[portal-commits] JBoss Portal SVN: r13428 - in branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium: cms and 2 other directories.

Author: vrockai Date: 2009-06-03 11:57:20 -0400 (Wed, 03 Jun 2009) New Revision: 13428 Modified: branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/IdentityAdminTestCase.java branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/JBossPortalSeleniumTestCase.java branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/UserLoginTestCase.java branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/assert.properties branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/cms/CMSArchiveUploadTestCase.java branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/cms/CMSDirectoryTestCase.java branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/cms/CMSFileWorkflowTestCase.java branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/portal/EndtoEndPortalAdminTestCase.java branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/portal/PortletInstancesTestCase.java branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/sso/CASSeleniumTestCase.java Log: [selenium] - xss Modified: branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/IdentityAdminTestCase.java =================================================================== --- branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/IdentityAdminTestCase.java 2009-06-03 04:25:33 UTC (rev 13427) +++ branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/IdentityAdminTestCase.java 2009-06-03 15:57:20 UTC (rev 13428) @@ -17,6 +17,10 @@ + private static final String LNK_MEMBERS = "link=Members"; + + private static final String LNK_ADMIN = "link=Admin"; + /** prefix for locator properties */ public String casePfx = "iden.man."; @@ -204,7 +208,7 @@ logout(); // trying to log in with disabled account - selenium.open(ADDR_PORTAL); + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); selenium.click(LINK_LOGIN); @@ -483,16 +487,148 @@ } /** - * @deprecated - * Test many users creates 25 users. The test is disabled. + * Xss testing of user creating dialog. XSS string is passed to user name input, the form is submitted and text indicating incorrect username input is asserted. + * The page is realoaded and XSS string is passed to user e-mail input, the form is submitted and text indicating incorrect user e-mail input is asserted. */ - @Test(enabled = false) - public void testManyUsers() { - for (int i = 0; i < 25; i++) { - createUser("user0" + i + "", "useruser", "user0" + i + "" + &quot;(a)portal.com&quot;); - } + //TODO Q: password can be anystring? + //TODO Q: what about serach input? + @Test(enabled = true) + public void testUserCreateXss() { + openAndWait(ADR_PORTAL); + clickAndWait(LNK_ADMIN); + clickAndWait(LNK_MEMBERS); + clickAndWait(LNK_CREATE_USER); + + selenium.type(INP_USERNAME, XSS_STR1); + clickAndWait(SUB_CREATE_USER); + + Assert.assertTrue(selenium.isTextPresent("is an invalid username")); + + openAndWait(ADR_PORTAL); + + clickIfVisible(LNK_ADMIN); + clickIfVisible(LNK_MEMBERS); + clickIfVisible(LNK_CREATE_USER); + + selenium.type(INP_USERNAME, "user"); + selenium.type(INP_USEREMAIL, XSS_STR1); + + clickAndWait(SUB_CREATE_USER); + + Assert.assertTrue(selenium.isTextPresent("Invalid E-Mail address.")); + } + + /** + * + */ + @Test(enabled = true) + public void testRoleCreateXss() { + openAndWait(ADR_PORTAL); + clickIfVisible(LNK_ADMIN); + clickIfVisible(LNK_ADMIN); + clickIfVisible(LNK_MEMBERS); + clickIfVisible(LNK_ROLETAB); + clickIfVisible(LNK_ROLEMAIN); + clickIfVisible(LNK_ROLE_CREATE); + + selenium.type(INP_ROLENAME, XSS_STR1); + selenium.type(INP_ROLEDISNAME,"diddi"); + clickAndWait(SUB_ROLE_CREATE); + + Assert.assertTrue(selenium.isTextPresent("is an invalid role name")); + + openAndWait(ADR_PORTAL); + + clickIfVisible(LNK_ADMIN); + clickIfVisible(LNK_ADMIN); + clickIfVisible(LNK_MEMBERS); + clickIfVisible(LNK_ROLETAB); + clickIfVisible(LNK_ROLEMAIN); + clickIfVisible(LNK_ROLE_CREATE); + + selenium.type(INP_ROLENAME, "rolee"); + selenium.type(INP_ROLEDISNAME, XSS_STR1); + + clickAndWait(SUB_ROLE_CREATE); + + Assert.assertTrue(selenium.isTextPresent("is an invalid role display name")); + } + + /** + * + */ + @Test(enabled = true, dependsOnMethods = {"testEditUser"}) + public void testEditUserXss() { + final String userName = "editXssMe"; + final String userPass = "editXssPass"; + final String userMail = &quot;editXssMe(a)redhat.com&quot;; + createUser(userName, userPass, userMail); + goToEdit(userName, userMail); + + testInput(INP_EDIT_USER_EMAIL, XSS_STR1, SUB_EDIT_PROF, "Invalid E-Mail address."); + + //firstname + goToEdit(userName, userMail); + testInput("//input[contains(@id,'profile-form:givenname')]", XSS_STR1, SUB_EDIT_PROF, "is an invalid value"); + //lastname + goToEdit(userName, userMail); + testInput("//input[contains(@id,'profile-form:familyname')]", XSS_STR1, SUB_EDIT_PROF, "is an invalid value"); + //location + goToEdit(userName, userMail); + testInput("//input[contains(@id,'profile-form:location')]", XSS_STR1, SUB_EDIT_PROF, "is