discourse/spec/controllers/onebox_controller_spec.rb

require 'rails_helper'

describe OneboxController do

  let(:url) { "http://google.com" }

  it "requires the user to be logged in" do
    get :show, params: { url: url }, format: :json
    expect(response.status).to eq(403)
  end

  describe "logged in" do

    before { @user = log_in(:admin) }

    it 'invalidates the cache if refresh is passed' do
      Oneboxer.expects(:preview).with(url, invalidate_oneboxes: true, user_id: @user.id, category_id: 0, topic_id: 0)
      get :show, params: { url: url, refresh: 'true' }, format: :json
    end

    describe "cached onebox" do

      it "returns the cached onebox response in the body" do
        onebox_html = <<~HTML
          <html>
          <head>
            <meta property="og:title" content="Fred the title">
            <meta property="og:description" content="this is bodycontent">
          </head>
          <body>
             <p>body</p>
          </body>
          <html>
        HTML

        url = "http://noodle.com/"

        stub_request(:head, url)
        stub_request(:get, url).to_return(body: onebox_html).then.to_raise

        get :show, params: { url: url, refresh: "true" }, format: :json

        expect(response).to be_success
        expect(response.body).to include('Fred')
        expect(response.body).to include('bodycontent')

        get :show, params: { url: url }, format: :json
        expect(response).to be_success
        expect(response.body).to include('Fred')
        expect(response.body).to include('bodycontent')
      end

    end

    describe "only 1 outgoing preview per user" do

      it "returns 429" do
        Oneboxer.expects(:is_previewing?).returns(true)
        get :show, params: { url: url }, format: :json
        expect(response.status).to eq(429)
      end

    end

    describe "found onebox" do

      let(:body) { "this is the onebox body" }

      before do
        Oneboxer.expects(:preview).returns(body)
        get :show, params: { url: url }, format: :json
      end

      it 'returns the onebox response in the body' do
        expect(response).to be_success
        expect(response.body).to eq(body)
      end

    end

    describe "missing onebox" do

      it "returns 404 if the onebox is nil" do
        Oneboxer.expects(:preview).returns(nil)
        get :show, params: { url: url }, format: :json
        expect(response.response_code).to eq(404)
      end

      it "returns 404 if the onebox is an empty string" do
        Oneboxer.expects(:preview).returns(" \t ")
        get :show, params: { url: url }, format: :json
        expect(response.response_code).to eq(404)
      end

    end

    describe "local onebox" do

      it 'does not cache local oneboxes' do
        post = create_post
        url = Discourse.base_url + post.url

        get :show, params: { url: url, category_id: post.topic.category_id }, format: :json
        expect(response.body).to include('blockquote')

        post.trash!

        get :show, params: { url: url, category_id: post.topic.category_id }, format: :json
        expect(response.body).not_to include('blockquote')
      end
    end

    it 'does not onebox when you have no permission on category' do
      log_in

      post = create_post
      url = Discourse.base_url + post.url

      get :show, params: { url: url, category_id: post.topic.category_id }, format: :json
      expect(response.body).to include('blockquote')

      post.topic.category.set_permissions(staff: :full)
      post.topic.category.save

      get :show, params: { url: url, category_id: post.topic.category_id }, format: :json
      expect(response.body).not_to include('blockquote')
    end

    it 'does not allow onebox of PMs' do
      user = log_in

      post = create_post(archetype: 'private_message', target_usernames: [user.username])
      url = Discourse.base_url + post.url

      get :show, params: { url: url }, format: :json
      expect(response.body).not_to include('blockquote')
    end

    it 'does not allow whisper onebox' do
      log_in

      post = create_post
      whisper = create_post(topic_id: post.topic_id, post_type: Post.types[:whisper])
      url = Discourse.base_url + whisper.url

      get :show, params: { url: url }, format: :json
      expect(response.body).not_to include('blockquote')
    end

    it 'allows onebox to public topics/posts in PM' do
      log_in

      post = create_post
      url = Discourse.base_url + post.url

      get :show, params: { url: url }, format: :json
      expect(response.body).to include('blockquote')
    end

