forked from LengKundee/MQL5-Google-Onedrive
40 lines
1.4 KiB
Python
40 lines
1.4 KiB
Python
|
import unittest
|
||
|
|
from unittest.mock import patch
|
||
|
|
import os
|
||
|
|
import sys
|
||
|
|
|
||
|
|
# Add scripts directory to path so we can import web_dashboard
|
||
|
|
sys.path.append(os.path.dirname(os.path.abspath(__file__)))
|
||
|
|
|
||
|
|
import web_dashboard
|
||
|
|
from web_dashboard import app
|
||
|
|
|
||
|
|
class TestWebDashboardSecurity(unittest.TestCase):
|
||
|
|
def setUp(self):
|
||
|
|
self.app = app.test_client()
|
||
|
|
self.app.testing = True
|
||
|
|
|
||
|
|
@patch('web_dashboard.get_cached_markdown')
|
||
|
|
def test_error_handling_no_leak(self, mock_get):
|
||
|
|
"""Test that exceptions do not leak internal details."""
|
||
|
|
# Force an exception with sensitive info
|
||
|
|
sensitive_data = "SENSITIVE_INTERNAL_DATA"
|
||
|
|
mock_get.side_effect = Exception(sensitive_data)
|
||
|
|
|
||
|
|
# We need to ensure DASHBOARD_TEMPLATE is None so render() is called and exception happens
|
||
|
|
# (or exception happens inside get_cached_markdown)
|
||
|
|
web_dashboard.DASHBOARD_TEMPLATE = None
|
||
|
|
|
||
|
|
response = self.app.get('/')
|
||
|
|
|
||
|
|
self.assertEqual(response.status_code, 500)
|
||
|
|
|
||
|
|
# In vulnerable code: str(e) is returned -> "Error: SENSITIVE_INTERNAL_DATA"
|
||
|
|
# We want to assert that sensitive_data is NOT in response.data
|
||
|
|
if sensitive_data.encode() in response.data:
|
||
|
|
self.fail(f"SECURITY VULNERABILITY: Response leaked exception details! Found: {response.data}")
|
||
|
|
|
||
|
|
self.assertIn(b"Internal Server Error", response.data)
|
||
|
|
|
||
|
|
if __name__ == '__main__':
|
||
|
|
unittest.main()
|