diff options
Diffstat (limited to 'tests/check_framework')
| -rw-r--r-- | tests/check_framework/test_security.py | 129 |
1 files changed, 77 insertions, 52 deletions
diff --git a/tests/check_framework/test_security.py b/tests/check_framework/test_security.py index 34254b66d5..b4591030f5 100644 --- a/tests/check_framework/test_security.py +++ b/tests/check_framework/test_security.py @@ -1,5 +1,6 @@ from django.conf import settings from django.core.checks.security import base, csrf, sessions +from django.core.checks.utils import patch_middleware_message from django.test import SimpleTestCase from django.test.utils import override_settings @@ -13,7 +14,7 @@ class CheckSessionCookieSecureTest(SimpleTestCase): @override_settings( SESSION_COOKIE_SECURE=False, INSTALLED_APPS=["django.contrib.sessions"], - MIDDLEWARE_CLASSES=[]) + MIDDLEWARE=[]) def test_session_cookie_secure_with_installed_app(self): """ Warn if SESSION_COOKIE_SECURE is off and "django.contrib.sessions" is @@ -23,20 +24,36 @@ class CheckSessionCookieSecureTest(SimpleTestCase): @override_settings( SESSION_COOKIE_SECURE=False, + INSTALLED_APPS=["django.contrib.sessions"], + MIDDLEWARE=None, + MIDDLEWARE_CLASSES=[]) + def test_session_cookie_secure_with_installed_app_middleware_classes(self): + self.assertEqual(self.func(None), [sessions.W010]) + + @override_settings( + SESSION_COOKIE_SECURE=False, INSTALLED_APPS=[], - MIDDLEWARE_CLASSES=["django.contrib.sessions.middleware.SessionMiddleware"]) + MIDDLEWARE=["django.contrib.sessions.middleware.SessionMiddleware"]) def test_session_cookie_secure_with_middleware(self): """ Warn if SESSION_COOKIE_SECURE is off and "django.contrib.sessions.middleware.SessionMiddleware" is in - MIDDLEWARE_CLASSES. + MIDDLEWARE. """ self.assertEqual(self.func(None), [sessions.W011]) @override_settings( SESSION_COOKIE_SECURE=False, - INSTALLED_APPS=["django.contrib.sessions"], + INSTALLED_APPS=[], + MIDDLEWARE=None, MIDDLEWARE_CLASSES=["django.contrib.sessions.middleware.SessionMiddleware"]) + def test_session_cookie_secure_with_middleware_middleware_classes(self): + self.assertEqual(self.func(None), [patch_middleware_message(sessions.W011)]) + + @override_settings( + SESSION_COOKIE_SECURE=False, + INSTALLED_APPS=["django.contrib.sessions"], + MIDDLEWARE=["django.contrib.sessions.middleware.SessionMiddleware"]) def test_session_cookie_secure_both(self): """ If SESSION_COOKIE_SECURE is off and we find both the session app and @@ -45,9 +62,17 @@ class CheckSessionCookieSecureTest(SimpleTestCase): self.assertEqual(self.func(None), [sessions.W012]) @override_settings( - SESSION_COOKIE_SECURE=True, + SESSION_COOKIE_SECURE=False, INSTALLED_APPS=["django.contrib.sessions"], + MIDDLEWARE=None, MIDDLEWARE_CLASSES=["django.contrib.sessions.middleware.SessionMiddleware"]) + def test_session_cookie_secure_both_middleware_classes(self): + self.assertEqual(self.func(None), [sessions.W012]) + + @override_settings( + SESSION_COOKIE_SECURE=True, + INSTALLED_APPS=["django.contrib.sessions"], + MIDDLEWARE=["django.contrib.sessions.middleware.SessionMiddleware"]) def test_session_cookie_secure_true(self): """ If SESSION_COOKIE_SECURE is on, there's