Skip to content

Commit 33a3200

Browse files
KahncodeKahncode
committed
Added security test script and performed test
1 parent d93ff05 commit 33a3200

File tree

17 files changed

+1205
-1
lines changed

17 files changed

+1205
-1
lines changed

‎bin/security/ue4cpp-petstore.sh

Lines changed: 31 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,31 @@
1+
#!/bin/sh
2+
3+
SCRIPT="$0"
4+
5+
while [ -h "$SCRIPT" ] ; do
6+
ls=`ls -ld "$SCRIPT"`
7+
link=`expr "$ls" : '.*-> \(.*\)$'`
8+
if expr "$link" : '/.*' > /dev/null; then
9+
SCRIPT="$link"
10+
else
11+
SCRIPT=`dirname "$SCRIPT"`/"$link"
12+
fi
13+
done
14+
15+
if [ ! -d "${APP_DIR}" ]; then
16+
APP_DIR=`dirname "$SCRIPT"`/..
17+
APP_DIR=`cd "${APP_DIR}"; pwd`
18+
fi
19+
20+
executable="./modules/swagger-codegen-cli/target/swagger-codegen-cli.jar"
21+
22+
if [ ! -f "$executable" ]
23+
then
24+
mvn clean package
25+
fi
26+
27+
# if you've executed sbt assembly previously it will use that instead.
28+
export JAVA_OPTS="${JAVA_OPTS} -XX:MaxPermSize=256M -Xmx1024M -DloggerPath=conf/log4j.properties"
29+
ags="$@ generate -t modules/swagger-codegen/src/main/resources/ue4cpp -i modules/swagger-codegen/src/test/resources/2_0/petstore-security-test.yaml -l ue4cpp -o samples/client/petstore-security-test/ue4cpp"
30+
31+
java $JAVA_OPTS -jar $executable $ags

‎samples/client/petstore-security-test/ue4cpp/.swagger-codegen-ignore

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
# Swagger Codegen Ignore
2+
# Generated by swagger-codegen https://github.com/swagger-api/swagger-codegen
3+
4+
# Use this file to prevent files from being overwritten by the generator.
5+
# The patterns follow closely to .gitignore or .dockerignore.
6+
7+
# As an example, the C# client generator defines ApiClient.cs.
8+
# You can make changes and tell Swagger Codgen to ignore just this file by uncommenting the following line:
9+
#ApiClient.cs
10+
11+
# You can match any string of characters against a directory, file or extension with a single asterisk (*):
12+
#foo/*/qux
13+
# The above matches foo/bar/qux and foo/baz/qux, but not foo/bar/baz/qux
14+
15+
# You can recursively match patterns against a directory, file or extension with a double asterisk (**):
16+
#foo/**/qux
17+
# This matches foo/bar/qux, foo/baz/qux, and foo/bar/baz/qux
18+
19+
# You can also negate patterns with an exclamation (!).
20+
# For example, you can ignore all files in a docs folder with the file extension .md:
21+
#docs/*.md
22+
# Then explicitly reverse the ignore rule for a single file:
23+
#!docs/README.md

‎samples/client/petstore-security-test/ue4cpp/.swagger-codegen/VERSION

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
2.4.15-SNAPSHOT

‎samples/client/petstore-security-test/ue4cpp/Private/SwaggerBaseModel.cpp

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/**
2+
* Swagger Petstore *_/ ' \" =end -- \\r\\n \\n \\r
3+
* This spec is mainly for testing Petstore server and contains fake endpoints, models. Please do not use this for any other purpose. Special characters: \" \\ *_/ ' \" =end --
4+
*
5+
* OpenAPI spec version: 1.0.0 *_/ ' \" =end -- \\r\\n \\n \\r
6+
* Contact: [email protected] *_/ ' \" =end -- \\r\\n \\n \\r
7+
*
8+
* NOTE: This class is auto generated by the swagger code generator program.
9+
* https://github.com/swagger-api/swagger-codegen.git
10+
* Do not edit the class manually.
11+
*/
12+
#include "SwaggerBaseModel.h"
13+
14+
namespace Swagger
15+
{
16+
17+
void Response::SetHttpResponseCode(EHttpResponseCodes::Type InHttpResponseCode)
18+
{
19+
ResponseCode = InHttpResponseCode;
20+
SetSuccessful(EHttpResponseCodes::IsOk(InHttpResponseCode));
21+
if(InHttpResponseCode == EHttpResponseCodes::RequestTimeout)
22+
{
23+
SetResponseString(TEXT("Request Timeout"));
24+
}
25+
}
26+
27+
}

