feat: add unit tests for websocket csrf

Author: oliemansm

graphql-spring-boot-autoconfigure/src/main/java/graphql/kickstart/autoconfigure/web/servlet/GraphQLSubscriptionWebsocketProperties.java

@@ -15,6 +15,7 @@ class GraphQLSubscriptionWebsocketProperties {
   private CsrfProperties csrf = new CsrfProperties();
 
   @Data
+  static
   class CsrfProperties {
 
     private boolean enabled = false;

graphql-spring-boot-autoconfigure/src/test/java/graphql/kickstart/autoconfigure/web/servlet/WsCsrfFilterTest.java

@@ -0,0 +1,86 @@
+package graphql.kickstart.autoconfigure.web.servlet;
+
+import static org.assertj.core.api.AssertionsForClassTypes.assertThatThrownBy;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.ArgumentMatchers.any;
+import static org.mockito.Mockito.mock;
+import static org.mockito.Mockito.never;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import graphql.kickstart.autoconfigure.web.servlet.GraphQLSubscriptionWebsocketProperties.CsrfProperties;
+import jakarta.websocket.server.HandshakeRequest;
+import java.util.List;
+import java.util.Map;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+@ExtendWith(MockitoExtension.class)
+class WsCsrfFilterTest {
+
+  private CsrfProperties csrfProperties = new CsrfProperties();
+  @Mock private WsCsrfTokenRepository tokenRepository;
+  @Mock private HandshakeRequest handshakeRequest;
+
+  @Test
+  void givenCsrfDisabled_whenDoFilter_thenDoesNotLoadToken() {
+    csrfProperties.setEnabled(false);
+    WsCsrfFilter filter = new WsCsrfFilter(csrfProperties, tokenRepository);
+    filter.doFilter(handshakeRequest);
+
+    verify(tokenRepository, never()).loadToken(any());
+  }
+
+  @Test
+  void givenCsrfEnabledAndRepositoryNull_whenDoFilter_thenDoesNotGetTokenFromRequest() {
+    csrfProperties.setEnabled(true);
+    WsCsrfFilter filter = new WsCsrfFilter(csrfProperties, null);
+    filter.doFilter(handshakeRequest);
+
+    verify(handshakeRequest, never()).getParameterMap();
+  }
+
+  @Test
+  void givenNoTokenInSession_whenDoFilter_thenGenerateAndSaveToken() {
+    csrfProperties.setEnabled(true);
+    when(tokenRepository.loadToken(handshakeRequest)).thenReturn(null);
+    WsCsrfToken csrfToken = mock(WsCsrfToken.class);
+    when(tokenRepository.generateToken(handshakeRequest)).thenReturn(csrfToken);
+
+    WsCsrfFilter filter = new WsCsrfFilter(csrfProperties, tokenRepository);
+    filter.doFilter(handshakeRequest);
+
+    verify(tokenRepository).saveToken(csrfToken, handshakeRequest);
+  }
+
+  @Test
+  void givenDifferentActualToken_whenDoFilter_thenThrowsException() {
+    csrfProperties.setEnabled(true);
+    WsCsrfToken csrfToken = new DefaultWsCsrfToken("some-token", "_csrf");
+    when(tokenRepository.loadToken(handshakeRequest)).thenReturn(csrfToken);
+    when(handshakeRequest.getParameterMap())
+        .thenReturn(Map.of("_csrf", List.of("different-token")));
+
+    WsCsrfFilter filter = new WsCsrfFilter(csrfProperties, tokenRepository);
+    assertThatThrownBy(() -> filter.doFilter(handshakeRequest))
+        .isInstanceOf(IllegalStateException.class)
+        .hasMessage(
+            "Invalid CSRF Token 'different-token' was found on the request parameter '_csrf'.");
+  }
+
+  @Test
+  void givenSameToken_whenDoFilter_thenDoesNotThrow() {
+    csrfProperties.setEnabled(true);
+    WsCsrfToken csrfToken = new DefaultWsCsrfToken("some-token", "_csrf");
+    when(tokenRepository.loadToken(handshakeRequest)).thenReturn(csrfToken);
+    when(handshakeRequest.getParameterMap())
+        .thenReturn(Map.of("_csrf", List.of("some-token")));
+
+    WsCsrfFilter filter = new WsCsrfFilter(csrfProperties, tokenRepository);
+    assertDoesNotThrow(() -> filter.doFilter(handshakeRequest));
+
+    verify(tokenRepository).loadToken(handshakeRequest);
+  }
+}

