Skip to content

Generated test didn't pass Spring Security's firewall. #2726

Description

@ancavar

To Reproduce

  1. Add Spring Security to dependencies
  2. Generate integration tests for controller's method which has @PathVariable parameter.
@GetMapping("/{name}")
publicStringdemo(@PathVariableStringname) {
returnname;
}

Expected behavior

Test should not fail.

Actual behavior

/** * @utbot.classUnderTest {@link BookController} * @utbot.methodUnderTest {@link BookController#demo(String)} */@Test@DisplayName("demo: name = '\uFFEA#$\\\"'' (mutated from '#$\\\"'') -> throw RequestRejectedException")
publicvoidtestDemoThrowsRREWithNonEmptyString() throwsException {
UriComponentsBuilderuriComponentsBuilder = fromPath("/{name}");
Mapmap = newHashMap();
map.put("name", "\uFFEA#$\\\"'");
UriComponentsBuilderuriComponentsBuilder1 = uriComponentsBuilder.uriVariables(map);
Stringstring = uriComponentsBuilder1.toUriString();
Object[] objectArray = {};
MockHttpServletRequestBuildermockHttpServletRequestBuilder = get(string, objectArray);
/* This test fails because method [org.springframework.test.web.servlet.MockMvc.perform] produces [org.springframework.security.web.firewall.RequestRejectedException: The request was rejected because the URL contained a potentially malicious String "%25"] org.springframework.security.web.firewall.StrictHttpFirewall.rejectedBlacklistedUrls(StrictHttpFirewall.java:369) org.springframework.security.web.firewall.StrictHttpFirewall.getFirewalledRequest(StrictHttpFirewall.java:336) org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:194) org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178) org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358) org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271) org.springframework.mock.web.MockFilterChain.doFilter(MockFilterChain.java:134) org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) org.springframework.mock.web.MockFilterChain.doFilter(MockFilterChain.java:134) org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) org.springframework.mock.web.MockFilterChain.doFilter(MockFilterChain.java:134) org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) org.springframework.mock.web.MockFilterChain.doFilter(MockFilterChain.java:134) org.springframework.test.web.servlet.MockMvc.perform(MockMvc.java:183) */mockMvc.perform(mockHttpServletRequestBuilder);
}
///endregion

Metadata

Metadata

Assignees

No one assigned

    Labels

    ctg-bugIssue is a bug

    Type

    No type

    Projects

    Status
    Todo

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions