rack-cors 0.4.1 → 2.0.1

data/test/unit/cors_test.rb

@@ -1,3 +1,5 @@
+# frozen_string_literal: true
+
 require 'minitest/autorun'
 require 'rack/test'
 require 'mocha/setup'
@@ -7,7 +9,7 @@ require 'ostruct'
 Rack::Test::Session.class_eval do
   unless defined? :options
     def options(uri, params = {}, env = {}, &block)
-      env = env_for(uri, env.merge(:method => "OPTIONS", :params => params))
+      env = env_for(uri, env.merge(method: 'OPTIONS', params: params))
       process_request(uri, env, &block)
     end
   end
@@ -17,20 +19,59 @@ Rack::Test::Methods.class_eval do
   def_delegator :current_session, :options
 end
 
+module MiniTest::Assertions
+  def assert_cors_success(response)
+    assert !response.headers['Access-Control-Allow-Origin'].nil?, 'Expected a successful CORS response'
+  end
+
+  def assert_not_cors_success(response)
+    assert response.headers['Access-Control-Allow-Origin'].nil?, 'Expected a failed CORS response'
+  end
+end
+
+class CaptureResult
+  def initialize(app, options = {})
+    @app = app
+    @result_holder = options[:holder]
+  end
+
+  def call(env)
+    response = @app.call(env)
+    @result_holder.cors_result = env[Rack::Cors::RACK_CORS]
+    response
+  end
+end
+
+class FakeProxy
+  def initialize(app, _options = {})
+    @app = app
+  end
+
+  def call(env)
+    status, headers, body = @app.call(env)
+    headers['vary'] = %w[Origin User-Agent]
+    [status, headers, body]
+  end
+end
+
+Rack::MockResponse.infect_an_assertion :assert_cors_success, :must_render_cors_success, :only_one_argument
+Rack::MockResponse.infect_an_assertion :assert_not_cors_success, :wont_render_cors_success, :only_one_argument
+
 describe Rack::Cors do
   include Rack::Test::Methods
 
   attr_accessor :cors_result
 
-  def load_app(name)
+  def load_app(name, options = {})
     test = self
     Rack::Builder.new do
+      use CaptureResult, holder: test
       eval File.read(File.dirname(__FILE__) + "/#{name}.ru")
+      use FakeProxy if options[:proxy]
       map('/') do
-        run proc { |env|
-          test.cors_result = env[Rack::Cors::ENV_KEY]
-          [200, {'Content-Type' => 'text/html'}, ['success']]
-        }
+        run(lambda do |_env|
+          [200, { 'content-type' => 'text/html' }, ['success']]
+        end)
       end
     end
   end
@@ -38,105 +79,139 @@ describe Rack::Cors do
   let(:app) { load_app('test') }
 
   it 'should support simple CORS request' do
-    cors_request
-    cors_result.must_be :hit
+    successful_cors_request
+    _(cors_result).must_be :hit
   end
 
   it "should not return CORS headers if Origin header isn't present" do
     get '/'
-    should_render_cors_failure
-    cors_result.wont_be :hit
+    _(last_response).wont_render_cors_success
+    _(cors_result).wont_be :hit
   end
 
   it 'should support OPTIONS CORS request' do
-    cors_request '/options', :method => :options
+    successful_cors_request '/options', method: :options
   end
 
   it 'should support regex origins configuration' do
-    cors_request :origin => 'http://192.168.0.1:1234'
+    successful_cors_request origin: 'http://192.168.0.1:1234'
   end
 
   it 'should support subdomain example' do
-    cors_request :origin => 'http://subdomain.example.com'
+    successful_cors_request origin: 'http://subdomain.example.com'
   end
 
   it 'should support proc origins configuration' do
-    cors_request '/proc-origin', :origin => 'http://10.10.10.10:3000'
+    successful_cors_request '/proc-origin', origin: 'http://10.10.10.10:3000'
+  end
+
+  it 'should support lambda origin configuration' do
+    successful_cors_request '/lambda-origin', origin: 'http://10.10.10.10:3000'
+  end
+
+  it 'should support proc origins configuration (inverse)' do
+    cors_request '/proc-origin', origin: 'http://bad.guy'
+    _(last_response).wont_render_cors_success
   end
 
