X-Git-Url: https://git.arvados.org/arvados.git/blobdiff_plain/04efddf61ee4a0e5c65a72a538fe3f026ae94e8e..3e1c43866e5b523c3f1d273c25942ad56dc66d3f:/services/keep-web/handler_test.go diff --git a/services/keep-web/handler_test.go b/services/keep-web/handler_test.go index d394659033..f86f81bfa1 100644 --- a/services/keep-web/handler_test.go +++ b/services/keep-web/handler_test.go @@ -1,15 +1,23 @@ +// Copyright (C) The Arvados Authors. All rights reserved. +// +// SPDX-License-Identifier: AGPL-3.0 + package main import ( + "bytes" "fmt" "html" "io/ioutil" "net/http" "net/http/httptest" "net/url" + "os" + "path/filepath" "regexp" "strings" + "git.curoverse.com/arvados.git/sdk/go/arvados" "git.curoverse.com/arvados.git/sdk/go/arvadostest" "git.curoverse.com/arvados.git/sdk/go/auth" check "gopkg.in/check.v1" @@ -39,12 +47,12 @@ func (s *UnitSuite) TestCORSPreflight(c *check.C) { c.Check(resp.Code, check.Equals, http.StatusOK) c.Check(resp.Body.String(), check.Equals, "") c.Check(resp.Header().Get("Access-Control-Allow-Origin"), check.Equals, "*") - c.Check(resp.Header().Get("Access-Control-Allow-Methods"), check.Equals, "GET, POST") - c.Check(resp.Header().Get("Access-Control-Allow-Headers"), check.Equals, "Range") + c.Check(resp.Header().Get("Access-Control-Allow-Methods"), check.Equals, "COPY, DELETE, GET, MKCOL, MOVE, OPTIONS, POST, PROPFIND, PUT, RMCOL") + c.Check(resp.Header().Get("Access-Control-Allow-Headers"), check.Equals, "Authorization, Content-Type, Range") // Check preflight for a disallowed request resp = httptest.NewRecorder() - req.Header.Set("Access-Control-Request-Method", "DELETE") + req.Header.Set("Access-Control-Request-Method", "MAKE-COFFEE") h.ServeHTTP(resp, req) c.Check(resp.Body.String(), check.Equals, "") c.Check(resp.Code, check.Equals, http.StatusMethodNotAllowed) @@ -327,7 +335,20 @@ func (s *IntegrationSuite) TestVhostRedirectQueryTokenRequestAttachment(c *check http.StatusOK, "foo", ) - c.Check(strings.Split(resp.Header().Get("Content-Disposition"), ";")[0], check.Equals, "attachment") + c.Check(resp.Header().Get("Content-Disposition"), check.Matches, "attachment(;.*)?") +} + +func (s *IntegrationSuite) TestVhostRedirectQueryTokenSiteFS(c *check.C) { + s.testServer.Config.AttachmentOnlyHost = "download.example.com" + resp := s.testVhostRedirectTokenToCookie(c, "GET", + "download.example.com/by_id/"+arvadostest.FooCollection+"/foo", + "?api_token="+arvadostest.ActiveToken, + "", + "", + http.StatusOK, + "foo", + ) + c.Check(resp.Header().Get("Content-Disposition"), check.Matches, "attachment(;.*)?") } func (s *IntegrationSuite) TestVhostRedirectQueryTokenTrustAllContent(c *check.C) { @@ -411,6 +432,38 @@ func (s *IntegrationSuite) TestAnonymousTokenError(c *check.C) { ) } +func (s *IntegrationSuite) TestSpecialCharsInPath(c *check.C) { + s.testServer.Config.AttachmentOnlyHost = "download.example.com" + + client := s.testServer.Config.Client + client.AuthToken = arvadostest.ActiveToken + fs, err := (&arvados.Collection{}).FileSystem(&client, nil) + c.Assert(err, check.IsNil) + f, err := fs.OpenFile("https:\\\"odd' path chars", os.O_CREATE, 0777) + c.Assert(err, check.IsNil) + f.Close() + mtxt, err := fs.MarshalManifest(".") + c.Assert(err, check.IsNil) + coll := arvados.Collection{ManifestText: mtxt} + err = client.RequestAndDecode(&coll, "POST", "arvados/v1/collections", client.UpdateBody(coll), nil) + c.Assert(err, check.IsNil) + + u, _ := url.Parse("http://download.example.com/c=" + coll.UUID + "/") + req := &http.Request{ + Method: "GET", + Host: u.Host, + URL: u, + RequestURI: u.RequestURI(), + Header: http.Header{ + "Authorization": {"Bearer " + client.AuthToken}, + }, + } + resp := httptest.NewRecorder() + s.testServer.Handler.ServeHTTP(resp, req) + c.Check(resp.Code, check.Equals, http.StatusOK) + c.Check(resp.Body.String(), check.Matches, `(?ms).