Add comprehensive security tests for authentication, roles, and user management
- Enhance `test-auth.sh` with SQL injection, XSS, and credential validation tests. - Extend `test-roles-permissions.sh` to include unauthorized access and duplicate role creation tests. - Improve `test-users.sh` with checks for invalid emails, duplicate users, and unauthorized actions. - Introduce `test-security.sh` for thorough security assessments including CSRF, SQL injection, XSS, rate limiting, and session management. - Add `.serena.gitignore` and `.serena/project.yml` for project configuration and file management.
This commit is contained in:
MythEclipse
+61
-1
@@ -15,6 +15,9 @@ test_events_endpoints() {
|
||||
test_api_endpoint "GET Events (Search)" "GET" "/v1/cms/landing/events?search=test" 200 "" false
|
||||
test_api_endpoint "GET Events (Filter Online)" "GET" "/v1/cms/landing/events?filter=online" 200 "" false
|
||||
|
||||
# Security: Test SQL injection in search
|
||||
test_api_endpoint "GET Events with SQL Injection (Should Be Safe)" "GET" "/v1/cms/landing/events?search=' OR '1'='1" 200 "" false
|
||||
|
||||
# Get event by ID - use correct endpoint /detail/{id}
|
||||
local events_response=$(curl -s "$BASE_URL/v1/cms/landing/events")
|
||||
local test_event_id=$(echo "$events_response" | jq -r '.data[0].id // empty')
|
||||
@@ -23,8 +26,20 @@ test_events_endpoints() {
|
||||
test_api_endpoint "GET Event By ID" "GET" "/v1/cms/landing/events/detail/$test_event_id" 200 "" false
|
||||
fi
|
||||
|
||||
# Create event (protected) - use correct field name
|
||||
# Security: Test that create endpoint requires authentication
|
||||
local create_event_data=$(jq -n '{
|
||||
name: "Unauthorized Event '$(date +%s)'",
|
||||
description: "Should not be created",
|
||||
start_date: "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
|
||||
end_date: "'$(date -u -d '+2 hours' +%Y-%m-%dT%H:%M:%SZ)'",
|
||||
detail_link: "https://example.com/event",
|
||||
price: 0,
|
||||
is_online: true
|
||||
}')
|
||||
test_api_endpoint "POST Create Event without Auth (Should Fail)" "POST" "/v1/cms/landing/events/create" 401 "$create_event_data" false
|
||||
|
||||
# Create event (protected) - use correct field name
|
||||
create_event_data=$(jq -n '{
|
||||
name: "Test Event '$(date +%s)'",
|
||||
description: "Auto-generated test event",
|
||||
start_date: "'$(date -u +%Y-%m-%dT%H:%M:%SZ)'",
|
||||
@@ -37,6 +52,14 @@ test_events_endpoints() {
|
||||
local created_event_id=$(echo "$create_event_response" | jq -r '.data.id // empty')
|
||||
|
||||
if [ -n "$created_event_id" ]; then
|
||||
# Security: Test XSS in event name
|
||||
local xss_event_data=$(jq -n --arg id "$created_event_id" '{
|
||||
name: "<script>alert(\"XSS\")</script>",
|
||||
description: "XSS test",
|
||||
is_online: false
|
||||
}')
|
||||
test_api_endpoint "PATCH Update Event with XSS (Should Be Sanitized)" "PATCH" "/v1/cms/landing/events/update/$created_event_id" 200 "$xss_event_data" true
|
||||
|
||||
# Update event - use correct endpoint /update/{id} with PATCH
|
||||
local update_event_data=$(jq -n '{
|
||||
name: "Updated Test Event",
|
||||
@@ -45,8 +68,19 @@ test_events_endpoints() {
|
||||
}')
|
||||
test_api_endpoint "PATCH Update Event" "PATCH" "/v1/cms/landing/events/update/$created_event_id" 200 "$update_event_data" true
|
||||
|
||||
# Security: Test unauthorized update
|
||||
local saved_token="$AUTH_TOKEN"
|
||||
AUTH_TOKEN=""
|
||||
test_api_endpoint "PATCH Update Event without Auth (Should Fail)" "PATCH" "/v1/cms/landing/events/update/$created_event_id" 401 "$update_event_data" false
|
||||
AUTH_TOKEN="$saved_token"
|
||||
|
||||
