From cd9e0d7509e3484b1b006f78537253bfe0d476fa Mon Sep 17 00:00:00 2001 From: Elias Nahum Date: Wed, 27 Sep 2023 12:18:56 +0300 Subject: [PATCH] fix mobile oauth tests (#24610) * fix mobile oauth tests * update test description --------- Co-authored-by: Mattermost Build --- server/channels/web/oauth_test.go | 22 +++++++++++++--------- 1 file changed, 13 insertions(+), 9 deletions(-) diff --git a/server/channels/web/oauth_test.go b/server/channels/web/oauth_test.go index 838048fa9d..1d0cde142f 100644 --- a/server/channels/web/oauth_test.go +++ b/server/channels/web/oauth_test.go @@ -404,7 +404,7 @@ func TestMobileLoginWithOAuth(t *testing.T) { var siteURL = "http://localhost:8065" th.App.UpdateConfig(func(cfg *model.Config) { *cfg.ServiceSettings.SiteURL = siteURL - cfg.NativeAppSettings.AppCustomURLSchemes = append(cfg.NativeAppSettings.AppCustomURLSchemes, "mmauth://") + *cfg.GitLabSettings.Enable = true }) translationFunc := i18n.GetUserTranslations("en") @@ -413,36 +413,40 @@ func TestMobileLoginWithOAuth(t *testing.T) { provider := &MattermostTestProvider{} einterfaces.RegisterOAuthProvider(model.ServiceGitlab, provider) - t.Run("Should include redirect URL in the output when valid URL Scheme is passed", func(t *testing.T) { + t.Run("Should redirect to the SSO login page when valid URL Scheme is passed as redirect_to parameter", func(t *testing.T) { responseWriter := httptest.NewRecorder() request, _ := http.NewRequest(http.MethodGet, th.App.GetSiteURL()+"/oauth/gitlab/mobile_login?redirect_to="+url.QueryEscape("mmauth://"), nil) mobileLoginWithOAuth(c, responseWriter, request) - assert.Contains(t, responseWriter.Body.String(), "mmauth://") + assert.Equal(t, responseWriter.Code, 302) assert.NotContains(t, responseWriter.Body.String(), siteURL) }) t.Run("Should include SiteURL in the output when invalid URL Scheme is passed", func(t *testing.T) { + einterfaces.RegisterOAuthProvider(model.ServiceGitlab, provider) responseWriter := httptest.NewRecorder() request, _ := http.NewRequest(http.MethodGet, th.App.GetSiteURL()+"/oauth/gitlab/mobile_login?redirect_to="+url.QueryEscape("randomScheme://"), nil) mobileLoginWithOAuth(c, responseWriter, request) - assert.NotContains(t, responseWriter.Body.String(), "randomScheme://") - assert.Contains(t, responseWriter.Body.String(), siteURL) + body := responseWriter.Body.String() + assert.NotContains(t, body, "randomScheme://") + assert.Contains(t, body, siteURL) }) t.Run("Should not include the redirect URL consisting of javascript protocol", func(t *testing.T) { responseWriter := httptest.NewRecorder() request, _ := http.NewRequest(http.MethodGet, th.App.GetSiteURL()+"/oauth/gitlab/mobile_login?redirect_to="+url.QueryEscape("javascript:alert('hello')"), nil) mobileLoginWithOAuth(c, responseWriter, request) - assert.NotContains(t, responseWriter.Body.String(), "javascript:alert('hello')") - assert.Contains(t, responseWriter.Body.String(), siteURL) + body := responseWriter.Body.String() + assert.NotContains(t, body, "javascript:alert('hello')") + assert.Contains(t, body, siteURL) }) t.Run("Should not include the redirect URL consisting of javascript protocol in mixed case", func(t *testing.T) { responseWriter := httptest.NewRecorder() request, _ := http.NewRequest(http.MethodGet, th.App.GetSiteURL()+"/oauth/gitlab/mobile_login?redirect_to="+url.QueryEscape("JaVasCript:alert('hello')"), nil) mobileLoginWithOAuth(c, responseWriter, request) - assert.NotContains(t, responseWriter.Body.String(), "JaVasCript:alert('hello')") - assert.Contains(t, responseWriter.Body.String(), siteURL) + body := responseWriter.Body.String() + assert.NotContains(t, body, "JaVasCript:alert('hello')") + assert.Contains(t, body, siteURL) }) }