Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Generated test didn't pass Spring Security's firewall. #2726

Open
ancavar opened this issue Dec 19, 2023 · 0 comments
Open

Generated test didn't pass Spring Security's firewall. #2726

ancavar opened this issue Dec 19, 2023 · 0 comments
Labels
ctg-bug Issue is a bug

Comments

@ancavar
Copy link

ancavar commented Dec 19, 2023

To Reproduce

  1. Add Spring Security to dependencies
  2. Generate integration tests for controller's method which has @PathVariable parameter.
    @GetMapping("/{name}")
    public String demo(@PathVariable String name) {
        return name;
    }

Expected behavior

Test should not fail.

Actual behavior

/**
     * @utbot.classUnderTest {@link BookController}
     * @utbot.methodUnderTest {@link BookController#demo(String)}
     */
    @Test
    @DisplayName("demo: name = '\uFFEA#$\\\"'' (mutated from '#$\\\"'') -> throw RequestRejectedException")
    public void testDemoThrowsRREWithNonEmptyString() throws Exception {
        UriComponentsBuilder uriComponentsBuilder = fromPath("/{name}");
        Map map = new HashMap();
        map.put("name", "\uFFEA#$\\\"'");
        UriComponentsBuilder uriComponentsBuilder1 = uriComponentsBuilder.uriVariables(map);
        String string = uriComponentsBuilder1.toUriString();
        Object[] objectArray = {};
        MockHttpServletRequestBuilder mockHttpServletRequestBuilder = get(string, objectArray);
        
        /* This test fails because method [org.springframework.test.web.servlet.MockMvc.perform] produces [org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String "%25"]
            org.springframework.security.web.firewall.StrictHttpFirewall.rejectedBlacklistedUrls(StrictHttpFirewall.java:369)
            org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:336)
            org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:194)
            org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178)
            org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358)
            org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271)
            org.springframework.mock.web.MockFilterChain.doFilter(MockFilterChain.java:134)
            org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100)
            org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
            org.springframework.mock.web.MockFilterChain.doFilter(MockFilterChain.java:134)
            org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93)
            org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
            org.springframework.mock.web.MockFilterChain.doFilter(MockFilterChain.java:134)
            org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201)
            org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119)
            org.springframework.mock.web.MockFilterChain.doFilter(MockFilterChain.java:134)
            org.springframework.test.web.servlet.MockMvc.perform(MockMvc.java:183) */
        mockMvc.perform(mockHttpServletRequestBuilder);
    }
    ///endregion
@ancavar ancavar added the ctg-bug Issue is a bug label Dec 19, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
ctg-bug Issue is a bug
Projects
Status: Todo
Development

No branches or pull requests

1 participant