Mirror
/
zulip
mirror of https://github.com/zulip/zulip.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity
zulip/zerver/tests/test_compatibility.py

114 lines
5.3 KiB
Python
Raw Normal View History

version: Move minimum desktop version configuration to version.py. This makes it relatively easy for a system administrator to temporarily override these values after a desktop app security release that they want to ensure all of their users take. We're not putting this in settings, since we don't want to encourage accidental long-term overrides of these important-to-security values.
2020-04-01 22:11:26 +02:00
import mock
mobile: Add an endpoint for checking compatibility.
2017-01-30 07:21:13 +01:00
from zerver.lib.test_classes import ZulipTestCase
compatibility: Add more strict desktop app blocking. This allows us to block use of the desktop app with insecure versions (we simply fail to load the Zulip webapp at all, instead rendering an error page). For now we block only versions that are known to be both insecure and not auto-updating, but we can easily adjust these parameters in the future.
2020-03-25 02:00:28 +01:00
from zerver.views.compatibility import find_mobile_os, version_lt, is_outdated_desktop_app
compatibility: Implement a version comparator.
2018-12-04 23:22:05 +01:00
class VersionTest(ZulipTestCase):
data = [case.split() for case in '''
1.2.3 < 1.2.4
1.2.3 = 1.2.3
1.4.1 > 1.2.3
1.002a = 1.2a
compatibility: Make 1.2 < 1.2.3; rewrite version_lt internals.
2018-12-05 00:00:56 +01:00
1.2 < 1.2.3
compatibility: Implement a version comparator.
2018-12-04 23:22:05 +01:00
1.2.3 ? 1.2-dev
1.2-dev ? 1.2a
1.2a ? 1.2rc3
1.2rc3 ? 1.2
1.2 ? 1.2-g0f1e2d3c4
10.1 > 1.2
0.17.18 < 16.2.96
9.10.11 < 16.2.96
15.1.95 < 16.2.96
16.2.96 = 16.2.96
20.0.103 > 16.2.96
compatibility: Treat empty version as unknown, not old.
2018-12-05 00:06:46 +01:00
'''.strip().split('\n')] + [
['', '?', '1'],
['', '?', 'a'],
]
compatibility: Implement a version comparator.
2018-12-04 23:22:05 +01:00
def test_version_lt(self) -> None:
for ver1, cmp, ver2 in self.data:
msg = 'expected {} {} {}'.format(ver1, cmp, ver2)
if cmp == '<':
self.assertTrue(version_lt(ver1, ver2), msg=msg)
self.assertFalse(version_lt(ver2, ver1), msg=msg)
elif cmp == '=':
self.assertFalse(version_lt(ver1, ver2), msg=msg)
self.assertFalse(version_lt(ver2, ver1), msg=msg)
elif cmp == '>':
self.assertFalse(version_lt(ver1, ver2), msg=msg)
self.assertTrue(version_lt(ver2, ver1), msg=msg)
elif cmp == '?':
self.assertIsNone(version_lt(ver1, ver2), msg=msg)
self.assertIsNone(version_lt(ver2, ver1), msg=msg)
else:
assert False # nocoverage
mobile: Add an endpoint for checking compatibility.
2017-01-30 07:21:13 +01:00
compatibility: Add and test a helper find_mobile_os.
2018-12-05 00:46:52 +01:00
mobile_os_data = [case.split(None, 1) for case in '''
android ZulipMobile/1.2.3 (Android 4.5)
ios ZulipMobile/1.2.3 (iPhone OS 2.1)
ios ZulipMobile/1.2.3 (iOS 6)
None ZulipMobile/1.2.3 (Windows 8)
'''.strip().split('\n')]
def test_find_mobile_os(self) -> None:
for expected_, user_agent in self.mobile_os_data:
expected = None if expected_ == 'None' else expected_
self.assertEqual(find_mobile_os(user_agent), expected,
msg=user_agent)
mobile: Add an endpoint for checking compatibility.
2017-01-30 07:21:13 +01:00
class CompatibilityTest(ZulipTestCase):
compatibility: Add test data from real server logs. In a quick scan of today's nginx logs on chat.zulip.org, there were 20 distinct user-agents that begin with 'ZulipMobile/'. Here's a representative sampling of them, such that the rest were all boringly similar to one of these. First, to make room for these without an excess of copy-paste and overlong lines, convert this test to a data-oriented style. The existing, synthetic cases appear in the new data followed by the seen-in-the-wild cases. Happily, the code being tested passes all these new cases unchanged.
2018-12-05 01:07:58 +01:00
data = [case.split(None, 1) for case in '''
old ZulipInvalid/5.0
ok ZulipMobile/5.0
ok ZulipMobile/5.0 (iOS 11)
ok ZulipMobile/5.0 (Androidish 9)
old ZulipMobile/5.0 (Android 9)
old ZulipMobile/15.1.95 (Android 9)
old ZulipMobile/16.1.94 (Android 9)
ok ZulipMobile/16.2.96 (Android 9)
ok ZulipMobile/20.0.103 (Android 9)
ok ZulipMobile/0.7.1.1 (iOS 11.4)
old ZulipMobile/1.0.13 (Android 9)
ok ZulipMobile/17.1.98 (iOS 12.0)
ok ZulipMobile/19.2.102 (Android 6.0)
ok ZulipMobile/1 CFNetwork/974.2.1 Darwin/18.0.0
ok ZulipMobile/20.0.103 (Android 6.0.1)
ok ZulipMobile/20.0.103 (iOS 12.1)
'''.strip().split('\n') if case]
compatibility: Rewrite verbose test for compact legibility. This will facilitate adding a bunch more test cases shortly.