   it 'should not mix up path rules across origins' do
     header 'Origin', 'http://10.10.10.10:3000'
     get '/' # / is configured in a separate rule block
-    should_render_cors_failure
+    _(last_response).wont_render_cors_success
   end
 
   it 'should support alternative X-Origin header' do
     header 'X-Origin', 'http://localhost:3000'
     get '/'
-    should_render_cors_success
+    _(last_response).must_render_cors_success
   end
 
   it 'should support expose header configuration' do
-    cors_request '/expose_single_header'
-    last_response.headers['Access-Control-Expose-Headers'].must_equal 'expose-test'
+    successful_cors_request '/expose_single_header'
+    _(last_response.headers['Access-Control-Expose-Headers']).must_equal 'expose-test'
   end
 
   it 'should support expose multiple header configuration' do
-    cors_request '/expose_multiple_headers'
-    last_response.headers['Access-Control-Expose-Headers'].must_equal 'expose-test-1, expose-test-2'
+    successful_cors_request '/expose_multiple_headers'
+    _(last_response.headers['Access-Control-Expose-Headers']).must_equal 'expose-test-1, expose-test-2'
   end
 
   # Explanation: http://www.fastly.com/blog/best-practices-for-using-the-vary-header/
   it "should add Vary header if resource matches even if Origin header isn't present" do
     get '/'
-    should_render_cors_failure
-    last_response.headers['Vary'].must_equal 'Origin'
+    _(last_response).wont_render_cors_success
+    _(last_response.headers['Vary']).must_equal 'Origin'
+  end
+
+  it 'should add Vary header based on :vary option' do
+    successful_cors_request '/vary_test'
+    _(last_response.headers['Vary']).must_equal 'Origin, Host'
   end
 
-  it "should add Vary header based on :vary option" do
-    cors_request '/vary_test'
-    last_response.headers['Vary'].must_equal 'Origin, Host'
+  it 'decode URL and resolve paths before resource matching' do
+    header 'Origin', 'http://localhost:3000'
+    get '/public/a/..%2F..%2Fprivate/stuff'
+    _(last_response).wont_render_cors_success
+  end
+
+  describe 'with upstream Vary headers' do
+    let(:app) { load_app('test', { proxy: true }) }
+
+    it 'should add to them' do
+      successful_cors_request '/vary_test'
+      _(last_response.headers['Vary']).must_equal 'Origin, User-Agent, Host'
+    end
   end
 
   it 'should add Vary header if Access-Control-Allow-Origin header was added and if it is specific' do
-    cors_request '/', :origin => "http://192.168.0.3:8080"
-    last_response.headers['Access-Control-Allow-Origin'].must_equal 'http://192.168.0.3:8080'
-    last_response.headers['Vary'].wont_be_nil
+    successful_cors_request '/', origin: 'http://192.168.0.3:8080'
+    _(last_response.headers['Access-Control-Allow-Origin']).must_equal 'http://192.168.0.3:8080'
+    _(last_response.headers['Vary']).wont_be_nil
   end
 
   it 'should add Vary header even if Access-Control-Allow-Origin header was added and it is generic (*)' do
-    cors_request '/public_without_credentials', :origin => "http://192.168.1.3:8080"
-    last_response.headers['Access-Control-Allow-Origin'].must_equal '*'
-    last_response.headers['Vary'].must_equal 'Origin'
+    successful_cors_request '/public_without_credentials', origin: 'http://192.168.1.3:8080'
+    _(last_response.headers['Access-Control-Allow-Origin']).must_equal '*'
+    _(last_response.headers['Vary']).must_equal 'Origin'
   end
 
   it 'should support multi allow configurations for the same resource' do
-    cors_request '/multi-allow-config', :origin => "http://mucho-grande.com"
-    last_response.headers['Access-Control-Allow-Origin'].must_equal 'http://mucho-grande.com'
-    last_response.headers['Vary'].must_equal 'Origin'
+    successful_cors_request '/multi-allow-config', origin: 'http://mucho-grande.com'
+    _(last_response.headers['Access-Control-Allow-Origin']).must_equal 'http://mucho-grande.com'
+    _(last_response.headers['Vary']).must_equal 'Origin'
 
