From 646100d2eaac7af01815ef3c9ca96da89e74607a Mon Sep 17 00:00:00 2001 From: Phillip Kruger Date: Tue, 30 May 2023 22:55:19 +1000 Subject: [PATCH] Added some test for dev ui cors Signed-off-by: Phillip Kruger --- .../devui/deployment/DevUIProcessor.java | 1 - .../devmode/console/DevConsoleProcessor.java | 1 - .../vertx/http/devui/DevUICorsTest.java | 194 ++++++++++++++++++ .../vertx/http/devui/DevUIRemoteCorsTest.java | 39 ++++ 4 files changed, 233 insertions(+), 2 deletions(-) create mode 100644 extensions/vertx-http/deployment/src/test/java/io/quarkus/vertx/http/devui/DevUICorsTest.java create mode 100644 extensions/vertx-http/deployment/src/test/java/io/quarkus/vertx/http/devui/DevUIRemoteCorsTest.java diff --git a/extensions/vertx-http/deployment/src/main/java/io/quarkus/devui/deployment/DevUIProcessor.java b/extensions/vertx-http/deployment/src/main/java/io/quarkus/devui/deployment/DevUIProcessor.java index bee1adcbebb57..c995e43333b4f 100644 --- a/extensions/vertx-http/deployment/src/main/java/io/quarkus/devui/deployment/DevUIProcessor.java +++ b/extensions/vertx-http/deployment/src/main/java/io/quarkus/devui/deployment/DevUIProcessor.java @@ -139,7 +139,6 @@ void registerDevUiHandlers( if (devUIConfig.cors.enabled) { routeProducer.produce(nonApplicationRootPathBuildItem.routeBuilder() .orderedRoute(DEVUI + SLASH_ALL, -1 * FilterBuildItem.CORS) - //.route(DEVUI + SLASH_ALL) .handler(new DevConsoleCORSFilter()) .build()); } diff --git a/extensions/vertx-http/deployment/src/main/java/io/quarkus/vertx/http/deployment/devmode/console/DevConsoleProcessor.java b/extensions/vertx-http/deployment/src/main/java/io/quarkus/vertx/http/deployment/devmode/console/DevConsoleProcessor.java index 97efb0a0030fe..f70d7def67025 100644 --- a/extensions/vertx-http/deployment/src/main/java/io/quarkus/vertx/http/deployment/devmode/console/DevConsoleProcessor.java +++ b/extensions/vertx-http/deployment/src/main/java/io/quarkus/vertx/http/deployment/devmode/console/DevConsoleProcessor.java @@ -495,7 +495,6 @@ public void setupDevConsoleRoutes( if (devUIConfig.cors.enabled) { routeBuildItemBuildProducer.produce(nonApplicationRootPathBuildItem.routeBuilder() .orderedRoute("dev-v1/*", -1 * FilterBuildItem.CORS) - //.route("dev-v1/*") .handler(new DevConsoleCORSFilter()) .build()); } diff --git a/extensions/vertx-http/deployment/src/test/java/io/quarkus/vertx/http/devui/DevUICorsTest.java b/extensions/vertx-http/deployment/src/test/java/io/quarkus/vertx/http/devui/DevUICorsTest.java new file mode 100644 index 0000000000000..f17f7e5f636c1 --- /dev/null +++ b/extensions/vertx-http/deployment/src/test/java/io/quarkus/vertx/http/devui/DevUICorsTest.java @@ -0,0 +1,194 @@ +package io.quarkus.vertx.http.devui; + +import static org.hamcrest.Matchers.emptyOrNullString; +import static org.hamcrest.Matchers.not; +import static org.hamcrest.Matchers.nullValue; + +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.RegisterExtension; + +import io.quarkus.test.QuarkusDevModeTest; +import io.restassured.RestAssured; + +public class DevUICorsTest { + + @RegisterExtension + static final QuarkusDevModeTest config = new QuarkusDevModeTest() + .withEmptyApplication(); + + @Test + public void testPreflightHttpLocalhostOrigin() { + String origin = "http://localhost:8080"; + String methods = "GET,POST"; + RestAssured.given() + .header("Origin", origin) + .header("Access-Control-Request-Method", methods) + .when() + .options("q/dev-ui/configuration-form-editor").then() + .statusCode(200) + .header("Access-Control-Allow-Origin", origin) + .header("Access-Control-Allow-Methods", methods) + .body(emptyOrNullString()); + } + + @Test + public void testPreflightHttpLocalhostIpOrigin() { + String origin = "http://127.0.0.1:8080"; + String methods = "GET,POST"; + RestAssured.given() + .header("Origin", origin) + .header("Access-Control-Request-Method", methods) + .when() + .options("q/dev-ui/configuration-form-editor").then() + .statusCode(200) + .header("Access-Control-Allow-Origin", origin) + .header("Access-Control-Allow-Methods", methods) + .body(emptyOrNullString()); + } + + @Test + public void testPreflightHttpsLocalhostOrigin() { + String origin = "https://localhost:8443"; + String methods = "GET,POST"; + RestAssured.given() + .header("Origin", origin) + .header("Access-Control-Request-Method", methods) + .when() + .options("q/dev-ui/configuration-form-editor").then() + .statusCode(200) + .header("Access-Control-Allow-Origin", origin) + .header("Access-Control-Allow-Methods", methods) + .body(emptyOrNullString()); + } + + @Test + public void testPreflightHttpsLocalhostIpOrigin() { + String origin = "https://127.0.0.1:8443"; + String methods = "GET,POST"; + RestAssured.given() + .header("Origin", origin) + .header("Access-Control-Request-Method", methods) + .when() + .options("q/dev-ui/configuration-form-editor").then() + .statusCode(200) + .header("Access-Control-Allow-Origin", origin) + .header("Access-Control-Allow-Methods", methods) + .body(emptyOrNullString()); + } + + @Test + public void testPreflightNonLocalhostOrigin() { + String methods = "GET,POST"; + RestAssured.given() + .header("Origin", "https://quarkus.io/http://localhost") + .header("Access-Control-Request-Method", methods) + .when() + .options("q/dev-ui/configuration-form-editor").then() + .statusCode(403) + .header("Access-Control-Allow-Origin", nullValue()) + .header("Access-Control-Allow-Methods", nullValue()) + .body(emptyOrNullString()); + } + + @Test + public void testPreflightBadLocalhostOrigin() { + String methods = "GET,POST"; + RestAssured.given() + .header("Origin", "http://localhost:8080/devui") + .header("Access-Control-Request-Method", methods) + .when() + .options("q/dev-ui/configuration-form-editor").then() + .statusCode(403) + .header("Access-Control-Allow-Origin", nullValue()) + .body(emptyOrNullString()); + } + + @Test + public void testPreflightBadLocalhostIpOrigin() { + String methods = "GET,POST"; + RestAssured.given() + .header("Origin", "http://127.0.0.1:8080/devui") + .header("Access-Control-Request-Method", methods) + .when() + .options("q/dev-ui/configuration-form-editor").then() + .statusCode(403) + .header("Access-Control-Allow-Origin", nullValue()) + .body(emptyOrNullString()); + } + + @Test + public void testPreflightLocalhostOriginWithoutPort() { + String methods = "GET,POST"; + RestAssured.given() + .header("Origin", "http://localhost") + .header("Access-Control-Request-Method", methods) + .when() + .options("q/dev-ui/configuration-form-editor").then() + .statusCode(403) + .header("Access-Control-Allow-Origin", nullValue()) + .body(emptyOrNullString()); + } + + @Test + public void testSimpleRequestHttpLocalhostOrigin() { + String origin = "http://localhost:8080"; + RestAssured.given() + .header("Origin", origin) + .when() + .get("q/dev-ui/configuration-form-editor").then() + .statusCode(200) + .header("Access-Control-Allow-Origin", origin) + .header("Access-Control-Allow-Methods", nullValue()) + .body(not(emptyOrNullString())); + } + + @Test + public void testSimpleRequestHttpLocalhostIpOrigin() { + String origin = "http://127.0.0.1:8080"; + RestAssured.given() + .header("Origin", origin) + .when() + .get("q/dev-ui/configuration-form-editor").then() + .statusCode(200) + .header("Access-Control-Allow-Origin", origin) + .header("Access-Control-Allow-Methods", nullValue()) + .body(not(emptyOrNullString())); + } + + @Test + public void testSimpleRequestHttpsLocalhostOrigin() { + String origin = "https://localhost:8443"; + RestAssured.given() + .header("Origin", origin) + .when() + .get("q/dev-ui/configuration-form-editor").then() + .statusCode(200) + .header("Access-Control-Allow-Origin", origin) + .header("Access-Control-Allow-Methods", nullValue()) + .body(not(emptyOrNullString())); + } + + @Test + public void testSimpleRequestHttpsLocalhostIpOrigin() { + String origin = "https://127.0.0.1:8443"; + RestAssured.given() + .header("Origin", origin) + .when() + .get("q/dev-ui/configuration-form-editor").then() + .statusCode(200) + .header("Access-Control-Allow-Origin", origin) + .header("Access-Control-Allow-Methods", nullValue()) + .body(not(emptyOrNullString())); + } + + @Test + public void testSimpleRequestNonLocalhostOrigin() { + RestAssured.given() + .header("Origin", "https://quarkus.io/http://localhost") + .when() + .get("q/dev-ui/configuration-form-editor").then() + .statusCode(403) + .header("Access-Control-Allow-Origin", nullValue()) + .body(emptyOrNullString()); + } +} diff --git a/extensions/vertx-http/deployment/src/test/java/io/quarkus/vertx/http/devui/DevUIRemoteCorsTest.java b/extensions/vertx-http/deployment/src/test/java/io/quarkus/vertx/http/devui/DevUIRemoteCorsTest.java new file mode 100644 index 0000000000000..d437f99289a26 --- /dev/null +++ b/extensions/vertx-http/deployment/src/test/java/io/quarkus/vertx/http/devui/DevUIRemoteCorsTest.java @@ -0,0 +1,39 @@ +package io.quarkus.vertx.http.devui; + +import static org.hamcrest.Matchers.emptyOrNullString; +import static org.hamcrest.Matchers.not; +import static org.hamcrest.Matchers.nullValue; + +import org.junit.jupiter.api.Test; +import org.junit.jupiter.api.extension.RegisterExtension; + +import io.quarkus.test.QuarkusDevModeTest; +import io.restassured.RestAssured; +import java.net.Inet4Address; +import java.net.UnknownHostException; + +public class DevUIRemoteCorsTest { + + @RegisterExtension + static final QuarkusDevModeTest config = new QuarkusDevModeTest() + .setBuildSystemProperty("quarkus.http.host", "0.0.0.0") + .withEmptyApplication(); + + @Test + public void test() throws UnknownHostException { + String origin = Inet4Address.getLocalHost().toString(); + if(origin.contains("/")){ + origin = "http://" + origin.split("/")[1] + ":8080"; + } + String methods = "GET,POST"; + RestAssured.given() + .header("Origin", origin) + .header("Access-Control-Request-Method", methods) + .when() + .options("q/dev-ui/configuration-form-editor").then() + .statusCode(403) + .body(emptyOrNullString()); + } + + +}