  end

end
Prepare for separation of RSpec helper files Since rspec-rails 3, the default installation creates two helper files: * `spec_helper.rb` * `rails_helper.rb` `spec_helper.rb` is intended as a way of running specs that do not require Rails, whereas `rails_helper.rb` loads Rails (as Discourse's current `spec_helper.rb` does). For more information: https://www.relishapp.com/rspec/rspec-rails/docs/upgrade#default-helper-files In this commit, I've simply replaced all instances of `spec_helper` with `rails_helper`, and renamed the original `spec_helper.rb`. This brings the Discourse project closer to the standard usage of RSpec in a Rails app. At present, every spec relies on loading Rails, but there are likely many that don't need to. In a future pull request, I hope to introduce a separate, minimal `spec_helper.rb` which can be used in tests which don't rely on Rails. 2015-10-11 05:41:23 -04:00			`require 'rails_helper'`
Initial release of Discourse 2013-02-05 14:16:51 -05:00
			`describe OneboxController do`

Fix onebox loading on every keystroke after a request fails. 2013-03-05 14:03:50 -05:00			`let(:url) { "http://google.com" }`
Initial release of Discourse 2013-02-05 14:16:51 -05:00
FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00			`it "requires the user to be logged in" do`
FIX: return 429 when admin api key is limited on admin route This also handles a general case where exceptions leak out prior to being handled by the application controller 2018-01-11 22:15:10 -05:00			`get :show, params: { url: url }, format: :json`
			`expect(response.status).to eq(403)`
Fix onebox loading on every keystroke after a request fails. 2013-03-05 14:03:50 -05:00			`end`

FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00			`describe "logged in" do`
Fix onebox loading on every keystroke after a request fails. 2013-03-05 14:03:50 -05:00
FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00			`before { @user = log_in(:admin) }`
Fix onebox loading on every keystroke after a request fails. 2013-03-05 14:03:50 -05:00
FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00			`it 'invalidates the cache if refresh is passed' do`
fix the build 2018-02-19 16:52:54 -05:00			`Oneboxer.expects(:preview).with(url, invalidate_oneboxes: true, user_id: @user.id, category_id: 0, topic_id: 0)`
SECURITY: correct local onebox category checks Also removes ugly "source_topic_id" from cooked posts Patch was authored by @zogstrip Signed-off-by: Sam <sam.saffron@gmail.com> 2018-02-13 18:39:44 -05:00			`get :show, params: { url: url, refresh: 'true' }, format: :json`
Fix onebox loading on every keystroke after a request fails. 2013-03-05 14:03:50 -05:00			`end`

FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00			`describe "cached onebox" do`

PERF: hijack onebox requests so they do not use up a unicorn worker 2017-11-23 23:31:23 -05:00			`it "returns the cached onebox response in the body" do`
			`onebox_html = <<~HTML`
			`<html>`
			`<head>`
			`<meta property="og:title" content="Fred the title">`
			`<meta property="og:description" content="this is bodycontent">`
			`</head>`
			`<body>`
			`<p>body</p>`
			`</body>`
			`<html>`
			`HTML`
FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00
PERF: hijack onebox requests so they do not use up a unicorn worker 2017-11-23 23:31:23 -05:00			`url = "http://noodle.com/"`
FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00
FIX: don't double request when downloading a file 2018-02-24 06:35:57 -05:00			`stub_request(:head, url)`
			`stub_request(:get, url).to_return(body: onebox_html).then.to_raise`
PERF: hijack onebox requests so they do not use up a unicorn worker 2017-11-23 23:31:23 -05:00
SECURITY: correct local onebox category checks Also removes ugly "source_topic_id" from cooked posts Patch was authored by @zogstrip Signed-off-by: Sam <sam.saffron@gmail.com> 2018-02-13 18:39:44 -05:00			`get :show, params: { url: url, refresh: "true" }, format: :json`
PERF: hijack onebox requests so they do not use up a unicorn worker 2017-11-23 23:31:23 -05:00
			`expect(response).to be_success`
			`expect(response.body).to include('Fred')`
			`expect(response.body).to include('bodycontent')`

SECURITY: correct local onebox category checks Also removes ugly "source_topic_id" from cooked posts Patch was authored by @zogstrip Signed-off-by: Sam <sam.saffron@gmail.com> 2018-02-13 18:39:44 -05:00			`get :show, params: { url: url }, format: :json`
Fix all the errors to get our tests green on Rails 5.1. 2017-08-31 00:06:56 -04:00			`expect(response).to be_success`
PERF: hijack onebox requests so they do not use up a unicorn worker 2017-11-23 23:31:23 -05:00			`expect(response.body).to include('Fred')`
			`expect(response.body).to include('bodycontent')`
FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00			`end`

