<s> import morepath <EOL> from morepath . request import Response <EOL> from morepath import generic <EOL> from morepath . authentication import Identity , NO_IDENTITY <EOL> from . fixtures import identity_policy <EOL> import base64 <EOL> import json <EOL> from webtest import TestApp as Client <EOL> try : <EOL> from cookielib import CookieJar <EOL> except ImportError : <EOL> from http . cookiejar import CookieJar <EOL> def setup_module ( module ) : <EOL> morepath . disable_implicit ( ) <EOL> def test_no_permission ( ) : <EOL> class app ( morepath . App ) : <EOL> pass <EOL> class Model ( object ) : <EOL> def __init__ ( self , id ) : <EOL> self . id = id <EOL> class Permission ( object ) : <EOL> pass <EOL> @ app . path ( model = Model , path = '<STR_LIT>' , <EOL> variables = lambda model : { '<STR_LIT:id>' : model . id } ) <EOL> def get_model ( id ) : <EOL> return Model ( id ) <EOL> @ app . view ( model = Model , permission = Permission ) <EOL> def default ( self , request ) : <EOL> return "<STR_LIT>" % self . id <EOL> c = Client ( app ( ) ) <EOL> c . get ( '<STR_LIT>' , status = <NUM_LIT> ) <EOL> def test_permission_directive_identity ( ) : <EOL> class app ( morepath . App ) : <EOL> pass <EOL> class Model ( object ) : <EOL> def __init__ ( self , id ) : <EOL> self . id = id <EOL> class Permission ( object ) : <EOL> pass <EOL> @ app . verify_identity ( ) <EOL> def verify_identity ( identity ) : <EOL> return True <EOL> @ app . path ( model = Model , path = '<STR_LIT>' , <EOL> variables = lambda model : { '<STR_LIT:id>' : model . id } ) <EOL> def get_model ( id ) : <EOL> return Model ( id ) <EOL> @ app . permission_rule ( model = Model , permission = Permission ) <EOL> def get_permission ( identity , model , permission ) : <EOL> if model . id == '<STR_LIT:foo>' : <EOL> return True <EOL> else : <EOL> return False <EOL> @ app . view ( model = Model , permission = Permission ) <EOL> def default ( self , request ) : <EOL> return "<STR_LIT>" % self . id <EOL> @ app . identity_policy ( ) <EOL> class IdentityPolicy ( object ) : <EOL> def identify ( self , request ) : <EOL> return Identity ( '<STR_LIT>' ) <EOL> def remember ( self , response , request , identity ) : <EOL> pass <EOL> def forget ( self , response , request ) : <EOL> pass <EOL> c = Client ( app ( ) ) <EOL> response = c . get ( '<STR_LIT>' ) <EOL> assert response . body == b'<STR_LIT>' <EOL> response = c . get ( '<STR_LIT>' , status = <NUM_LIT> ) <EOL> def test_permission_directive_no_identity ( ) : <EOL> class app ( morepath . App ) : <EOL> pass <EOL> class Model ( object ) : <EOL> def __init__ ( self , id ) : <EOL> self . id = id <EOL> class Permission ( object ) : <EOL> pass <EOL> @ app . path ( model = Model , path = '<STR_LIT>' , <EOL> variables = lambda model : { '<STR_LIT:id>' : model . id } ) <EOL> def get_model ( id ) : <EOL> return Model ( id ) <EOL> @ app . permission_rule ( model = Model , permission = Permission , identity = None ) <EOL> def get_permission ( identity , model , permission ) : <EOL> if model . id == '<STR_LIT:foo>' : <EOL> return True <EOL> else : <EOL> return False <EOL> @ app . view ( model = Model , permission = Permission ) <EOL> def default ( self , request ) : <EOL> return "<STR_LIT>" % self . id <EOL> c = Client ( app ( ) ) <EOL> response = c . get ( '<STR_LIT>' ) <EOL> assert response . body == b'<STR_LIT>' <EOL> response = c . get ( '<STR_LIT>' , status = <NUM_LIT> ) <EOL> def test_policy_action ( ) : <EOL> c = Client ( identity_policy . app ( ) ) <EOL> response = c . get ( '<STR_LIT>' ) <EOL> assert response . body == b'<STR_LIT>' <EOL> response = c . get ( '<STR_LIT>' , status = <NUM_LIT> ) <EOL> class DumbCookieIdentityPolicy ( object ) : <EOL> """<STR_LIT>""" <EOL> def identify ( self , request ) : <EOL> data = request . cookies . get ( '<STR_LIT>' , None ) <EOL> if data is None : <EOL> return NO_IDENTITY <EOL> data = json . loads ( base64 . b64decode ( data ) . decode ( ) ) <EOL> return Identity ( ** data ) <EOL> def remember ( self , response , request , identity ) : <EOL> data = base64 . b64encode ( str . encode ( json . dumps ( identity . as_dict ( ) ) ) ) <EOL> response . set_cookie ( '<STR_LIT>' , data ) <EOL> def forget ( self , response , request ) : <EOL> response . delete_cookie ( '<STR_LIT>' ) <EOL> def test_cookie_identity_policy ( ) : <EOL> class app ( morepath . App ) : <EOL> pass <EOL> @ app . path ( path = '<STR_LIT>' ) <EOL> class Model ( object ) : <EOL> def __init__ ( self , id ) : <EOL> self . id = id <EOL> class Permission ( object ) : <EOL> pass <EOL> @ app . permission_rule ( model = Model , permission = Permission ) <EOL> def get_permission ( identity , model , permission ) : <EOL> return identity . userid == '<STR_LIT:user>' <EOL> @ app . view ( model = Model , permission = Permission ) <EOL> def default ( self , request ) : <EOL> return "<STR_LIT>" % self . id <EOL> @ app . view ( model = Model , name = '<STR_LIT>' ) <EOL> def log_in ( self , request ) : <EOL> response = Response ( ) <EOL> generic . remember_identity ( response , request , <EOL> Identity ( userid = '<STR_LIT:user>' , <EOL> payload = '<STR_LIT>' ) , <EOL> lookup = request . lookup ) <EOL> return response <EOL> @ app . view ( model = Model , name = '<STR_LIT>' ) <EOL> def log_out ( self , request ) : <EOL> response = Response ( ) <EOL> generic . forget_identity ( response , request , lookup = request . lookup ) <EOL> return response <EOL> @ app . identity_policy ( ) <EOL> def policy ( ) : <EOL> return DumbCookieIdentityPolicy ( ) <EOL> @ app . verify_identity ( ) <EOL> def verify_identity ( identity ) : <EOL> return True <EOL> c = Client ( app ( ) , cookiejar = CookieJar ( ) ) <EOL> response = c . get ( '<STR_LIT>' , status = <NUM_LIT> ) <EOL> response = c . get ( '<STR_LIT>' ) <EOL> response = c . get ( '<STR_LIT>' , status = <NUM_LIT:200> ) <EOL> assert response . body == b'<STR_LIT>' <EOL> response = c . get ( '<STR_LIT>' ) <EOL> response = c . get ( '<STR_LIT>' , status = <NUM_LIT> ) <EOL> def test_default_verify_identity ( ) : <EOL> class app ( morepath . App ) : <EOL> pass <EOL> identity = morepath . Identity ( '<STR_LIT:foo>' ) <EOL> assert not generic . verify_identity ( identity , lookup = app ( ) . lookup ) <EOL> def test_verify_identity_directive ( ) : <EOL> class app ( morepath . App ) : <EOL> pass <EOL> @ app . verify_identity ( ) <EOL> def verify_identity ( identity ) : <EOL> return identity . password == '<STR_LIT:right>' <EOL> identity = morepath . Identity ( '<STR_LIT:foo>' , password = '<STR_LIT>' ) <EOL> assert not generic . verify_identity ( identity , lookup = app ( ) . lookup ) <EOL> identity = morepath . Identity ( '<STR_LIT:foo>' , password = '<STR_LIT:right>' ) <EOL> assert generic . verify_identity ( identity , lookup = app ( ) . lookup ) <EOL> def test_false_verify_identity ( ) : <EOL> class app ( morepath . App ) : <EOL> pass <EOL> @ app . path ( path = '<STR_LIT>' ) <EOL> class Model ( object ) : <EOL> def __init__ ( self , id ) : <EOL> self . id = id <EOL> class Permission ( object ) : <EOL> pass <EOL> @ app . view ( model = Model , permission = Permission ) <EOL> def default ( self , request ) : <EOL> return "<STR_LIT>" % self . id <EOL> @ app . view ( model = Model , name = '<STR_LIT>' ) <EOL> def log_in ( self , request ) : <EOL> response = Response ( ) <EOL> generic . remember_identity ( response , request , <EOL> Identity ( userid = '<STR_LIT:user>' , <EOL> payload = '<STR_LIT>' ) , <EOL> lookup = request . lookup ) <EOL> return response <EOL> @ app . identity_policy ( ) <EOL> def policy ( ) : <EOL> return DumbCookieIdentityPolicy ( ) <EOL> @ app . verify_identity ( ) <EOL> def verify_identity ( identity ) : <EOL> return False <EOL> c = Client ( app ( ) , cookiejar = CookieJar ( ) ) <EOL> c . get ( '<STR_LIT>' , status = <NUM_LIT> ) <EOL> c . get ( '<STR_LIT>' ) <EOL> c . get ( '<STR_LIT>' , status = <NUM_LIT> ) <EOL> def test_settings ( ) : <EOL> class App ( morepath . App ) : <EOL> pass <EOL> class Model ( object ) : <EOL> pass <EOL> @ App . verify_identity ( ) <EOL> def verify_identity ( identity ) : <EOL> return True <EOL> @ App . path ( model = Model , path = '<STR_LIT:test>' ) <EOL> def get_model ( ) : <EOL> return Model ( ) <EOL> @ App . view ( model = Model ) <EOL> def default ( self , request ) : <EOL> return "<STR_LIT>" % request . identity . userid <EOL> @ App . setting_section ( section = "<STR_LIT:test>" ) <EOL> def get_test_settings ( ) : <EOL> return { '<STR_LIT>' : '<STR_LIT>' } <EOL> @ App . identity_policy ( ) <EOL> def get_identity_policy ( settings ) : <EOL> test_settings = settings . test . __dict__ . copy ( ) <EOL> return IdentityPolicy ( ** test_settings ) <EOL> class IdentityPolicy ( object ) : <EOL> def __init__ ( self , encryption_key ) : <EOL> self . encryption_key = encryption_key <EOL> def identify ( self , request ) : <EOL> token = self . get_token ( request ) <EOL> if token is None or not self . token_is_valid ( <EOL> token , self . encryption_key <EOL> ) : <EOL> return NO_IDENTITY <EOL> return Identity ( '<STR_LIT>' ) <EOL> def remember ( self , response , request , identity ) : <EOL> pass <EOL> def forget ( self , response , request ) : <EOL> pass <EOL> def get_token ( self , request ) : <EOL> try : <EOL> authtype , token = request . authorization <EOL> except ValueError : <EOL> return None <EOL> if authtype . lower ( ) != '<STR_LIT>' : <EOL> return None <EOL> return token <EOL> def token_is_valid ( self , token , encryption_key ) : <EOL> return token == encryption_key <EOL> c = Client ( App ( ) ) <EOL> headers = { '<STR_LIT>' : '<STR_LIT>' } <EOL> response = c . get ( '<STR_LIT>' , headers = headers ) <EOL> assert response . body == b'<STR_LIT>' <EOL> def test_prevent_poisoned_host_headers ( ) : <EOL> class App ( morepath . App ) : <EOL> pass <EOL> @ App . path ( path = '<STR_LIT>' ) <EOL> class Model ( object ) : <EOL> pass <EOL> @ App . view ( model = Model ) <EOL> def view_model ( self , request ) : <EOL> return '<STR_LIT>' <EOL> poisoned_hosts = ( <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> ) <EOL> legit_hosts = ( <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> '<STR_LIT>' , <EOL> ) <EOL> c = Client ( App ( ) ) <EOL> for host in legit_hosts : <EOL> response = c . get ( '<STR_LIT:/>' , headers = { '<STR_LIT>' : host } ) <EOL> assert response . status_code == <NUM_LIT:200> <EOL> for host in poisoned_hosts : <EOL> response = c . get ( '<STR_LIT:/>' , headers = { '<STR_LIT>' : host } , expect_errors = True ) <EOL> assert response . status_code == <NUM_LIT> </s>