‎samples/client/petstore-security-test/ue4cpp/Private/SwaggerFakeApi.cpp

Lines changed: 122 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,122 @@
1+
/**
2+
* Swagger Petstore *_/ ' \" =end -- \\r\\n \\n \\r
3+
* This spec is mainly for testing Petstore server and contains fake endpoints, models. Please do not use this for any other purpose. Special characters: \" \\ *_/ ' \" =end --
4+
*
5+
* OpenAPI spec version: 1.0.0 *_/ ' \" =end -- \\r\\n \\n \\r
6+
* Contact: [email protected] *_/ ' \" =end -- \\r\\n \\n \\r
7+
*
8+
* NOTE: This class is auto generated by the swagger code generator program.
9+
* https://github.com/swagger-api/swagger-codegen.git
10+
* Do not edit the class manually.
11+
*/
12+
#include "SwaggerFakeApi.h"
13+
14+
#include "SwaggerFakeApiOperations.h"
15+
#include "SwaggerModule.h"
16+
17+
#include "HttpModule.h"
18+
#include "Serialization/JsonSerializer.h"
19+
20+
namespace Swagger
21+
{
22+
23+
SwaggerFakeApi::SwaggerFakeApi()
24+
: Url(TEXT("https://petstore.swagger.io *_/ ' \" =end -- \\r\\n \\n \\r/v2 *_/ ' \" =end -- \\r\\n \\n \\r"))
25+
{
26+
}
27+
28+
SwaggerFakeApi::~SwaggerFakeApi() {}
29+
30+
void SwaggerFakeApi::SetURL(const FString& InUrl)
31+
{
32+
Url = InUrl;
33+
}
34+
35+
void SwaggerFakeApi::AddHeaderParam(const FString& Key, const FString& Value)
36+
{
37+
AdditionalHeaderParams.Add(Key, Value);
38+
}
39+
40+
void SwaggerFakeApi::ClearHeaderParams()
41+
{
42+
AdditionalHeaderParams.Reset();
43+
}
44+
45+
bool SwaggerFakeApi::IsValid() const
46+
{
47+
if (Url.IsEmpty())
48+
{
49+
UE_LOG(LogSwagger, Error, TEXT("SwaggerFakeApi: Endpoint Url is not set, request cannot be performed"));
50+
return false;
51+
}
52+
53+
return true;
54+
}
55+
56+
void SwaggerFakeApi::HandleResponse(FHttpResponsePtr HttpResponse, bool bSucceeded, Response& InOutResponse) const
57+
{
58+
InOutResponse.SetHttpResponse(HttpResponse);
59+
InOutResponse.SetSuccessful(bSucceeded);
60+
61+
if (bSucceeded && HttpResponse.IsValid())
62+
{
63+
InOutResponse.SetHttpResponseCode((EHttpResponseCodes::Type)HttpResponse->GetResponseCode());
64+
FString ContentType = HttpResponse->GetContentType();
65+
FString Content;
66+
67+
if (ContentType == TEXT("application/json"))
68+
{
69+
Content = HttpResponse->GetContentAsString();
70+
71+
TSharedPtr<FJsonValue> JsonValue;
72+
auto Reader = TJsonReaderFactory<>::Create(Content);
73+
74+
if (FJsonSerializer::Deserialize(Reader, JsonValue) && JsonValue.IsValid())
75+
{
76+
if (InOutResponse.FromJson(JsonValue))
77+
return; // Successfully parsed
78+
}
79+
}
80+
else if(ContentType == TEXT("text/plain"))
81+
{
82+
Content = HttpResponse->GetContentAsString();
83+
InOutResponse.SetResponseString(Content);
84+
return; // Successfully parsed
85+
}
86+
87+
// Report the parse error but do not mark the request as unsuccessful. Data could be partial or malformed, but the request succeeded.
88+
UE_LOG(LogSwagger, Error, TEXT("Failed to deserialize Http response content (type:%s):\n%s"), *ContentType , *Content);
89+
return;
90+
}
91+
92+
// By default, assume we failed to establish connection
93+
InOutResponse.SetHttpResponseCode(EHttpResponseCodes::RequestTimeout);
94+
}
95+
96+
bool SwaggerFakeApi::TestCodeInjectEndRnNR(const TestCodeInjectEndRnNRRequest& Request, const FTestCodeInjectEndRnNRDelegate& Delegate /*= FTestCodeInjectEndRnNRDelegate()*/) const
97+
{
98+
if (!IsValid())
99+
return false;
100+
101+
TSharedRef<IHttpRequest> HttpRequest = FHttpModule::Get().CreateRequest();
102+
HttpRequest->SetURL(*(Url + Request.ComputePath()));
103+
104+
for(const auto& It : AdditionalHeaderParams)
105+
{
106+
HttpRequest->SetHeader(It.Key, It.Value);
107+
}
108+
109+
Request.SetupHttpRequest(HttpRequest);
110+
111+
HttpRequest->OnProcessRequestComplete().BindRaw(this, &SwaggerFakeApi::OnTestCodeInjectEndRnNRResponse, Delegate);
112+
return HttpRequest->ProcessRequest();
113+
}
114+
115+
void SwaggerFakeApi::OnTestCodeInjectEndRnNRResponse(FHttpRequestPtr HttpRequest, FHttpResponsePtr HttpResponse, bool bSucceeded, FTestCodeInjectEndRnNRDelegate Delegate) const
116+
{
117+
TestCodeInjectEndRnNRResponse Response;
118+
HandleResponse(HttpResponse, bSucceeded, Response);
119+
Delegate.ExecuteIfBound(Response);
120+
}
121+
122+
}

