diff options
author | Zuul <zuul@review.opendev.org> | 2021-09-16 00:20:58 +0000 |
---|---|---|
committer | Gerrit Code Review <review@openstack.org> | 2021-09-16 00:20:58 +0000 |
commit | 7f00f7be226511840747643919d167c97a021bea (patch) | |
tree | 23f4899f16fdf746a658878618e9d6a5cb406901 /nova/tests/unit/console/test_websocketproxy.py | |
parent | e9b60776b48e20b41b1c57757605345f77956903 (diff) | |
parent | 9588cdbfd4649ea53d60303f2d10c5d62a070a07 (diff) | |
download | nova-7f00f7be226511840747643919d167c97a021bea.tar.gz |
Merge "address open redirect with 3 forward slashes" into stable/victoria22.3.0
Diffstat (limited to 'nova/tests/unit/console/test_websocketproxy.py')
-rw-r--r-- | nova/tests/unit/console/test_websocketproxy.py | 34 |
1 files changed, 34 insertions, 0 deletions
diff --git a/nova/tests/unit/console/test_websocketproxy.py b/nova/tests/unit/console/test_websocketproxy.py index 11561f4c53..92883134a2 100644 --- a/nova/tests/unit/console/test_websocketproxy.py +++ b/nova/tests/unit/console/test_websocketproxy.py @@ -659,6 +659,40 @@ class NovaProxyRequestHandlerTestCase(test.NoDBTestCase): # Verify no redirect happens and instead a 400 Bad Request is returned. self.assertIn('400 URI must not start with //', result[0].decode()) + def test_reject_open_redirect_3_slashes(self): + # This will test the behavior when an attempt is made to cause an open + # redirect. It should be rejected. + mock_req = mock.MagicMock() + mock_req.makefile().readline.side_effect = [ + b'GET ///example.com/%2F.. HTTP/1.1\r\n', + b'' + ] + + # Collect the response data to verify at the end. The + # SimpleHTTPRequestHandler writes the response data by calling the + # request socket sendall() method. + self.data = b'' + + def fake_sendall(data): + self.data += data + + mock_req.sendall.side_effect = fake_sendall + + client_addr = ('8.8.8.8', 54321) + mock_server = mock.MagicMock() + # This specifies that the server will be able to handle requests other + # than only websockets. + mock_server.only_upgrade = False + + # Constructing a handler will process the mock_req request passed in. + websocketproxy.NovaProxyRequestHandler( + mock_req, client_addr, mock_server) + + # Verify no redirect happens and instead a 400 Bad Request is returned. + self.data = self.data.decode() + self.assertIn('Error code: 400', self.data) + self.assertIn('Message: URI must not start with //', self.data) + @mock.patch('websockify.websocketproxy.select_ssl_version') def test_ssl_min_version_is_not_set(self, mock_select_ssl): websocketproxy.NovaWebSocketProxy() |