an invalid value"); + //skype + goToEdit(userName, userMail); + testInput("//input[contains(@id,'profile-form:skype')]", XSS_STR1, SUB_EDIT_PROF, "is an invalid value"); + //icq + goToEdit(userName, userMail); + testInput("//input[contains(@id,'profile-form:icq')]", XSS_STR1, SUB_EDIT_PROF, "is an invalid value"); + //aim + goToEdit(userName, userMail); + testInput("//input[contains(@id,'profile-form:aim')]", XSS_STR1, SUB_EDIT_PROF, "is an invalid value"); + //msn + goToEdit(userName, userMail); + testInput("//input[contains(@id,'profile-form:msnm')]", XSS_STR1, SUB_EDIT_PROF, "is an invalid value"); + //yahoo + goToEdit(userName, userMail); + testInput("//input[contains(@id,'profile-form:yim')]", XSS_STR1, SUB_EDIT_PROF, "is an invalid value"); + //xmmp + goToEdit(userName, userMail); + testInput("//input[contains(@id,'profile-form:xmmp')]", XSS_STR1, SUB_EDIT_PROF, "is an invalid value"); + //homepage + goToEdit(userName, userMail); + testInput("//input[contains(@id,'profile-form:homepage')]", XSS_STR1, SUB_EDIT_PROF, "is an invalid value"); + //occup + goToEdit(userName, userMail); + testInput("//input[contains(@id,'profile-form:occupation')]", XSS_STR1, SUB_EDIT_PROF, "is an invalid value"); + //hobby + goToEdit(userName, userMail); + testInput("//input[contains(@id,'profile-form:interests')]", XSS_STR1, SUB_EDIT_PROF, "is an invalid value"); + //sign + goToEdit(userName, userMail); + testInput("//textarea[contains(@id,'profile-form:signature')]", XSS_STR1, SUB_EDIT_PROF, "is an invalid value"); + //extra + goToEdit(userName, userMail); + testInput("//textarea[contains(@id,'profile-form:extra')]", XSS_STR1, SUB_EDIT_PROF, "is an invalid value"); + + deleteUser(userName, userMail); + } + private void goToEdit(String userName, String userMail){ + searchUser(userName, userMail); + + int r = findTableRow(TBL_USERLIST, userName, 0); + selenium.click(MessageFormat.format(LNK_T_USRLIST_EDIT, r - 1)); + selenium.waitForPageToLoad(PAGE_LOAD); + + } + + private void testInput(String inpLoc, String inpStr, String subLoc, String mes){ + selenium.type(inpLoc, inpStr); + clickAndWait(subLoc); + Assert.assertTrue(selenium.isTextPresent(mes)); + } + /** * Test search user count is responsible for the search functions for users.. * The test creates 95 users named man0us - man94us. @@ -598,10 +734,10 @@ selenium.open("/portal/auth/portal/default"); selenium.waitForPageToLoad(PAGE_LOAD); - selenium.click("link=Admin"); + selenium.click(LNK_ADMIN); selenium.waitForPageToLoad(PAGE_LOAD); - selenium.click("link=Members"); + selenium.click(LNK_MEMBERS); selenium.waitForPageToLoad(PAGE_LOAD); clickIfVisible(LNK_USERTAB); @@ -638,9 +774,9 @@ selenium.open("/portal/auth/portal/default"); selenium.waitForPageToLoad(PAGE_LOAD); - selenium.click("link=Admin"); + selenium.click(LNK_ADMIN); selenium.waitForPageToLoad(PAGE_LOAD); - selenium.click("link=Members"); + selenium.click(LNK_MEMBERS); selenium.waitForPageToLoad(PAGE_LOAD); clickIfVisible(LNK_USERMAIN); @@ -661,15 +797,15 @@ void searchUser(String userName, String userMail) { selenium.open("/portal/"); selenium.waitForPageToLoad(PAGE_LOAD); - selenium.click("link=Admin"); + selenium.click(LNK_ADMIN); selenium.waitForPageToLoad(PAGE_LOAD); - selenium.click("link=Members"); + selenium.click(LNK_MEMBERS); selenium.waitForPageToLoad(PAGE_LOAD); clickIfVisible(LNK_USERTAB); clickIfVisible(LNK_USERMAIN); clickIfVisible(LNK_USERMANG_MAIN); - + clickIfVisible("//a[contains(@id,'user-temp-form1:user-managment-link')]"); selenium.click(LNK_SEARCH_USER); selenium.waitForPageToLoad(PAGE_LOAD); @@ -707,9 +843,9 @@ private void deleteUser(String username, String email) { selenium.open("/portal/"); selenium.waitForPageToLoad(PAGE_LOAD); - selenium.click("link=Admin"); + selenium.click(LNK_ADMIN); selenium.waitForPageToLoad(PAGE_LOAD); - selenium.click("link=Members"); + selenium.click(LNK_MEMBERS); selenium.waitForPageToLoad(PAGE_LOAD); clickIfVisible(LNK_USERTAB); @@ -717,6 +853,7 @@ clickIfVisible(LNK_USERMAIN); clickIfVisible(LNK_USERMANG_MAIN); clickIfVisible(LNK_USERMANG_MAIN2); + clickIfVisible("//a[contains(@id,'user-temp-form1:user-managment-link')]"); selenium.click(LNK_SEARCH_USER); selenium.waitForPageToLoad(PAGE_LOAD); @@ -738,18 +875,18 @@ private void clickUntilMembers() { selenium.open("/portal/"); selenium.waitForPageToLoad(PAGE_LOAD); - selenium.click("link=Admin"); + selenium.click(LNK_ADMIN); selenium.waitForPageToLoad(PAGE_LOAD); - selenium.click("link=Members"); + selenium.click(LNK_MEMBERS); selenium.waitForPageToLoad(PAGE_LOAD); } private void createRole(String roleName, String roleDisplayName) { selenium.open("/portal/"); selenium.waitForPageToLoad(PAGE_LOAD); - selenium.click("link=Admin"); + selenium.click(LNK_ADMIN); selenium.waitForPageToLoad(PAGE_LOAD); - selenium.click("link=Members"); + selenium.click(LNK_MEMBERS); selenium.waitForPageToLoad(PAGE_LOAD); clickIfVisible(LNK_ROLETAB); @@ -774,9 +911,9 @@ private void deleteRole(String