‎samples/client/petstore-security-test/ue4cpp/Private/SwaggerFakeApiOperations.cpp

Lines changed: 86 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,86 @@
1+
/**
2+
* Swagger Petstore *_/ ' \" =end -- \\r\\n \\n \\r
3+
* This spec is mainly for testing Petstore server and contains fake endpoints, models. Please do not use this for any other purpose. Special characters: \" \\ *_/ ' \" =end --
4+
*
5+
* OpenAPI spec version: 1.0.0 *_/ ' \" =end -- \\r\\n \\n \\r
6+
* Contact: [email protected] *_/ ' \" =end -- \\r\\n \\n \\r
7+
*
8+
* NOTE: This class is auto generated by the swagger code generator program.
9+
* https://github.com/swagger-api/swagger-codegen.git
10+
* Do not edit the class manually.
11+
*/
12+
#include "SwaggerFakeApiOperations.h"
13+
14+
#include "SwaggerModule.h"
15+
#include "SwaggerHelpers.h"
16+
17+
#include "Dom/JsonObject.h"
18+
#include "Templates/SharedPointer.h"
19+
#include "HttpModule.h"
20+
#include "PlatformHttp.h"
21+
22+
namespace Swagger
23+
{
24+
25+
FString SwaggerFakeApi::TestCodeInjectEndRnNRRequest::ComputePath() const
26+
{
27+
FString Path(TEXT("/fake"));
28+
return Path;
29+
}
30+
31+
void SwaggerFakeApi::TestCodeInjectEndRnNRRequest::SetupHttpRequest(const TSharedRef<IHttpRequest>& HttpRequest) const
32+
{
33+
static const TArray<FString> Consumes = { TEXT("application/json"), TEXT("*_/ ' =end -- ") };
34+
//static const TArray<FString> Produces = { TEXT("application/json"), TEXT("*_/ ' =end -- ") };
35+
36+
HttpRequest->SetVerb(TEXT("PUT"));
37+
38+
// Default to Json Body request
39+
if (Consumes.Num() == 0 || Consumes.Contains(TEXT("application/json")))
40+
{
41+
UE_LOG(LogSwagger, Error, TEXT("Form parameter (test code inject */ &#39; &quot; &#x3D;end -- \r\n \n \r) was ignored, cannot be used in JsonBody"));
42+
}
43+
else if (Consumes.Contains(TEXT("multipart/form-data")))
44+
{
45+
HttpMultipartFormData FormData;
46+
if(TestCodeInjectEndRnNR.IsSet())
47+
{
48+
FormData.AddStringPart(TEXT("test code inject */ &#39; &quot; &#x3D;end -- \r\n \n \r"), *ToUrlString(TestCodeInjectEndRnNR.GetValue()));
49+
}
50+
51+
FormData.SetupHttpRequest(HttpRequest);
52+
}
53+
else if (Consumes.Contains(TEXT("application/x-www-form-urlencoded")))
54+
{
55+
TArray<FString> FormParams;
56+
if(TestCodeInjectEndRnNR.IsSet())
57+
{
58+
FormParams.Add(FString(TEXT("test code inject */ &#39; &quot; &#x3D;end -- \r\n \n \r=")) + ToUrlString(TestCodeInjectEndRnNR.GetValue()));
59+
}
60+
61+
HttpRequest->SetHeader(TEXT("Content-Type"), TEXT("application/x-www-form-urlencoded; charset=utf-8"));
62+
HttpRequest->SetContentAsString(FString::Join(FormParams, TEXT("&")));
63+
}
64+
else
65+
{
66+
UE_LOG(LogSwagger, Error, TEXT("Request ContentType not supported (%s)"), *FString::Join(Consumes, TEXT(",")));
67+
}
68+
}
69+
70+
void SwaggerFakeApi::TestCodeInjectEndRnNRResponse::SetHttpResponseCode(EHttpResponseCodes::Type InHttpResponseCode)
71+
{
72+
Response::SetHttpResponseCode(InHttpResponseCode);
73+
switch ((int)InHttpResponseCode)
74+
{
75+
case 400:
76+
SetResponseString(TEXT("To test code injection *_/ &#39; \&quot; &#x3D;end -- \\r\\n \\n \\r"));
77+
break;
78+
}
79+
}
80+
81+
bool SwaggerFakeApi::TestCodeInjectEndRnNRResponse::FromJson(const TSharedPtr<FJsonValue>& JsonValue)
82+
{
83+
return true;
84+
}
85+
86+
}

0 commit comments

Comments
 (0)