-    cors_request '/multi-allow-config', :origin => "http://192.168.1.3:8080"
-    last_response.headers['Access-Control-Allow-Origin'].must_equal '*'
-    last_response.headers['Vary'].must_equal 'Origin'
+    successful_cors_request '/multi-allow-config', origin: 'http://192.168.1.3:8080'
+    _(last_response.headers['Access-Control-Allow-Origin']).must_equal '*'
+    _(last_response.headers['Vary']).must_equal 'Origin'
   end
 
-  it "should not return CORS headers on OPTIONS request if Access-Control-Allow-Origin is not present" do
+  it 'should not return CORS headers on OPTIONS request if Access-Control-Allow-Origin is not present' do
     options '/get-only'
-    last_response.headers['Access-Control-Allow-Origin'].must_be_nil
+    _(last_response.headers['Access-Control-Allow-Origin']).must_be_nil
   end
 
-  it "should not apply CORS headers if it does not match conditional on resource" do
+  it 'should not apply CORS headers if it does not match conditional on resource' do
     header 'Origin', 'http://192.168.0.1:1234'
     get '/conditional'
-    should_render_cors_failure
+    _(last_response).wont_render_cors_success
   end
 
-  it "should apply CORS headers if it does match conditional on resource" do
+  it 'should apply CORS headers if it does match conditional on resource' do
     header 'X-OK', '1'
-    cors_request '/conditional', :origin => 'http://192.168.0.1:1234'
+    successful_cors_request '/conditional', origin: 'http://192.168.0.1:1234'
+  end
+
+  it 'should not allow everything if Origin is configured as blank string' do
+    cors_request '/blank-origin', origin: 'http://example.net'
+    _(last_response).wont_render_cors_success
   end
 
- describe 'logging' do
+  it 'should not allow credentials for public resources' do
+    successful_cors_request '/public'
+    _(last_response.headers['Access-Control-Allow-Credentials']).must_be_nil
+  end
+
+  describe 'logging' do
     it 'should not log debug messages if debug option is false' do
       app = mock
       app.stubs(:call).returns(200, {}, [''])
@@ -144,7 +219,7 @@ describe Rack::Cors do
       logger = mock
       logger.expects(:debug).never
 
-      cors = Rack::Cors.new(app, :debug => false, :logger => logger) {}
+      cors = Rack::Cors.new(app, debug: false, logger: logger) {}
       cors.send(:debug, {}, 'testing')
     end
 
@@ -155,7 +230,7 @@ describe Rack::Cors do
       logger = mock
       logger.expects(:debug)
 
-      cors = Rack::Cors.new(app, :debug => true, :logger => logger) {}
+      cors = Rack::Cors.new(app, debug: true, logger: logger) {}
       cors.send(:debug, {}, 'testing')
     end
 
@@ -166,8 +241,8 @@ describe Rack::Cors do
       logger = mock
       logger.expects(:debug).at_least_once
 
-      cors = Rack::Cors.new(app, :debug => true) {}
-      cors.call({'rack.logger' => logger, 'HTTP_ORIGIN' => 'test.com'})
+      cors = Rack::Cors.new(app, debug: true) {}
+      cors.call({ 'rack.logger' => logger, 'HTTP_ORIGIN' => 'test.com' })
     end
 
     it 'should use logger proc' do
@@ -177,8 +252,8 @@ describe Rack::Cors do
       logger = mock
       logger.expects(:debug)
 
-      cors = Rack::Cors.new(app, :debug => true, :logger => proc { logger }) {}
-      cors.call({'HTTP_ORIGIN' => 'test.com'})
+      cors = Rack::Cors.new(app, debug: true, logger: proc { logger }) {}
+      cors.call({ 'HTTP_ORIGIN' => 'test.com' })
     end
 
     describe 'with Rails setup' do
@@ -193,93 +268,158 @@ describe Rack::Cors do
         logger = mock
         logger.expects(:debug)
 
-        ::Rails = OpenStruct.new(:logger => logger)
+        ::Rails = OpenStruct.new(logger: logger)
 