roleName) { selenium.open("/portal/"); selenium.waitForPageToLoad(PAGE_LOAD); - selenium.click("link=Admin"); + selenium.click(LNK_ADMIN); selenium.waitForPageToLoad(PAGE_LOAD); - selenium.click("link=Members"); + selenium.click(LNK_MEMBERS); selenium.waitForPageToLoad(PAGE_LOAD); clickIfVisible(LNK_ROLETAB); @@ -799,9 +936,9 @@ private void searchSimple(String name, String count) { selenium.open("/portal/"); selenium.waitForPageToLoad(PAGE_LOAD); - selenium.click("link=Admin"); + selenium.click(LNK_ADMIN); selenium.waitForPageToLoad(PAGE_LOAD); - selenium.click("link=Members"); + selenium.click(LNK_MEMBERS); selenium.waitForPageToLoad(PAGE_LOAD); clickIfVisible(LNK_USERTAB); Modified: branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/JBossPortalSeleniumTestCase.java =================================================================== --- branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/JBossPortalSeleniumTestCase.java 2009-06-03 04:25:33 UTC (rev 13427) +++ branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/JBossPortalSeleniumTestCase.java 2009-06-03 15:57:20 UTC (rev 13428) @@ -41,11 +41,13 @@ protected final String LINK_LOGOUT = getLoc(casePfx + "link.logout", "link=Logout"); protected final String SUBMIT_LOGIN = getLoc(casePfx + "submit.login", "login"); - protected final String ADDR_PORTAL = getLoc(casePfx + "addr.portal", "/portal/"); + protected final String ADR_PORTAL = getLoc(casePfx + "addr.portal", "/portal/"); protected final String FRAME_LOGIN_CONTENT = getLoc(casePfx + "frame.login.content", "login-content"); protected final String LINK_LOGIN = getLoc(casePfx + "link.login", "link=Login"); protected final String INPUT_PASSWORD = getLoc(casePfx + "input.password", "j_password"); protected final String INPUT_USERNAME = getLoc(casePfx + "input.username", "j_username"); + + protected final String XSS_STR1 = getMess("portal.xxs.1", "/Dave</option><script>alert(document.cookie);</script>"); protected static Properties propsLoc; protected static Properties propsMes; @@ -373,7 +375,7 @@ * the password */ public void login(String username, String password) { - selenium.open(ADDR_PORTAL); + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); selenium.click(LINK_LOGIN); @@ -396,7 +398,7 @@ * Logs out from JBoss portal application. */ public void logout() { - selenium.open(ADDR_PORTAL); + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); Assert.assertTrue(selenium.isElementPresent(LINK_LOGOUT)); selenium.click(LINK_LOGOUT); @@ -410,7 +412,7 @@ */ // TODO refactoring needed - use function logout() public void logoutIfPossible() { - selenium.open(ADDR_PORTAL); + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); if (selenium.isElementPresent(LINK_LOGOUT)) { selenium.click(LINK_LOGOUT); Modified: branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/UserLoginTestCase.java =================================================================== --- branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/UserLoginTestCase.java 2009-06-03 04:25:33 UTC (rev 13427) +++ branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/UserLoginTestCase.java 2009-06-03 15:57:20 UTC (rev 13428) @@ -4,7 +4,6 @@ import org.testng.annotations.AfterClass; import org.testng.annotations.Test; - /** * Testcase responsible for testing of login form. * @@ -13,43 +12,42 @@ @Test(groups = { "login" }, enabled = true) public class UserLoginTestCase extends JBossPortalSeleniumTestCase { - - /** prefix for locator properties = user.login.*/ + + /** prefix for locator properties = user.login. */ public final String casePfx = "user.login."; - - private final String ADR_PORTAL = getLoc(casePfx+"adr.portal","/portal"); - private final String FRM_MAIN = getLoc(casePfx+"frm.main","relative=up"); - private final String SUB_CANCEL = getLoc(casePfx+"sub.portal","cancel"); - private final String LNK_LOGOUT = getLoc(casePfx+"lnk.logout","link=Logout"); - private final String SUB_LOGIN = getLoc(casePfx+"saub.login","login-submit"); - private final String INP_PASSWORD = getLoc(casePfx+"inp.password","xpath=id('j_password')"); - private final String INP_USERNAME = getLoc(casePfx+"inp.username","xpath=id('j_username')"); - private final String FRM_LOGINFORM = getLoc(casePfx+"frm.login","login-content"); - private final String LNK_LOGIN = getLoc(casePfx+"lnk.login","link=Login"); - + + private final String ADR_PORTAL = getLoc(casePfx + "adr.portal", "/portal"); + private final String FRM_MAIN = getLoc(casePfx + "frm.main", "relative=up"); + private final String SUB_CANCEL = getLoc(casePfx + "sub.portal", "cancel"); + private final String LNK_LOGOUT = getLoc(casePfx + "lnk.logout", "link=Logout"); + private final String SUB_LOGIN = getLoc(casePfx + "saub.login", "login-submit"); + private final String INP_PASSWORD = getLoc(casePfx + "inp.password", "xpath=id('j_password')"); + private final String INP_USERNAME = getLoc(casePfx + "inp.username", "xpath=id('j_username')"); + private final String FRM_LOGINFORM = getLoc(casePfx + "frm.login", "login-content"); + private final String LNK_LOGIN = getLoc(casePfx + "lnk.login", "link=Login"); + @AfterClass(enabled = true) - private void logoutIfNeeded() - { + private void logoutIfNeeded() { selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); - - if (selenium.isElementPresent(LNK_LOGOUT)){ + + if (selenium.isElementPresent(LNK_LOGOUT)) { selenium.click(LNK_LOGOUT); selenium.waitForPageToLoad(PAGE_LOAD); } } - /** * Test default user login. * - * Login as user/user and check if the message with login information appears. + * Login as user/user and check if the message with login information + * appears. */ @Test(enabled = true, description = "login as default user 'user' with password 'user'.") public void testDefaultUserLogin() { final String loginName = "user"; final String loginPass = "user"; - + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); @@ -61,7 +59,7 @@ waitForElement(INP_USERNAME); waitForElement(INP_PASSWORD); - + Assert.assertTrue(selenium.isElementPresent(INP_USERNAME), "Expected input DOM element for username doesn't exist."); selenium.type(INP_USERNAME, loginName); @@ -73,7 +71,7 @@ selenium.waitForPageToLoad(PAGE_LOAD); - Assert.assertTrue(selenium.isTextPresent("Logged in as: "+loginName), "\"Logged in as\" message missing."); + Assert.assertTrue(selenium.isTextPresent("Logged in as: " + loginName), "\"Logged in as\" message missing."); Assert.assertTrue(selenium.isElementPresent(LNK_LOGOUT), "Expected DOM element for login link does not exist."); Assert.assertEquals(selenium.getText(LNK_LOGOUT), "Logout", "Logout has wrong label."); @@ -86,13 +84,14 @@ /** * Test admin login. * - * Login as admin/admin and check if the message with login information appears. + * Login as admin/admin and check if the message with login information + * appears. */ @Test(enabled = true, description = "login as admin user 'admin' with password 'admin'.") public void testAdminLogin() { final String loginName = "admin"; final String loginPass = "admin"; - + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); waitForElement(LNK_LOGIN); @@ -104,7 +103,7 @@ waitForElement(INP_USERNAME); waitForElement(INP_PASSWORD); - + Assert.assertTrue(selenium.isElementPresent(INP_USERNAME), "Expected input DOM element for username doesn't exist."); selenium.type(INP_USERNAME, loginName); Assert.assertTrue(selenium.isElementPresent(INP_PASSWORD), "Expected input DOM element for password doesn't exist."); @@ -112,7 +111,7 @@ selenium.fireEvent(INP_PASSWORD, "keydown"); selenium.click(SUB_LOGIN); - //waitFor(AJAX_LOAD); + // waitFor(AJAX_LOAD); selenium.waitForPageToLoad(PAGE_LOAD); Assert.assertTrue(selenium.isTextPresent("Logged in as: admin"), "\"Logged in as\" message missing."); @@ -134,7 +133,7 @@ public void testUserLoginCancel() { final String loginName = "saki"; final String loginPass = "paki"; - + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); @@ -148,7 +147,7 @@ waitForElement(INP_USERNAME); waitForElement(INP_PASSWORD); - + Assert.assertTrue(selenium.isElementPresent(INP_USERNAME), "Expected input DOM element for username doesn't exist."); selenium.type(INP_USERNAME, loginName); Assert.assertTrue(selenium.isElementPresent(INP_PASSWORD), "Expected input DOM element for password doesn't exist."); @@ -162,7 +161,7 @@ Assert.assertFalse(selenium.isTextPresent("Logged in as:"), "\"Logged in as:\" message with no user logged in is missing."); } - + /** * Test false name login. * @@ -172,7 +171,7 @@ public void testFalseNameLogin() { final String loginName = "us2er"; final String loginPass = "user"; - + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); @@ -184,20 +183,19 @@ waitForElement(INP_USERNAME); waitForElement(INP_PASSWORD); - + Assert.assertTrue(selenium.isElementPresent(INP_USERNAME), "Expected input DOM element for username doesn't exist."); selenium.type(INP_USERNAME, loginName); Assert.assertTrue(selenium.isElementPresent(INP_PASSWORD), "Expected input DOM element for password doesn't exist."); selenium.type(INP_PASSWORD, loginPass); selenium.fireEvent(INP_PASSWORD, "keydown"); selenium.click(SUB_LOGIN); - + selenium.waitForPageToLoad(PAGE_LOAD); Assert.assertTrue(selenium.isTextPresent("The user doesn't exist or the password is incorrect "), "\"Logged in as\" message missing."); } - - + /** * Test false password login. * @@ -207,7 +205,7 @@ public void testFalsePasswordLogin() { final String loginName = "user"; final String loginPass = "us2er"; - + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); @@ -219,7 +217,7 @@ waitForElement(INP_USERNAME); waitForElement(INP_PASSWORD); - + Assert.assertTrue(selenium.isElementPresent(INP_USERNAME), "Expected input DOM element for username doesn't exist."); selenium.type(INP_USERNAME, loginName); Assert.assertTrue(selenium.isElementPresent(INP_PASSWORD), "Expected input DOM element for password doesn't exist."); @@ -232,4 +230,52 @@ Assert.assertTrue(selenium.isTextPresent("The user doesn't exist or the password is incorrect "), "\"Logged in as\" message