package org.jboss.resteasy.test.xxe;

import java.io.File;

import javax.ws.rs.client.Entity;
import javax.ws.rs.core.MediaType;
import javax.ws.rs.core.Response;


import org.apache.logging.log4j.LogManager;
import org.apache.logging.log4j.Logger;
import org.jboss.arquillian.container.test.api.Deployment;
import org.jboss.arquillian.container.test.api.RunAsClient;
import org.jboss.arquillian.junit.Arquillian;
import org.jboss.resteasy.client.jaxrs.ResteasyClient;
import org.jboss.resteasy.client.jaxrs.ResteasyClientBuilder;
import org.jboss.resteasy.test.xxe.resource.ExternalParameterEntityResource;
import org.jboss.resteasy.test.xxe.resource.ExternalParameterEntityWrapper;
import org.jboss.resteasy.util.HttpResponseCodes;
import org.jboss.resteasy.utils.TestUtil;
import org.jboss.shrinkwrap.api.Archive;
import org.jboss.shrinkwrap.api.spec.WebArchive;
import org.junit.After;
import org.junit.Assert;
import org.junit.Before;
import org.junit.Test;
import org.junit.runner.RunWith;

import static org.jboss.resteasy.utils.PortProviderUtil.generateURL;

/**
 * @tpSubChapter XXE
 * @tpChapter Integration tests
 * @tpTestCaseDetails Regression test for RESTEASY-1073.
 *      External parameter entities should be disabled when the resteasy.document.expand.entity.references parameter was set to false.
 *      A remote attacker able to send XML requests to a RESTEasy endpoint could use this flaw to read files accessible to the user
 *      running the application server, and potentially perform other more advanced XXE attacks.
 * @tpSince RESTEasy 3.0.16
 */
@RunWith(Arquillian.class)
@RunAsClient
public class ExternalParameterEntityTest {

   protected final Logger logger = LogManager.getLogger(ExternalParameterEntityTest.class.getName());
   static ResteasyClient client;

   private static final String EXPAND = "war_expand";
   private static final String NO_EXPAND = "war_no_expand";

   private String passwdFile = new File(TestUtil.getResourcePath(ExternalParameterEntityTest.class, "ExternalParameterEntityPasswd")).getAbsolutePath();
   private String dtdFile = new File(TestUtil.getResourcePath(ExternalParameterEntityTest.class, "ExternalParameterEntity.dtd")).getAbsolutePath();

   private String request =
         "<!DOCTYPE foo [\r" +
         "  <!ENTITY % file SYSTEM \"" + passwdFile + "\">\r" +
         "  <!ENTITY % start \"<![CDATA[\">\r" +
         "  <!ENTITY % end \"]]>\">\r" +
         "  <!ENTITY % dtd SYSTEM \"" + dtdFile + "\">\r" +
         "%dtd;\r" +
         "]>\r" +
         "<externalParameterEntityWrapper><name>&xxe;</name></externalParameterEntityWrapper>";

   @Deployment(name = EXPAND, order = 1)
   public static Archive<?> createTestArchive1() {
      WebArchive war = TestUtil.prepareArchive(EXPAND);
      war.addClass(ExternalParameterEntityWrapper.class);
      war.addAsWebInfResource(ExternalParameterEntityTest.class.getPackage(), "ExternalParameterEntityExpandWeb.xml", "web.xml");
      return TestUtil.finishContainerPrepare(war, null, ExternalParameterEntityResource.class);
   }

   @Deployment(name = NO_EXPAND, order = 2)
   public static Archive<?> createTestArchive2() {
      WebArchive war = TestUtil.prepareArchive(NO_EXPAND);
      war.addClass(ExternalParameterEntityWrapper.class);
      war.addAsWebInfResource(ExternalParameterEntityTest.class.getPackage(), "ExternalParameterEntityNoExpandWeb.xml", "web.xml");
      return TestUtil.finishContainerPrepare(war, null, ExternalParameterEntityResource.class);
   }

   @Before
   public void init() {
      client = new ResteasyClientBuilder().build();
   }

   @After
   public void after() throws Exception {
      client.close();
   }

   /**
    * @tpTestDetails "resteasy.document.expand.entity.references" is set to "true"
    * @tpPassCrit Passwd file should be returned by request.
    * @tpSince RESTEasy 3.0.16
    */
   @Test
   public void testExternalParameterEntityExpand() throws Exception {
      logger.info(String.format("Request body: %s", this.request.replace('\r', '\n')));
      Response response = client.target(generateURL("/test", EXPAND)).request()
            .post(Entity.entity(this.request, MediaType.APPLICATION_XML));
      Assert.assertEquals(HttpResponseCodes.SC_OK, response.getStatus());
      String entity = response.readEntity(String.class);
      logger.info(String.format("Result: \"%s\"", entity.replace('\r', '\n')));
      Assert.assertEquals("root:x:0:0:root:/root:/bin/bash", entity.trim());
   }

   /**
    * @tpTestDetails "resteasy.document.expand.entity.references" is set to "false"
    * @tpPassCrit Passwd file should not be returned by request.
    * @tpSince RESTEasy 3.0.16
    */
   @Test
   public void testExternalParameterEntityNoExpand() throws Exception {
      logger.info(String.format("Request body: %s", this.request.replace('\r', '\n')));
      Response response = client.target(generateURL("/test", NO_EXPAND)).request()
            .post(Entity.entity(this.request, MediaType.APPLICATION_XML));
      Assert.assertEquals(HttpResponseCodes.SC_OK, response.getStatus());
      String entity = response.readEntity(String.class);
      logger.info(String.format("Result: \"%s\"", entity.replace('\r', '\n')));
      Assert.assertEquals("", entity.trim());
   }
}
