/*
 * Copyright (c) 2002-2012 Alibaba Group Holding Limited.
 * All rights reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *    http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */

package com.alibaba.citrus.service.requestcontext.basic;

import static com.alibaba.citrus.test.TestUtil.*;
import static org.easymock.EasyMock.*;
import static org.junit.Assert.*;

import java.io.IOException;
import javax.servlet.http.Cookie;

import com.alibaba.citrus.service.requestcontext.basic.impl.ResponseHeaderSecurityFilter;
import com.alibaba.citrus.util.HumanReadableSize;
import org.junit.Before;
import org.junit.Test;

public class ResponseHeaderSecurityFilterTests extends AbstractBasicResponseTests {
    private ResponseHeaderSecurityFilter filter;

    @Before
    public void init() {
        filter = new ResponseHeaderSecurityFilter();
        createResponse(filter);
    }

    @Test
    public void checkHeaderName() {
        try {
            response.setHeader("wrong\r\nname", "value");
            fail();
        } catch (ResponseHeaderRejectedException e) {
            assertThat(e, exception("Invalid response header: wrong\\r\\nname"));
        }

        responseMock.addIntHeader("name", 123); // keep original name
        replayMocks();

        response.addIntHeader("name", 123);
        verifyMocks();
    }

    @Test
    public void checkHeaderValue() {
        responseMock.setHeader("name", "value1 value2 value3 ");
        replayMocks();

        response.setHeader("name", "value1\r\nvalue2\rvalue3\n");
        verifyMocks();
    }

    @Test
    public void checkCookieName() {
        Cookie wrongCookie = createMock(Cookie.class);

        expect(wrongCookie.getName()).andReturn("wrong\r\nname").atLeastOnce();
        expect(wrongCookie.getValue()).andReturn("value").atLeastOnce();

        replay(wrongCookie);

        try {
            response.addCookie(wrongCookie);
            fail();
        } catch (CookieRejectedException e) {
            assertThat(e, exception("Cookie rejected: wrong\\r\\nname=value"));
        }

        Cookie cookie = new Cookie("name", "value");

        responseMock.addHeader("Set-Cookie", "name=value"); // keep original cookie
        replayMocks();

        response.addCookie(cookie);
        verifyMocks();
    }

    @Test
    public void checkCookieValue() {
        responseMock.addHeader("Set-Cookie", "name=\"value1 value2 value3 \"; Version=1; Discard");
        replayMocks();

        response.addCookie(new Cookie("name", "value1\r\nvalue2\rvalue3\n"));
        verifyMocks();
    }

    @Test
    public void checkCookieHeaderValue_exceedsMaxSize() {
        StringBuilder sb = new StringBuilder();

        for (int i = 0; i < 7 * 512 - 6; i++) {
            sb.append("x");
        }

        String value = sb.toString();
        responseMock.addHeader("Set-Cookie", "test1=" + value);
        responseMock.addHeader("Set-Cookie", "test2=" + value);
        responseMock.addHeader("Set-Cookie", "");
        replayMocks();

        response.addCookie(new Cookie("test1", value));
        response.addCookie(new Cookie("test2", value));
        response.addCookie(new Cookie("test3", "value3"));
        verifyMocks();
    }

    @Test
    public void checkCookieHeaderValue_setMaxSetCookieSize() {
        filter.setMaxSetCookieSize(new HumanReadableSize(20));
        assertEquals(20, filter.getMaxSetCookieSize().getValue());

        responseMock.addHeader("Set-Cookie", "test=value");
        responseMock.addHeader("Set-Cookie", "");
        replayMocks();

        response.addCookie(new Cookie("test", "value"));
        response.addCookie(new Cookie("test1", "value1"));
        verifyMocks();
    }

    @Test
    public void checkRedirectLocation() throws IOException {
        // 正常情况下，包含crlf的location是没有机会被crlfFilter发现的，因为在此之前已经出错。
        // 但为了保障安全，仍作此测试。
        assertEquals("value1 value2 value3 ",
                     new ResponseHeaderSecurityFilter().checkRedirectLocation("value1\r\nvalue2\rvalue3\n"));
    }

    @Test
    @SuppressWarnings("deprecation")
    public void checkStatusMessage() throws IOException {
        responseMock.setStatus(500, "hello&world");
        responseMock.sendError(404, "hello&world");
        replayMocks();

        response.setStatus(500, "hello&world");
        response.sendError(404, "hello&world");
        verifyMocks();
    }
}