Fix onebox loading on every keystroke after a request fails. 2013-03-05 14:03:50 -05:00			`end`

FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00			`describe "only 1 outgoing preview per user" do`

			`it "returns 429" do`
			`Oneboxer.expects(:is_previewing?).returns(true)`
SECURITY: correct local onebox category checks Also removes ugly "source_topic_id" from cooked posts Patch was authored by @zogstrip Signed-off-by: Sam <sam.saffron@gmail.com> 2018-02-13 18:39:44 -05:00			`get :show, params: { url: url }, format: :json`
FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00			`expect(response.status).to eq(429)`
			`end`

Fix onebox loading on every keystroke after a request fails. 2013-03-05 14:03:50 -05:00			`end`

FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00			`describe "found onebox" do`

Add rubocop to our build. (#5004) 2017-07-27 21:20:09 -04:00			`let(:body) { "this is the onebox body" }`
FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00
			`before do`
SECURITY: correct local onebox category checks Also removes ugly "source_topic_id" from cooked posts Patch was authored by @zogstrip Signed-off-by: Sam <sam.saffron@gmail.com> 2018-02-13 18:39:44 -05:00			`Oneboxer.expects(:preview).returns(body)`
			`get :show, params: { url: url }, format: :json`
FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00			`end`
Fix onebox loading on every keystroke after a request fails. 2013-03-05 14:03:50 -05:00
FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00			`it 'returns the onebox response in the body' do`
Fix all the errors to get our tests green on Rails 5.1. 2017-08-31 00:06:56 -04:00			`expect(response).to be_success`
FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00			`expect(response.body).to eq(body)`
			`end`
Fix onebox loading on every keystroke after a request fails. 2013-03-05 14:03:50 -05:00
			`end`

FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00			`describe "missing onebox" do`

			`it "returns 404 if the onebox is nil" do`
SECURITY: correct local onebox category checks Also removes ugly "source_topic_id" from cooked posts Patch was authored by @zogstrip Signed-off-by: Sam <sam.saffron@gmail.com> 2018-02-13 18:39:44 -05:00			`Oneboxer.expects(:preview).returns(nil)`
			`get :show, params: { url: url }, format: :json`
FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00			`expect(response.response_code).to eq(404)`
			`end`

			`it "returns 404 if the onebox is an empty string" do`
SECURITY: correct local onebox category checks Also removes ugly "source_topic_id" from cooked posts Patch was authored by @zogstrip Signed-off-by: Sam <sam.saffron@gmail.com> 2018-02-13 18:39:44 -05:00			`Oneboxer.expects(:preview).returns(" \t ")`
			`get :show, params: { url: url }, format: :json`
FIX: prevent DDoS with lots of _oneboxable_ links FIX: ensure the onebox route is only allowed to logged in users FIX: only allow 1 outgoing onebox preview per user FIX: client should only do 1 preview at a time 2016-12-19 18:31:10 -05:00			`expect(response.response_code).to eq(404)`
			`end`

Fix onebox loading on every keystroke after a request fails. 2013-03-05 14:03:50 -05:00			`end`

SECURITY: correct local onebox category checks Also removes ugly "source_topic_id" from cooked posts Patch was authored by @zogstrip Signed-off-by: Sam <sam.saffron@gmail.com> 2018-02-13 18:39:44 -05:00			`describe "local onebox" do`

			`it 'does not cache local oneboxes' do`
FIX: allow local oneboxes to public topics/posts in PM 2018-02-15 12:13:57 -05:00			`post = create_post`
			`url = Discourse.base_url + post.url`
SECURITY: correct local onebox category checks Also removes ugly "source_topic_id" from cooked posts Patch was authored by @zogstrip Signed-off-by: Sam <sam.saffron@gmail.com> 2018-02-13 18:39:44 -05:00
FIX: allow local oneboxes to public topics/posts in PM 2018-02-15 12:13:57 -05:00			`get :show, params: { url: url, category_id: post.topic.category_id }, format: :json`
SECURITY: correct local onebox category checks Also removes ugly "source_topic_id" from cooked posts Patch was authored by @zogstrip Signed-off-by: Sam <sam.saffron@gmail.com> 2018-02-13 18:39:44 -05:00			`expect(response.body).to include('blockquote')`

