Skip to content

Commit 9d259e4

Browse files
aoberoiaoberoi
committed
tests for bad sessionIds in generateToken #11 
1 parent 0355b5c commit 9d259e4

File tree

3 files changed

+77
-143
lines changed

3 files changed

+77
-143
lines changed

‎src/main/java/com/opentok/OpenTok.java

Lines changed: 12 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,9 @@
1111
package com.opentok;
1212

1313
import java.io.StringReader;
14+
import java.io.UnsupportedEncodingException;
1415
import java.util.Collection;
16+
import java.util.List;
1517
import java.util.Map;
1618

1719
import javax.xml.xpath.XPath;
@@ -20,6 +22,7 @@
2022

2123
import com.opentok.exception.OpenTokException;
2224
import com.opentok.exception.InvalidArgumentException;
25+
import com.opentok.util.Crypto;
2326
import com.opentok.util.HttpClient;
2427
import org.xml.sax.InputSource;
2528

@@ -138,30 +141,19 @@ public OpenTok(int apiKey, String apiSecret, String apiUrl) {
138141
* @return The token string.
139142
*/
140143
public String generateToken(String sessionId, TokenOptions tokenOptions) throws OpenTokException {
141-
144+
List<String> sessionIdParts = null;
142145
if(sessionId == null || sessionId == "") {
143146
throw new InvalidArgumentException("Session not valid");
144147
}
145148

146-
// TODO: use more succinct codec routines
147-
// String decodedSessionId = "";
148-
// try {
149-
// String subSessionId = sessionId.substring(2);
150-
// for (int i = 0; i<3; i++){
151-
// String newSessionId = subSessionId.concat(repeatString("=",i));
152-
// decodedSessionId = new String(DatatypeConverter.parseBase64Binary(
153-
// newSessionId.replace('-', '+').replace('_', '/')), "ISO8859_1");
154-
// if (decodedSessionId.contains("~")){
155-
// break;
156-
// }
157-
// }
158-
// } catch (UnsupportedEncodingException e) {
159-
// throw new SessionNotFoundException("Session not found");
160-
// }
161-
//
162-
// if(!decodedSessionId.split("~")[1].equals(String.valueOf(apiKey))) {
163-
// throw new SessionNotFoundException("Session not found");
164-
// }
149+
try {
150+
sessionIdParts = Crypto.decodeSessionId(sessionId);
151+
} catch (UnsupportedEncodingException e) {
152+
throw new InvalidArgumentException("Session ID was not valid");
153+
}
154+
if (!sessionIdParts.contains(Integer.toString(this.apiKey))) {
155+
throw new InvalidArgumentException("Session ID was not valid");
156+
}
165157

166158
Session session = new Session(sessionId, apiKey, apiSecret);
167159
return session.generateToken(tokenOptions);

‎src/main/java/com/opentok/util/Crypto.java

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,16 @@
11
package com.opentok.util;
22

3+
import java.io.UnsupportedEncodingException;
34
import java.security.InvalidKeyException;
45
import java.security.NoSuchAlgorithmException;
56
import java.security.SignatureException;
7+
import java.util.ArrayList;
8+
import java.util.Arrays;
69
import java.util.Formatter;
10+
import java.util.List;
711
import javax.crypto.Mac;
812
import javax.crypto.spec.SecretKeySpec;
13+
import org.apache.commons.codec.binary.Base64;
914

1015
public class Crypto {
1116
private static final String HMAC_SHA1_ALGORITHM = "HmacSHA1";
@@ -28,4 +33,12 @@ public static String signData(String data, String key)
2833
mac.init(signingKey);
2934
return toHexString(mac.doFinal(data.getBytes()));
3035
}
36+
37+
public static List<String> decodeSessionId(String sessionId) throws UnsupportedEncodingException {
38+
sessionId = sessionId.substring(2);
39+
sessionId = sessionId.replaceAll("-", "+").replaceAll("_", "/");
40+
byte[] buffer = Base64.decodeBase64(sessionId);
41+
sessionId = new String(buffer, "UTF-8");
42+
return new ArrayList<String>(Arrays.asList(sessionId.split("~")));
43+
}
3144
}