missing."); } + /** + * Test xss attacks on login form. Xss attack string is wirtten into + * password field for "user" and it is asserted, that "wrong password" + * message is present. Xss attack string is wirtten into userGname field for + * "user" and it is asserted, that "wrong password" message is present. + * + * Try to login with user/us2er and check that you are not logged in. + */ + @Test(enabled = true, description = "xss attack") + public void testXssAttack() { + final String loginName = "user"; + final String loginPass = "us2er"; + + selenium.open(ADR_PORTAL); + selenium.waitForPageToLoad(PAGE_LOAD); + + selenium.click(LNK_LOGIN); + selenium.selectFrame(FRM_LOGINFORM); + + waitForElement(INP_USERNAME); + waitForElement(INP_PASSWORD); + + selenium.type(INP_USERNAME, loginName); + selenium.type(INP_PASSWORD, XSS_STR1); + selenium.fireEvent(INP_PASSWORD, "keydown"); + selenium.click(SUB_LOGIN); + selenium.waitForPageToLoad(PAGE_LOAD); + Assert.assertTrue(selenium.isTextPresent("The user doesn't exist or the password is incorrect")); + + selenium.open(ADR_PORTAL); + selenium.waitForPageToLoad(PAGE_LOAD); + + selenium.click(LNK_LOGIN); + selenium.selectFrame(FRM_LOGINFORM); + + waitForElement(INP_USERNAME); + waitForElement(INP_PASSWORD); + + selenium.type(INP_USERNAME, XSS_STR1); + selenium.type(INP_PASSWORD, loginPass); + selenium.fireEvent(INP_PASSWORD, "keydown"); + selenium.click(SUB_LOGIN); + selenium.waitForPageToLoad(PAGE_LOAD); + Assert.assertTrue(selenium.isTextPresent("The user doesn't exist or the password is incorrect")); + + Assert.assertTrue(selenium.isTextPresent("The user doesn't exist or the password is incorrect "), "\"Logged in as\" message missing."); + } + } Modified: branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/assert.properties =================================================================== --- branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/assert.properties 2009-06-03 04:25:33 UTC (rev 13427) +++ branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/assert.properties 2009-06-03 15:57:20 UTC (rev 13428) @@ -2,6 +2,10 @@ selenium.timeout.ajax=3000 selenium.timeout.elem=220 +portal.xxs.1=/Dave</option><script>alert(document.cookie);</script> +#portal.xxs.2= +#portal.xxs.3= + iden.man.chk.role=Create new role cms.sec.denied=You are not allowed to access the resource Modified: branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/cms/CMSArchiveUploadTestCase.java =================================================================== --- branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/cms/CMSArchiveUploadTestCase.java 2009-06-03 04:25:33 UTC (rev 13427) +++ branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/cms/CMSArchiveUploadTestCase.java 2009-06-03 15:57:20 UTC (rev 13428) @@ -90,7 +90,7 @@ "archive was accepted for processing afte cancelling the upload"); Assert.assertFalse(selenium.isElementPresent("link=archive"), "not uploaded (upload cancelled) archive found #1"); - selenium.open(ADDR_PORTAL); + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); Assert.assertFalse(selenium.isElementPresent("link=archive"), "not uploaded (upload cancelled) archive found #2"); Modified: branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/cms/CMSDirectoryTestCase.java =================================================================== --- branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/cms/CMSDirectoryTestCase.java 2009-06-03 04:25:33 UTC (rev 13427) +++ branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/cms/CMSDirectoryTestCase.java 2009-06-03 15:57:20 UTC (rev 13428) @@ -69,7 +69,7 @@ selenium.click("cancel"); // really creating - selenium.open(ADDR_PORTAL); + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); selenium.click("link=Admin"); @@ -131,7 +131,7 @@ selenium.waitForPageToLoad(PAGE_LOAD); // really deleting - selenium.open(ADDR_PORTAL); + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); selenium.click("link=Admin"); selenium.waitForPageToLoad(PAGE_LOAD); @@ -152,7 +152,7 @@ selenium.waitForPageToLoad(PAGE_LOAD); // assuring that the deletition was processed - selenium.open(ADDR_PORTAL); + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); selenium.click("link=Admin"); selenium.waitForPageToLoad(PAGE_LOAD); Modified: branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/cms/CMSFileWorkflowTestCase.java =================================================================== --- branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/cms/CMSFileWorkflowTestCase.java 2009-06-03 04:25:33 UTC (rev 13427) +++ branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/cms/CMSFileWorkflowTestCase.java 2009-06-03 15:57:20 UTC (rev 13428) @@ -88,7 +88,7 @@ selenium.waitForPageToLoad(PAGE_LOAD); // saving - selenium.open(ADDR_PORTAL); + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); selenium.click(LNK_ADMIN); selenium.waitForPageToLoad(PAGE_LOAD); @@ -165,7 +165,7 @@ public void testCreateFilePreview() { String