This commit is contained in:
Ajay Ramachandran
2021-06-28 13:24:04 -04:00
8 changed files with 558 additions and 24 deletions

View File

@@ -3,20 +3,20 @@ import {db} from '../../src/databases/databases';
import {Done, getbaseURL} from '../utils';
import {getHash} from '../../src/utils/getHash';
const ENOENTID = "0000000000000000000000000000000000000000000000000000000000000000"
const upvotedID = "a000000000000000000000000000000000000000000000000000000000000000"
const downvotedID = "b000000000000000000000000000000000000000000000000000000000000000"
const lockedupID = "c000000000000000000000000000000000000000000000000000000000000000"
const infvotesID = "d000000000000000000000000000000000000000000000000000000000000000"
const shadowhiddenID = "e000000000000000000000000000000000000000000000000000000000000000"
const lockeddownID = "f000000000000000000000000000000000000000000000000000000000000000"
const hiddenID = "1000000000000000000000000000000000000000000000000000000000000000"
const fillerID1 = "1100000000000000000000000000000000000000000000000000000000000000"
const fillerID2 = "1200000000000000000000000000000000000000000000000000000000000000"
const fillerID3 = "1300000000000000000000000000000000000000000000000000000000000000"
const fillerID4 = "1400000000000000000000000000000000000000000000000000000000000000"
const fillerID5 = "1500000000000000000000000000000000000000000000000000000000000000"
const oldID = "a0000000-0000-0000-0000-000000000000"
const ENOENTID = "0".repeat(64);
const upvotedID = "a"+"0".repeat(63);
const downvotedID = "b"+"0".repeat(63);
const lockedupID = "c"+"0".repeat(63);
const infvotesID = "d"+"0".repeat(63);
const shadowhiddenID = "e"+"0".repeat(63);
const lockeddownID = "f"+"0".repeat(63);
const hiddenID = "1"+"0".repeat(63);
const fillerID1 = "11"+"0".repeat(62);
const fillerID2 = "12"+"0".repeat(62);
const fillerID3 = "13"+"0".repeat(62);
const fillerID4 = "14"+"0".repeat(62);
const fillerID5 = "15"+"0".repeat(62);
const oldID = `${'0'.repeat(8)}-${'0000-'.repeat(3)}${'0'.repeat(12)}`;
describe('getSegmentInfo', () => {
before(async () => {

403
test/cases/getUserID.ts Normal file
View File

@@ -0,0 +1,403 @@
import fetch from 'node-fetch';
import {Done, getbaseURL} from '../utils';
import {db} from '../../src/databases/databases';
import {getHash} from '../../src/utils/getHash';
describe('getUserID', () => {
before(async () => {
const insertUserNameQuery = 'INSERT INTO "userNames" ("userID", "userName") VALUES(?, ?)';
await db.prepare("run", insertUserNameQuery, [getHash("getuserid_user_01"), 'fuzzy user 01']);
await db.prepare("run", insertUserNameQuery, [getHash("getuserid_user_02"), 'fuzzy user 02']);
await db.prepare("run", insertUserNameQuery, [getHash("getuserid_user_03"), 'specific user 03']);
await db.prepare("run", insertUserNameQuery, [getHash("getuserid_user_04"), 'repeating']);
await db.prepare("run", insertUserNameQuery, [getHash("getuserid_user_05"), 'repeating']);
await db.prepare("run", insertUserNameQuery, [getHash("getuserid_user_06"), getHash("getuserid_user_06")]);
await db.prepare("run", insertUserNameQuery, [getHash("getuserid_user_07"), '0redos0']);
await db.prepare("run", insertUserNameQuery, [getHash("getuserid_user_08"), '%redos%']);
await db.prepare("run", insertUserNameQuery, [getHash("getuserid_user_09"), '_redos_']);
await db.prepare("run", insertUserNameQuery, [getHash("getuserid_user_10"), 'redos\\%']);
await db.prepare("run", insertUserNameQuery, [getHash("getuserid_user_11"), '\\\\\\']);
await db.prepare("run", insertUserNameQuery, [getHash("getuserid_user_12"), 'a']);
});
it('Should be able to get a 200', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username=fuzzy+user+01')
.then(async res => {
const text = await res.text()
if (res.status !== 200) done('non 200 (' + res.status + ')');
else done(); // pass
})
.catch(err => done('couldn\'t call endpoint'));
});
it('Should be able to get a 400 (No username parameter)', (done: Done) => {
