GitVita
New repositoryImport repositoryNew issue
Your repositories Your dashboard Sign in

microsoft/teams.net

Public

mirrored fromhttps://github.com/microsoft/teams.netAvailable

Watch0Fork0Star0
CodeCommitsIssuesPull requestsActionsInsightsSecurity
v2.0.8

Branches

Tags

  • No tags available.
0Branches0Tags
Go to file
Add file
Code

Clone

HTTPS

Download ZIP

teams.net/core/test/Microsoft.Teams.Core.UnitTests

core/test/Microsoft.Teams.Core.UnitTests/HttpRequestExtensionsTests.cs

124lines · modecode

RawDownload
Latest commit unavailable.
1// Copyright (c) Microsoft Corporation.
2// Licensed under the MIT License.
3
4using Microsoft.AspNetCore.Http;
5
6namespace Microsoft.Teams.Core.UnitTests;
7
8public class HttpRequestExtensionsTests
9{
10 [Fact]
11 public void GetCorrelationVector_WithValidValue_ReturnsValue()
12 {
13 DefaultHttpContext httpContext = new();
14 httpContext.Request.Headers["MS-CV"] = "valid-correlation-vector";
15
16 string? result = httpContext.Request.GetCorrelationVector();
17
18 Assert.Equal("valid-correlation-vector", result);
19 }
20
21 [Fact]
22 public void GetCorrelationVector_WithNewlineCharacters_SanitizesValue()
23 {
24 DefaultHttpContext httpContext = new();
25 httpContext.Request.Headers["MS-CV"] = $"correlation{Environment.NewLine}vector{Environment.NewLine}with{Environment.NewLine}newlines";
26
27 string? result = httpContext.Request.GetCorrelationVector();
28
29 Assert.Equal("correlationvectorwithnewlines", result);
30 Assert.DoesNotContain(Environment.NewLine, result);
31 }
32
33 [Fact]
34 public void GetCorrelationVector_WithCarriageReturnCharacters_SanitizesValue()
35 {
36 DefaultHttpContext httpContext = new();
37 httpContext.Request.Headers["MS-CV"] = $"correlation{Environment.NewLine}vector{Environment.NewLine}with{Environment.NewLine}carriage{Environment.NewLine}returns";
38
39 string? result = httpContext.Request.GetCorrelationVector();
40
41 Assert.Equal("correlationvectorwithcarriagereturns", result);
42 Assert.DoesNotContain(Environment.NewLine, result);
43 }
44
45 [Fact]
46 public void GetCorrelationVector_WithCRLF_SanitizesValue()
47 {
48 DefaultHttpContext httpContext = new();
49 httpContext.Request.Headers["MS-CV"] = $"correlation{Environment.NewLine}vector{Environment.NewLine}with{Environment.NewLine}CRLF";
50
51 string? result = httpContext.Request.GetCorrelationVector();
52
53 Assert.Equal("correlationvectorwithCRLF", result);
54 Assert.DoesNotContain(Environment.NewLine, result);
55 }
56
57 [Fact]
58 public void GetCorrelationVector_WithLogForgingAttempt_PreventsInjection()
59 {
60 // Simulates a malicious attempt to inject fake log entries
61 DefaultHttpContext httpContext = new();
62 httpContext.Request.Headers["MS-CV"] = $"legitimate-value{Environment.NewLine}FAKE_LOG_ENTRY: Unauthorized access granted";
63
64 string? result = httpContext.Request.GetCorrelationVector();
65
66 Assert.Equal("legitimate-valueFAKE_LOG_ENTRY: Unauthorized access granted", result);
67 Assert.DoesNotContain(Environment.NewLine, result);
68 // Verify that the newline that would allow log forging is removed
69 }
70
71 [Fact]
72 public void GetCorrelationVector_WithNullRequest_ReturnsEmptyString()
73 {
74 HttpRequest? request = null;
75
76 string? result = request!.GetCorrelationVector();
77
78 Assert.Equal(string.Empty, result);
79 }
80
81 [Fact]
82 public void GetCorrelationVector_WithMissingHeader_ReturnsEmptyString()
83 {
84 DefaultHttpContext httpContext = new();
85
86 string? result = httpContext.Request.GetCorrelationVector();
87
88 Assert.Equal(string.Empty, result);
89 }
90
91 [Fact]
92 public void GetCorrelationVector_WithEmptyHeader_ReturnsEmptyString()
93 {
94 DefaultHttpContext httpContext = new();
95 httpContext.Request.Headers["MS-CV"] = string.Empty;
96
97 string? result = httpContext.Request.GetCorrelationVector();
98
99 Assert.Equal(string.Empty, result);
100 }
101
102 [Fact]
103 public void GetCorrelationVector_WithMultipleHeaderValues_ReturnsFirstValue()
104 {
105 DefaultHttpContext httpContext = new();
106 httpContext.Request.Headers["MS-CV"] = new[] { "first-value", "second-value" };
107
108 string? result = httpContext.Request.GetCorrelationVector();
109
110 Assert.Equal("first-value", result);
111 }
112
113 [Fact]
114 public void GetCorrelationVector_WithNewlineInMultipleValues_SanitizesFirstValue()
115 {
116 DefaultHttpContext httpContext = new();
117 httpContext.Request.Headers["MS-CV"] = new[] { $"first{Environment.NewLine}value", "second-value" };
118
119 string? result = httpContext.Request.GetCorrelationVector();
120
121 Assert.Equal("firstvalue", result);
122 Assert.DoesNotContain(Environment.NewLine, result);
123 }
124}
125