-        cors = Rack::Cors.new(app, :debug => true) {}
-        cors.call({'HTTP_ORIGIN' => 'test.com'})
+        cors = Rack::Cors.new(app, debug: true) {}
+        cors.call({ 'HTTP_ORIGIN' => 'test.com' })
       end
     end
+
+    it 'should use Logger if none is set' do
+      app = mock
+      app.stubs(:call).returns([200, {}, ['']])
+
+      logger = mock
+      Logger.expects(:new).returns(logger)
+      logger.expects(:tap).returns(logger)
+      logger.expects(:debug)
+
+      cors = Rack::Cors.new(app, debug: true) {}
+      cors.call({ 'HTTP_ORIGIN' => 'test.com' })
+    end
   end
 
   describe 'preflight requests' do
     it 'should fail if origin is invalid' do
       preflight_request('http://allyourdataarebelongtous.com', '/')
-      should_render_cors_failure
-      cors_result.wont_be :hit
-      cors_result.must_be :preflight
+      _(last_response).wont_render_cors_success
+      _(cors_result).wont_be :hit
+      _(cors_result).must_be :preflight
     end
 
     it 'should fail if Access-Control-Request-Method is not allowed' do
-      preflight_request('http://localhost:3000', '/get-only', :method => :post)
-      should_render_cors_failure
+      preflight_request('http://localhost:3000', '/get-only', method: :post)
+      _(last_response).wont_render_cors_success
+      _(cors_result.miss_reason).must_equal Rack::Cors::Result::MISS_DENY_METHOD
+      _(cors_result).wont_be :hit
+      _(cors_result).must_be :preflight
     end
 
     it 'should fail if header is not allowed' do
-      preflight_request('http://localhost:3000', '/single_header', :headers => 'Fooey')
-      should_render_cors_failure
+      preflight_request('http://localhost:3000', '/single_header', headers: 'Fooey')
+      _(last_response).wont_render_cors_success
+      _(cors_result.miss_reason).must_equal Rack::Cors::Result::MISS_DENY_HEADER
+      _(cors_result).wont_be :hit
+      _(cors_result).must_be :preflight
     end
 
     it 'should allow any header if headers = :any' do
-      preflight_request('http://localhost:3000', '/', :headers => 'Fooey')
-      should_render_cors_success
+      preflight_request('http://localhost:3000', '/', headers: 'Fooey')
+      _(last_response).must_render_cors_success
     end
 
     it 'should allow any method if methods = :any' do
-      preflight_request('http://localhost:3000', '/', :methods => :any)
-      should_render_cors_success
+      preflight_request('http://localhost:3000', '/', methods: :any)
+      _(last_response).must_render_cors_success
+    end
+
+    it 'allows PATCH method' do
+      preflight_request('http://localhost:3000', '/', methods: [:patch])
+      _(last_response).must_render_cors_success
     end
 
     it 'should allow header case insensitive match' do
-      preflight_request('http://localhost:3000', '/single_header', :headers => 'X-Domain-Token')
-      should_render_cors_success
+      preflight_request('http://localhost:3000', '/single_header', headers: 'X-Domain-Token')
+      _(last_response).must_render_cors_success
     end
 
     it 'should allow multiple headers match' do
       # Webkit style
-      preflight_request('http://localhost:3000', '/two_headers', :headers => 'X-Requested-With, X-Domain-Token')
-      should_render_cors_success
+      preflight_request('http://localhost:3000', '/two_headers', headers: 'X-Requested-With, X-Domain-Token')
+      _(last_response).must_render_cors_success
 
       # Gecko style
-      preflight_request('http://localhost:3000', '/two_headers', :headers => 'x-requested-with,x-domain-token')
-      should_render_cors_success
+      preflight_request('http://localhost:3000', '/two_headers', headers: 'x-requested-with,x-domain-token')
+      _(last_response).must_render_cors_success
     end
 
-    it 'should * origin should allow any origin' do
+    it "should allow '*' origins to allow any origin" do
       preflight_request('http://locohost:3000', '/public')
-      should_render_cors_success
-      last_response.headers['Access-Control-Allow-Origin'].must_equal 'http://locohost:3000'
+      _(last_response).must_render_cors_success
+      _(last_response.headers['Access-Control-Allow-Origin']).must_equal '*'
     end
 