fetch(getbaseURL() + '/api/userID')
.then(res => {
if (res.status !== 400) done('non 400 (' + res.status + ')');
else done(); // pass
})
.catch(err => done('couldn\'t call endpoint'));
});
it('Should be able to get a 200 (username is public id)', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username='+getHash("getuserid_user_06"))
.then(async res => {
const text = await res.text()
if (res.status !== 200) done('non 200 (' + res.status + ')');
else done(); // pass
})
.catch(err => done('couldn\'t call endpoint'));
});
it('Should be able to get a 400 (username longer than 64 chars)', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username='+getHash("getuserid_user_06")+'0')
.then(res => {
if (res.status !== 400) done('non 400 (' + res.status + ')');
else done(); // pass
})
.catch(err => done('couldn\'t call endpoint'));
});
it('Should be able to get single username', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username=fuzzy+user+01')
.then(async res => {
if (res.status !== 200) {
done("non 200");
} else {
const data = await res.json();
if (data.length !== 1) {
done('Returned incorrect number of users "' + data.length + '"');
} else if (data[0].userName !== "fuzzy user 01") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[0].userID !== getHash("getuserid_user_01")) {
done('Returned incorrect userID "' + data.userID + '"');
} else {
done(); // pass
}
}
})
.catch(err => ("couldn't call endpoint"));
});
it('Should be able to get multiple fuzzy user info from start', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username=fuzzy+user')
.then(async res => {
if (res.status !== 200) {
done("non 200");
} else {
const data = await res.json();
if (data.length !== 2) {
done('Returned incorrect number of users "' + data.length + '"');
} else if (data[0].userName !== "fuzzy user 01") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[0].userID !== getHash("getuserid_user_01")) {
done('Returned incorrect userID "' + data.userID + '"');
} else if (data[1].userName !== "fuzzy user 02") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[1].userID !== getHash("getuserid_user_02")) {
done('Returned incorrect userID "' + data.userID + '"');
} else {
done(); // pass
}
}
})
.catch(err => ("couldn't call endpoint"));
});
it('Should be able to get multiple fuzzy user info from middle', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username=user')
.then(async res => {
if (res.status !== 200) {
done("non 200");
} else {
const data = await res.json();
if (data.length !== 3) {
done('Returned incorrect number of users "' + data.length + '"');
} else if (data[0].userName !== "fuzzy user 01") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[0].userID !== getHash("getuserid_user_01")) {
done('Returned incorrect userID "' + data.userID + '"');
} else if (data[1].userName !== "fuzzy user 02") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[1].userID !== getHash("getuserid_user_02")) {
done('Returned incorrect userID "' + data.userID + '"');
} else if (data[2].userName !== "specific user 03") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[2].userID !== getHash("getuserid_user_03")) {
done('Returned incorrect userID "' + data.userID + '"');
} else {
done(); // pass
}
}
})
.catch(err => ("couldn't call endpoint"));
});
it('Should be able to get with public ID', (done: Done) => {
const userID = getHash("getuserid_user_06");
fetch(getbaseURL() + '/api/userID?username='+userID)
.then(async res => {
if (res.status !== 200) {
done("non 200");
} else {
const data = await res.json();
if (data.length !== 1) {
done('Returned incorrect number of users "' + data.length + '"');
} else if (data[0].userName !== userID) {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[0].userID !== userID) {
done('Returned incorrect userID "' + data.userID + '"');
} else {
done(); // pass
}
}
})
.catch(err => ("couldn't call endpoint"));
});
it('Should be able to get with fuzzy public ID', (done: Done) => {
