Update TestOAuthRequestTokenEndpoint to handle CSRF

Signed-off-by: Monis Khan <mkhan@redhat.com>

Author: enj

test/integration/oauth_token_endpoint_test.go

@@ -2,9 +2,11 @@ package integration
 
 import (
 	"bytes"
+	"io"
 	"io/ioutil"
 	"net/http"
 	"net/url"
+	"strings"
 	"testing"
 
 	"golang.org/x/net/html"
@@ -50,7 +52,7 @@ func TestOAuthRequestTokenEndpoint(t *testing.T) {
 	}
 	masterURL.Path = "/oauth/token/request"
 
-	_, tokenHeaderLocation := checkNewReqAndRoundTrip(t, transport, masterURL.String(), false, http.StatusFound)
+	_, tokenHeaderLocation := checkNewReqAndRoundTrip(t, transport, http.MethodGet, masterURL.String(), nil, nil, false, http.StatusFound)
 
 	if len(tokenHeaderLocation) == 0 {
 		t.Fatalf("no Location header")
@@ -61,14 +63,44 @@ func TestOAuthRequestTokenEndpoint(t *testing.T) {
 		t.Fatalf("unexpected error %v", err)
 	}
 
-	_, authHeaderLocation := checkNewReqAndRoundTrip(t, transport, authRedirect.String(), true, http.StatusFound)
+	_, authHeaderLocation := checkNewReqAndRoundTrip(t, transport, http.MethodGet, authRedirect.String(), nil, nil, true, http.StatusFound)
 
 	if len(authHeaderLocation) == 0 {
 		t.Fatalf("no Location header")
 	}
 
-	displayResp, _ := checkNewReqAndRoundTrip(t, transport, authHeaderLocation, false, http.StatusOK)
-	apiToken := getTokenFromDisplay(t, displayResp)
+	displayRespGet, _ := checkNewReqAndRoundTrip(t, transport, http.MethodGet, authHeaderLocation, nil, nil, false, http.StatusOK)
+
+	code, csrf, loc := getCodeCSRFFromDisplay(t, displayRespGet)
+	masterURL.Path = loc
+	values := url.Values{}
+	values.Set("code", code)
+	values.Set("csrf", csrf)
+	headers := map[string]string{"content-type": "application/x-www-form-urlencoded"}
+
+	// no csrf cookie fails
+	b1, _ := checkNewReqAndRoundTrip(t, transport, http.MethodPost, masterURL.String(), headers, strings.NewReader(values.Encode()), false, http.StatusBadRequest)
+	assertBodyContains(t, b1, "Could not check CSRF token. Please try again.")
+
+	// empty csrf cookie fails
+	headers["cookie"] = "csrf="
+	b2, _ := checkNewReqAndRoundTrip(t, transport, http.MethodPost, masterURL.String(), headers, strings.NewReader(values.Encode()), false, http.StatusBadRequest)
+	assertBodyContains(t, b2, "Could not check CSRF token. Please try again.")
+
+	// wrong csrf cookie fails
+	headers["cookie"] = "csrf=123"
+	b3, _ := checkNewReqAndRoundTrip(t, transport, http.MethodPost, masterURL.String(), headers, strings.NewReader(values.Encode()), false, http.StatusBadRequest)
+	assertBodyContains(t, b3, "Could not check CSRF token. Please try again.")
+
+	// technically any matching csrf gets past the check (do not send code as it is one use only)
+	b4, _ := checkNewReqAndRoundTrip(t, transport, http.MethodPost, masterURL.String(), headers, strings.NewReader(headers["cookie"]), false, http.StatusBadRequest)
+	assertBodyContains(t, b4, "Error handling auth request: Requested parameter not sent")
+
+	// correct csrf cookie works
+	headers["cookie"] = "csrf=" + csrf
+	displayRespPost, _ := checkNewReqAndRoundTrip(t, transport, http.MethodPost, masterURL.String(), headers, strings.NewReader(values.Encode()), false, http.StatusOK)
+
+	apiToken := getTokenFromDisplay(t, displayRespPost)
 
 	// Verify use of the bearer token
 	userConfig := restclient.AnonymousClientConfig(clientConfig)
@@ -87,6 +119,61 @@ func TestOAuthRequestTokenEndpoint(t *testing.T) {
 	}
 }
 