FIX: allow local oneboxes to public topics/posts in PM 2018-02-15 12:13:57 -05:00			`post.trash!`
SECURITY: correct local onebox category checks Also removes ugly "source_topic_id" from cooked posts Patch was authored by @zogstrip Signed-off-by: Sam <sam.saffron@gmail.com> 2018-02-13 18:39:44 -05:00
FIX: allow local oneboxes to public topics/posts in PM 2018-02-15 12:13:57 -05:00			`get :show, params: { url: url, category_id: post.topic.category_id }, format: :json`
SECURITY: correct local onebox category checks Also removes ugly "source_topic_id" from cooked posts Patch was authored by @zogstrip Signed-off-by: Sam <sam.saffron@gmail.com> 2018-02-13 18:39:44 -05:00			`expect(response.body).not_to include('blockquote')`
			`end`
			`end`

FIX: allow local oneboxes to public topics/posts in PM 2018-02-15 12:13:57 -05:00			`it 'does not onebox when you have no permission on category' do`
			`log_in`

			`post = create_post`
			`url = Discourse.base_url + post.url`

			`get :show, params: { url: url, category_id: post.topic.category_id }, format: :json`
			`expect(response.body).to include('blockquote')`
SECURITY: correct local onebox category checks Also removes ugly "source_topic_id" from cooked posts Patch was authored by @zogstrip Signed-off-by: Sam <sam.saffron@gmail.com> 2018-02-13 18:39:44 -05:00
FIX: allow local oneboxes to public topics/posts in PM 2018-02-15 12:13:57 -05:00			`post.topic.category.set_permissions(staff: :full)`
			`post.topic.category.save`
SECURITY: correct local onebox category checks Also removes ugly "source_topic_id" from cooked posts Patch was authored by @zogstrip Signed-off-by: Sam <sam.saffron@gmail.com> 2018-02-13 18:39:44 -05:00
FIX: allow local oneboxes to public topics/posts in PM 2018-02-15 12:13:57 -05:00			`get :show, params: { url: url, category_id: post.topic.category_id }, format: :json`
			`expect(response.body).not_to include('blockquote')`
			`end`

FIX: oneboxing to private messages 2018-02-15 16:00:06 -05:00			`it 'does not allow onebox of PMs' do`
			`user = log_in`

			`post = create_post(archetype: 'private_message', target_usernames: [user.username])`
			`url = Discourse.base_url + post.url`

			`get :show, params: { url: url }, format: :json`
			`expect(response.body).not_to include('blockquote')`
			`end`

SECURITY: don't onebox whispers 2018-02-15 16:56:13 -05:00			`it 'does not allow whisper onebox' do`
			`log_in`

			`post = create_post`
			`whisper = create_post(topic_id: post.topic_id, post_type: Post.types[:whisper])`
			`url = Discourse.base_url + whisper.url`

			`get :show, params: { url: url }, format: :json`
			`expect(response.body).not_to include('blockquote')`
			`end`

FIX: allow local oneboxes to public topics/posts in PM 2018-02-15 12:13:57 -05:00			`it 'allows onebox to public topics/posts in PM' do`
			`log_in`
SECURITY: correct local onebox category checks Also removes ugly "source_topic_id" from cooked posts Patch was authored by @zogstrip Signed-off-by: Sam <sam.saffron@gmail.com> 2018-02-13 18:39:44 -05:00
FIX: allow local oneboxes to public topics/posts in PM 2018-02-15 12:13:57 -05:00			`post = create_post`
			`url = Discourse.base_url + post.url`
SECURITY: correct local onebox category checks Also removes ugly "source_topic_id" from cooked posts Patch was authored by @zogstrip Signed-off-by: Sam <sam.saffron@gmail.com> 2018-02-13 18:39:44 -05:00
FIX: allow local oneboxes to public topics/posts in PM 2018-02-15 12:13:57 -05:00			`get :show, params: { url: url }, format: :json`
			`expect(response.body).to include('blockquote')`
			`end`
SECURITY: correct local onebox category checks Also removes ugly "source_topic_id" from cooked posts Patch was authored by @zogstrip Signed-off-by: Sam <sam.saffron@gmail.com> 2018-02-13 18:39:44 -05:00
Initial release of Discourse 2013-02-05 14:16:51 -05:00			`end`

			`end`