From 1d47910d3b1a012504802cfc45a026e5c45d57a9 Mon Sep 17 00:00:00 2001 From: Eugen Date: Wed, 19 Apr 2017 17:28:35 +0200 Subject: Fix possibility of unrightful webfinger redirect (#2147) * Fix possibility of unrightful webfinger redirect * Add more tests for FollowRemoteAccountService --- .../services/follow_remote_account_service_spec.rb | 37 ++++++++++++++++++---- 1 file changed, 31 insertions(+), 6 deletions(-) (limited to 'spec/services') diff --git a/spec/services/follow_remote_account_service_spec.rb b/spec/services/follow_remote_account_service_spec.rb index 27df76457..a8d4a7c6b 100644 --- a/spec/services/follow_remote_account_service_spec.rb +++ b/spec/services/follow_remote_account_service_spec.rb @@ -3,10 +3,35 @@ require 'rails_helper' RSpec.describe FollowRemoteAccountService do subject { FollowRemoteAccountService.new } - it 'returns nil if no such user can be resolved via webfinger' - it 'returns nil if the domain does not have webfinger' - it 'returns nil if remote user does not offer a hub URL' - it 'returns an already existing remote account' - it 'returns a new remote account' - it 'fills the remote account with profile information' + before do + stub_request(:get, "https://quitter.no/.well-known/host-meta").to_return(request_fixture('.host-meta.txt')) + stub_request(:get, "https://example.com/.well-known/host-meta").to_return(status: 404) + stub_request(:get, "https://quitter.no/.well-known/webfinger?resource=acct:gargron@quitter.no").to_return(request_fixture('webfinger.txt')) + stub_request(:get, "https://quitter.no/.well-known/webfinger?resource=acct:catsrgr8@quitter.no").to_return(status: 404) + stub_request(:get, "https://quitter.no/api/statuses/user_timeline/7477.atom").to_return(request_fixture('feed.txt')) + stub_request(:get, "https://quitter.no/avatar/7477-300-20160211190340.png").to_return(request_fixture('avatar.txt')) + end + + it 'raises error if no such user can be resolved via webfinger' do + expect { subject.call('catsrgr8@quitter.no') }.to raise_error Goldfinger::Error + end + + it 'raises error if the domain does not have webfinger' do + expect { subject.call('catsrgr8@example.com') }.to raise_error Goldfinger::Error + end + + it 'returns an already existing remote account' do + old_account = Fabricate(:account, username: 'gargron', domain: 'quitter.no') + returned_account = subject.call('gargron@quitter.no') + + expect(old_account.id).to eq returned_account.id + end + + it 'returns a new remote account' do + account = subject.call('gargron@quitter.no') + + expect(account.username).to eq 'gargron' + expect(account.domain).to eq 'quitter.no' + expect(account.remote_url).to eq 'https://quitter.no/api/statuses/user_timeline/7477.atom' + end end -- cgit