<commit_before>package org.http4s.server.middleware

import org.http4s._
import org.http4s.dsl._
import org.http4s.headers.{`Set-Cookie` => HCookie}
import fs2.Task
import org.http4s.implicits._
import cats.implicits._

class CSRFSpec extends Http4sSpec {

  val dummyService: HttpService = HttpService {
    case GET -> Root =>
      Thread.sleep(1) //Fix so clock doesn't compute the same nonce, to emulate a real service
      Ok()
  }

  val dummyRequest = Request()

  CSRFMiddleware.withGeneratedKey().map { csrf =>
    "CSRFMiddleware" should {

      "not validate different tokens" in {
        val equalCheck = for {
          t1 <- csrf.generateToken
          t2 <- csrf.generateToken
        } yield CSRFMiddleware.isEqual(t1, t2)

        equalCheck.unsafeValue() must beSome(false)
      }
      "validate for the correct csrf token" in {
        val response = (for {
          token <- csrf.generateToken
          res <- csrf.validate(dummyService).orNotFound(
            dummyRequest
              .addCookie(Cookie(csrf.cookieName, token))
              .putHeaders(Header(csrf.headerName, token))
          )
        } yield res).unsafeValue()

        response.map(_.status) must beSome(Status.Ok)
      }

      "not validate for token missing in cookie" in {
        val response = (for {
          token <- csrf.generateToken
          res <- csrf.validate(dummyService).orNotFound(
            dummyRequest
              .putHeaders(Header(csrf.headerName, token))
          )
        } yield res).unsafeValue()

        response.map(_.status) must beSome(Status.Unauthorized)
      }

      "not validate for token missing in header" in {
        val response = (for {
          token <- csrf.generateToken
          res <- csrf.validate(dummyService).orNotFound(
            dummyRequest
              .addCookie(Cookie(csrf.cookieName, token))
          )
        } yield res).unsafeValue()

        response.map(_.status) must beSome(Status.Unauthorized)
      }

      "not validate if token is missing in both" in {
        val response = csrf.validate(dummyService).orNotFound(dummyRequest).unsafeValue()

        response.map(_.status) must beSome(Status.Unauthorized)
      }

      "not validate for different tokens" in {
        val response = (for {
          token1 <- csrf.generateToken
          token2 <- csrf.generateToken
          res <- csrf.validate(dummyService).orNotFound(
            dummyRequest
              .addCookie(Cookie(csrf.cookieName, token1))
              .putHeaders(Header(csrf.headerName, token2))
          )
        } yield res).unsafeValue()

        response.map(_.status) must beSome(Status.Unauthorized)
      }

      "not return the same token to mitigate BREACH" in {
        val (response, originalToken) = (for {
          token <- csrf.generateToken
          res <- csrf.validate(dummyService).apply(
            dummyRequest
              .addCookie(Cookie(csrf.cookieName, token))
              .putHeaders(Header(csrf.headerName, token))
          )
          c <- Task.now(
            HCookie
              .from(res.orNotFound.headers)
              .map(_.cookie)
              .find(_.name == csrf.cookieName))
        } yield (c, token)).unsafeValue().get
        response.isDefined must_== true
        response.map(_.content) must_!= Some(originalToken)
      }

      "not return a token for a failed CSRF check" in {
        val response = (for {
          token <- csrf.generateToken
          res <- csrf.validate(dummyService).orNotFound(dummyRequest)<commit_msg>make tests consistent<commit_after>package org.http4s.server.middleware

import org.http4s._
import org.http4s.dsl._
import org.http4s.headers.{`Set-Cookie` => HCookie}
import fs2.Task
import org.http4s.implicits._
import cats.implicits._

class CSRFSpec extends Http4sSpec {

  val dummyService: HttpService = HttpService {
    case GET -> Root =>
      Thread.sleep(1) //Fix so clock doesn't compute the same nonce, to emulate a real service
      Ok()
  }

  val dummyRequest = Request()

  CSRFMiddleware.withGeneratedKey().map { csrf =>
    "CSRFMiddleware" should {

      "not validate different tokens" in {
        val equalCheck = for {
          t1 <- csrf.generateToken
          t2 <- csrf.generateToken
        } yield CSRFMiddleware.isEqual(t1, t2)

        equalCheck.unsafeValue() must beSome(false)
      }
      "validate for the correct csrf token" in {
        val response = (for {
          token <- csrf.generateToken
          res <- csrf.validate(dummyService).orNotFound(
            dummyRequest
              .addCookie(Cookie(csrf.cookieName, token))
              .putHeaders(Header(csrf.headerName, token))
          )
        } yield res).unsafeValue().get

        response.status must_== Status.Ok
      }

      "not validate for token missing in cookie" in {
        val response = (for {
          token <- csrf.generateToken
          res <- csrf.validate(dummyService).orNotFound(
            dummyRequest
              .putHeaders(Header(csrf.headerName, token))
          )
        } yield res).unsafeValue().get

        response.status must_== Status.Unauthorized
      }

      "not validate for token missing in header" in {
        val response = (for {
          token <- csrf.generateToken
          res <- csrf.validate(dummyService).orNotFound(
            dummyRequest
              .addCookie(Cookie(csrf.cookieName, token))
          )
        } yield res).unsafeValue().get

        response.status must_== Status.Unauthorized
      }

      "not validate if token is missing in both" in {
        val response = csrf.validate(dummyService).orNotFound(dummyRequest).unsafeValue().get

        response.status must_== Status.Unauthorized
      }

      "not validate for different tokens" in {
        val response = (for {
          token1 <- csrf.generateToken
          token2 <- csrf.generateToken
          res <- csrf.validate(dummyService).orNotFound(
            dummyRequest
              .addCookie(Cookie(csrf.cookieName, token1))
              .putHeaders(Header(csrf.headerName, token2))
          )
        } yield res).unsafeValue().get

        response.status must_== Status.Unauthorized
      }

      "not return the same token to mitigate BREACH" in {
        val (response, originalToken) = (for {
          token <- csrf.generateToken
          res <- csrf.validate(dummyService).apply(
            dummyRequest
              .addCookie(Cookie(csrf.cookieName, token))
              .putHeaders(Header(csrf.headerName, token))
          )
          c <- Task.now(
            HCookie
              .from(res.orNotFound.headers)
              .map(_.cookie)
              .find(_.name == csrf.cookieName))
        } yield (c, token)).unsafeValue().get
        response.isDefined must_== true
        response.map(_.content) must_!= Some(originalToken)
      }

      "not return a token for a failed CSRF check" in {
        val response = (for {
          token <- csrf.generateToken
          res <- csrf.validate(dummyService).orNotFound(dummyRequest)
{'fraction_non_alphanumeric': 0.0998589562764457, 'fraction_numerical': 0.004513399153737658, 'mean_word_length': 2.0472711645896005, 'pattern_counts': {'":': 0, '<': 35, '<?xml version=': 0, '>': 11, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '3435946', 'n_tokens_mistral': 2020, 'n_tokens_neox': 1980, 'n_words': 463}