name = "file2preview"; - selenium.open(ADDR_PORTAL); + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); selenium.click(LNK_ADMIN); selenium.waitForPageToLoad(PAGE_LOAD); @@ -278,7 +278,7 @@ Assert.assertTrue(selenium.isElementPresent("link=fileToMove")); // really moving file - selenium.open(ADDR_PORTAL); + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); selenium.click(LNK_ADMIN); selenium.waitForPageToLoad(PAGE_LOAD); @@ -372,7 +372,7 @@ selenium.waitForPageToLoad(PAGE_LOAD); // really creating and approving - selenium.open(ADDR_PORTAL); + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); selenium.click(LNK_ADMIN); selenium.waitForPageToLoad(PAGE_LOAD); @@ -417,7 +417,7 @@ private void createFile(String name, String content) { // save and approve - selenium.open(ADDR_PORTAL); + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); selenium.click(LNK_ADMIN); selenium.waitForPageToLoad(PAGE_LOAD); Modified: branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/portal/EndtoEndPortalAdminTestCase.java =================================================================== --- branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/portal/EndtoEndPortalAdminTestCase.java 2009-06-03 04:25:33 UTC (rev 13427) +++ branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/portal/EndtoEndPortalAdminTestCase.java 2009-06-03 15:57:20 UTC (rev 13428) @@ -23,27 +23,28 @@ /** prefix for locator properties = portal.e2e. */ public static String casePfx = "portal.e2e."; - - private final String SUB_POR_PROPS_UPDATE = getLoc(casePfx + "sub.por.props.update", "//input[contains(@id,'common-manage-prop-form:update')]"); - private final String SUB_POR_PROPERTY = getLoc(casePfx + "sub.por.property", "//input[contains(@id,'common-edit-prop-form:add-property')]"); - private final String INP_POR_PROPERTY = getLoc(casePfx + "inp.por.property", "//input[contains(@id,'common-edit-prop-form:property')]"); - private final String SUB_POR_LISTENER = getLoc(casePfx + "sub.por.listener", "//input[contains(@id,'edit-prop-form:update')]"); - private final String SEL_POR_LISTENER = getLoc(casePfx + "sel.por.listener", "//select[contains(@id,'edit-prop-form:listener')]"); - private final String SUB_PAL = getLoc(casePfx + "sub.pal", "//input[contains(@id,'common-edit-page-error-form:update')]"); - private final String INP_PAL_PR = getLoc(casePfx + "inp.pal.pr", "//input[contains(@id,'common-edit-page-error-form:page-res-select')]"); - private final String SEL_PAL_PN = getLoc(casePfx + "sel.pal.pn", "//select[contains(@id,'common-edit-page-error-form:page-not-found-select')]"); - private final String SEL_PAL_PI = getLoc(casePfx + "sel.pal.pi", "//select[contains(@id,'common-edit-page-error-form:page-internal-select')]"); - private final String SEL_PAL_PE = getLoc(casePfx + "sel.pal.pe", "//select[contains(@id,'common-edit-page-error-form:page-error-select')]"); - private final String SEL_PAL_PC = getLoc(casePfx + "sel.pal.pc", "//select[contains(@id,'common-edit-page-error-form:page-control-select')]"); - private final String SEL_PAL_PA = getLoc(casePfx + "sel.pal.pa", "//select[contains(@id,'common-edit-page-error-form:page-access-select')]"); - private final String SUB_POL = getLoc(casePfx + "sub.pol", "//input[contains(@id,'common-edit-portal-error-form:update')]"); - private final String INP_POL_PR = getLoc(casePfx + "inp.pol.pr", "//input[contains(@id,'common-edit-portal-error-form:portal-res-input')]"); - private final String SEL_POL_PN = getLoc(casePfx + "sel.pol.pn", "//select[contains(@id,'common-edit-portal-error-form:portal-not-found-select')]"); - private final String SEL_POL_PI = getLoc(casePfx + "sel.pol.pi", "//select[contains(@id,'common-edit-portal-error-form:portal-internal-select')]"); - private final String SEL_POL_PE = getLoc(casePfx + "sel.pol.pe", "//select[contains(@id,'common-edit-portal-error-form:portal-error-select')]"); - private final String SEL_POL_PU = getLoc(casePfx + "sel.pol.pu", "//select[contains(@id,'common-edit-portal-error-form:portal-unavail-select')]"); - private final String SEL_POL_PA = getLoc(casePfx + "sel.pol.pa", "//select[contains(@id,'common-edit-portal-error-form:portal-access-select')]"); + private final String SEL_PREDEF_PROP = getLoc(casePfx + "sel.predef.prop", "//select[contains(@id,'predefined-properties:predefinedProperty')]"); + private final String SUB_POR_PROPS_UPDATE = getLoc(casePfx + "sub.por.props.update", "//input[contains(@id,'common-manage-prop-form:update')]"); + private final String SUB_POR_PROPERTY = getLoc(casePfx + "sub.por.property", "//input[contains(@id,'common-edit-prop-form:add-property')]"); + private final String INP_POR_PROPERTY = getLoc(casePfx + "inp.por.property", "//input[contains(@id,'common-edit-prop-form:property')]"); + private final String SUB_POR_LISTENER = getLoc(casePfx + "sub.por.listener", "//input[contains(@id,'edit-prop-form:update')]"); + private final String SEL_POR_LISTENER = getLoc(casePfx + "sel.por.listener", "//select[contains(@id,'edit-prop-form:listener')]"); + private