no warning about it. @@ -64,7 +89,7 @@ class CheckSessionCookieHttpOnlyTest(SimpleTestCase): @override_settings( SESSION_COOKIE_HTTPONLY=False, INSTALLED_APPS=["django.contrib.sessions"], - MIDDLEWARE_CLASSES=[]) + MIDDLEWARE=[]) def test_session_cookie_httponly_with_installed_app(self): """ Warn if SESSION_COOKIE_HTTPONLY is off and "django.contrib.sessions" @@ -75,19 +100,19 @@ class CheckSessionCookieHttpOnlyTest(SimpleTestCase): @override_settings( SESSION_COOKIE_HTTPONLY=False, INSTALLED_APPS=[], - MIDDLEWARE_CLASSES=["django.contrib.sessions.middleware.SessionMiddleware"]) + MIDDLEWARE=["django.contrib.sessions.middleware.SessionMiddleware"]) def test_session_cookie_httponly_with_middleware(self): """ Warn if SESSION_COOKIE_HTTPONLY is off and "django.contrib.sessions.middleware.SessionMiddleware" is in - MIDDLEWARE_CLASSES. + MIDDLEWARE. """ self.assertEqual(self.func(None), [sessions.W014]) @override_settings( SESSION_COOKIE_HTTPONLY=False, INSTALLED_APPS=["django.contrib.sessions"], - MIDDLEWARE_CLASSES=["django.contrib.sessions.middleware.SessionMiddleware"]) + MIDDLEWARE=["django.contrib.sessions.middleware.SessionMiddleware"]) def test_session_cookie_httponly_both(self): """ If SESSION_COOKIE_HTTPONLY is off and we find both the session app and @@ -98,7 +123,7 @@ class CheckSessionCookieHttpOnlyTest(SimpleTestCase): @override_settings( SESSION_COOKIE_HTTPONLY=True, INSTALLED_APPS=["django.contrib.sessions"], - MIDDLEWARE_CLASSES=["django.contrib.sessions.middleware.SessionMiddleware"]) + MIDDLEWARE=["django.contrib.sessions.middleware.SessionMiddleware"]) def test_session_cookie_httponly_true(self): """ If SESSION_COOKIE_HTTPONLY is on, there's no warning about it. @@ -112,15 +137,15 @@ class CheckCSRFMiddlewareTest(SimpleTestCase): from django.core.checks.security.csrf import check_csrf_middleware return check_csrf_middleware - @override_settings(MIDDLEWARE_CLASSES=[]) + @override_settings(MIDDLEWARE=[], MIDDLEWARE_CLASSES=[]) def test_no_csrf_middleware(self): """ - Warn if CsrfViewMiddleware isn't in MIDDLEWARE_CLASSES. + Warn if CsrfViewMiddleware isn't in MIDDLEWARE. """ self.assertEqual(self.func(None), [csrf.W003]) @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.csrf.CsrfViewMiddleware"]) + MIDDLEWARE=["django.middleware.csrf.CsrfViewMiddleware"]) def test_with_csrf_middleware(self): self.assertEqual(self.func(None), []) @@ -132,25 +157,25 @@ class CheckCSRFCookieSecureTest(SimpleTestCase): return check_csrf_cookie_secure @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.csrf.CsrfViewMiddleware"], + MIDDLEWARE=["django.middleware.csrf.CsrfViewMiddleware"], CSRF_COOKIE_SECURE=False) def test_with_csrf_cookie_secure_false(self): """ - Warn if CsrfViewMiddleware is in MIDDLEWARE_CLASSES but + Warn if CsrfViewMiddleware is in MIDDLEWARE but CSRF_COOKIE_SECURE isn't True. """ self.assertEqual(self.func(None), [csrf.W016]) - @override_settings(MIDDLEWARE_CLASSES=[], CSRF_COOKIE_SECURE=False) + @override_settings(MIDDLEWARE=[], MIDDLEWARE_CLASSES=[], CSRF_COOKIE_SECURE=False) def test_with_csrf_cookie_secure_false_no_middleware(self): """ - No warning if CsrfViewMiddleware isn't in