*href="./https:%5c%22odd%27%20path%20chars"\S+https:\\"odd' path chars.*`) +} + // XHRs can't follow redirect-with-cookie so they rely on method=POST // and disposition=attachment (telling us it's acceptable to respond // with content instead of a redirect) and an Origin header that gets @@ -487,10 +540,11 @@ func (s *IntegrationSuite) TestDirectoryListing(c *check.C) { "Authorization": {"OAuth2 " + arvadostest.ActiveToken}, } for _, trial := range []struct { - uri string - header http.Header - expect []string - cutDirs int + uri string + header http.Header + expect []string + redirect string + cutDirs int }{ { uri: strings.Replace(arvadostest.FooAndBarFilesInDirPDH, "+", "-", -1) + ".example.com/", @@ -502,7 +556,7 @@ func (s *IntegrationSuite) TestDirectoryListing(c *check.C) { uri: strings.Replace(arvadostest.FooAndBarFilesInDirPDH, "+", "-", -1) + ".example.com/dir1/", header: authHeader, expect: []string{"foo", "bar"}, - cutDirs: 0, + cutDirs: 1, }, { uri: "download.example.com/collections/" + arvadostest.FooAndBarFilesInDirUUID + "/", @@ -510,6 +564,50 @@ func (s *IntegrationSuite) TestDirectoryListing(c *check.C) { expect: []string{"dir1/foo", "dir1/bar"}, cutDirs: 2, }, + { + uri: "download.example.com/users/active/foo_file_in_dir/", + header: authHeader, + expect: []string{"dir1/"}, + cutDirs: 3, + }, + { + uri: "download.example.com/users/active/foo_file_in_dir/dir1/", + header: authHeader, + expect: []string{"bar"}, + cutDirs: 4, + }, + { + uri: "download.example.com/", + header: authHeader, + expect: []string{"users/"}, + cutDirs: 0, + }, + { + uri: "download.example.com/users", + header: authHeader, + redirect: "/users/", + expect: []string{"active/"}, + cutDirs: 1, + }, + { + uri: "download.example.com/users/", + header: authHeader, + expect: []string{"active/"}, + cutDirs: 1, + }, + { + uri: "download.example.com/users/active", + header: authHeader, + redirect: "/users/active/", + expect: []string{"foo_file_in_dir/"}, + cutDirs: 2, + }, + { + uri: "download.example.com/users/active/", + header: authHeader, + expect: []string{"foo_file_in_dir/"}, + cutDirs: 2, + }, { uri: "collections.example.com/collections/download/" + arvadostest.FooAndBarFilesInDirUUID + "/" + arvadostest.ActiveToken + "/", header: nil, @@ -523,22 +621,36 @@ func (s *IntegrationSuite) TestDirectoryListing(c *check.C) { cutDirs: 2, }, { - uri: "download.example.com/c=" + arvadostest.FooAndBarFilesInDirUUID + "/dir1/", + uri: "collections.example.com/c=" + arvadostest.FooAndBarFilesInDirUUID + "/t=" + arvadostest.ActiveToken, + header: nil, + expect: []string{"dir1/foo", "dir1/bar"}, + cutDirs: 2, + }, + { + uri: "download.example.com/c=" + arvadostest.FooAndBarFilesInDirUUID, header: authHeader, - expect: []string{"foo", "bar"}, + expect: []string{"dir1/foo", "dir1/bar"}, cutDirs: 1, }, + { + uri: "download.example.com/c=" + arvadostest.FooAndBarFilesInDirUUID + "/dir1", + header: authHeader, + redirect: "/c=" + arvadostest.FooAndBarFilesInDirUUID + "/dir1/", + expect: []string{"foo", "bar"}, + cutDirs: 2, + }, { uri: "download.example.com/c=" + arvadostest.FooAndBarFilesInDirUUID + "/_/dir1/", header: authHeader, expect: []string{"foo", "bar"}, - cutDirs: 2, + cutDirs: 3, }, { - uri: arvadostest.FooAndBarFilesInDirUUID + ".example.com/dir1?api_token=" + arvadostest.ActiveToken, - header: authHeader, - expect: []string{"foo", "bar"}, - cutDirs: 