owasp-esapi-ruby 0.30.0

data/spec/owasp_esapi_encoder_spec.rb

@@ -0,0 +1,226 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+
+module Owasp
+  module Esapi
+    describe Encoder do
+      # Setup some encoders
+      let (:encoder) { Owasp::Esapi.encoder }
+      let (:jsencoder) {Owasp::Esapi::Encoder.new([Owasp::Esapi::Codec::JavascriptCodec.new])}
+      let (:cssencoder) {Owasp::Esapi::Encoder.new([Owasp::Esapi::Codec::CssCodec.new])}
+
+      # HTML and Percent Codec tests
+      # Generate dynamic canonicalization tests
+      {
+        "%25F"=> "%F",
+        "%3c"=> "<",
+        "%3C"=> "<",
+        "%X1"=> "%X1",
+        "&#60"=> "<",
+        "&#060"=> "<",
+        "&#0060"=> "<",
+        "&#000060"=>"<",
+        "&#0000060"=>"<",
+        "&#60;"=> "<",
+        "&#060;"=> "<",
+        "&#0060;"=> "<",
+        "&#000060;"=> "<",
+        "&#0000060;"=> "<",
+        "&#x3c"=> "<",
+        "&#x03c"=> "<",
+        "&#x0003c"=> "<",
+        "&#x000003c"=> "<",
+        "&#x00000003c"=> "<",
+        "&#x3c;"=> "<",
+        "&#x03c;"=> "<",
+        "&#x003c;"=> "<",
+        "&#x00003c;"=> "<",
+        "&#x0000003c;"=> "<",
+        "&#X03c"=> "<",
+        "&#X3c"=> "<",
+        "&#X0003c"=> "<",
+        "&#X000003c"=> "<",
+        "&#X00000003c"=> "<",
+        "&#x3C"=> "<",
+        "&#x03C"=> "<",
+        "&#x0003C"=> "<",
+        "&#x000003C"=> "<",
+        "&#x00000003C"=> "<",
+        "&#X3C"=> "<",
+        "&#X03C"=> "<",
+        "&#X0003C"=> "<",
+        "&#X000003C"=> "<",
+        "&#X00000003C"=> "<",
+        "&lt"=> "<",
+        "&LT"=> "<",
+        "&Lt"=> "<",
+        "&lT"=> "<",
+        "&lt;"=> "<",
+        "&LT;"=> "<",
+        "&Lt;"=> "<",
+        "&lT;"=> "<",
+        "&#37;"=> "%",
+        "&#37"=> "%",
+        "&#37b"=> "%b",
+        "%3Cscript%3Ealert%28%22hello%22%29%3B%3C%2Fscript%3E"=> "<script>alert(\"hello\");</script>",
+        "%3Cscript&#x3E;alert%28%22hello&#34%29%3B%3C%2Fscript%3E"=> "<script>alert(\"hello\");</script>",
+      }.each_pair do |k,v|
+        it "should canonicalize #{k} to #{v}" do
+          begin
+            encoder.canonicalize(k.dup).should == v
+          rescue IntrustionException =>e
+            # if IDSis on we would throw an intrustion exception, other exceptions are real errors
+          end
+        end
+      end
+
+      # Javascript dynamic canonicilzation tests
+      {
+        "\\0"=> "\0",
+        "\\b"=> "\b",
+        "\\t"=> "\t",
+        "\\n"=> "\n",
+        "\\v"=> "\v",
+        "\\f"=> "\f",
+        "\\r"=> "\r",
+        "\\'"=> "\'",
+        "\\\""=> "\"",
+        "\\\\"=> "\\",
+        "\\<"=> "<",
+      }.each_pair do |k,v|
+         it "should canonicalize javascript #{k} to #{v}" do
+            begin
+              jsencoder.canonicalize(k.dup).should == v
+            rescue IntrustionException =>e
+              # if IDSis on we would throw an intrustion exception, other exceptions are real errors
+            end
+          end
+      end
+      # CSS dynamic canonicalization tests
+      {
+        "\\3c"=> "<",
+        "\\03c"=> "<",
+        "\\003c"=> "<",
+        "\\0003c"=> "<",
+        "\\00003c"=> "<",
+        "\\3C"=> "<",
+        "\\03C"=> "<",
+        "\\003C"=> "<",
+        "\\0003C"=> "<",
+        "\\00003C"=> "<",
+      }.each_pair do |k,v|
+         it "should canonicalize CSS #{k} to #{v}" do
+            begin
+              cssencoder.canonicalize(k.dup).should == v
+            rescue IntrustionException =>e
+              # if IDSis on we would throw an intrustion exception, other exceptions are real errors
+            end
+          end
+      end
+      # Sanitize
+      it "should sanitize input exceptions" do
+        # test null value
+        encoder.canonicalize(nil).should == nil
+        # test exception paths