‎src/test/java/com/opentok/test/OpenTokTest.java

Lines changed: 52 additions & 123 deletions
Original file line numberDiff line numberDiff line change
@@ -155,6 +155,29 @@ public void testCreateBadSession() throws OpenTokException {
155155
}
156156

157157
// TODO: test session creation conditions that result in errors
158+
// @Test
159+
// public void testRoleGarbageInput() {
160+
// OpenTokException expected = null;
161+
// try {
162+
// Session s= sdk.createSession();
163+
// s.generateToken("asdfasdf");
164+
// } catch (OpenTokException e) {
165+
// expected = e;
166+
// }
167+
// Assert.assertNotNull("Java SDK tests: exception should be thrown for role asdfasdf", expected);
168+
// }
169+
//
170+
// @Test
171+
// public void testRoleNull() {
172+
// OpenTokException expected = null;
173+
// try {
174+
// Session s= sdk.createSession();
175+
// s.generateToken(null);
176+
// } catch (OpenTokException e) {
177+
// expected = e;
178+
// }
179+
// Assert.assertNotNull("Java SDK tests: exception should be thrown for role null", expected);
180+
// }
158181

159182
@Test
160183
public void testTokenDefault() throws
@@ -248,6 +271,7 @@ public void testTokenExpireTime() throws
248271
assertEquals(Double.toString(inOneDay), defaultTokenData.get("expire_time"));
249272
Map<String, String> oneHourTokenData = Helpers.decodeToken(oneHourToken);
250273
assertEquals(Double.toString(inOneHour), oneHourTokenData.get("expire_time"));
274+
assertEquals(2, exceptions.size());
251275
for (Exception e : exceptions) {
252276
assertEquals(InvalidArgumentException.class, e.getClass());
253277
}
@@ -291,31 +315,34 @@ public void testTokenConnectionData() throws
291315
assertEquals(InvalidArgumentException.class, tooLongException.getClass());
292316
}
293317

