|
| 1 | +""" |
| 2 | +Regression tests: the V3 location/endpoint reference write paths limit the |
| 3 | +references a request may select to the objects the requesting user is authorized |
| 4 | +for. Each test asserts an authorized reference is accepted and an unauthorized |
| 5 | +one is rejected, for the Finding endpoints field, the import endpoint_to_add |
| 6 | +field, and bulk-mitigate reference updates. |
| 7 | +""" |
| 8 | +from django.core.files.uploadedfile import SimpleUploadedFile |
| 9 | +from django.urls import reverse |
| 10 | +from django.utils.timezone import now |
| 11 | +from rest_framework.exceptions import ValidationError as DRFValidationError |
| 12 | +from rest_framework.test import APIRequestFactory |
| 13 | + |
| 14 | +from dojo.api_v2.serializers import ImportScanSerializer |
| 15 | +from dojo.authorization.roles_permissions import Roles |
| 16 | +from dojo.location.models import ( |
| 17 | + LocationFindingReference, |
| 18 | + LocationProductReference, |
| 19 | +) |
| 20 | +from dojo.location.status import FindingLocationStatus |
| 21 | +from dojo.models import ( |
| 22 | + Dojo_User, |
| 23 | + Engagement, |
| 24 | + Finding, |
| 25 | + Product, |
| 26 | + Product_Member, |
| 27 | + Product_Type, |
| 28 | + Role, |
| 29 | + Test, |
| 30 | + Test_Type, |
| 31 | +) |
| 32 | +from dojo.url.models import URL |
| 33 | +from unittests.dojo_test_case import DojoAPITestCase, skip_unless_v3 |
| 34 | + |
| 35 | +GENERIC_FINDINGS = b'{"findings": [{"title": "probe", "severity": "Info", "description": "probe"}]}' |
| 36 | + |
| 37 | + |
| 38 | +@skip_unless_v3 |
| 39 | +class V3LocationReferenceAuthzTests(DojoAPITestCase): |
| 40 | + |
| 41 | + """Two products, two users; each user is authorized only for their own product.""" |
| 42 | + |
| 43 | + @classmethod |
| 44 | + def setUpTestData(cls): |
| 45 | + cls.pt = Product_Type.objects.create(name="v3_locref_pt") |
| 46 | + cls.product_a = Product.objects.create(name="v3_locref_a", description="a", prod_type=cls.pt) |
| 47 | + cls.product_b = Product.objects.create(name="v3_locref_b", description="b", prod_type=cls.pt) |
| 48 | + |
| 49 | + cls.user_a = Dojo_User.objects.create(username="v3_locref_user_a", is_active=True) |
| 50 | + cls.user_b = Dojo_User.objects.create(username="v3_locref_user_b", is_active=True) |
| 51 | + # Grant membership two ways so the test is authorization-backend agnostic: |
| 52 | + # legacy authorized_users (honored by the OS backend) and a Product_Member |
| 53 | + # Owner role (honored by the Pro backend). |
| 54 | + owner = Role.objects.get(id=Roles.Owner) |
| 55 | + for product, user in ((cls.product_a, cls.user_a), (cls.product_b, cls.user_b)): |
| 56 | + product.authorized_users.add(user) |
| 57 | + Product_Member.objects.create(product=product, user=user, role=owner) |
| 58 | + |
| 59 | + cls.test_type, _ = Test_Type.objects.get_or_create(name="v3_locref_scan") |
| 60 | + |
| 61 | + cls.finding_a = cls._make_finding(cls.product_a, cls.user_a, "finding_a") |
| 62 | + cls.engagement_a = cls.finding_a.test.engagement |
| 63 | + cls.finding_b = cls._make_finding(cls.product_b, cls.user_b, "finding_b") |
| 64 | + |
| 65 | + # A location on product_b (authorized only for user_b). |
| 66 | + url_b = URL.get_or_create_from_object(URL.from_value("https://b.example.test/x")) |
| 67 | + cls.lfr_b = url_b.location.associate_with_finding(cls.finding_b) |
| 68 | + cls.location_b = url_b.location |
| 69 | + |
| 70 | + # A location on product_a (authorized for user_a) for the accepted-case controls. |
| 71 | + cls.finding_a_extra = cls._make_finding(cls.product_a, cls.user_a, "finding_a_extra") |
| 72 | + url_a = URL.get_or_create_from_object(URL.from_value("https://a.example.test/ok")) |
| 73 | + cls.lfr_a = url_a.location.associate_with_finding(cls.finding_a_extra) |
| 74 | + cls.location_a = url_a.location |
| 75 | + |
| 76 | + # A location associated with both products, with an active reference from product_b. |
