mirror of
https://github.com/argoproj/argo-cd
synced 2026-04-21 17:07:16 +00:00
68cbd05e52
Signed-off-by: rohansood10 <rohansood10@users.noreply.github.com> Signed-off-by: Blake Pettersson <blake.pettersson@gmail.com> Co-authored-by: rohansood10 <rohansood10@users.noreply.github.com> Co-authored-by: Blake Pettersson <blake.pettersson@gmail.com> Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
70 lines
2.1 KiB
Go
70 lines
2.1 KiB
Go
package swagger
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net"
|
|
"net/http"
|
|
"testing"
|
|
|
|
"github.com/go-openapi/loads"
|
|
"github.com/stretchr/testify/require"
|
|
|
|
"github.com/argoproj/argo-cd/v3/util/assets"
|
|
)
|
|
|
|
func TestSwaggerUI(t *testing.T) {
|
|
lc := &net.ListenConfig{}
|
|
serve := func(c chan<- string) {
|
|
// listen on first available dynamic (unprivileged) port
|
|
listener, err := lc.Listen(t.Context(), "tcp", ":0")
|
|
if err != nil {
|
|
panic(err)
|
|
}
|
|
|
|
// send back the address so that it can be used
|
|
c <- listener.Addr().String()
|
|
|
|
mux := http.NewServeMux()
|
|
ServeSwaggerUI(mux, assets.SwaggerJSON, "/swagger-ui", "")
|
|
panic(http.Serve(listener, mux))
|
|
}
|
|
|
|
c := make(chan string, 1)
|
|
|
|
// run a local webserver to test data retrieval
|
|
go serve(c)
|
|
|
|
address := <-c
|
|
t.Logf("Listening at address: %s", address)
|
|
|
|
server := "http://" + address
|
|
|
|
specDoc, err := loads.Spec(server + "/swagger.json")
|
|
require.NoError(t, err)
|
|
|
|
_, err = json.MarshalIndent(specDoc.Spec(), "", " ")
|
|
require.NoError(t, err)
|
|
|
|
req, err := http.NewRequestWithContext(t.Context(), http.MethodGet, server+"/swagger.json", http.NoBody)
|
|
require.NoError(t, err)
|
|
|
|
resp, err := http.DefaultClient.Do(req)
|
|
require.NoError(t, err)
|
|
require.Equalf(t, http.StatusOK, resp.StatusCode, "Was expecting status code 200 from swagger-ui, but got %d instead", resp.StatusCode)
|
|
require.NoError(t, resp.Body.Close())
|
|
|
|
// Verify clickjacking protection headers on swagger.json
|
|
require.Equal(t, "DENY", resp.Header.Get("X-Frame-Options"))
|
|
require.Equal(t, "frame-ancestors 'none'", resp.Header.Get("Content-Security-Policy"))
|
|
|
|
// Verify clickjacking protection headers on swagger-ui
|
|
uiReq, err := http.NewRequestWithContext(t.Context(), http.MethodGet, server+"/swagger-ui", http.NoBody)
|
|
require.NoError(t, err)
|
|
|
|
uiResp, err := http.DefaultClient.Do(uiReq)
|
|
require.NoError(t, err)
|
|
require.Equalf(t, http.StatusOK, uiResp.StatusCode, "Was expecting status code 200 from swagger-ui, but got %d instead", uiResp.StatusCode)
|
|
require.Equal(t, "DENY", uiResp.Header.Get("X-Frame-Options"))
|
|
require.Equal(t, "frame-ancestors 'none'", uiResp.Header.Get("Content-Security-Policy"))
|
|
require.NoError(t, uiResp.Body.Close())
|
|
}
|