const userID = getHash("getuserid_user_06");
fetch(getbaseURL() + '/api/userID?username='+userID.substr(10,60))
.then(async res => {
if (res.status !== 200) {
done("non 200");
} else {
const data = await res.json();
if (data.length !== 1) {
done('Returned incorrect number of users "' + data.length + '"');
} else if (data[0].userName !== userID) {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[0].userID !== userID) {
done('Returned incorrect userID "' + data.userID + '"');
} else {
done(); // pass
}
}
})
.catch(err => ("couldn't call endpoint"));
});
it('Should be able to get repeating username', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username=repeating')
.then(async res => {
if (res.status !== 200) {
done("non 200");
} else {
const data = await res.json();
if (data.length !== 2) {
done('Returned incorrect number of users "' + data.length + '"');
} else if (data[0].userName !== "repeating") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[0].userID !== getHash("getuserid_user_04")) {
done('Returned incorrect userID "' + data.userID + '"');
} else if (data[1].userName !== "repeating") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[1].userID !== getHash("getuserid_user_05")) {
done('Returned incorrect userID "' + data.userID + '"');
} else {
done(); // pass
}
}
})
.catch(err => ("couldn't call endpoint"));
});
it('Should be able to get repeating fuzzy username', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username=peat')
.then(async res => {
if (res.status !== 200) {
done("non 200");
} else {
const data = await res.json();
if (data.length !== 2) {
done('Returned incorrect number of users "' + data.length + '"');
} else if (data[0].userName !== "repeating") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[0].userID !== getHash("getuserid_user_04")) {
done('Returned incorrect userID "' + data.userID + '"');
} else if (data[1].userName !== "repeating") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[1].userID !== getHash("getuserid_user_05")) {
done('Returned incorrect userID "' + data.userID + '"');
} else {
done(); // pass
}
}
})
.catch(err => ("couldn't call endpoint"));
});
it('should avoid ReDOS with _', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username=_redos_')
.then(async res => {
if (res.status !== 200) {
done("non 200");
} else {
const data = await res.json();
if (data.length !== 1) {
done('Returned incorrect number of users "' + data.length + '"');
} else if (data[0].userName !== "_redos_") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[0].userID !== getHash("getuserid_user_09")) {
done('Returned incorrect userID "' + data.userID + '"');
} else {
done(); // pass
}
}
})
.catch(err => ("couldn't call endpoint"));
});
it('should avoid ReDOS with %', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username=%redos%')
.then(async res => {
if (res.status !== 200) {
done("non 200");
} else {
const data = await res.json();
if (data.length !== 1) {
done('Returned incorrect number of users "' + data.length + '"');
} else if (data[0].userName !== "%redos%") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[0].userID !== getHash("getuserid_user_08")) {
done('Returned incorrect userID "' + data.userID + '"');
} else {
done(); // pass
}
}
})
.catch(err => ("couldn't call endpoint"));
});
it('should return 404 if escaped backslashes present', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username=%redos\\\\_')
.then(res => {
if (res.status !== 404) done('non 404 (' + res.status + ')');
else done(); // pass
})
.catch(err => ("couldn't call endpoint"));
});
it('should return 404 if backslashes present', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username=\\%redos\\_')
.then(res => {
if (res.status !== 404) done('non 404 (' + res.status + ')');
else done(); // pass
})
.catch(err => ("couldn't call endpoint"));
});
it('should return user if just backslashes', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username=\\\\\\')
.then(async res => {
