SEC-2325 Added JSP tags for CSRF meta tags and form fields

taglibs/src/test/java/org/springframework/security/taglibs/csrf/AbstractCsrfTagTests.java

@@ -0,0 +1,91 @@
+package org.springframework.security.taglibs.csrf;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.springframework.mock.web.MockHttpServletRequest;
+import org.springframework.mock.web.MockHttpServletResponse;
+import org.springframework.mock.web.MockPageContext;
+import org.springframework.mock.web.MockServletContext;
+import org.springframework.security.web.csrf.CsrfToken;
+import org.springframework.security.web.csrf.DefaultCsrfToken;
+
+import javax.servlet.jsp.JspException;
+import javax.servlet.jsp.tagext.TagSupport;
+
+import java.io.UnsupportedEncodingException;
+
+import static org.junit.Assert.*;
+
+/**
+ * @author Nick Williams
+ */
+public class AbstractCsrfTagTests {
+
+    public MockTag tag;
+    private MockHttpServletRequest request;
+    private MockHttpServletResponse response;
+
+    @Before
+    public void setUp() {
+        MockServletContext servletContext = new MockServletContext();
+        this.request = new MockHttpServletRequest(servletContext);
+        this.response = new MockHttpServletResponse();
+        MockPageContext pageContext = new MockPageContext(servletContext, this.request, this.response);
+        this.tag = new MockTag();
+        this.tag.setPageContext(pageContext);
+    }
+
+    @Test
+    public void testDoEndTag01() throws JspException, UnsupportedEncodingException {
+
+        this.tag.handleReturn = "fooBarBazQux";
+
+        int returned = this.tag.doEndTag();
+
+        assertEquals("The returned value is not correct.", TagSupport.EVAL_PAGE, returned);
+        assertEquals("The output value is not correct.", "", this.response.getContentAsString());
+    }
+
+    @Test
+    public void testDoEndTag02() throws JspException, UnsupportedEncodingException {
+
+        CsrfToken token = new DefaultCsrfToken("X-Csrf-Token", "_csrf", "abc123def456ghi789");
+        this.request.setAttribute(CsrfToken.class.getName(), token);
+
+        this.tag.handleReturn = "fooBarBazQux";
+
+        int returned = this.tag.doEndTag();
+
+        assertEquals("The returned value is not correct.", TagSupport.EVAL_PAGE, returned);
+        assertEquals("The output value is not correct.", "fooBarBazQux", this.response.getContentAsString());
+        assertSame("The token is not correct.", token, this.tag.token);
+    }
+
+    @Test
+    public void testDoEndTag03() throws JspException, UnsupportedEncodingException {
+
+        CsrfToken token = new DefaultCsrfToken("X-Csrf-Token", "_csrf", "abc123def456ghi789");
+        this.request.setAttribute(CsrfToken.class.getName(), token);
+
+        this.tag.handleReturn = "<input type=\"hidden\" />";
+
+        int returned = this.tag.doEndTag();
+
+        assertEquals("The returned value is not correct.", TagSupport.EVAL_PAGE, returned);
+        assertEquals("The output value is not correct.", "<input type=\"hidden\" />",
+                this.response.getContentAsString());
+        assertSame("The token is not correct.", token, this.tag.token);
+    }
+
+    private static class MockTag extends AbstractCsrfTag {
+
+        private CsrfToken token;
+        private String handleReturn;
+
+        @Override
+        protected String handleToken(CsrfToken token) {
+            this.token = token;
+            return this.handleReturn;
+        }
+    }
+}

taglibs/src/test/java/org/springframework/security/taglibs/csrf/FormFieldTagTests.java

@@ -0,0 +1,45 @@
+package org.springframework.security.taglibs.csrf;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.springframework.security.web.csrf.CsrfToken;
+import org.springframework.security.web.csrf.DefaultCsrfToken;
+
+import static org.junit.Assert.*;
+
+/**
+ * @author Nick Williams
+ */
+public class FormFieldTagTests {
+
+    public FormFieldTag tag;
+
+    @Before
+    public void setUp() {
+        this.tag = new FormFieldTag();
+    }
+
+    @Test
+    public void testHandleToken01() {
+        CsrfToken token = new DefaultCsrfToken("X-Csrf-Token", "_csrf", "abc123def456ghi789");
+
+        String value = this.tag.handleToken(token);
+
+        assertNotNull("The returned value should not be null.", value);
+        assertEquals("The output is not correct.",
+                "<input type=\"hidden\" name=\"_csrf\" value=\"abc123def456ghi789\" />\n",
+                value);
+    }
+
+    @Test
+    public void testHandleToken() {
+        CsrfToken token = new DefaultCsrfToken("X-Csrf-Token", "csrfParameter", "fooBarBazQux");
+
+        String value = this.tag.handleToken(token);
+
+        assertNotNull("The returned value should not be null.", value);
+        assertEquals("The output is not correct.",
+                "<input type=\"hidden\" name=\"csrfParameter\" value=\"fooBarBazQux\" />\n",
+                value);
+    }
+}

taglibs/src/test/java/org/springframework/security/taglibs/csrf/MetaTagsTagTests.java

@@ -0,0 +1,49 @@
+package org.springframework.security.taglibs.csrf;
+
+import org.junit.Before;
+import org.junit.Test;
+import org.springframework.security.web.csrf.CsrfToken;
+import org.springframework.security.web.csrf.DefaultCsrfToken;
+
+import static org.junit.Assert.*;
+
+/**
+ * @author Nick Williams
+ */
+public class MetaTagsTagTests {
+
+    public MetaTagsTag tag;
+
+    @Before
+    public void setUp() {
+        this.tag = new MetaTagsTag();
+    }
+
+    @Test
+    public void testHandleToken01() {
+        CsrfToken token = new DefaultCsrfToken("X-Csrf-Token", "_csrf", "abc123def456ghi789");
+
+        String value = this.tag.handleToken(token);
+
+        assertNotNull("The returned value should not be null.", value);
+        assertEquals("The output is not correct.",
+                "<meta name=\"_csrf_parameter\" content=\"_csrf\" />\n" +
+                        "        <meta name=\"_csrf_header\" content=\"X-Csrf-Token\" />\n" +
+                        "        <meta name=\"_csrf\" content=\"abc123def456ghi789\" />\n",
+                value);
+    }
+
+    @Test
+    public void testHandleToken02() {
+        CsrfToken token = new DefaultCsrfToken("csrfHeader", "csrfParameter", "fooBarBazQux");
+
+        String value = this.tag.handleToken(token);
+
+        assertNotNull("The returned value should not be null.", value);
+        assertEquals("The output is not correct.",
+                "<meta name=\"_csrf_parameter\" content=\"csrfParameter\" />\n" +
+                        "        <meta name=\"_csrf_header\" content=\"csrfHeader\" />\n" +
+                        "        <meta name=\"_csrf\" content=\"fooBarBazQux\" />\n",
+                value);
+    }
+}