-    it 'should * origin should allow any origin, and set * if no credentials required' do
-      preflight_request('http://locohost:3000', '/public_without_credentials')
-      should_render_cors_success
-      last_response.headers['Access-Control-Allow-Origin'].must_equal '*'
+    it "should allow '/<path>/' resource if match pattern is /<path>/*" do
+      preflight_request('http://localhost:3000', '/wildcard/')
+      _(last_response).must_render_cors_success
+      _(last_response.headers['Access-Control-Allow-Origin']).wont_equal nil
     end
 
-    it 'should "null" origin, allowed as "file://", returned as "null" in header' do
-      preflight_request('null', '/')
-      should_render_cors_success
-      last_response.headers['Access-Control-Allow-Origin'].must_equal 'null'
+    it "should allow '/<path>' resource if match pattern is /<path>/*" do
+      preflight_request('http://localhost:3000', '/wildcard')
+      _(last_response).must_render_cors_success
+      _(last_response.headers['Access-Control-Allow-Origin']).wont_equal nil
+    end
+
+    it "should allow '*' origin to allow any origin, and set '*' if no credentials required" do
+      preflight_request('http://locohost:3000', '/public_without_credentials')
+      _(last_response).must_render_cors_success
+      _(last_response.headers['Access-Control-Allow-Origin']).must_equal '*'
     end
 
     it 'should return "file://" as header with "file://" as origin' do
       preflight_request('file://', '/')
-      should_render_cors_success
-      last_response.headers['Access-Control-Allow-Origin'].must_equal 'file://'
+      _(last_response).must_render_cors_success
+      _(last_response.headers['Access-Control-Allow-Origin']).must_equal 'file://'
     end
 
-    it 'should return a Content-Type' do
-      preflight_request('http://localhost:3000', '/')
-      should_render_cors_success
-      last_response.headers['Content-Type'].wont_be_nil
+    it 'supports custom protocols in origin' do
+      preflight_request('custom-protocol://abcdefg', '/')
+      _(last_response).must_render_cors_success
+      _(last_response.headers['Access-Control-Allow-Origin']).must_equal 'custom-protocol://abcdefg'
+    end
+
+    describe '' do
+      let(:app) do
+        test = self
+        Rack::Builder.new do
+          use CaptureResult, holder: test
+          use Rack::Cors, debug: true, logger: Logger.new(StringIO.new) do
+            allow do
+              origins '*'
+              resource '/', methods: :post
+            end
+          end
+          map('/') do
+            run ->(_env) { [500, {}, ['FAIL!']] }
+          end
+        end
+      end
+
+      it 'should not send failed preflight requests thru the app' do
+        preflight_request('http://localhost', '/', method: :unsupported)
+        _(last_response).wont_render_cors_success
+        _(last_response.status).must_equal 200
+        _(cors_result).must_be :preflight
+        _(cors_result).wont_be :hit
+        _(cors_result.miss_reason).must_equal Rack::Cors::Result::MISS_DENY_METHOD
+      end
+    end
+  end
+
+  describe 'with insecure configuration' do
+    let(:app) { load_app('insecure') }
+
+    it 'should raise an error' do
+      _(proc { cors_request '/public' }).must_raise Rack::Cors::Resource::CorsMisconfigurationError
     end
   end
 
-  describe "with non HTTP config" do
-    let(:app) { load_app("non_http") }
+  describe 'with non HTTP config' do
+    let(:app) { load_app('non_http') }
 
     it 'should support non http/https origins' do
-      cors_request '/public', origin: 'content://com.company.app'
+      successful_cors_request '/public', origin: 'content://com.company.app'
     end
   end
 
@@ -288,13 +428,13 @@ describe Rack::Cors do
       @app ||= Rack::Builder.new do
         use Rack::Cors
         use Rack::Lint
-        run ->(env) { [200, {'Content-Type' => 'text/html'}, ['hello']] }
+        run ->(_env) { [200, { 'content-type' => 'text/html' }, ['hello']] }
       end
     end
 
     it 'is lint-compliant with non-CORS request' do
       get '/'
-      last_response.status.must_equal 200
+      _(last_response.status).must_equal 200
     end
   end
 
@@ -308,50 +448,93 @@ describe Rack::Cors do
           end
         end
         map('/') do
-          run ->(env) { [200, {'Content-Type' => 'text/plain', 'Access-Control-Allow-Origin' => 'http://foo.net'}, ['success']] }
+          run ->(_env) { [200, { 'Access-Control-Allow-Origin' => 'http://foo.net' }, ['success']] }
         end
       end
     end
 