+        encoder.sanitize("%25",true).should == '%'
+        encoder.sanitize("%25",false).should == '%'
+      end
+
+      # Dynamic double canonicalization tests
+      {
+        "&#x26;lt&#59"=> "<",# double entity
+        "%255c"=> "\\",      # double percent
+        "%2525"=> "%" ,      #double percent
+        "%26lt%3b"=> "<",    #double percent
+        "%253c"=> "<",
+        "%26lt%3b"=> "<",
+        "&#x25;26"=> "&",
+        "%%33%63"=> "<",
+        "%%33c"=> "<",
+        "%3%63"=> "<",
+        "&&#108;t;"=> "<",
+        "&%6ct;"=> "<",
+        "%&#x33;c"=> "<",
+        "%25 %2526 %26#X3c;script&#x3e; &#37;3Cscript%25252525253e"=> "% & <script> <script>",
+        "%26lt; %26lt; &#X25;3c &#x25;3c %2526lt%253B %2526lt%253B %2526lt%253B"=> "< < < < < < <",
+        "%253Cscript"=> "<script",
+        "&#37;3Cscript"=> "<script",
+      }.each_pair do |k,v|
+        it "should properly handle #{k} with double canonicalization and return #{v}" do
+          begin
+            encoder.sanitize(k.dup,false).should == v
+          rescue IntrustionException =>e
+            # if IDSis on we would throw an intrustion exception, other exceptions are real errors
+          end
+        end
+      end
+
+      # Css Encoder
+      it "should css encode nil as nil" do
+        encoder.encode_for_css(nil).should == nil
+      end
+
+      it "should css encode <script> as '\\3cscript\\3e" do
+        encoder.encode_for_css("<script>").should == "\\3c script\\3e "
+      end
+
+      it "should css encode punction properly" do
+        result = encoder.encode_for_css("!@$%()=+{}[]")
+        result.should == "\\21 \\40 \\24 \\25 \\28 \\29 \\3d \\2b \\7b \\7d \\5b \\5d "
+      end
+
+      # HTML Encoder
+      {
+        "<script>" => "&lt;script&gt;",
+        "&lt;script&gt;"=>"&amp;lt&#x3b;script&amp;gt&#x3b;",
+        "!@$%()=+{}[]" => "&#x21;&#x40;&#x24;&#x25;&#x28;&#x29;&#x3d;&#x2b;&#x7b;&#x7d;&#x5b;&#x5d;",
+        ",.-_ " => ",.-_ ",
+        "dir&" => "dir&amp;",
+        "one&two" => "one&amp;two",
+      }.each_pair do |k,v|
+        it "should encode HTML #{k} as #{v}" do
+          encoder.encode_for_html(k).should == v
+        end
+      end
+
+      # HTML Attribute
+      {
+        "<script>" => "&lt;script&gt;",
+        "&lt;script&gt;"=>"&amp;lt&#x3b;script&amp;gt&#x3b;",
+        " !@$%()=+{}[]" => "&#x20;&#x21;&#x40;&#x24;&#x25;&#x28;&#x29;&#x3d;&#x2b;&#x7b;&#x7d;&#x5b;&#x5d;",
+      }.each_pair do |k,v|
+        it "should encode html attribute #{k} as #{v}" do
+          encoder.encode_for_html_attr(k).should == v
+        end
+      end
+
+      # JS Encoder
+      it "should hs encode nil as nil" do
+        encoder.encode_for_javascript(nil).should == nil
+      end
+
+      it "should js encode special characers" do
+        encoder.encode_for_javascript("!@$%()=+{}[]").should == "\\x21\\x40\\x24\\x25\\x28\\x29\\x3D\\x2B\\x7B\\x7D\\x5B\\x5D"
+      end
+      it "should js encode ',.-_ '" do
+        encoder.encode_for_javascript(",.-_ ").should == ",.\\x2D_\\x20"
+      end
+      it "should js encode a script tag" do
+        encoder.encode_for_javascript("<script>").should == "\\x3Cscript\\x3E"
+      end
+
+      # Vb script encoder
+      {
+        "<script>" => "chrw(60)&\"script\"&chrw(62)",
+        "x !@$%()=+{}[]" => "x\"&chrw(32)&chrw(33)&chrw(64)&chrw(36)&chrw(37)&chrw(40)&chrw(41)&chrw(61)&chrw(43)&chrw(123)&chrw(125)&chrw(91)&chrw(93)",
+        "alert('ESAPI test!')" => "alert\"&chrw(40)&chrw(39)&\"ESAPI\"&chrw(32)&\"test\"&chrw(33)&chrw(39)&chrw(41)",
+        "sal.scotto@gmail.com" => "sal.scotto\"&chrw(64)&\"gmail.com",
+        "test <> test" => "test\"&chrw(32)&chrw(60)&chrw(62)&chrw(32)&\"test"
+      }.each_pair do |k,v|
+        it "should encode vbscript #{k} as #{v}" do
+          encoder.encode_for_vbscript(k).should == v
+        end
+      end
+
+    end
+  end
+end

data/spec/owasp_esapi_executor_spec.rb

@@ -0,0 +1,9 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+
+module Owasp
+  module Esapi
+    describe Executor do
+      it "execute a command and get output"
+    end
+  end
+end

data/spec/owasp_esapi_ruby_email_validator_spec.rb

@@ -0,0 +1,39 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+
+module Owasp
+  module Esapi
+    module Validator
+      describe Email do
+        let(:validator) {Owasp::Esapi::Validator::Email.new}
+          
+        it "should discard invalid email addresses" do
+          validator.valid?("this is not an email address").should == false
+        end
+      
+        it "should discard invalid email addresses" do
+          validator.valid?("12313.it").should == false
+        end
+        
+        it "should discard invalid email addresses" do
+          validator.valid?("thesp0nge_at_owasp_dot_org").should == false
+        end
+        
+        it "should discard invalid email addresses" do
+          validator.valid?("thesp0 nge@owasp.org").should == false
+        end
+          
+        it "should discard invalid email addresses" do
+          validator.valid?("thesp0nge@owasp..org").should == false
+        end
+        
+        it "should discard invalid email addresses" do
+          validator.valid?("thesp0nge@ow asp.org").should == false
+        end
+        
+        it "should validate goot email addresses" do
+          validator.valid?("thesp0nge@owasp.org").should == true 
+        end
+      end
+    end
+  end
+end

data/spec/owasp_esapi_ruby_xss_sanitizer_spec.rb

@@ -0,0 +1,66 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+
+module Owasp
+  module Esapi
+      module Sanitizer
+        describe Xss do
+          let(:filter) {Owasp::Esapi::Sanitizer::Xss.new}
+          
+          it "should leave untouched untainted strings" do
+            untainted = "This is an unoffensive string"
+            output = filter.sanitize(untainted)
+            output.should == untainted
+          end
+          
+          it "should sanitize the '<' character" do
+            false_positive_tainted = "I am a supposed to be a tainted < string"
+            output = filter.sanitize(false_positive_tainted)
+            output.should == false_positive_tainted.gsub("<", "&lt;")
+          end
+          
+          it "should sanitize the '>' character" do
+            false_positive_tainted = "I am a supposed to be a tainted > string"
+            output = filter.sanitize(false_positive_tainted)
+            output.should == false_positive_tainted.gsub(">", "&gt;")
+          end
+          
+          it "should sanitize the '&' character" do
+            false_positive_tainted = "I am a supposed to be a tainted & string"
+            output = filter.sanitize(false_positive_tainted)
+            output.should == false_positive_tainted.gsub("&", "&amp;")
+          end
+          
+          it "should sanitize the '\"' character" do
+            false_positive_tainted = "I am a supposed to be a tainted \" string"
+            output = filter.sanitize(false_positive_tainted)
+            output.should == false_positive_tainted.gsub("\"", "&quot;")
+          end
+          
+          it "should sanitize the '\'' character" do
+            false_positive_tainted = "I am a supposed to be a tainted \' string"
+            output = filter.sanitize(false_positive_tainted)
+            output.should == false_positive_tainted.gsub("\'", "&#x27;")
+          end
+          
+          it "should sanitize the '/' character" do
+            false_positive_tainted = "I am a supposed to be a tainted / string"
+            output = filter.sanitize(false_positive_tainted)
+            output.should == false_positive_tainted.gsub("/", "&#x2F;")
+          end
+          
+          it "shoud sanitize an injecting up attack pattern" do
+            taint = "<script>alert('xss here');</script>"
+            output = filter.sanitize(taint)
+            output.should == taint.gsub("<", "&lt;").gsub(">", "&gt;").gsub("\'", "&#x27;").gsub("/", "&#x2F;")
+          end
+          
+          it "shoud sanitize an injecting up attack pattern" do
+            taint = "/><script>alert('xss here');</script>"
+            output = filter.sanitize(taint)
+            output.should == taint.gsub("<", "&lt;").gsub(">", "&gt;").gsub("\'", "&#x27;").gsub("/", "&#x2F;")
+          end
+        end
+      end
+   
+  end
+end

