Skip to content

Commit

Permalink
add more tests
Browse files Browse the repository at this point in the history
  • Loading branch information
goulinkh committed Oct 22, 2024
1 parent b86857f commit 6a63f6a
Show file tree
Hide file tree
Showing 2 changed files with 49 additions and 7 deletions.
30 changes: 30 additions & 0 deletions tests/cla/test_routes.py
Original file line number Diff line number Diff line change
Expand Up @@ -26,6 +26,36 @@ def test_canonical_cla_api_proxy(self, mock_request):
self.assertEqual(response.headers["Content-Type"], "application/json")
self.assertEqual(response.headers["Cache-Control"], "no-store")

@patch("requests.request")
def test_canonical_cla_api_proxy_non_json_response(self, mock_request):
mock_response = MagicMock()
mock_response.content = b"""
<html>
<head><title>502 Bad Gateway</title></head>
<body>
<center><h1>502 Bad Gateway</h1></center>
<hr><center>nginx/1.10.3 (Ubuntu)</center>
</body>
</html>
"""
mock_response.headers = {"Content-Type": "text/html"}
mock_response.status_code = 502
mock_request.return_value = mock_response
response = self.client.get(
"""/legal/contributors/agreement/api
?request_url=aHR0cHM6Ly9leGFtcGxlLmNvbS9hcGk="""
)

self.assertEqual(response.status_code, 500)
self.assertEqual(response.headers["Content-Type"], "application/json")
self.assertEqual(response.headers["Cache-Control"], "no-store")
self.assertEqual(
response.get_json(),
{
"detail": "Internal server error",
},
)

def test_canonical_cla_api_github_logout(self):
response = self.client.get(
"/legal/contributors/agreement/api/github/logout"
Expand Down
26 changes: 19 additions & 7 deletions webapp/canonical_cla/views.py
Original file line number Diff line number Diff line change
Expand Up @@ -138,10 +138,22 @@ def canonical_cla_api_proxy():
cookies=flask.request.cookies,
data=flask.request.data,
)
response = flask.make_response(api_service_response.content)
response.headers["Content-Type"] = api_service_response.headers[
"Content-Type"
]
response.status_code = api_service_response.status_code
response.cache_control.no_store = True
return response
if (
api_service_response.headers["Content-Type"] != "application/json"
and api_service_response.status_code != 200
):
error_response = flask.make_response(
{"detail": "Internal server error"}
)
error_response.headers["Content-Type"] = "application/json"
error_response.status_code = 500
error_response.cache_control.no_store = True
return error_response
else:
response = flask.make_response(api_service_response.content)

Check warning

Code scanning / CodeQL

Reflected server-side cross-site scripting Medium

Cross-site scripting vulnerability due to a
user-provided value
.
response.headers["Content-Type"] = api_service_response.headers[
"Content-Type"
]
response.status_code = api_service_response.status_code
response.cache_control.no_store = True
return response

0 comments on commit 6a63f6a

Please sign in to comment.