if (res.status !== 200) {
done("non 200");
} else {
const data = await res.json();
if (data.length !== 1) {
done('Returned incorrect number of users "' + data.length + '"');
} else if (data[0].userName !== "\\\\\\") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[0].userID !== getHash("getuserid_user_11")) {
done('Returned incorrect userID "' + data.userID + '"');
} else {
done(); // pass
}
}
})
.catch(err => ("couldn't call endpoint"));
});
it('should not allow usernames more than 64 characters', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username='+'0'.repeat(65))
.then(res => {
if (res.status !== 400) done('non 400 (' + res.status + ')');
else done(); // pass
})
.catch(err => ("couldn't call endpoint"));
});
it('should not allow usernames less than 3 characters', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username=aa')
.then(res => {
if (res.status !== 400) done('non 400 (' + res.status + ')');
else done(); // pass
})
.catch(err => ("couldn't call endpoint"));
});
it('should allow exact match', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username=a&exact=true')
.then(async res => {
if (res.status !== 200) {
done("non 200");
} else {
const data = await res.json();
if (data.length !== 1) {
done('Returned incorrect number of users "' + data.length + '"');
} else if (data[0].userName !== "a") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[0].userID !== getHash("getuserid_user_12")) {
done('Returned incorrect userID "' + data.userID + '"');
} else {
done(); // pass
}
}
})
.catch(err => ("couldn't call endpoint"));
});
it('Should be able to get repeating username with exact username', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username=repeating&exact=true')
.then(async res => {
if (res.status !== 200) {
done("non 200");
} else {
const data = await res.json();
if (data.length !== 2) {
done('Returned incorrect number of users "' + data.length + '"');
} else if (data[0].userName !== "repeating") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[0].userID !== getHash("getuserid_user_04")) {
done('Returned incorrect userID "' + data.userID + '"');
} else if (data[1].userName !== "repeating") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[1].userID !== getHash("getuserid_user_05")) {
done('Returned incorrect userID "' + data.userID + '"');
} else {
done(); // pass
}
}
})
.catch(err => ("couldn't call endpoint"));
});
it('Should not get exact unless explicitly set to true', (done: Done) => {
fetch(getbaseURL() + '/api/userID?username=user&exact=1')
.then(async res => {
if (res.status !== 200) {
done("non 200");
} else {
const data = await res.json();
if (data.length !== 3) {
done('Returned incorrect number of users "' + data.length + '"');
} else if (data[0].userName !== "fuzzy user 01") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[0].userID !== getHash("getuserid_user_01")) {
done('Returned incorrect userID "' + data.userID + '"');
} else if (data[1].userName !== "fuzzy user 02") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[1].userID !== getHash("getuserid_user_02")) {
done('Returned incorrect userID "' + data.userID + '"');
} else if (data[2].userName !== "specific user 03") {
done('Returned incorrect username "' + data.userName + '"');
} else if (data[2].userID !== getHash("getuserid_user_03")) {
done('Returned incorrect userID "' + data.userID + '"');
} else {
done(); // pass
}
}
})
.catch(err => ("couldn't call endpoint"));
});
});

View File

@@ -1,6 +1,6 @@
import fetch from 'node-fetch';
import { Done, getbaseURL } from '../utils';
import { db } from '../../src/databases/databases';
import { db, privateDB } from '../../src/databases/databases';
import { getHash } from '../../src/utils/getHash';
const adminPrivateUserID = 'testUserId';
@@ -21,6 +21,7 @@ const username07 = 'Username 07';
async function addUsername(userID: string, userName: string, locked = 0) {
await db.prepare('run', 'INSERT INTO "userNames" ("userID", "userName", "locked") VALUES(?, ?, ?)', [userID, userName, locked]);
