_unclaimed_URLs(self, monkeypatch, logger): logger = Logger()
logger.args = []
monkeypatch.setattr("mitmproxy.ctx.log", logger) monkeypatch.setattr("mitmproxy.ctx.log", logger)
monkeypatch.setattr("socket.gethostbyname", self.mocked_socket_gethostbyname) yield logger
@pytest.fixture(scope='function')
def get_request_vuln(self, monkeypatch):
monkeypatch.setattr(requests, 'get', self.mocked_requests_vuln)
@pytest.fixture(scope='function')
def get_request_invuln(self, monkeypatch):
monkeypatch.setattr(requests, 'get', self.mocked_requests_invuln)
@pytest.fixture(scope='function')
def mock_gethostbyname(self, monkeypatch):
def gethostbyname(domain):
claimed_domains = ["google.com"]
if domain not in claimed_domains:
from socket import gaierror
raise gaierror("[Errno -2] Name or service not known")
else:
return '216.58.221.46'
monkeypatch.setattr("socket.gethostbyname", gethostbyname)
def test_find_unclaimed_URLs(self, logger, mock_gethostbyname):
xss.find_unclaimed_URLs("<html><script src=\"http://google.com\"></script></html>", xss.find_unclaimed_URLs("<html><script src=\"http://google.com\"></script></html>",
"https://example.com") "https://example.com")
assert logger.args == [] assert logger.args == []
@ -329,14 +338,12 @@ class TestXSSScanner():
assert logger.args[0] == 'XSS found in https://example.com due to unclaimed URL "http://unclaimedDomainName.com".' assert logger.args[0] == 'XSS found in https://example.com due to unclaimed URL "http://unclaimedDomainName.com".'
xss.find_unclaimed_URLs("<html><iframe src=\"http://unclaimedDomainName.com\"></iframe></html>", xss.find_unclaimed_URLs("<html><iframe src=\"http://unclaimedDomainName.com\"></iframe></html>",
"https://example.com") "https://example.com")
assert logger.args[0] == 'XSS found in https://example.com due to unclaimed URL "http://unclaimedDomainName.com".' assert logger.args[1] == 'XSS found in https://example.com due to unclaimed URL "http://unclaimedDomainName.com".'
xss.find_unclaimed_URLs("<html><link rel=\"stylesheet\" href=\"http://unclaimedDomainName.com\"></html>", xss.find_unclaimed_URLs("<html><link rel=\"stylesheet\" href=\"http://unclaimedDomainName.com\"></html>",
"https://example.com") "https://example.com")
assert logger.args[0] == 'XSS found in https://example.com due to unclaimed URL "http://unclaimedDomainName.com".' assert logger.args[2] == 'XSS found in https://example.com due to unclaimed URL "http://unclaimedDomainName.com".'
def test_log_XSS_data(self, monkeypatch, logger): def test_log_XSS_data(self, logger):
logger.args = []
monkeypatch.setattr("mitmproxy.ctx.log", logger)
xss.log_XSS_data(None) xss.log_XSS_data(None)
assert logger.args == [] assert logger.args == []
# self, url: str, injection_point: str, exploit: str, line: str # self, url: str, injection_point: str, exploit: str, line: str
@ -350,9 +357,7 @@ class TestXSSScanner():
assert logger.args[3] == 'Suggested Exploit: String' assert logger.args[3] == 'Suggested Exploit: String'
assert logger.args[4] == 'Line: Line of HTML' assert logger.args[4] == 'Line: Line of HTML'
def test_log_SQLi_data(self, monkeypatch, logger): def test_log_SQLi_data(self, logger):
logger.args = []
monkeypatch.setattr("mitmproxy.ctx.log", logger)
xss.log_SQLi_data(None) xss.log_SQLi_data(None)
assert logger.args == [] assert logger.args == []
xss.log_SQLi_data(xss.SQLiData('https://example.com', xss.log_SQLi_data(xss.SQLiData('https://example.com',
@ -371,11 +376,11 @@ class TestXSSScanner():
# It only uses the request cookies # It only uses the request cookies
assert xss.get_cookies(mocked_flow) == {"cookieName2": "cookieValue2"} assert xss.get_cookies(mocked_flow) == {"cookieName2": "cookieValue2"}
def test_response(self, monkeypatch, logger): def test_response(self, get_request_invuln, logger):
logger.args = [] mocked_flow = tflow.tflow(
monkeypatch.setattr("mitmproxy.ctx.log", logger) req=tutils.treq(path=b"index.html?q=1"),
monkeypatch.setattr(requests, 'get', self.mocked_requests_invuln) resp=tutils.tresp(content=b'<html></html>')
mocked_flow = tflow.tflow(req=tutils.treq(path=b"index.html?q=1"), resp=tutils.tresp(content=b'<html></html>')) )
xss.response(mocked_flow) xss.response(mocked_flow)
assert logger.args == [] assert logger.args == []