Commit 9acadf4d authored by Philip Cunningham's avatar Philip Cunningham Committed by Jan Provaznik

Validate URL addressable for DAST runner context

parent ca455230
...@@ -5,7 +5,10 @@ class DastSite < ApplicationRecord ...@@ -5,7 +5,10 @@ class DastSite < ApplicationRecord
belongs_to :dast_site_validation belongs_to :dast_site_validation
has_many :dast_site_profiles has_many :dast_site_profiles
validates :url, length: { maximum: 255 }, uniqueness: { scope: :project_id }, public_url: true validates :url, length: { maximum: 255 }, uniqueness: { scope: :project_id }
validates :url, addressable_url: true, if: :runner_validation_enabled?
validates :url, public_url: true, unless: :runner_validation_enabled?
validates :project_id, presence: true validates :project_id, presence: true
validate :dast_site_validation_project_id_fk validate :dast_site_validation_project_id_fk
...@@ -18,4 +21,8 @@ class DastSite < ApplicationRecord ...@@ -18,4 +21,8 @@ class DastSite < ApplicationRecord
errors.add(:project_id, 'does not match dast_site_validation.project') errors.add(:project_id, 'does not match dast_site_validation.project')
end end
end end
def runner_validation_enabled?
::Feature.enabled?(:dast_runner_site_validation, project, default_enabled: :yaml)
end
end end
...@@ -3,7 +3,9 @@ ...@@ -3,7 +3,9 @@
require 'spec_helper' require 'spec_helper'
RSpec.describe DastSite, type: :model do RSpec.describe DastSite, type: :model do
subject { create(:dast_site) } let_it_be(:project) { create(:project) }
subject { create(:dast_site, project: project) }
describe 'associations' do describe 'associations' do
it { is_expected.to belong_to(:project) } it { is_expected.to belong_to(:project) }
...@@ -32,11 +34,26 @@ RSpec.describe DastSite, type: :model do ...@@ -32,11 +34,26 @@ RSpec.describe DastSite, type: :model do
end end
context 'when the url is not public' do context 'when the url is not public' do
subject { build(:dast_site, url: 'http://127.0.0.1') } let_it_be(:message) { 'Url is blocked: Requests to localhost are not allowed' }
it 'is not valid' do subject { build(:dast_site, project: project, url: 'http://127.0.0.1') }
expect(subject.valid?).to be_falsey
expect(subject.errors.full_messages).to include('Url is blocked: Requests to localhost are not allowed') context 'worker validation' do
before do
stub_feature_flags(dast_runner_site_validation: false)
end
it 'is not valid', :aggregate_failures do
expect(subject).not_to be_valid
expect(subject.errors.full_messages).to include(message)
end
end
context 'runner validation' do
it 'is is valid', :aggregate_failures do
expect(subject).to be_valid
expect(subject.errors.full_messages).not_to include(message)
end
end end
end end
end end
......
...@@ -37,6 +37,7 @@ RSpec.describe 'Creating a DAST Site Profile' do ...@@ -37,6 +37,7 @@ RSpec.describe 'Creating a DAST Site Profile' do
end end
it_behaves_like 'an on-demand scan mutation when user cannot run an on-demand scan' it_behaves_like 'an on-demand scan mutation when user cannot run an on-demand scan'
it_behaves_like 'an on-demand scan mutation when user can run an on-demand scan' do it_behaves_like 'an on-demand scan mutation when user can run an on-demand scan' do
it 'updates the dast_site_profile' do it 'updates the dast_site_profile' do
subject subject
...@@ -49,10 +50,17 @@ RSpec.describe 'Creating a DAST Site Profile' do ...@@ -49,10 +50,17 @@ RSpec.describe 'Creating a DAST Site Profile' do
end end
end end
context 'when there is an issue updating the dast_site_profile' do context 'when there is a validation error' do
let(:new_target_url) { 'http://localhost:3000' } before do
allow(dast_site_profile).to receive(:valid?).and_return(false)
allow(dast_site_profile).to receive_message_chain(:errors, :full_messages).and_return(['There was a validation error'])
allow_next_instance_of(DastSiteProfilesFinder) do |instance|
allow(instance).to receive_message_chain(:execute, :first!).and_return(dast_site_profile)
end
end
it_behaves_like 'a mutation that returns errors in the response', errors: ['Url is blocked: Requests to localhost are not allowed'] it_behaves_like 'a mutation that returns errors in the response', errors: ['There was a validation error']
end end
context 'when the dast_site_profile does not exist' do context 'when the dast_site_profile does not exist' do
......
...@@ -36,7 +36,6 @@ RSpec.describe AppSec::Dast::SiteProfiles::CreateService do ...@@ -36,7 +36,6 @@ RSpec.describe AppSec::Dast::SiteProfiles::CreateService do
let(:status) { subject.status } let(:status) { subject.status }
let(:message) { subject.message } let(:message) { subject.message }
let(:errors) { subject.errors }
let(:payload) { subject.payload } let(:payload) { subject.payload }
context 'when a user does not have access to the project' do context 'when a user does not have access to the project' do
...@@ -111,18 +110,6 @@ RSpec.describe AppSec::Dast::SiteProfiles::CreateService do ...@@ -111,18 +110,6 @@ RSpec.describe AppSec::Dast::SiteProfiles::CreateService do
end end
end end
context 'when the target url is localhost' do
let(:target_url) { 'http://localhost:3000/hello-world' }
it 'returns an error status' do
expect(status).to eq(:error)
end
it 'populates errors' do
expect(errors).to include('Url is blocked: Requests to localhost are not allowed')
end
end
context 'when excluded_urls is nil' do context 'when excluded_urls is nil' do
let(:excluded_urls) { nil } let(:excluded_urls) { nil }
......
...@@ -113,18 +113,6 @@ RSpec.describe AppSec::Dast::SiteProfiles::UpdateService do ...@@ -113,18 +113,6 @@ RSpec.describe AppSec::Dast::SiteProfiles::UpdateService do
end end
end end
context 'when the target url is localhost' do
let(:new_target_url) { 'http://localhost:3000/hello-world' }
it 'returns an error status' do
expect(status).to eq(:error)
end
it 'populates errors' do
expect(errors).to include('Url is blocked: Requests to localhost are not allowed')
end
end
context 'when the target url is nil' do context 'when the target url is nil' do
let(:params) { default_params.merge(target_url: nil) } let(:params) { default_params.merge(target_url: nil) }
......
...@@ -49,12 +49,12 @@ RSpec.describe DastSites::FindOrCreateService do ...@@ -49,12 +49,12 @@ RSpec.describe DastSites::FindOrCreateService do
end end
end end
context 'when the target url is localhost' do context 'when the record is invalid' do
let(:url) { 'http://localhost:3000/hello-world' } let(:url) { 'i-am-not-a-url' }
it 'raises an exception' do it 'raises an exception' do
expect { subject }.to raise_error(ActiveRecord::RecordInvalid) do |err| expect { subject }.to raise_error(ActiveRecord::RecordInvalid) do |err|
expect(err.record.errors.full_messages).to include('Url is blocked: Requests to localhost are not allowed') expect(err.record.errors.full_messages).to include('Url is blocked: Only allowed schemes are http, https')
end end
end end
end end
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment