Skip to content

Commit 0bf1355

Browse files
defanatordefanator
committed
tests: check for valid HTTP/1.x response headers where applicable
1 parent d4d3ab3 commit 0bf1355

7 files changed

+36
-36
lines changed

‎tests/modsecurity-config-merge.t

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -160,7 +160,7 @@ $t->plan(10);
160160
###############################################################################
161161

162162
like(http_get_body('/', 'GOOD BODY'), qr/TEST-OK-IF-YOU-SEE-THIS/, "http level defaults, pass");
163-
like(http_get_body('/', 'VERY BAD BODY'), qr/403 Forbidden/, "http level defaults, block");
163+
like(http_get_body('/', 'VERY BAD BODY'), qr/^HTTP.*403/, "http level defaults, block");
164164

165165
like(http_get_body('/modsec-disabled', 'VERY BAD BODY'), qr/TEST-OK-IF-YOU-SEE-THIS/, "location override for SecRuleEngine, pass");
166166
like(http_get_body('/nobodyaccess', 'VERY BAD BODY'), qr/TEST-OK-IF-YOU-SEE-THIS/, "location override for SecRequestBodyAccess, pass");

‎tests/modsecurity-config.t

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -95,18 +95,18 @@ $t->plan(9);
9595

9696

9797
# Performing requests at root
98-
like(http_get('/index.html?what=root'), qr/302 Moved Temporarily/, 'redirect 302 - root');
98+
like(http_get('/index.html?what=root'), qr/^HTTP.*302/, 'redirect 302 - root');
9999
like(http_get('/index.html?what=subfolder1'), qr/should be moved\/blocked before this./, 'nothing - requested subfolder1 at root');
100100
like(http_get('/index.html?what=subfolder2'), qr/should be moved\/blocked before this./, 'nothing - requested subfolder2 at root');
101101

102102
# Performing requests at subfolder1
103103
like(http_get('/subfolder1/index.html?what=root'), qr/should be moved\/blocked before this./, 'nothing - requested root at subfolder 1');
104-
like(http_get('/subfolder1/index.html?what=subfolder1'), qr/302 Moved Temporarily/, 'redirect 302 - subfolder 1');
104+
like(http_get('/subfolder1/index.html?what=subfolder1'), qr/^HTTP.*302/, 'redirect 302 - subfolder 1');
105105
like(http_get('/subfolder1/index.html?what=subfolder2'), qr/should be moved\/blocked before this./, 'nothing - requested subfolder2 at subfolder1');
106106

107107
# Performing requests at subfolder2
108108
like(http_get('/subfolder1/subfolder2/index.html?what=root'), qr/should be moved\/blocked before this./, 'nothing - requested root at subfolder 2');
109-
like(http_get('/subfolder1/subfolder2/index.html?what=subfolder1'), qr/302 Moved Temporarily/, 'redirect 302 - subfolder 2');
110-
like(http_get('/subfolder1/subfolder2/index.html?what=subfolder2'), qr/302 Moved Temporarily/, 'redirect 302 - subfolder 2');
109+
like(http_get('/subfolder1/subfolder2/index.html?what=subfolder1'), qr/^HTTP.*302/, 'redirect 302 - subfolder 2');
110+
like(http_get('/subfolder1/subfolder2/index.html?what=subfolder2'), qr/^HTTP.*302/, 'redirect 302 - subfolder 2');
111111

112112

‎tests/modsecurity-proxy.t

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -114,27 +114,27 @@ unlike(http_head('/'), qr/SEE-THIS/, 'proxy head request');
114114

115115

116116
# Redirect (302)
117-
like(http_get('/phase1?what=redirect302'), qr/302 Moved Temporarily/, 'redirect 302 - phase 1');
118-
like(http_get('/phase2?what=redirect302'), qr/302 Moved Temporarily/, 'redirect 302 - phase 2');
119-
like(http_get('/phase3?what=redirect302'), qr/302 Moved Temporarily/, 'redirect 302 - phase 3');
117+
like(http_get('/phase1?what=redirect302'), qr/^HTTP.*302/, 'redirect 302 - phase 1');
118+
like(http_get('/phase2?what=redirect302'), qr/^HTTP.*302/, 'redirect 302 - phase 2');
119+
like(http_get('/phase3?what=redirect302'), qr/^HTTP.*302/, 'redirect 302 - phase 3');
120120
is(http_get('/phase4?what=redirect302'), '', 'redirect 302 - phase 4');
121121

122122
# Redirect (301)
123-
like(http_get('/phase1?what=redirect301'), qr/301 Moved Permanently/, 'redirect 301 - phase 1');
124-
like(http_get('/phase2?what=redirect301'), qr/301 Moved Permanently/, 'redirect 301 - phase 2');
125-
like(http_get('/phase3?what=redirect301'), qr/301 Moved Permanently/, 'redirect 301 - phase 3');
123+
like(http_get('/phase1?what=redirect301'), qr/^HTTP.*301/, 'redirect 301 - phase 1');
124+
like(http_get('/phase2?what=redirect301'), qr/^HTTP.*301/, 'redirect 301 - phase 2');
125+
like(http_get('/phase3?what=redirect301'), qr/^HTTP.*301/, 'redirect 301 - phase 3');
126126
is(http_get('/phase4?what=redirect301'), '', 'redirect 301 - phase 4');
127127

128128
# Block (401)
129-
like(http_get('/phase1?what=block401'), qr/401 Unauthorized/, 'block 401 - phase 1');
130-
like(http_get('/phase2?what=block401'), qr/401 Unauthorized/, 'block 401 - phase 2');
131-
like(http_get('/phase3?what=block401'), qr/401 Unauthorized/, 'block 401 - phase 3');
129+
like(http_get('/phase1?what=block401'), qr/^HTTP.*401/, 'block 401 - phase 1');
130+
like(http_get('/phase2?what=block401'), qr/^HTTP.*401/, 'block 401 - phase 2');
131+
like(http_get('/phase3?what=block401'), qr/^HTTP.*401/, 'block 401 - phase 3');
132132
is(http_get('/phase4?what=block401'), '', 'block 401 - phase 4');
133133

134134
# Block (403)
135-
like(http_get('/phase1?what=block403'), qr/403 Forbidden/, 'block 403 - phase 1');
136-
like(http_get('/phase2?what=block403'), qr/403 Forbidden/, 'block 403 - phase 2');
137-
like(http_get('/phase3?what=block403'), qr/403 Forbidden/, 'block 403 - phase 3');
135+
like(http_get('/phase1?what=block403'), qr/^HTTP.*403/, 'block 403 - phase 1');
136+
like(http_get('/phase2?what=block403'), qr/^HTTP.*403/, 'block 403 - phase 2');
137+
like(http_get('/phase3?what=block403'), qr/^HTTP.*403/, 'block 403 - phase 3');
138138
is(http_get('/phase4?what=block403'), '', 'block 403 - phase 4');
139139

140140
# Nothing to detect

‎tests/modsecurity-request-body.t

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -130,13 +130,13 @@ $t->plan(40);
130130

131131
foreach my $method (('GET', 'POST', 'PUT', 'DELETE')) {
132132
like(http_req_body($method, '/bodyaccess', 'GOOD BODY'), qr/TEST-OK-IF-YOU-SEE-THIS/, "$method request body access on, pass");
133-
like(http_req_body($method, '/bodyaccess', 'VERY BAD BODY'), qr/403 Forbidden/, "$method request body access on, block");
133+
like(http_req_body($method, '/bodyaccess', 'VERY BAD BODY'), qr/^HTTP.*403/, "$method request body access on, block");
134134
like(http_req_body($method, '/nobodyaccess', 'VERY BAD BODY'), qr/TEST-OK-IF-YOU-SEE-THIS/, "$method request body access off, pass");
135135
like(http_req_body_postargs($method, '/nobodyaccess', 'BAD ARG'), qr/TEST-OK-IF-YOU-SEE-THIS/, "$method request body access off (ARGS_POST), pass");
136136
like(http_req_body($method, '/bodylimitreject', 'BODY' x 32), qr/TEST-OK-IF-YOU-SEE-THIS/, "$method request body limit reject, pass");
137-
like(http_req_body($method, '/bodylimitreject', 'BODY' x 33), qr/403 Forbidden/, "$method request body limit reject, block");
137+
like(http_req_body($method, '/bodylimitreject', 'BODY' x 33), qr/^HTTP.*403/, "$method request body limit reject, block");
138138
like(http_req_body($method, '/bodylimitprocesspartial', 'BODY' x 32 . 'BAD BODY'), qr/TEST-OK-IF-YOU-SEE-THIS/, "$method request body limit process partial, pass");
139-
like(http_req_body($method, '/bodylimitprocesspartial', 'BODY' x 30 . 'BAD BODY' x 32), qr/403 Forbidden/, "$method request body limit process partial, block");
139+
like(http_req_body($method, '/bodylimitprocesspartial', 'BODY' x 30 . 'BAD BODY' x 32), qr/^HTTP.*403/, "$method request body limit process partial, block");
140140
}
141141

142142
like(http_req_body('POST', '/useauth', 'BODY' x 16), qr/TEST-OK-IF-YOU-SEE-THIS/, "POST with auth_request (request size < client_header_buffer_size)");
@@ -167,7 +167,7 @@ like(
167167
);
168168

169169
foreach my $method (('GET', 'POST', 'PUT', 'DELETE')) {
170-
like(http_req_body($method, '/bodylimitrejectserver', 'BODY' x 33), qr/403 Forbidden/, "$method request body limit reject, block (inherited SecRequestBodyLimit)");
170+
like(http_req_body($method, '/bodylimitrejectserver', 'BODY' x 33), qr/^HTTP.*403/, "$method request body limit reject, block (inherited SecRequestBodyLimit)");
171171
}
172172

173173
###############################################################################

‎tests/modsecurity-response-body.t

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,6 @@ $t->plan(1);
6464
TODO: {
6565
local $TODO = 'not yet';
6666

67-
like(http_get('/body1'), qr/403 Forbidden/, 'response body (block)');
67+
like(http_get('/body1'), qr/^HTTP.*403/, 'response body (block)');
6868
}
6969

‎tests/modsecurity-scoring.t

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -71,9 +71,9 @@ $t->plan(5);
7171
###############################################################################
7272

7373
like(http_get('/absolute?what=badarg1'), qr/should be moved\/blocked before this./, 'absolute scoring 1 (pass)');
74-
like(http_get('/absolute?what=badarg2'), qr/403 Forbidden/, 'absolute scoring 2 (block)');
74+
like(http_get('/absolute?what=badarg2'), qr/^HTTP.*403/, 'absolute scoring 2 (block)');
7575

7676
like(http_get('/iterative?arg1=badarg1'), qr/should be moved\/blocked before this./, 'iterative scoring 1 (pass)');
7777
like(http_get('/iterative?arg1=badarg1&arg2=badarg2'), qr/should be moved\/blocked before this./, 'iterative scoring 2 (pass)');
78-
like(http_get('/iterative?arg1=badarg1&arg2=badarg2&arg3=badarg3'), qr/403 Forbidden/, 'iterative scoring 3 (block)');
78+
like(http_get('/iterative?arg1=badarg1&arg2=badarg2&arg3=badarg3'), qr/^HTTP.*403/, 'iterative scoring 3 (block)');
7979

‎tests/modsecurity.t

Lines changed: 12 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -121,27 +121,27 @@ $t->plan(20);
121121

122122

123123
# Redirect (302)
124-
like(http_get('/phase1?what=redirect302'), qr/302 Moved Temporarily/, 'redirect 302 - phase 1');
125-
like(http_get('/phase2?what=redirect302'), qr/302 Moved Temporarily/, 'redirect 302 - phase 2');
126-
like(http_get('/phase3?what=redirect302'), qr/302 Moved Temporarily/, 'redirect 302 - phase 3');
124+
like(http_get('/phase1?what=redirect302'), qr/^HTTP.*302/, 'redirect 302 - phase 1');
125+
like(http_get('/phase2?what=redirect302'), qr/^HTTP.*302/, 'redirect 302 - phase 2');
126+
like(http_get('/phase3?what=redirect302'), qr/^HTTP.*302/, 'redirect 302 - phase 3');
127127
is(http_get('/phase4?what=redirect302'), '', 'redirect 302 - phase 4');
128128

129129
# Redirect (301)
130-
like(http_get('/phase1?what=redirect301'), qr/301 Moved Permanently/, 'redirect 301 - phase 1');
131-
like(http_get('/phase2?what=redirect301'), qr/301 Moved Permanently/, 'redirect 301 - phase 2');
132-
like(http_get('/phase3?what=redirect301'), qr/301 Moved Permanently/, 'redirect 301 - phase 3');
130+
like(http_get('/phase1?what=redirect301'), qr/^HTTP.*301/, 'redirect 301 - phase 1');
131+
like(http_get('/phase2?what=redirect301'), qr/^HTTP.*301/, 'redirect 301 - phase 2');
132+
like(http_get('/phase3?what=redirect301'), qr/^HTTP.*301/, 'redirect 301 - phase 3');
133133
is(http_get('/phase4?what=redirect301'), '', 'redirect 301 - phase 4');
134134

135135
# Block (401)
136-
like(http_get('/phase1?what=block401'), qr/401 Unauthorized/, 'block 401 - phase 1');
137-
like(http_get('/phase2?what=block401'), qr/401 Unauthorized/, 'block 401 - phase 2');
138-
like(http_get('/phase3?what=block401'), qr/401 Unauthorized/, 'block 401 - phase 3');
136+
like(http_get('/phase1?what=block401'), qr/^HTTP.*401/, 'block 401 - phase 1');
137+
like(http_get('/phase2?what=block401'), qr/^HTTP.*401/, 'block 401 - phase 2');
138+
like(http_get('/phase3?what=block401'), qr/^HTTP.*401/, 'block 401 - phase 3');
139139
is(http_get('/phase4?what=block401'), '', 'block 401 - phase 4');
140140

141141
# Block (403)
142-
like(http_get('/phase1?what=block403'), qr/403 Forbidden/, 'block 403 - phase 1');
143-
like(http_get('/phase2?what=block403'), qr/403 Forbidden/, 'block 403 - phase 2');
144-
like(http_get('/phase3?what=block403'), qr/403 Forbidden/, 'block 403 - phase 3');
142+
like(http_get('/phase1?what=block403'), qr/^HTTP.*403/, 'block 403 - phase 1');
143+
like(http_get('/phase2?what=block403'), qr/^HTTP.*403/, 'block 403 - phase 2');
144+
like(http_get('/phase3?what=block403'), qr/^HTTP.*403/, 'block 403 - phase 3');
145145
is(http_get('/phase4?what=block403'), '', 'block 403 - phase 4');
146146

147147
# Nothing to detect

0 commit comments

Comments
 (0)