Skip to content

Commit 3c9de4f

Browse files
dschadowdschadow
committed
added tests
1 parent 2f66404 commit 3c9de4f

5 files changed

Lines changed: 864 additions & 0 deletions

File tree

‎xss/pom.xml‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,16 @@
2929
<groupId>javax.servlet</groupId>
3030
<artifactId>javax.servlet-api</artifactId>
3131
</dependency>
32+
<dependency>
33+
<groupId>org.junit.jupiter</groupId>
34+
<artifactId>junit-jupiter</artifactId>
35+
<scope>test</scope>
36+
</dependency>
37+
<dependency>
38+
<groupId>org.mockito</groupId>
39+
<artifactId>mockito-core</artifactId>
40+
<scope>test</scope>
41+
</dependency>
3242
</dependencies>
3343

3444
<build>

‎xss/src/test/java/de/dominikschadow/javasecurity/xss/CSPServletTest.java‎

Lines changed: 205 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,205 @@
1+
/*
2+
* Copyright (C) 2026 Dominik Schadow, dominikschadow@gmail.com
3+
*
4+
* This file is part of the Java Security project.
5+
*
6+
* Licensed under the Apache License, Version 2.0 (the "License");
7+
* you may not use this file except in compliance with the License.
8+
* You may obtain a copy of the License at
9+
*
10+
* https://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
package de.dominikschadow.javasecurity.xss;
19+
20+
import org.junit.jupiter.api.BeforeEach;
21+
import org.junit.jupiter.api.Test;
22+
import org.mockito.Mock;
23+
import org.mockito.MockitoAnnotations;
24+
25+
import javax.servlet.http.HttpServletRequest;
26+
import javax.servlet.http.HttpServletResponse;
27+
import java.io.PrintWriter;
28+
import java.io.StringWriter;
29+
30+
import static org.junit.jupiter.api.Assertions.*;
31+
import static org.mockito.Mockito.*;
32+
33+
/**
34+
* Tests for the CSPServlet class.
35+
*
36+
* @author Dominik Schadow
37+
*/
38+
class CSPServletTest {
39+
@Mock
40+
private HttpServletRequest request;
41+
42+
@Mock
43+
private HttpServletResponse response;
44+
45+
private CSPServlet servlet;
46+
private StringWriter stringWriter;
47+
private PrintWriter printWriter;
48+
49+
@BeforeEach
50+
void setUp() throws Exception {
51+
MockitoAnnotations.openMocks(this);
52+
servlet = new CSPServlet();
53+
stringWriter = new StringWriter();
54+
printWriter = new PrintWriter(stringWriter);
55+
}
56+
57+
@Test
58+
void doPost_setsContentTypeToHtml() throws Exception {
59+
when(request.getParameter("cspName")).thenReturn("TestName");
60+
when(response.getWriter()).thenReturn(printWriter);
61+
62+
servlet.doPost(request, response);
63+
64+
verify(response).setContentType("text/html");
65+
}
66+
67+
@Test
68+
void doPost_setsContentSecurityPolicyHeader() throws Exception {
69+
when(request.getParameter("cspName")).thenReturn("TestName");
70+
when(response.getWriter()).thenReturn(printWriter);
71+
72+
servlet.doPost(request, response);
73+
74+
verify(response).setHeader("Content-Security-Policy", "default-src 'self'");
75+
}
76+
77+
@Test
78+
void doPost_outputContainsName() throws Exception {
79+
String testName = "TestUser";
80+
when(request.getParameter("cspName")).thenReturn(testName);
81+
when(response.getWriter()).thenReturn(printWriter);
82+
83+
servlet.doPost(request, response);
84+
printWriter.flush();
85+
86+
String output = stringWriter.toString();
87+
assertTrue(output.contains("[" + testName + "]"));
88+
}
89+
90+
@Test
91+
void doPost_outputContainsHtmlStructure() throws Exception {
92+
when(request.getParameter("cspName")).thenReturn("TestName");
93+
when(response.getWriter()).thenReturn(printWriter);
94+
95+
servlet.doPost(request, response);
96+
printWriter.flush();
97+
98+
String output = stringWriter.toString();
99+
assertTrue(output.contains("<html>"));
