<commit_before>#!/usr/bin/env python
# coding: utf-8
# Copyright 2013 The LUCI Authors. All rights reserved.
# Use of this source code is governed under the Apache License, Version 2.0
# that can be found in the LICENSE file.

import datetime
import json
import logging
import os
import sys
import unittest

# Setups environment.
import test_env_handlers

import webtest

import handlers_backend
import handlers_frontend
import template
from components import utils
from server import bot_code
from server import bot_management
from server import task_result


class AppTestBase(test_env_handlers.AppTestBase):
  @staticmethod
  def wsgi_app():
    return None

  def setUp(self):
    super(AppTestBase, self).setUp()
    template.bootstrap()
    # By default requests in tests are coming from bot with fake IP.
    self.app = webtest.TestApp(
        self.wsgi_app(),
        extra_environ={
          'REMOTE_ADDR': self.source_ip,
          'SERVER_SOFTWARE': os.environ['SERVER_SOFTWARE'],
        })

  def tearDown(self):
    try:
      template.reset()
    finally:
      super(AppTestBase, self).tearDown()


class FrontendTest(AppTestBase):
  @staticmethod
  def wsgi_app():
    return handlers_frontend.create_application(True)

  def test_root(self):
    response = self.app.get('/', status=200)
    self.assertGreater(len(response.body), 600)

  def test_all_swarming_handlers_secured(self):
    # Test that all handlers are accessible only to authenticated user or
    # bots. Assumes all routes are defined with plain paths (i.e.
    # '/some/handler/path' and not regexps).

    # URL prefixes that correspond to routes that are not protected by swarming
    # app code. It may be routes that do not require login or routes protected
    # by GAE itself via 'login: admin' in app.yaml.
    using_app_login_prefixes = (
      '/auth/',
    )

    public_urls = frozenset([
      '/',
      '/oldui',
      '/_ah/warmup',
      '/api/config/v1/validate',
      '/auth',
      '/ereporter2/api/v1/on_error',
      '/api/discovery/v1/apis',
      '/api/swarming/v1/server/permissions',
      '/swarming/api/v1/client/list',
      '/swarming/api/v1/bot/server_ping',
      '/user/tasks',
      '/restricted/bots',
    ])

    # Grab the set of all routes.
    app = self.app.app
    routes = set(app.router.match_routes)
    routes.update(app.router.build_routes.itervalues())

    # Get all routes that are not protected by GAE auth mechanism.
    routes_to_check = [
      route for route in routes
      if (route.template not in public_urls and
          not route.template.startswith(using_app_login_prefixes))
    ]
<commit_msg>[Swarming] Add public exemption for /api/static/proxy.html<commit_after>#!/usr/bin/env python
# coding: utf-8
# Copyright 2013 The LUCI Authors. All rights reserved.
# Use of this source code is governed under the Apache License, Version 2.0
# that can be found in the LICENSE file.

import datetime
import json
import logging
import os
import sys
import unittest

# Setups environment.
import test_env_handlers

import webtest

import handlers_backend
import handlers_frontend
import template
from components import utils
from server import bot_code
from server import bot_management
from server import task_result


class AppTestBase(test_env_handlers.AppTestBase):
  @staticmethod
  def wsgi_app():
    return None

  def setUp(self):
    super(AppTestBase, self).setUp()
    template.bootstrap()
    # By default requests in tests are coming from bot with fake IP.
    self.app = webtest.TestApp(
        self.wsgi_app(),
        extra_environ={
          'REMOTE_ADDR': self.source_ip,
          'SERVER_SOFTWARE': os.environ['SERVER_SOFTWARE'],
        })

  def tearDown(self):
    try:
      template.reset()
    finally:
      super(AppTestBase, self).tearDown()


class FrontendTest(AppTestBase):
  @staticmethod
  def wsgi_app():
    return handlers_frontend.create_application(True)

  def test_root(self):
    response = self.app.get('/', status=200)
    self.assertGreater(len(response.body), 600)

  def test_all_swarming_handlers_secured(self):
    # Test that all handlers are accessible only to authenticated user or
    # bots. Assumes all routes are defined with plain paths (i.e.
    # '/some/handler/path' and not regexps).

    # URL prefixes that correspond to routes that are not protected by swarming
    # app code. It may be routes that do not require login or routes protected
    # by GAE itself via 'login: admin' in app.yaml.
    using_app_login_prefixes = (
      '/auth/',
    )

    public_urls = frozenset([
      '/',
      '/oldui',
      '/_ah/warmup',
      '/api/config/v1/validate',
      '/auth',
      '/ereporter2/api/v1/on_error',
      '/api/discovery/v1/apis',
      '/api/static/proxy.html',
      '/api/swarming/v1/server/permissions',
      '/swarming/api/v1/client/list',
      '/swarming/api/v1/bot/server_ping',
      '/user/tasks',
      '/restricted/bots',
    ])

    # Grab the set of all routes.
    app = self.app.app
    routes = set(app.router.match_routes)
    routes.update(app.router.build_routes.itervalues())

    # Get all routes that are not protected by GAE auth mechanism.
    routes_to_check = [
      route for route in routes
      if (route.template not in public_urls and
          not route.template.startswith(using_app_login_prefixes))
    ]

{'fraction_non_alphanumeric': 0.09711090400745573, 'fraction_numerical': 0.007455731593662628, 'mean_word_length': 3.0682335102350264, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '6066112', 'n_tokens_mistral': 1717, 'n_tokens_neox': 1651, 'n_words': 482}