| 77 | + url_shared = URL.get_or_create_from_object(URL.from_value("https://shared.example.test/s")) |
| 78 | + cls.location_shared = url_shared.location |
| 79 | + cls.location_shared.associate_with_product(cls.product_a) |
| 80 | + cls.lfr_shared_b = LocationFindingReference.objects.create( |
| 81 | + location=cls.location_shared, finding=cls.finding_b, status=FindingLocationStatus.Active, |
| 82 | + ) |
| 83 | + |
| 84 | + @classmethod |
| 85 | + def _make_finding(cls, product, user, title): |
| 86 | + engagement = Engagement.objects.create(name=title + "_eng", product=product, target_start=now(), target_end=now()) |
| 87 | + test = Test.objects.create(engagement=engagement, test_type=cls.test_type, target_start=now(), target_end=now()) |
| 88 | + return Finding.objects.create( |
| 89 | + test=test, title=title, description="x", severity="High", |
| 90 | + numerical_severity="S0", active=True, verified=True, reporter=user, |
| 91 | + ) |
| 92 | + |
| 93 | + # Finding endpoints field |
| 94 | + def test_finding_endpoints_rejects_unauthorized_reference(self): |
| 95 | + self.client.force_authenticate(user=self.user_a) |
| 96 | + response = self.client.patch( |
| 97 | + reverse("finding-list") + f"{self.finding_a.id}/", |
| 98 | + {"endpoints": [self.lfr_b.id], "push_to_jira": False}, format="json", secure=True, |
| 99 | + ) |
| 100 | + self.assertEqual(response.status_code, 400) |
| 101 | + self.assertFalse( |
| 102 | + LocationProductReference.objects.filter(location=self.location_b, product=self.product_a).exists(), |
| 103 | + ) |
| 104 | + |
| 105 | + def test_finding_endpoints_allows_authorized_reference(self): |
| 106 | + self.client.force_authenticate(user=self.user_a) |
| 107 | + response = self.client.patch( |
| 108 | + reverse("finding-list") + f"{self.finding_a.id}/", |
| 109 | + {"endpoints": [self.lfr_a.id], "push_to_jira": False}, format="json", secure=True, |
| 110 | + ) |
| 111 | + self.assertEqual(response.status_code, 200) |
| 112 | + |
| 113 | + # import endpoint_to_add |
| 114 | + def test_import_endpoint_to_add_rejects_unauthorized_reference(self): |
| 115 | + self.client.force_authenticate(user=self.user_a) |
| 116 | + response = self.client.post(reverse("importscan-list"), { |
| 117 | + "engagement": self.engagement_a.id, |
| 118 | + "scan_type": "Generic Findings Import", |
| 119 | + "endpoint_to_add": self.location_b.id, |
| 120 | + "file": SimpleUploadedFile("s.json", GENERIC_FINDINGS, content_type="application/json"), |
| 121 | + }, secure=True) |
| 122 | + self.assertEqual(response.status_code, 400) |
| 123 | + self.assertFalse( |
| 124 | + LocationProductReference.objects.filter(location=self.location_b, product=self.product_a).exists(), |
| 125 | + ) |
| 126 | + |
| 127 | + def test_import_endpoint_to_add_allows_authorized_reference(self): |
| 128 | + # Checked at the field level so the assertion is about the queryset scoping, |
| 129 | + # not the downstream import pipeline. |
| 130 | + request = APIRequestFactory().post(reverse("importscan-list")) |
| 131 | + request.user = self.user_a |
| 132 | + field = ImportScanSerializer(context={"request": request}).fields["endpoint_to_add"] |
| 133 | + self.assertEqual(field.to_internal_value(self.location_a.id), self.location_a) |
| 134 | + with self.assertRaises(DRFValidationError): |
| 135 | + field.to_internal_value(self.location_b.id) |
| 136 | + |
| 137 | + # bulk mitigate reference updates |
| 138 | + def test_bulk_mitigate_scopes_reference_updates(self): |
| 139 | + self.client.force_login(self.user_a) |
| 140 | + response = self.client.post( |
| 141 | + reverse("endpoints_bulk_update_all_product", args=(self.product_a.id,)), |
| 142 | + data={"endpoints_to_update": self.location_shared.id}, secure=True, |
| 143 | + ) |
| 144 | + self.assertIn(response.status_code, (200, 302)) |
| 145 | + self.lfr_shared_b.refresh_from_db() |
| 146 | + # A reference outside the acting product is left unchanged. |
| 147 | + self.assertEqual(self.lfr_shared_b.status, FindingLocationStatus.Active) |
0 commit comments