final String SUB_PAL = getLoc(casePfx + "sub.pal", "//input[contains(@id,'common-edit-page-error-form:update')]"); + private final String INP_PAL_PR = getLoc(casePfx + "inp.pal.pr", "//input[contains(@id,'common-edit-page-error-form:page-res-select')]"); + private final String SEL_PAL_PN = getLoc(casePfx + "sel.pal.pn", "//select[contains(@id,'common-edit-page-error-form:page-not-found-select')]"); + private final String SEL_PAL_PI = getLoc(casePfx + "sel.pal.pi", "//select[contains(@id,'common-edit-page-error-form:page-internal-select')]"); + private final String SEL_PAL_PE = getLoc(casePfx + "sel.pal.pe", "//select[contains(@id,'common-edit-page-error-form:page-error-select')]"); + private final String SEL_PAL_PC = getLoc(casePfx + "sel.pal.pc", "//select[contains(@id,'common-edit-page-error-form:page-control-select')]"); + private final String SEL_PAL_PA = getLoc(casePfx + "sel.pal.pa", "//select[contains(@id,'common-edit-page-error-form:page-access-select')]"); + private final String SUB_POL = getLoc(casePfx + "sub.pol", "//input[contains(@id,'common-edit-portal-error-form:update')]"); + private final String INP_POL_PR = getLoc(casePfx + "inp.pol.pr", "//input[contains(@id,'common-edit-portal-error-form:portal-res-input')]"); + private final String SEL_POL_PN = getLoc(casePfx + "sel.pol.pn", "//select[contains(@id,'common-edit-portal-error-form:portal-not-found-select')]"); + private final String SEL_POL_PI = getLoc(casePfx + "sel.pol.pi", "//select[contains(@id,'common-edit-portal-error-form:portal-internal-select')]"); + private final String SEL_POL_PE = getLoc(casePfx + "sel.pol.pe", "//select[contains(@id,'common-edit-portal-error-form:portal-error-select')]"); + private final String SEL_POL_PU = getLoc(casePfx + "sel.pol.pu", "//select[contains(@id,'common-edit-portal-error-form:portal-unavail-select')]"); + private final String SEL_POL_PA = getLoc(casePfx + "sel.pol.pa", "//select[contains(@id,'common-edit-portal-error-form:portal-access-select')]"); + private final String ADR_PORTAL = getLoc(casePfx + "adr.home", "/portal"); public final String SEL_PORTLET_TYPE = getLoc(casePfx + "sel.portlet.type", "//select[contains(@id,'windowForm:instanceId')]"); private final String SUB_LAYOUT_ADD_CENTER = getLoc(casePfx + "sub.layout.add.center", "//input[contains(@id,'layoutForm:a_center')]"); @@ -211,15 +212,22 @@ } - @Test(enabled = true, description = "Usecase for managing portals - listeners and properties.") + /** + * Test for managing portal listeners. Manage portals screen is loaded and + * "test_listener" is submited as a listener for this context. The screen is + * loaded again and it is asserted, that previously selected listener is + * still selected. The selection is changed to "user_listener", page is + * loaded again and "user_listener" is asserted to be the selected listener. + */ + @Test(enabled = true, description = "Usecase for managing portals - listeners.") public void testManagePortalListernersUsecase() { int r = -1; - //createPortal(portalManName); + // createPortal(portalManName); // addPage(portalManName,page1ManName); // - Verify that you can add listener goToProperties(); - + selenium.select(SEL_POR_LISTENER, "label=test_listener"); selenium.click(SUB_POR_LISTENER); selenium.waitForPageToLoad(PAGE_LOAD); @@ -235,14 +243,18 @@ Assert.assertEquals(selenium.getSelectedLabel(SEL_POR_LISTENER), "user_listener", "Previously selected label not being the current label."); } - @Test(enabled = true, description = "Usecase for managing portals - listeners and properties.") + /** + * Test for managing portal properties. Manage portals screen is loaded and + * it is asserted that the property table is not present on the screen - no + * property was added before the test. Then a custom property "dragadrop" is added, the page is reloaded and it is asserted, that "dragadrop" is present in properties table. + * + */ + @Test(enabled = true, description = "Usecase for managing portals - properties.") public void testManagePortalPropertiesUsecase() { int r = -1; goToProperties(); // - assert no property is added - // r = countTableRows(TAB_PROPERTIES); - // Assert.assertTrue(r==0,"Property table is not empty."); Assert.assertFalse(selenium.isElementPresent(TAB_PROPERTIES)); // - add d&d prop @@ -256,7 +268,6 @@ goToProperties(); // - assert d&d is added - //selenium.setSpeed("5000"); r = findTableRow(TAB_PROPERTIES, "dragadrop", 0) - 1; Assert.assertTrue(r > -1, "Previously added property drag&drop not found in the property table"); @@ -274,6 +285,8 @@ // - assert partial refresh is added r = findTableRow(TAB_PROPERTIES, "partialRef", 0) - 1; Assert.assertTrue(r > -1, "Previously added property partial refresh not found in the property table"); + r = findTableRow(TAB_PROPERTIES, "partialicek", 0) - 1; + Assert.assertTrue(r > -1, "Previously added property partial refresh not found in the property table"); // - delete d&d prop r = findTableRow(TAB_PROPERTIES, "dragadrop", 0) - 1; @@ -293,6 +306,25 @@ // - assert partial refresh is not added Assert.assertFalse(selenium.isElementPresent(TAB_PROPERTIES)); + goToProperties(); + // add original drag and drop + selectIfNotSelected(SEL_PREDEF_PROP, "Drag and drop"); + selenium.click(SUB_POR_PROPERTY); + selenium.waitForPageToLoad(PAGE_LOAD); + + r = findTableRow(TAB_PROPERTIES, "Drag and drop", 0) - 1; + Assert.assertTrue(r > -1, "Predefined property drag and drop was not found in property table."); + + goToProperties(); + + r = findTableRow(TAB_PROPERTIES, "Drag and drop", 0) - 1; + selenium.click(MessageFormat.format(TAB_PROP_DEL, r)); + selenium.waitForPageToLoad(PAGE_LOAD); + + goToProperties(); + + Assert.assertFalse(selenium.isElementPresent(TAB_PROPERTIES)); + } @Test(enabled = true, description = "Usecase for managing portals - error handling.") @@ -318,18 +350,18 @@ selenium.waitForPageToLoad(PAGE_LOAD); // assert RED handling - logout(); - login("user","user"); + logout(); + login("user", "user"); openAndAssert("/portal/auth/portal/admin", "ACCESS_DENIED"); openAndAssert("/portal/auth/portal/admin", "View permission not granted has denied access"); logout(); - login("admin","admin"); - + login("admin", "admin"); + openAndAssert("/portal/auth/portal/default/Test/Exception+test/ExceptionPortletWindow?op=error&action=1", "ERROR"); openAndAssert("/portal/auth/portal/default/Test/Exception+test/ExceptionPortletWindow?op=error&action=1", "Powered by JBoss Portal"); openAndAssert("/portal/portal/default/Test/Exception+test/ExceptionPortletWindow?op=ioexception&action=1", "ERROR"); openAndAssert("/portal/portal/default/Test/Exception+test/ExceptionPortletWindow?op=ioexception&action=1", "Cause: java.io.IOException"); - + // select ERR handling goToProperties(); selectIfNotSelected(SEL_POL_PA, LAB_ERR); @@ -342,12 +374,12 @@ selenium.waitForPageToLoad(PAGE_LOAD); // assert ERR handling - logout(); - login("user","user"); + logout(); + login("user", "user"); openAndAssert("http://localhost:8080/portal/auth/portal/admin", "HTTP Status 403 - "); logout(); - login("admin","admin"); - + login("admin", "admin"); + openAndAssert("/portal/auth/portal/default/Test/Exception+test/ExceptionPortletWindow?op=error&action=1", "HTTP Status 500"); openAndAssert("/portal/portal/default/Test/Exception+test/ExceptionPortletWindow?op=ioexception&action=1", "HTTP Status 500 -"); @@ -397,21 +429,21 @@ selenium.waitForPageToLoad(PAGE_LOAD); // assert REM handling - openAndAssert("/portal/auth/portal/default/Test/Exception+test/ExceptionPortletWindow?op=error&action=1", "ERROR",false); - openAndAssert("/portal/auth/portal/default/Test/Exception+test/ExceptionPortletWindow?op=error&action=1", "Powered by JBoss Portal",false); + openAndAssert("/portal/auth/portal/default/Test/Exception+test/ExceptionPortletWindow?op=error&action=1", "ERROR", false); + openAndAssert("/portal/auth/portal/default/Test/Exception+test/ExceptionPortletWindow?op=error&action=1", "Powered by JBoss Portal", false); } - private void openAndAssert(String add, String ass){ + private void openAndAssert(String add, String ass) { openAndAssert(add, ass, true); } - + private void openAndAssert(String add, String ass, boolean b) { selenium.open(add); selenium.waitForPageToLoad(PAGE_LOAD); if (b) - Assert.assertTrue(selenium.isTextPresent(ass), "Text: {\"" + ass + "\"} not found on the page"); + Assert.assertTrue(selenium.isTextPresent(ass), "Text: {\"" + ass + "\"} not found on the page"); else - Assert.assertFalse(selenium.isTextPresent(ass), "Text: {\"" + ass + "\"} was found on the page"); + Assert.assertFalse(selenium.isTextPresent(ass), "Text: {\"" + ass + "\"} was found on the page"); } private void goToProperties() { Modified: branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/portal/PortletInstancesTestCase.java =================================================================== --- branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/portal/PortletInstancesTestCase.java 2009-06-03 04:25:33 UTC (rev 13427) +++ branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/portal/PortletInstancesTestCase.java 2009-06-03 15:57:20 UTC (rev 13428) @@ -598,7 +598,7 @@ } private void goToPI() { - selenium.open(ADDR_PORTAL); + selenium.open(ADR_PORTAL); clickIfVisible(LINK_ADMIN); clickIfVisible(LINK_ADMIN); clickIfVisible(LINK_TAB_PI); Modified: branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/sso/CASSeleniumTestCase.java =================================================================== --- branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/sso/CASSeleniumTestCase.java 2009-06-03 04:25:33 UTC (rev 13427) +++ branches/JBoss_Portal_Branch_2_7/testsuite/ui-tests/src/org/jboss/portal/test/selenium/sso/CASSeleniumTestCase.java 2009-06-03 15:57:20 UTC (rev 13428) @@ -206,7 +206,7 @@ */ @Test(enabled = false) public void logoutIfPossible() { - selenium.open(ADDR_PORTAL); + selenium.open(ADR_PORTAL); selenium.waitForPageToLoad(PAGE_LOAD); if (selenium.isElementPresent(LINK_LOGOUT)) { selenium.click(LINK_LOGOUT);