graphql-spring-boot-autoconfigure/src/test/java/graphql/kickstart/autoconfigure/web/servlet/WsSessionCsrfTokenRepositoryTest.java

@@ -0,0 +1,72 @@
+package graphql.kickstart.autoconfigure.web.servlet;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.junit.jupiter.api.Assertions.*;
+import static org.mockito.Mockito.verify;
+import static org.mockito.Mockito.when;
+
+import jakarta.servlet.http.HttpSession;
+import jakarta.websocket.server.HandshakeRequest;
+import java.util.UUID;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.extension.ExtendWith;
+import org.mockito.Mock;
+import org.mockito.junit.jupiter.MockitoExtension;
+
+@ExtendWith(MockitoExtension.class)
+class WsSessionCsrfTokenRepositoryTest {
+
+  public static final String TOKEN_SESSION_ATTRIBUTE_NAME =
+      "org.springframework.security.web.csrf.HttpSessionCsrfTokenRepository.CSRF_TOKEN";
+  @Mock private HandshakeRequest handshakeRequest;
+  @Mock private HttpSession httpSession;
+  @Mock private WsCsrfToken csrfToken;
+  private WsSessionCsrfTokenRepository tokenRepository = new WsSessionCsrfTokenRepository();
+
+  @Test
+  void givenNoSession_whenSaveToken_thenDoesNotThrow() {
+    when(handshakeRequest.getHttpSession()).thenReturn(null);
+    assertDoesNotThrow(() -> tokenRepository.saveToken(csrfToken, handshakeRequest));
+  }
+
+  @Test
+  void givenNoToken_whenSaveToken_thenRemovesFromSession() {
+    when(handshakeRequest.getHttpSession()).thenReturn(httpSession);
+    tokenRepository.saveToken(null, handshakeRequest);
+    verify(httpSession).removeAttribute(TOKEN_SESSION_ATTRIBUTE_NAME);
+  }
+
+  @Test
+  void givenToken_whenSaveToken_thenSetsInSession() {
+    when(handshakeRequest.getHttpSession()).thenReturn(httpSession);
+    tokenRepository.saveToken(csrfToken, handshakeRequest);
+    verify(httpSession).setAttribute(TOKEN_SESSION_ATTRIBUTE_NAME, csrfToken);
+  }
+
+  @Test
+  void givenNoSession_whenLoadToken_thenReturnNull() {
+    when(handshakeRequest.getHttpSession()).thenReturn(null);
+    WsCsrfToken csrfToken = tokenRepository.loadToken(handshakeRequest);
+    assertThat(csrfToken).isNull();
+  }
+
+  @Test
+  void givenTokenInSession_whenLoadToken_thenReturnTokenFromSession() {
+    when(handshakeRequest.getHttpSession()).thenReturn(httpSession);
+    when(httpSession.getAttribute(TOKEN_SESSION_ATTRIBUTE_NAME)).thenReturn(csrfToken);
+    WsCsrfToken loadedToken = tokenRepository.loadToken(handshakeRequest);
+    assertThat(loadedToken).isEqualTo(csrfToken);
+  }
+
+  @Test
+  void whenGenerateToken_thenContainsUUID() {
+    var generatedToken = tokenRepository.generateToken(handshakeRequest);
+    assertDoesNotThrow(() -> UUID.fromString(generatedToken.getToken()));
+  }
+
+  @Test
+  void whenGenerateToken_thenContainsCorrectParameterName() {
+    var generatedToken = tokenRepository.generateToken(handshakeRequest);
+    assertThat(generatedToken.getParameterName()).isEqualTo("_csrf");
+  }
+}