data/spec/owasp_esapi_ruby_zipcode_validator_spec.rb

@@ -0,0 +1,42 @@
+require File.expand_path(File.dirname(__FILE__) + '/spec_helper')
+
+module Owasp
+  module Esapi
+      module Validator
+        describe Zipcode do
+          let(:validator) {Owasp::Esapi::Validator::Zipcode.new}
+          
+          it "should validate a good US ZIP CODE" do
+            validator.valid?("12345").should == true
+          end
+          
+          it "should validate a good US ZIP CODE" do
+            validator.valid?("12345-6789").should == true
+          end
+          
+          it "should discard a bad US ZIP CODE" do
+            validator.valid?("foostring").should == false
+          end
+          
+          it "should discard a bad US ZIP CODE" do 
+            validator.valid?("123-323").should == false
+          end
+          
+          it "should validate a good Italian ZIP CODE equivalent" do
+            validator.matcher=Owasp::Esapi::Validator::Zipcode::ITALIAN_ZIPCODE
+            validator.valid?("20100").should == true
+          end
+          
+          it "should discard an invalid Italian ZIP CODE equivalent" do
+            validator.matcher=Owasp::Esapi::Validator::Zipcode::ITALIAN_ZIPCODE
+            validator.valid?("121").should == false
+          end
+          it "should discard an invalid Italian ZIP CODE equivalent" do
+            validator.matcher=Owasp::Esapi::Validator::Zipcode::ITALIAN_ZIPCODE
+            validator.valid?("ipse dixit").should == false
+          end
+        end
+      end
+    
+  end
+end

data/spec/spec_helper.rb

@@ -0,0 +1,10 @@
+$LOAD_PATH.unshift(File.dirname(__FILE__))
+$LOAD_PATH.unshift(File.join(File.dirname(__FILE__), '..', 'lib'))
+
+require 'owasp-esapi-ruby'
+require 'rspec'
+require 'rspec/autorun'
+
+RSpec.configure do |config|
+  config.color_enabled = true
+end

data/spec/validator/base_rule_spec.rb

@@ -0,0 +1,29 @@
+require File.expand_path(File.dirname(__FILE__) + '../../spec_helper')
+
+module Owasp
+  module Esapi
+    module Validator
+      describe BaseRule do
+        let(:rule) {Owasp::Esapi::Validator::BaseRule.new("test")}
+        it "should remove non whitelist characters" do
+          rule.whitelist("12345abcdefghijkmlaaaa","abc").should == "abcaaaa"
+        end
+
+        it "should raise and exception in the base class" do
+          lambda {rule.valid("test","input")}.should raise_error(Owasp::Esapi::ValidationException)
+        end
+
+        it "should return false for valid? int eh base rule" do
+          rule.valid?("test","input").should be_false
+        end
+
+        it "should has an item in the error list" do
+          v = Owasp::Esapi::Validator::ValidatorErrorList.new
+          rule.validate("context","input",v)
+          v.errors.should_not be_empty
+        end
+
+      end
+    end
+  end
+end

data/spec/validator/date_rule_spec.rb

@@ -0,0 +1,40 @@
+require File.expand_path(File.dirname(__FILE__) + '../../spec_helper')
+
+module Owasp
+  module Esapi
+    module Validator
+      describe DateRule do
+        let(:rule) {Owasp::Esapi::Validator::DateRule.new("test",nil,nil)}
+
+        it "should validate September 11, 2001 as a valid" do
+          rule.valid?("","September 11, 2001").should be_true
+        end
+
+        it "should fail to validate 9-11-2001 as valid with the default format" do
+          rule.valid?("","9-11-2001").should be_false
+        end
+
+        it "should fail to validate with a null date" do
+          rule.valid?("",nil).should be_false
+        end
+
+        it "should fail to validate with an empty string as the date" do
+          rule.valid?("","").should be_false
+        end
+
+        # Try a few different date formats
+        {
+          "Jan 1, 07 Sun GMT" => "%b %d, %y %Z",
+          "31-12-2010" => "%d-%m-%Y",
+          "31-1-2010" => "%d-%m-%Y",
+          "2010-02-27 15:00" => "%Y-%m-%d %H:%M"
+        }.each_pair do |k,v|
+          it "should validate #{k} as a valid date with #{v} as the format" do
+            rule = Owasp::Esapi::Validator::DateRule.new("test",nil,v)
+            rule.valid?("",k).should be_true
+          end
+        end
+      end
+    end
+  end
+end