100+
assertTrue(output.contains("</html>"));
101+
assertTrue(output.contains("<head>"));
102+
assertTrue(output.contains("</head>"));
103+
assertTrue(output.contains("<body>"));
104+
assertTrue(output.contains("</body>"));
105+
}
106+
107+
@Test
108+
void doPost_outputContainsTitle() throws Exception {
109+
when(request.getParameter("cspName")).thenReturn("TestName");
110+
when(response.getWriter()).thenReturn(printWriter);
111+
112+
servlet.doPost(request, response);
113+
printWriter.flush();
114+
115+
String output = stringWriter.toString();
116+
assertTrue(output.contains("<title>Cross-Site Scripting (XSS) - Content Security Policy</title>"));
117+
}
118+
119+
@Test
120+
void doPost_outputContainsHomeLink() throws Exception {
121+
when(request.getParameter("cspName")).thenReturn("TestName");
122+
when(response.getWriter()).thenReturn(printWriter);
123+
124+
servlet.doPost(request, response);
125+
printWriter.flush();
126+
127+
String output = stringWriter.toString();
128+
assertTrue(output.contains("index.jsp"));
129+
assertTrue(output.contains("Home"));
130+
}
131+
132+
@Test
133+
void doPost_outputContainsStylesheetLink() throws Exception {
134+
when(request.getParameter("cspName")).thenReturn("TestName");
135+
when(response.getWriter()).thenReturn(printWriter);
136+
137+
servlet.doPost(request, response);
138+
printWriter.flush();
139+
140+
String output = stringWriter.toString();
141+
assertTrue(output.contains("resources/css/styles.css"));
142+
}
143+
144+
@Test
145+
void doPost_outputContainsHeading() throws Exception {
146+
when(request.getParameter("cspName")).thenReturn("TestName");
147+
when(response.getWriter()).thenReturn(printWriter);
148+
149+
servlet.doPost(request, response);
150+
printWriter.flush();
151+
152+
String output = stringWriter.toString();
153+
assertTrue(output.contains("<h1>Cross-Site Scripting (XSS) - Content Security Policy</h1>"));
154+
}
155+
156+
@Test
157+
void doPost_withNullName_outputContainsNull() throws Exception {
158+
when(request.getParameter("cspName")).thenReturn(null);
159+
when(response.getWriter()).thenReturn(printWriter);
160+
161+
servlet.doPost(request, response);
162+
printWriter.flush();
163+
164+
String output = stringWriter.toString();
165+
assertTrue(output.contains("[null]"));
166+
}
167+
168+
@Test
169+
void doPost_withEmptyName_outputContainsEmptyBrackets() throws Exception {
170+
when(request.getParameter("cspName")).thenReturn("");
171+
when(response.getWriter()).thenReturn(printWriter);
172+
173+
servlet.doPost(request, response);
174+
printWriter.flush();
175+
176+
String output = stringWriter.toString();
177+
assertTrue(output.contains("[]"));
178+
}
179+
180+
@Test
181+
void doPost_withScriptTag_outputContainsScriptTag() throws Exception {
182+
String maliciousInput = "<script>alert('XSS')</script>";
183+
when(request.getParameter("cspName")).thenReturn(maliciousInput);
184+
when(response.getWriter()).thenReturn(printWriter);
185+
186+
servlet.doPost(request, response);
187+
printWriter.flush();
188+
189+
String output = stringWriter.toString();
190+
assertTrue(output.contains("[" + maliciousInput + "]"));
191+
}
192+
193+
@Test
194+
void doPost_withSpecialCharacters_outputContainsSpecialCharacters() throws Exception {
195+
String specialChars = "Test<>&\"'Name";
196+
when(request.getParameter("cspName")).thenReturn(specialChars);
197+
when(response.getWriter()).thenReturn(printWriter);
198+
199+
servlet.doPost(request, response);
200+
printWriter.flush();
201+
202+
String output = stringWriter.toString();
203+
assertTrue(output.contains("[" + specialChars + "]"));
204+
}
205+
}

0 commit comments

Comments
 (0)