search

bkesk / bad-apps-blog

An insecure blog web app intended for practice with application security.
Other
0 stars 0 forks source link

Adding logging broke GitHub actions tests #6

Closed bkesk closed 2 years ago

bkesk commented 2 years ago

Bad Apps: Blogs is passing all tests in the development environment, but not in GitHub actions.

bkesk commented 2 years ago

It looks like the tests that are failing have to do with logging in. There is a similar failed assertion in all of these.

=========================== short test summary info ============================
FAILED tests/test_auth.py::test_register - AssertionError: assert 'http://loc.../
FAILED tests/test_auth.py::test_login - AssertionError: assert '/' == 'http:/...
FAILED tests/test_blog.py::test_login_required[/create] - AssertionError: ass...
FAILED tests/test_blog.py::test_login_required[/1/update] - AssertionError: a...
FAILED tests/test_blog.py::test_login_required[/1/delete] - AssertionError: a...
FAILED tests/test_blog.py::test_delete - AssertionError: assert '/' == 'http:...
========================= 6 failed, 21 passed in 2.72s =========================
bkesk commented 2 years ago

The tests expect 'http://localhost/' as a prefix to the resource name, but the response only has the resource name. For example:

________________________________ test_register _________________________________

client = <FlaskClient <Flask 'bad_apps_blog'>>, app = <Flask 'bad_apps_blog'>

    def test_register(client, app):
        assert client.get('/auth/register').status_code == 200
        response = client.post(
            '/auth/register', data={'username': 'a', 'displayname' : 'user1' ,'password': 'a'}
        )
>       assert 'http://localhost/auth/login' == response.headers['Location']
E       AssertionError: assert 'http://localhost/auth/login' == '/auth/login'
E         - /auth/login
E         + http://localhost/auth/login
bkesk commented 2 years ago

I can reproduce the failed tests locally by updating to the most recent Flask release.

Flask release 2.1.0 changelog notes that Werkzeug changed the Location header's behavior. Tests should be updated to reflect the most recent releases behavior.

bkesk commented 2 years ago

Unit tests now pass in GitHub actions.