MIDDLEWARE_CLASSES, even if + No warning if CsrfViewMiddleware isn't in MIDDLEWARE, even if CSRF_COOKIE_SECURE is False. """ self.assertEqual(self.func(None), []) @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.csrf.CsrfViewMiddleware"], + MIDDLEWARE=["django.middleware.csrf.CsrfViewMiddleware"], CSRF_COOKIE_SECURE=True) def test_with_csrf_cookie_secure_true(self): self.assertEqual(self.func(None), []) @@ -163,25 +188,25 @@ class CheckCSRFCookieHttpOnlyTest(SimpleTestCase): return check_csrf_cookie_httponly @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.csrf.CsrfViewMiddleware"], + MIDDLEWARE=["django.middleware.csrf.CsrfViewMiddleware"], CSRF_COOKIE_HTTPONLY=False) def test_with_csrf_cookie_httponly_false(self): """ - Warn if CsrfViewMiddleware is in MIDDLEWARE_CLASSES but + Warn if CsrfViewMiddleware is in MIDDLEWARE but CSRF_COOKIE_HTTPONLY isn't True. """ self.assertEqual(self.func(None), [csrf.W017]) - @override_settings(MIDDLEWARE_CLASSES=[], CSRF_COOKIE_HTTPONLY=False) + @override_settings(MIDDLEWARE=[], MIDDLEWARE_CLASSES=[], CSRF_COOKIE_HTTPONLY=False) def test_with_csrf_cookie_httponly_false_no_middleware(self): """ - No warning if CsrfViewMiddleware isn't in MIDDLEWARE_CLASSES, even if + No warning if CsrfViewMiddleware isn't in MIDDLEWARE, even if CSRF_COOKIE_HTTPONLY is False. """ self.assertEqual(self.func(None), []) @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.csrf.CsrfViewMiddleware"], + MIDDLEWARE=["django.middleware.csrf.CsrfViewMiddleware"], CSRF_COOKIE_HTTPONLY=True) def test_with_csrf_cookie_httponly_true(self): self.assertEqual(self.func(None), []) @@ -193,15 +218,15 @@ class CheckSecurityMiddlewareTest(SimpleTestCase): from django.core.checks.security.base import check_security_middleware return check_security_middleware - @override_settings(MIDDLEWARE_CLASSES=[]) + @override_settings(MIDDLEWARE=[]) def test_no_security_middleware(self): """ - Warn if SecurityMiddleware isn't in MIDDLEWARE_CLASSES. + Warn if SecurityMiddleware isn't in MIDDLEWARE. """ self.assertEqual(self.func(None), [base.W001]) @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.security.SecurityMiddleware"]) + MIDDLEWARE=["django.middleware.security.SecurityMiddleware"]) def test_with_security_middleware(self): self.assertEqual(self.func(None), []) @@ -213,7 +238,7 @@ class CheckStrictTransportSecurityTest(SimpleTestCase): return check_sts @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.security.SecurityMiddleware"], + MIDDLEWARE=["django.middleware.security.SecurityMiddleware"], SECURE_HSTS_SECONDS=0) def test_no_sts(self): """ @@ -222,7 +247,7 @@ class CheckStrictTransportSecurityTest(SimpleTestCase): self.assertEqual(self.func(None), [base.W004]) @override_settings( - MIDDLEWARE_CLASSES=[], + MIDDLEWARE=[], SECURE_HSTS_SECONDS=0) def test_no_sts_no_middleware(self): """ @@ -232,7 +257,7 @@ class CheckStrictTransportSecurityTest(SimpleTestCase): self.assertEqual(self.func(None), []) @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.security.SecurityMiddleware"], + MIDDLEWARE=["django.middleware.security.SecurityMiddleware"], SECURE_HSTS_SECONDS=3600) def