# Delete event - use correct endpoint /delete/{id}
|
||||
test_api_endpoint "DELETE Event" "DELETE" "/v1/cms/landing/events/delete/$created_event_id" 200 "" true
|
||||
|
||||
# Security: Test unauthorized delete
|
||||
AUTH_TOKEN=""
|
||||
test_api_endpoint "DELETE Event without Auth (Should Fail)" "DELETE" "/v1/cms/landing/events/delete/$created_event_id" 401 "" false
|
||||
AUTH_TOKEN="$saved_token"
|
||||
fi
|
||||
}
|
||||
|
||||
@@ -58,6 +92,9 @@ test_testimonials_endpoints() {
|
||||
test_api_endpoint "GET Testimonials (Paginated)" "GET" "/v1/cms/landing/testimonials?page=1&limit=10" 200 "" false
|
||||
test_api_endpoint "GET Testimonials (Search)" "GET" "/v1/cms/landing/testimonials?search=test" 200 "" false
|
||||
|
||||
# Security: Test SQL injection in search
|
||||
test_api_endpoint "GET Testimonials with SQL Injection (Should Be Safe)" "GET" "/v1/cms/landing/testimonials?search=' OR '1'='1" 200 "" false
|
||||
|
||||
# Get testimonial by ID - use correct endpoint /detail/{id}
|
||||
local testimonials_response=$(curl -s "$BASE_URL/v1/cms/landing/testimonials")
|
||||
local test_testimonial_id=$(echo "$testimonials_response" | jq -r '.data[0].id // empty')
|
||||
@@ -66,6 +103,13 @@ test_testimonials_endpoints() {
|
||||
test_api_endpoint "GET Testimonial By ID" "GET" "/v1/cms/landing/testimonials/detail/$test_testimonial_id" 200 "" false
|
||||
fi
|
||||
|
||||
# Security: Test that create endpoint requires authentication
|
||||
local unauth_testimonial_data=$(jq -n '{
|
||||
role: "Hacker",
|
||||
content: "Unauthorized testimonial"
|
||||
}')
|
||||
test_api_endpoint "POST Create Testimonial without Auth (Should Fail)" "POST" "/v1/cms/landing/testimonials/create" 401 "$unauth_testimonial_data" false
|
||||
|
||||
# Create testimonial (protected)
|
||||
local create_testimonial_data=$(jq -n '{
|
||||
role: "Student",
|
||||
@@ -75,6 +119,13 @@ test_testimonials_endpoints() {
|
||||
local created_testimonial_id=$(echo "$create_testimonial_response" | jq -r '.data.id // empty')
|
||||
|
||||
if [ -n "$created_testimonial_id" ]; then
|
||||
# Security: Test XSS in testimonial content
|
||||
local xss_testimonial_data=$(jq -n '{
|
||||
role: "Student",
|
||||
content: "<script>alert(\"XSS\")</script>"
|
||||
}')
|
||||
test_api_endpoint "PATCH Update Testimonial with XSS (Should Be Sanitized)" "PATCH" "/v1/cms/landing/testimonials/update/$created_testimonial_id" 200 "$xss_testimonial_data" true
|
||||
|
||||
# Update testimonial - use correct endpoint /update/{id} with PATCH
|
||||
local update_testimonial_data=$(jq -n '{
|
||||
role: "Alumni",
|
||||
@@ -82,8 +133,17 @@ test_testimonials_endpoints() {
|
||||
}')
|
||||
test_api_endpoint "PATCH Update Testimonial" "PATCH" "/v1/cms/landing/testimonials/update/$created_testimonial_id" 200 "$update_testimonial_data" true
|
||||
|
||||
# Security: Test unauthorized update
|
||||
local saved_token="$AUTH_TOKEN"
|
||||
AUTH_TOKEN=""
|
||||
test_api_endpoint "PATCH Update Testimonial without Auth (Should Fail)" "PATCH" "/v1/cms/landing/testimonials/update/$created_testimonial_id" 401 "$update_testimonial_data" false
|
||||
AUTH_TOKEN="$saved_token"
|
||||
|
||||
# Delete testimonial - use correct endpoint /delete/{id}
|
||||
test_api_endpoint "DELETE Testimonial" "DELETE" "/v1/cms/landing/testimonials/delete/$created_testimonial_id" 200 "" true
|
||||
|
||||
# Security: Test that non-existent resource returns proper error
|
||||
test_api_endpoint "DELETE Non-existent Testimonial (Should Fail)" "DELETE" "/v1/cms/landing/testimonials/delete/00000000-0000-0000-0000-000000000000" 404 "" true
|
||||
fi
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user