0, + uri: arvadostest.FooAndBarFilesInDirUUID + ".example.com/dir1?api_token=" + arvadostest.ActiveToken, + header: authHeader, + redirect: "/dir1/", + expect: []string{"foo", "bar"}, + cutDirs: 1, }, { uri: "collections.example.com/c=" + arvadostest.FooAndBarFilesInDirUUID + "/theperthcountyconspiracydoesnotexist/", @@ -546,7 +658,7 @@ func (s *IntegrationSuite) TestDirectoryListing(c *check.C) { expect: nil, }, } { - c.Logf("%q => %q", trial.uri, trial.expect) + c.Logf("HTML: %q => %q", trial.uri, trial.expect) resp := httptest.NewRecorder() u := mustParseURL("//" + trial.uri) req := &http.Request{ @@ -554,7 +666,7 @@ func (s *IntegrationSuite) TestDirectoryListing(c *check.C) { Host: u.Host, URL: u, RequestURI: u.RequestURI(), - Header: trial.header, + Header: copyHeader(trial.header), } s.testServer.Handler.ServeHTTP(resp, req) var cookies []*http.Cookie @@ -565,7 +677,7 @@ func (s *IntegrationSuite) TestDirectoryListing(c *check.C) { Host: u.Host, URL: u, RequestURI: u.RequestURI(), - Header: http.Header{}, + Header: copyHeader(trial.header), } cookies = append(cookies, (&http.Response{Header: resp.Header()}).Cookies()...) for _, c := range cookies { @@ -574,14 +686,82 @@ func (s *IntegrationSuite) TestDirectoryListing(c *check.C) { resp = httptest.NewRecorder() s.testServer.Handler.ServeHTTP(resp, req) } + if trial.redirect != "" { + c.Check(req.URL.Path, check.Equals, trial.redirect) + } if trial.expect == nil { c.Check(resp.Code, check.Equals, http.StatusNotFound) } else { c.Check(resp.Code, check.Equals, http.StatusOK) for _, e := range trial.expect { - c.Check(resp.Body.String(), check.Matches, `(?ms).*href="`+e+`".*`) + c.Check(resp.Body.String(), check.Matches, `(?ms).*href="./`+e+`".*`) } c.Check(resp.Body.String(), check.Matches, `(?ms).*--cut-dirs=`+fmt.Sprintf("%d", trial.cutDirs)+` .*`) } + + c.Logf("WebDAV: %q => %q", trial.uri, trial.expect) + req = &http.Request{ + Method: "OPTIONS", + Host: u.Host, + URL: u, + RequestURI: u.RequestURI(), + Header: copyHeader(trial.header), + Body: ioutil.NopCloser(&bytes.Buffer{}), + } + resp = httptest.NewRecorder() + s.testServer.Handler.ServeHTTP(resp, req) + if trial.expect == nil { + c.Check(resp.Code, check.Equals, http.StatusNotFound) + } else { + c.Check(resp.Code, check.Equals, http.StatusOK) + } + + req = &http.Request{ + Method: "PROPFIND", + Host: u.Host, + URL: u, + RequestURI: u.RequestURI(), + Header: copyHeader(trial.header), + Body: ioutil.NopCloser(&bytes.Buffer{}), + } + resp = httptest.NewRecorder() + s.testServer.Handler.ServeHTTP(resp, req) + if trial.expect == nil { + c.Check(resp.Code, check.Equals, http.StatusNotFound) + } else { + c.Check(resp.Code, check.Equals, http.StatusMultiStatus) + for _, e := range trial.expect { + c.Check(resp.Body.String(), check.Matches, `(?ms).*`+filepath.Join(u.Path, e)+`.*`) + } + } + } +} + +func (s *IntegrationSuite) TestHealthCheckPing(c *check.C) { + s.testServer.Config.ManagementToken = arvadostest.ManagementToken + authHeader := http.Header{ + "Authorization": {"Bearer " + arvadostest.ManagementToken}, + } + + resp := httptest.NewRecorder() + u := mustParseURL("http://download.example.com/_health/ping") + req := &http.Request{ + Method: "GET", + Host: u.Host, + URL: u, + RequestURI: u.RequestURI(), + Header: authHeader, + } + s.testServer.Handler.ServeHTTP(resp, req) + + c.Check(resp.Code, check.Equals, http.StatusOK) + c.Check(resp.Body.String(), check.Matches, `{"health":"OK"}\n`) +} + +func copyHeader(h http.Header) http.Header { + hc := http.Header{} + for k, v := range h { + hc[k] = append([]string(nil), v...) } + return hc }