PagesControllerFacts.cs

// Copyright (c) .NET Foundation. All rights reserved.
// Licensed under the Apache License, Version 2.0. See License.txt in the project root for license information.

using System;
using System.Threading.Tasks;
using System.Web;
using Moq;
using NuGet.Services.Entities;
using NuGet.Services.Messaging.Email;
using NuGetGallery.Areas.Admin;
using NuGetGallery.Framework;
using NuGetGallery.Infrastructure.Mail.Messages;
using NuGetGallery.ViewModels;
using Xunit;

namespace NuGetGallery
{
    public class PagesControllerFacts
    {
        public class TheContactAction : TestContainer
        {
            [Fact]
            public async Task HtmlEncodesTheSupportContactEmail()
            {
                // arrage: the contact form, the expected encoding, and setup a user
                var contactForm = new ContactSupportViewModel
                {
                    Message = "<strong>Something with HTML in it</strong>",
                    SubjectLine = "<script>alert('malicious javascript perhaps')</script>"
                };

                var expectedMessage = HttpUtility.HtmlEncode(contactForm.Message);
                var expectedSubjectLine = HttpUtility.HtmlEncode(contactForm.SubjectLine);

                var controller = GetController<PagesController>();
                // Have to set this up first because it needs current user
                controller.SetCurrentUser(new User
                {
                    Username = "aUsername",
                    UnconfirmedEmailAddress = "old@example.com",
                    EmailConfirmationToken = "aToken",
                });

                // act: run the controller action
                await controller.Contact(contactForm);

                // assert: the HTML encoded message was passed to the service
                GetMock<IMessageService>()
                    .Verify(svc => svc.SendMessageAsync(
                        It.Is<ContactSupportMessage>(
                            msg =>
                            msg.Message == expectedMessage
                            && msg.Reason == expectedSubjectLine),
                        false,
                        false));
            }

            [Fact]
            public async Task HtmlEncodesTheSupportRequest()
            {
                // arrage: the contact form, the expected encoding, and setup a user
                var contactForm = new ContactSupportViewModel
                {
                    Message = "<b>some html</b>",
                    SubjectLine = "maybe some malicious javascript: <script>alert('teh XSS hax')</script>"
                };

                var expectedMessage = HttpUtility.HtmlEncode(contactForm.Message);

                var controller = GetController<PagesController>();
                // Have to set this up first because it needs current user
                controller.SetCurrentUser(new User
                {
                    Username = "aUsername",
                    UnconfirmedEmailAddress = "old@example.com",
                    EmailConfirmationToken = "aToken",
                });

                // act: run the controller action
                await controller.Contact(contactForm);

                // assert: the HTML encoded message was passed to the service
                GetMock<ISupportRequestService>()
                    .Verify(m => m.AddNewSupportRequestAsync(
                        It.IsAny<string>(),
                        expectedMessage,
                        It.IsAny<string>(),
                        It.IsAny<string>(),
                        It.IsAny<User>(),
                        It.IsAny<Package>()));
            }

            [Fact]
            public async Task WithExternalPrivacyUrlConfigured()
            {
                var externalPrivacyUrl = "https://privacy.microsoft.com";
                var configuration = GetConfigurationService();
                var pagesController = GetController<PagesController>();

                configuration.Current.ExternalPrivacyPolicyUrl = externalPrivacyUrl;

                var result = await pagesController.Privacy();

                GetMock<IContentService>()
                    .Verify(m => m.GetContentItemAsync(
                        It.IsAny<string>(),
                        It.IsAny<TimeSpan>()), Times.Never);

            }

            [Fact]
            public async Task WithoutExternalPrivacyUrlConfigured()
            {
                var externalPrivacyUrl = "";
                var configuration = GetConfigurationService();
                var pagesController = GetController<PagesController>();

                configuration.Current.ExternalPrivacyPolicyUrl = externalPrivacyUrl;

                var result = await pagesController.Privacy();

                GetMock<IContentService>()
                    .Verify(m => m.GetContentItemAsync(
                        It.IsAny<string>(),
                        It.IsAny<TimeSpan>()), Times.Once);
            }
        }

        public class TheYourPrivacyChoicesUrl : TestContainer
        {
            [Fact]
            public void WithExternalYourPrivacyChoicesUrlConfigured()
            {
                var expectedUrl = "https://aka.ms/yourcaliforniaprivacychoices";
                var configuration = GetConfigurationService();
                configuration.Current.ExternalYourPrivacyChoicesUrl = expectedUrl;

                var urlHelper = TestUtility.MockUrlHelper();

                var result = UrlHelperExtensions.YourPrivacyChoices(urlHelper);

                Assert.Equal(expectedUrl, result);
            }

            [Fact]
            public void WithoutExternalYourPrivacyChoicesUrlConfigured()
            {
                var configuration = GetConfigurationService();
                configuration.Current.ExternalYourPrivacyChoicesUrl = "";

                var urlHelper = TestUtility.MockUrlHelper();

                var result = UrlHelperExtensions.YourPrivacyChoices(urlHelper);

                Assert.NotEqual("https://aka.ms/yourcaliforniaprivacychoices", result);
            }

            [Fact]
            public void WithNullExternalYourPrivacyChoicesUrlConfigured()
            {
                var configuration = GetConfigurationService();
                configuration.Current.ExternalYourPrivacyChoicesUrl = null;

                var urlHelper = TestUtility.MockUrlHelper();

                var result = UrlHelperExtensions.YourPrivacyChoices(urlHelper);

                Assert.NotEqual("https://aka.ms/yourcaliforniaprivacychoices", result);
            }
        }
    }
}