+func assertBodyContains(t *testing.T, body []byte, sub string) {
+	t.Helper()
+
+	if !bytes.Contains(body, []byte(sub)) {
+		t.Fatalf("request body %s missing data %s", string(body), sub)
+	}
+}
+
+func getCodeCSRFFromDisplay(t *testing.T, body []byte) (code, csrf, loc string) {
+	tokenizer := html.NewTokenizer(bytes.NewReader(body))
+
+	var codeSeen, csrfSeen, locSeen bool
+
+	for tokenType := tokenizer.Next(); tokenType != html.ErrorToken; tokenType = tokenizer.Next() {
+		if token := tokenizer.Token(); tokenType == html.StartTagToken {
+			if token.Data == "form" && getVal("method", token.Attr) == "post" {
+				if locSeen {
+					t.Fatalf("loc seen more than once in body %s, first loc=%s", string(body), loc)
+				}
+				loc = getVal("action", token.Attr)
+				locSeen = true
+			}
+			if token.Data == "input" && getVal("name", token.Attr) == "code" {
+				if codeSeen {
+					t.Fatalf("code seen more than once in body %s, first code=%s", string(body), code)
+				}
+				code = getVal("value", token.Attr)
+				codeSeen = true
+			}
+			if token.Data == "input" && getVal("name", token.Attr) == "csrf" {
+				if csrfSeen {
+					t.Fatalf("csrf seen more than once in body %s, first csrf=%s", string(body), csrf)
+				}
+				csrf = getVal("value", token.Attr)
+				csrfSeen = true
+			}
+		}
+	}
+
+	if len(code) == 0 || len(csrf) == 0 || len(loc) == 0 {
+		t.Fatalf("could not find code or csrf or loc in body %s, saw: code=%s, csrf=%s, loc=%s", string(body), code, csrf, loc)
+	}
+
+	return code, csrf, loc
+}
+
+func getVal(key string, attrs []html.Attribute) string {
+	for _, attr := range attrs {
+		if attr.Key == key {
+			return attr.Val
+		}
+	}
+	return ""
+}
+
 // Parse the HTML body for the API token contained in the first <code></code> block
 func getTokenFromDisplay(t *testing.T, body []byte) string {
 	tokenizer := html.NewTokenizer(bytes.NewReader(body))
@@ -102,17 +189,22 @@ func getTokenFromDisplay(t *testing.T, body []byte) string {
 		}
 	}
 
-	t.Fatalf("API Token not found in display")
+	t.Fatalf("API Token not found in display, body %s", string(body))
 	return ""
 }
 
-func checkNewReqAndRoundTrip(t *testing.T, rt http.RoundTripper, url string, doBasicAuth bool, expectedCode int) ([]byte, string) {
-	req, err := http.NewRequest("GET", url, nil)
+func checkNewReqAndRoundTrip(t *testing.T, rt http.RoundTripper, method, url string, headers map[string]string, reqBody io.Reader, doBasicAuth bool, expectedCode int) ([]byte, string) {
+	t.Helper()
+
+	req, err := http.NewRequest(method, url, reqBody)
 	if err != nil {
 		t.Fatalf("unexpected error %v", err)
 	}
 
 	req.Header.Set("Accept", "text/html; charset=UTF-8")
+	for k, v := range headers {
+		req.Header.Set(k, v)
+	}
 
 	if doBasicAuth {
 		req.SetBasicAuth("foo", "bar")
@@ -123,14 +215,15 @@ func checkNewReqAndRoundTrip(t *testing.T, rt http.RoundTripper, url string, doB
 		t.Fatalf("unexpected error %v", err)
 	}
 	defer resp.Body.Close()
-	if resp.StatusCode != expectedCode {
-		t.Fatalf("unexpected response code %v", resp.StatusCode)
-	}
 
 	body, err := ioutil.ReadAll(resp.Body)
 	if err != nil {
 		t.Fatalf("unexpected error %v", err)
 	}
 
+	if resp.StatusCode != expectedCode {
+		t.Fatalf("unexpected response code %v, body=%s", resp.StatusCode, string(body))
+	}
+
 	return body, resp.Header.Get("Location")
 }