294-
//
295-
// @Test
296-
// public void testRoleGarbageInput() {
297-
// OpenTokException expected = null;
298-
// try {
299-
// Session s= sdk.createSession();
300-
// s.generateToken("asdfasdf");
301-
// } catch (OpenTokException e) {
302-
// expected = e;
303-
// }
304-
// Assert.assertNotNull("Java SDK tests: exception should be thrown for role asdfasdf", expected);
305-
// }
306-
//
307-
// @Test
308-
// public void testRoleNull() {
309-
// OpenTokException expected = null;
310-
// try {
311-
// Session s= sdk.createSession();
312-
// s.generateToken(null);
313-
// } catch (OpenTokException e) {
314-
// expected = e;
315-
// }
316-
// Assert.assertNotNull("Java SDK tests: exception should be thrown for role null", expected);
317-
// }
318-
//
318+
@Test
319+
public void testTokenBadSessionId() throws OpenTokException {
320+
int apiKey = 123456;
321+
String apiSecret = "1234567890abcdef1234567890abcdef1234567890";
322+
OpenTok opentok = new OpenTok(apiKey, apiSecret);
323+
ArrayList<Exception> exceptions = new ArrayList<Exception>();
324+
325+
try {
326+
String nullSessionToken = opentok.generateToken(null);
327+
} catch (Exception e) {
328+
exceptions.add(e);
329+
}
330+
try {
331+
String emptySessionToken = opentok.generateToken("");
332+
} catch (Exception e) {
333+
exceptions.add(e);
334+
}
335+
try {
336+
String invalidSessionToken = opentok.generateToken("NOT A VALID SESSION ID");
337+
} catch (Exception e) {
338+
exceptions.add(e);
339+
}
340+
341+
assertEquals(3, exceptions.size());
342+
for (Exception e : exceptions) {
343+
assertEquals(InvalidArgumentException.class, e.getClass());
344+
}
345+
}
319346
// @Test
320347
// public void testTokenNullSessionId() throws OpenTokException {
321348
// OpenTokException expected = null;
@@ -348,103 +375,5 @@ public void testTokenConnectionData() throws
348375
// }
349376
// Assert.assertNotNull("Java SDK tests: exception should be thrown for invalid sessionId", expected);
350377
// }
351-
//
352-
// @Test
353-
// public void testTokenExpireTimeDefault() throws OpenTokException {
354-
// Session s= sdk.createSession();
355-
// String t = s.generateToken(Role.MODERATOR);
356-
// TokBoxXML xml = get_token_info(t);
357-
// Assert.assertFalse("Java SDK tests: expire_time should not exist for default", xml.hasElement("expire_time", "token"));
358-
// }
359-
//
360-
// @Test
361-
// public void testTokenExpireTimePast() {
362-
// OpenTokException expected = null;
363-
// try {
364-
// Session s= sdk.createSession();
365-
// s.generateToken(Role.MODERATOR, new Date().getTime() / 1000 - 100);
366-
// } catch (OpenTokException e) {
367-
// expected = e;
368-
// }
369-
// Assert.assertNotNull("Java SDK tests: exception should be thrown for expire time in past", expected);
370-
// }
371-
//
372-
// @Test
373-
// public void testTokenExpireTimeNow() throws OpenTokException {
374-
// long expireTime = new Date().getTime() / 1000;
375-
// String expected = "Token expired on " + expireTime;
376-
// Session s = sdk.createSession();
377-
// String t = s.generateToken(Role.MODERATOR, expireTime);
378-
// // Allow the token to expire.
379-
// try {
380-
// Thread.sleep(1000);
381-
// } catch (InterruptedException e) {
382-
// // do nothing
383-
// }
384-
// TokBoxXML xml = get_token_info(t);
385-
// String actual = xml.getElementValue("invalid", "token");
386-
// Assert.assertEquals("Java SDK tests: unexpected invalid token message", expected, actual);
387-
// }
388-
//
389-
// @Test
390-
// public void testTokenExpireTimeNearFuture() throws OpenTokException {
391-
// long expected = new Date().getTime() / 1000 + 34200;
392-
// Session s= sdk.createSession();
393-
// String t = s.generateToken(Role.MODERATOR, expected);
394-
// TokBoxXML xml = get_token_info(t);
395-
// long actual = new Long(xml.getElementValue("expire_time", "token").trim());
396-
// Assert.assertEquals("Java SDK tests: expire time not set to expected time", expected, actual);
397-
// }
398-
//
399-
// @Test
400-
// public void testTokenExpireTimeFarFuture() {
401-
// OpenTokException expected = null;
402-
// try {
403-
// Session s= sdk.createSession();
404-
// s.generateToken(Role.MODERATOR, new Date().getTime() + 604800000);
405-
// } catch (OpenTokException e) {
406-
// expected = e;
407-
// }
408-
// Assert.assertNotNull("Java SDK tests: exception should be thrown for expire time more than 7 days in future", expected);
409-
// }
410-
//
411-
// @Test
412-
// public void testConnectionData() throws OpenTokException {
413-
// String expected = "test string";
414-
// String actual = null;
415-
// Session s= sdk.createSession();
416-
// String t = s.generateToken(Role.PUBLISHER, 0, expected);
417-
// TokBoxXML xml = get_token_info(t);
418-
// actual = xml.getElementValue("connection_data", "token").trim();
419-
// Assert.assertEquals("Java SDK tests: connection data not set", expected, actual);
420-
// }
421-
//
422-
// @Test
423-
// public void testConnectionDataTooLarge() {
424-
// OpenTokException expected = null;
425-
// String test_string = "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" +
426-
// "bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb" +
427-
// "cccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccccc" +
428-
// "dddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddddd" +
429-
// "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee" +
430-
// "eeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeeee" +
431-
// "ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff" +
432-
// "gggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggggg" +
433-
// "hhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhhh" +
434-
// "iiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiii" +
435-
// "jjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjjj" +
436-
// "kkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkk" +
437-
// "llllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll" +
438-
// "mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm" +
439-
// "nnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnnn" +
440-
// "oooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooooo";
441-
// try {
442-
// Session s= sdk.createSession();
443-
// s.generateToken(Role.PUBLISHER, new Date().getTime(), test_string);
444-
// } catch (OpenTokException e) {
445-
// expected = e;
446-
// }
447-
// Assert.assertNotNull("Java SDK tests: connection data over 1000 characters should not be accepted. Test String: " + test_string , expected);
448-
// }
449378

450379
}

0 commit comments

Comments
 (0)