2018-12-05 00:17:02 +01:00
compatibility: Respond with HTTP 400 when no User-Agent header. Prior to this commit, a request to /compatibility without a User-Agent header would result in the server 500ing.
2018-12-10 22:42:28 +01:00
def test_compatibility_without_user_agent(self) -> None:
test_classes: Use realistic web and mobile User-Agent strings. This fixes a confusing aspect of how our automated tests worked previously, where we'd almost all HTTP requests in the unlikely configuration with no User-Agent string specified. We need to adjust query counts in a few tests that now are a bit cheaper because they now can take advantage of a Client object created in server_initialization.py in `process_client`.
2020-02-25 02:53:12 +01:00
result = self.client_get("/compatibility", skip_user_agent=True)
compatibility: Respond with HTTP 400 when no User-Agent header. Prior to this commit, a request to /compatibility without a User-Agent header would result in the server 500ing.
2018-12-10 22:42:28 +01:00
self.assert_json_error(result, 'User-Agent header missing from request')
compatibility: Add test data from real server logs. In a quick scan of today's nginx logs on chat.zulip.org, there were 20 distinct user-agents that begin with 'ZulipMobile/'. Here's a representative sampling of them, such that the rest were all boringly similar to one of these. First, to make room for these without an excess of copy-paste and overlong lines, convert this test to a data-oriented style. The existing, synthetic cases appear in the new data followed by the seen-in-the-wild cases. Happily, the code being tested passes all these new cases unchanged.
2018-12-05 01:07:58 +01:00
def test_compatibility(self) -> None:
for expected, user_agent in self.data:
result = self.client_get("/compatibility",
HTTP_USER_AGENT=user_agent)
if expected == 'ok':
self.assert_json_success(result)
elif expected == 'old':
self.assert_json_error(result, "Client is too old")
else:
assert False # nocoverage
panels: Show a banner for users with legacy desktop apps. Users who are using ZulipDesktop or haven't managed to auto-update to ZulipElectron should be strongly encouraged to upgrade. We'll likely want to move to something even stricter that blocks loading the app at all, but this is a good start.
2020-02-28 09:55:29 +01:00
def test_insecure_desktop_app(self) -> None:
compatibility: Add more strict desktop app blocking. This allows us to block use of the desktop app with insecure versions (we simply fail to load the Zulip webapp at all, instead rendering an error page). For now we block only versions that are known to be both insecure and not auto-updating, but we can easily adjust these parameters in the future.
2020-03-25 02:00:28 +01:00
self.assertEqual(is_outdated_desktop_app('ZulipDesktop/0.5.2 (Mac)'), (True, True, True))
self.assertEqual(is_outdated_desktop_app('ZulipElectron/2.3.82 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Zulip/2.3.82 Chrome/61.0.3163.100 Electron/2.0.9 Safari/537.36'), (True, True, True))
version: Move minimum desktop version configuration to version.py. This makes it relatively easy for a system administrator to temporarily override these values after a desktop app security release that they want to ensure all of their users take. We're not putting this in settings, since we don't want to encourage accidental long-term overrides of these important-to-security values.
2020-04-01 22:11:26 +02:00
self.assertEqual(is_outdated_desktop_app('ZulipElectron/4.0.0 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Zulip/4.0.3 Chrome/66.0.3359.181 Electron/3.1.10 Safari/537.36'), (True, True, False))
self.assertEqual(is_outdated_desktop_app('ZulipElectron/4.0.3 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Zulip/4.0.3 Chrome/66.0.3359.181 Electron/3.1.10 Safari/537.36'), (True, True, False))
# Verify what happens if DESKTOP_MINIMUM_VERSION < v < DESKTOP_WARNING_VERSION
with mock.patch('zerver.views.compatibility.DESKTOP_MINIMUM_VERSION', '4.0.3'):
self.assertEqual(is_outdated_desktop_app('ZulipElectron/4.0.3 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Zulip/4.0.3 Chrome/66.0.3359.181 Electron/3.1.10 Safari/537.36'), (True, False, False))
self.assertEqual(is_outdated_desktop_app('ZulipElectron/5.0.0 Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_3) AppleWebKit/537.36 (KHTML, like Gecko) Zulip/4.0.3 Chrome/66.0.3359.181 Electron/3.1.10 Safari/537.36'), (False, False, False))
panels: Show a banner for users with legacy desktop apps. Users who are using ZulipDesktop or haven't managed to auto-update to ZulipElectron should be strongly encouraged to upgrade. We'll likely want to move to something even stricter that blocks loading the app at all, but this is a good start.
2020-02-28 09:55:29 +01:00
compatibility: Add more strict desktop app blocking. This allows us to block use of the desktop app with insecure versions (we simply fail to load the Zulip webapp at all, instead rendering an error page). For now we block only versions that are known to be both insecure and not auto-updating, but we can easily adjust these parameters in the future.
2020-03-25 02:00:28 +01:00
self.assertEqual(is_outdated_desktop_app('Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36'), (False, False, False))
home: Don't assume user agent header is set for insecure_desktop_app. The header may not be set - this leads to CI failures on 2.1.x branch, but in any case is a real bug.
2020-02-28 15:54:30 +01:00
compatibility: Add more strict desktop app blocking. This allows us to block use of the desktop app with insecure versions (we simply fail to load the Zulip webapp at all, instead rendering an error page). For now we block only versions that are known to be both insecure and not auto-updating, but we can easily adjust these parameters in the future.
2020-03-25 02:00:28 +01:00
self.assertEqual(is_outdated_desktop_app(''), (False, False, False))