kern/test-src/de/superx/spring/CsRfRequestMatcherTest.java

package de.superx.spring;

import static org.junit.Assert.assertFalse;
import static org.junit.Assert.assertTrue;
import static org.mockito.Mockito.when;

import jakarta.servlet.http.HttpServletRequest;

import org.junit.Before;
import org.junit.Test;
import org.mockito.Mock;
import org.mockito.Mockito;

/**
 * Class to test de.superx.spring.CsRfRequestMatcher
 * 
 * @author hiber
 */
public class CsRfRequestMatcherTest {
	
	private CsRfRequestMatcher csrfRequestMatcher = new CsRfRequestMatcher();
	
	@Mock
	private HttpServletRequest request;
	
	
	/**
	 * setup before each test
	 */
	@Before
	public void setup() {
		this.request = Mockito.mock(HttpServletRequest.class);
	}
	
	@Test
	public void testMatches() {	
		when(this.request.getMethod()).thenReturn("OPTIONS");
		when(this.request.getHeader("X-Requested-With")).thenReturn("XMLHttpRequest");
		boolean result = this.csrfRequestMatcher.matches(this.request);
		assertFalse("method returns false", result);
		
		when(this.request.getHeader("X-Requested-With")).thenReturn(null);
		result = this.csrfRequestMatcher.matches(this.request);
		assertFalse("method returns false", result);
		
		when(this.request.getHeader("X-Requested-With")).thenReturn("");
		result = this.csrfRequestMatcher.matches(this.request);
		assertFalse("method returns false", result);	

		when(this.request.getMethod()).thenReturn("GET");
		when(this.request.getRequestURL()).thenReturn(new StringBuffer("http://localhost:8080/SuperXmlAnmeldung"));
		result = this.csrfRequestMatcher.matches(this.request);
		assertFalse("method returns false", result);
		
		when(this.request.getRequestURL()).thenReturn(new StringBuffer("http://localhost:8080/SuperXmlAbmeldung&query=junit"));
		result = this.csrfRequestMatcher.matches(this.request);
		assertFalse("method returns false", result);
		
		when(this.request.getRequestURL()).thenReturn(new StringBuffer("http://localhost:8080/xml/his1/index.jsp&query=junit"));
		result = this.csrfRequestMatcher.matches(this.request);
		assertFalse("method returns false", result);
		
		when(this.request.getRequestURL()).thenReturn(new StringBuffer("http://localhost:8080/control&query=junit"));
		result = this.csrfRequestMatcher.matches(this.request);
		assertTrue("method returns true", result);
		
	}
	
	@Test
	public void testIsTrustedOrigin() {
		final String HOST ="test-host";
		
		when(this.request.getHeader("Host")).thenReturn(HOST);
		when(this.request.getHeader("Origin")).thenReturn(null);
		assertTrue("method returns true", CsRfRequestMatcher.isTrustedOrigin(this.request));
		
		when(this.request.getHeader("Origin")).thenReturn("test_origin://"+HOST);
		assertTrue("method returns true", CsRfRequestMatcher.isTrustedOrigin(this.request));
		
		when(this.request.getHeader("Origin")).thenReturn("test_origin://");
		assertFalse("method returns false", CsRfRequestMatcher.isTrustedOrigin(this.request));
		
	}
}