await addLogUserNameChange(userID, userName);
}
async function getUsernameInfo(userID: string): Promise<{ userName: string, locked: string }> {
@@ -31,6 +32,40 @@ async function getUsernameInfo(userID: string): Promise<{ userName: string, lock
return row;
}
async function addLogUserNameChange(userID: string, newUserName: string, oldUserName: string = '') {
privateDB.prepare('run',
`INSERT INTO "userNameLogs"("userID", "newUserName", "oldUserName", "updatedAt", "updatedByAdmin") VALUES(?, ?, ?, ?, ?)`,
[getHash(userID), newUserName, oldUserName, new Date().getTime(), + true]
);
}
async function getLastLogUserNameChange(userID: string) {
return privateDB.prepare('get', `SELECT * FROM "userNameLogs" WHERE "userID" = ? ORDER BY "updatedAt" DESC LIMIT 1`, [getHash(userID)]);
}
function wellFormatUserName(userName: string) {
return userName.replace(/[\u0000-\u001F\u007F-\u009F]/g, '');
}
async function testUserNameChangelog(userID: string, newUserName: string, oldUserName: string, byAdmin: boolean, done: Done) {
const log = await getLastLogUserNameChange(userID);
if (newUserName !== log.newUserName) {
return done(`UserID '${userID}' incorrect log on newUserName: ${newUserName} !== ${log.newUserName}`);
}
if (oldUserName !== log.oldUserName) {
return done(`UserID '${userID}' incorrect log on oldUserName: ${oldUserName} !== ${log.oldUserName}`);
}
if (byAdmin !== Boolean(log.updatedByAdmin)) {
return done(`UserID '${userID}' incorrect log on updatedByAdmin: ${byAdmin} !== ${log.updatedByAdmin}`);
}
return done();
}
describe('setUsername', () => {
before(async () => {
await addUsername(getHash(user01PrivateUserID), username01, 0);
@@ -46,9 +81,11 @@ describe('setUsername', () => {
fetch(`${getbaseURL()}/api/setUsername?userID=${user01PrivateUserID}&username=Changed%20Username`, {
method: 'POST',
})
.then(res => {
.then(async res => {
if (res.status !== 200) done(`Status code was ${res.status}`);
else done(); // pass
else {
testUserNameChangelog(user01PrivateUserID, decodeURIComponent('Changed%20Username'), username01, false, done);
}
})
.catch(err => done(`couldn't call endpoint`));
});
@@ -114,7 +151,7 @@ describe('setUsername', () => {
const usernameInfo = await getUsernameInfo(getHash(user03PrivateUserID));
if (usernameInfo.userName !== newUsername) done(`Username did not change`);
if (usernameInfo.locked == "1") done(`Username was locked when it shouldn't have been`);
else done();
testUserNameChangelog(user03PrivateUserID, newUsername, username03, false, done);
})
.catch(err => done(`couldn't call endpoint`));
});
@@ -141,7 +178,7 @@ describe('setUsername', () => {
.then(async res => {
const usernameInfo = await getUsernameInfo(getHash(user05PrivateUserID));
if (usernameInfo.userName === newUsername) done(`Username contains unicode control characters`);
else done();
testUserNameChangelog(user05PrivateUserID, wellFormatUserName(newUsername), username05, false, done);
})
.catch(err => done(`couldn't call endpoint`));
});
@@ -167,7 +204,7 @@ describe('setUsername', () => {
const usernameInfo = await getUsernameInfo(getHash(user06PrivateUserID));
if (usernameInfo.userName !== newUsername) done(`Failed to change username from '${username06}' to '${newUsername}'`);
if (usernameInfo.locked == "0") done(`Username was not locked`);
else done();
else testUserNameChangelog(user06PrivateUserID, newUsername, username06, true, done);
})
.catch(err => done(`couldn't call endpoint`));
});
@@ -181,7 +218,7 @@ describe('setUsername', () => {
const usernameInfo = await getUsernameInfo(getHash(user06PrivateUserID));
if (usernameInfo.userName !== newUsername) done(`Failed to change username from '${username06}' to '${newUsername}'`);
if (usernameInfo.locked == "0") done(`Username was unlocked when it shouldn't have been`);
else done();
else testUserNameChangelog(user07PrivateUserID, newUsername, username07, true, done);
})
.catch(err => done(`couldn't call endpoint`));
});