Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add test for PathTraversal class #456

Merged
merged 3 commits into from
Dec 4, 2023
Merged

Add test for PathTraversal class #456

Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
b5f8a61
Add test for PathTraversal class
Nov 22, 2023
eddf7a4
Add next tests for PathTraversal class
Dec 4, 2023
e4ad5d7
running spotlessapply
Dec 4, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
306 changes: 306 additions & 0 deletions src/test/java/org/sasanlabs/service/vulnerability/pathTraversal/PathTraversalTest.java
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,306 @@
package org.sasanlabs.service.vulnerability.pathTraversal;

import org.junit.jupiter.api.Test;
import org.mockito.InjectMocks;
import org.sasanlabs.service.vulnerability.bean.GenericVulnerabilityResponseBean;
import org.springframework.http.HttpMethod;
import org.springframework.http.HttpStatus;
import org.springframework.http.ResponseEntity;
import org.springframework.http.RequestEntity;


import java.net.URI;
import java.net.URISyntaxException;
import java.util.HashMap;
import java.util.Map;

import static org.junit.jupiter.api.Assertions.*;


class PathTraversalVulnerabilityTest {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Please run ./gradlew spotlessApply this will fix the indentation and will pass the CI/CD pipeline.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

image

@InjectMocks
private PathTraversalVulnerability pathTraversalVulnerability = new PathTraversalVulnerability();
@Test
void testGetVulnerablePayloadLevel1WithNullFileName() {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", null);
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel1(queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
assertNotNull(response.getBody());
assertFalse(response.getBody().getIsValid());
assertNull(response.getBody().getContent());
}
@Test
void testGetVulnerablePayloadLevel1() {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", "UserInfo.json");
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel1(queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
}
@Test
void testGetVulnerablePayloadLevel2WithNullFileName() throws URISyntaxException {
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@richard66033 can you please use other conditions for test instead of just Null like ../ is there in level 1 and it passes the test but if ../ is there in second level, it will not allow it. Similarly .. and %2f are not there in level 4 and so on.

Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", null);
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel2(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
assertNotNull(response.getBody());
assertFalse(response.getBody().getIsValid());
assertNull(response.getBody().getContent());
}
@Test
void testGetVulnerablePayloadLevel2() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", "UserInfo.json");
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel2(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
}
@Test
void testGetVulnerablePayloadLevel3WithNullFileName() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", null);
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel3(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
assertNotNull(response.getBody());
assertFalse(response.getBody().getIsValid());
assertNull(response.getBody().getContent());
}

@Test
void testGetVulnerablePayloadLevel3() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", "UserInfo.json");
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel3(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
}
@Test
void testGetVulnerablePayloadLevel4WithNullFileName() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", null);
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel4(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
assertNotNull(response.getBody());
assertFalse(response.getBody().getIsValid());
assertNull(response.getBody().getContent());
}
@Test
void testGetVulnerablePayloadLevel4() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", "UserInfo.json");
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel4(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
}
@Test
void testGetVulnerablePayloadLevel5WithNullFileName() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", null);
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel5(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
assertNotNull(response.getBody());
assertFalse(response.getBody().getIsValid());
assertNull(response.getBody().getContent());
}
@Test
void testGetVulnerablePayloadLevel5() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", "UserInfo.json");
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel5(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
}
@Test
void testGetVulnerablePayloadLevel6WithNullFileName() {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", null);
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel6(queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
assertNotNull(response.getBody());
assertFalse(response.getBody().getIsValid());
assertNull(response.getBody().getContent());
}
@Test
void testGetVulnerablePayloadLevel6() {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", "UserInfo.json");
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel6(queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
}
@Test
void testGetVulnerablePayloadLevel7WithNullFileName() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", null);
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel7(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
assertNotNull(response.getBody());
assertFalse(response.getBody().getIsValid());
assertNull(response.getBody().getContent());
}
@Test
void testGetVulnerablePayloadLevel7() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", "UserInfo.json");
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel7(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
}
@Test
void testGetVulnerablePayloadLevel8WithNullFileName() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", null);
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel8(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
assertNotNull(response.getBody());
assertFalse(response.getBody().getIsValid());
assertNull(response.getBody().getContent());
}
@Test
void testGetVulnerablePayloadLevel8() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", "UserInfo.json");
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel8(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
}
@Test
void testGetVulnerablePayloadLevel9WithNullFileName() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", null);
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel9(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
assertNotNull(response.getBody());
assertFalse(response.getBody().getIsValid());
assertNull(response.getBody().getContent());
}
@Test
void testGetVulnerablePayloadLevel9() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", "UserInfo.json");
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel9(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
}
@Test
void testGetVulnerablePayloadLevel10WithNullFileName() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", null);
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel10(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
assertNotNull(response.getBody());
assertFalse(response.getBody().getIsValid());
assertNull(response.getBody().getContent());
}
@Test
void testGetVulnerablePayloadLevel10() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", "UserInfo.json");
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel10(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
}
@Test
void testGetVulnerablePayloadLevel11WithNullFileName() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", null);
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel11(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
assertNotNull(response.getBody());
assertFalse(response.getBody().getIsValid());
assertNull(response.getBody().getContent());
}
@Test
void testGetVulnerablePayloadLevel11() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", "UserInfo.json");
RequestEntity<String> requestEntity =
new RequestEntity<>(
HttpMethod.GET, new URI("localhost"));
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel11(requestEntity,queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
}
@Test
void testGetVulnerablePayloadLevel12WithNullFileName() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", null);
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel12(queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
assertNotNull(response.getBody());
assertFalse(response.getBody().getIsValid());
assertNull(response.getBody().getContent());
}
@Test
void testGetVulnerablePayloadLevel12() throws URISyntaxException {
Map<String, String> queryParams = new HashMap<>();
queryParams.put("fileName", "UserInfo.json");
ResponseEntity<GenericVulnerabilityResponseBean<String>> response =
pathTraversalVulnerability.getVulnerablePayloadLevel12(queryParams);
assertEquals(HttpStatus.OK, response.getStatusCode());
}
}
Loading