-    it "should return app header" do
-      cors_request origin: "http://example.net"
-      last_response.headers['Access-Control-Allow-Origin'].must_equal "http://foo.net"
+    it 'should return app header' do
+      successful_cors_request origin: 'http://example.net'
+      _(last_response.headers['Access-Control-Allow-Origin']).must_equal 'http://foo.net'
     end
 
-    it "should return original headers if in debug" do
-      cors_request origin: "http://example.net"
-      last_response.headers['X-Rack-CORS-Original-Access-Control-Allow-Origin'].must_equal "http://example.net"
+    it 'should return original headers if in debug' do
+      successful_cors_request origin: 'http://example.net'
+      _(last_response.headers['X-Rack-CORS-Original-Access-Control-Allow-Origin']).must_equal '*'
     end
   end
 
-  protected
-    def cors_request(*args)
-      path = args.first.is_a?(String) ? args.first : '/'
-
-      opts = { :method => :get, :origin => 'http://localhost:3000' }
-      opts.merge! args.last if args.last.is_a?(Hash)
+  describe 'with headers set to nil' do
+    let(:app) do
+      Rack::Builder.new do
+        use Rack::Cors do
+          allow do
+            origins '*'
+            resource '/', headers: nil
+          end
+        end
+        map('/') do
+          run ->(_env) { [200, { 'content-type' => 'text/html' }, ['hello']] }
+        end
+      end
+    end
 
-      header 'Origin', opts[:origin]
-      current_session.__send__ opts[:method], path, {}, test: self
-      should_render_cors_success
+    it 'should succeed with CORS simple headers' do
+      preflight_request('http://localhost:3000', '/', headers: 'Accept')
+      _(last_response).must_render_cors_success
     end
+  end
 
-    def preflight_request(origin, path, opts = {})
-      header 'Origin', origin
-      unless opts.key?(:method) && opts[:method].nil?
-        header 'Access-Control-Request-Method', opts[:method] ? opts[:method].to_s.upcase : 'GET'
-      end
-      if opts[:headers]
-        header 'Access-Control-Request-Headers', opts[:headers]
+  describe 'with custom allowed headers' do
+    let(:app) do
+      Rack::Builder.new do
+        use Rack::Cors do
+          allow do
+            origins '*'
+            resource '/', headers: []
+          end
+        end
+        map('/') do
+          run ->(_env) { [200, { 'content-type' => 'text/html' }, ['hello']] }
+        end
       end
-      options path
     end
 
-    def should_render_cors_success
-      last_response.headers['Access-Control-Allow-Origin'].wont_be_nil
+    it 'should succeed with CORS simple headers' do
+      preflight_request('http://localhost:3000', '/', headers: 'Accept')
+      _(last_response).must_render_cors_success
+      preflight_request('http://localhost:3000', '/', headers: 'Accept-Language')
+      _(last_response).must_render_cors_success
+      preflight_request('http://localhost:3000', '/', headers: 'Content-Type')
+      _(last_response).must_render_cors_success
+      preflight_request('http://localhost:3000', '/', headers: 'Content-Language')
+      _(last_response).must_render_cors_success
     end
+  end
+
+  protected
+
+  def cors_request(*args)
+    path = args.first.is_a?(String) ? args.first : '/'
+
+    opts = { method: :get, origin: 'http://localhost:3000' }
+    opts.merge! args.last if args.last.is_a?(Hash)
 
-    def should_render_cors_failure
-      last_response.headers['Access-Control-Allow-Origin'].must_be_nil
+    header 'origin', opts[:origin]
+    current_session.__send__ opts[:method], path, {}, test: self
+  end
+
+  def successful_cors_request(*args)
+    cors_request(*args)
+    _(last_response).must_render_cors_success
+  end
+
+  def preflight_request(origin, path, opts = {})
+    header 'Origin', origin
+    unless opts.key?(:method) && opts[:method].nil?
+      header 'Access-Control-Request-Method', opts[:method] ? opts[:method].to_s.upcase : 'GET'
     end
+    header 'Access-Control-Request-Headers', opts[:headers] if opts[:headers]
+    options path
+  end
 end