test_with_sts(self): self.assertEqual(self.func(None), []) @@ -245,7 +270,7 @@ class CheckStrictTransportSecuritySubdomainsTest(SimpleTestCase): return check_sts_include_subdomains @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.security.SecurityMiddleware"], + MIDDLEWARE=["django.middleware.security.SecurityMiddleware"], SECURE_HSTS_INCLUDE_SUBDOMAINS=False, SECURE_HSTS_SECONDS=3600) def test_no_sts_subdomains(self): @@ -255,7 +280,7 @@ class CheckStrictTransportSecuritySubdomainsTest(SimpleTestCase): self.assertEqual(self.func(None), [base.W005]) @override_settings( - MIDDLEWARE_CLASSES=[], + MIDDLEWARE=[], SECURE_HSTS_INCLUDE_SUBDOMAINS=False, SECURE_HSTS_SECONDS=3600) def test_no_sts_subdomains_no_middleware(self): @@ -265,7 +290,7 @@ class CheckStrictTransportSecuritySubdomainsTest(SimpleTestCase): self.assertEqual(self.func(None), []) @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.security.SecurityMiddleware"], + MIDDLEWARE=["django.middleware.security.SecurityMiddleware"], SECURE_SSL_REDIRECT=False, SECURE_HSTS_SECONDS=None) def test_no_sts_subdomains_no_seconds(self): @@ -275,7 +300,7 @@ class CheckStrictTransportSecuritySubdomainsTest(SimpleTestCase): self.assertEqual(self.func(None), []) @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.security.SecurityMiddleware"], + MIDDLEWARE=["django.middleware.security.SecurityMiddleware"], SECURE_HSTS_INCLUDE_SUBDOMAINS=True, SECURE_HSTS_SECONDS=3600) def test_with_sts_subdomains(self): @@ -288,14 +313,14 @@ class CheckXFrameOptionsMiddlewareTest(SimpleTestCase): from django.core.checks.security.base import check_xframe_options_middleware return check_xframe_options_middleware - @override_settings(MIDDLEWARE_CLASSES=[]) + @override_settings(MIDDLEWARE=[]) def test_middleware_not_installed(self): """ - Warn if XFrameOptionsMiddleware isn't in MIDDLEWARE_CLASSES. + Warn if XFrameOptionsMiddleware isn't in MIDDLEWARE. """ self.assertEqual(self.func(None), [base.W002]) - @override_settings(MIDDLEWARE_CLASSES=["django.middleware.clickjacking.XFrameOptionsMiddleware"]) + @override_settings(MIDDLEWARE=["django.middleware.clickjacking.XFrameOptionsMiddleware"]) def test_middleware_installed(self): self.assertEqual(self.func(None), []) @@ -307,26 +332,26 @@ class CheckXFrameOptionsDenyTest(SimpleTestCase): return check_xframe_deny @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.clickjacking.XFrameOptionsMiddleware"], + MIDDLEWARE=["django.middleware.clickjacking.XFrameOptionsMiddleware"], X_FRAME_OPTIONS='SAMEORIGIN', ) def test_x_frame_options_not_deny(self): """ - Warn if XFrameOptionsMiddleware is in MIDDLEWARE_CLASSES but + Warn if XFrameOptionsMiddleware is in MIDDLEWARE but X_FRAME_OPTIONS isn't 'DENY'. """ self.assertEqual(self.func(None), [base.W019]) - @override_settings(MIDDLEWARE_CLASSES=[], X_FRAME_OPTIONS='SAMEORIGIN') + @override_settings(MIDDLEWARE=[], X_FRAME_OPTIONS='SAMEORIGIN') def test_middleware_not_installed(self): """ - No error if XFrameOptionsMiddleware isn't in MIDDLEWARE_CLASSES even if + No error if XFrameOptionsMiddleware isn't in MIDDLEWARE even if X_FRAME_OPTIONS isn't 'DENY'. """ self.assertEqual(self.func(None), []) @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.clickjacking.XFrameOptionsMiddleware"], + MIDDLEWARE=["django.middleware.clickjacking.XFrameOptionsMiddleware"], X_FRAME_OPTIONS='DENY', ) def test_xframe_deny(self): @@ -340,7 +365,7 @@ class CheckContentTypeNosniffTest(SimpleTestCase): return check_content_type_nosniff @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.security.SecurityMiddleware"], + MIDDLEWARE=["django.middleware.security.SecurityMiddleware"], SECURE_CONTENT_TYPE_NOSNIFF=False) def test_no_content_type_nosniff(self): """ @@ -349,17 +374,17 @@ class CheckContentTypeNosniffTest(SimpleTestCase): self.assertEqual(self.func(None), [base.W006]) @override_settings( - MIDDLEWARE_CLASSES=[], + MIDDLEWARE=[], SECURE_CONTENT_TYPE_NOSNIFF=False) def test_no_content_type_nosniff_no_middleware(self): """ Don't warn if SECURE_CONTENT_TYPE_NOSNIFF isn't True and - SecurityMiddleware isn't in MIDDLEWARE_CLASSES. + SecurityMiddleware isn't in MIDDLEWARE. """ self.assertEqual(self.func(None), []) @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.security.SecurityMiddleware"], + MIDDLEWARE=["django.middleware.security.SecurityMiddleware"], SECURE_CONTENT_TYPE_NOSNIFF=True) def test_with_content_type_nosniff(self): self.assertEqual(self.func(None), []) @@ -372,7 +397,7 @@ class CheckXssFilterTest(SimpleTestCase): return check_xss_filter @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.security.SecurityMiddleware"], + MIDDLEWARE=["django.middleware.security.SecurityMiddleware"], SECURE_BROWSER_XSS_FILTER=False) def test_no_xss_filter(self): """ @@ -381,17 +406,17 @@ class CheckXssFilterTest(SimpleTestCase): self.assertEqual(self.func(None), [base.W007]) @override_settings( - MIDDLEWARE_CLASSES=[], + MIDDLEWARE=[], SECURE_BROWSER_XSS_FILTER=False) def test_no_xss_filter_no_middleware(self): """ Don't warn if SECURE_BROWSER_XSS_FILTER isn't True and - SecurityMiddleware isn't in MIDDLEWARE_CLASSES. + SecurityMiddleware isn't in MIDDLEWARE. """ self.assertEqual(self.func(None), []) @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.security.SecurityMiddleware"], + MIDDLEWARE=["django.middleware.security.SecurityMiddleware"], SECURE_BROWSER_XSS_FILTER=True) def test_with_xss_filter(self): self.assertEqual(self.func(None), []) @@ -404,7 +429,7 @@ class CheckSSLRedirectTest(SimpleTestCase): return check_ssl_redirect @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.security.SecurityMiddleware"], + MIDDLEWARE=["django.middleware.security.SecurityMiddleware"], SECURE_SSL_REDIRECT=False) def test_no_ssl_redirect(self): """ @@ -413,7 +438,7 @@ class CheckSSLRedirectTest(SimpleTestCase): self.assertEqual(self.func(None), [base.W008]) @override_settings( - MIDDLEWARE_CLASSES=[], + MIDDLEWARE=[], SECURE_SSL_REDIRECT=False) def test_no_ssl_redirect_no_middleware(self): """ @@ -423,7 +448,7 @@ class CheckSSLRedirectTest(SimpleTestCase): self.assertEqual(self.func(None), []) @override_settings( - MIDDLEWARE_CLASSES=["django.middleware.security.SecurityMiddleware"], + MIDDLEWARE=["django.middleware.security.SecurityMiddleware"], SECURE_SSL_REDIRECT=True) def test_with_ssl_redirect(self): self.assertEqual(self.func(None), []) |