3 class NodeControllerTest < ActionController::TestCase
7 # test all routes which lead to this controller
10 { :path => "/api/0.6/node/create", :method => :put },
11 { :controller => "node", :action => "create" }
14 { :path => "/api/0.6/node/1", :method => :get },
15 { :controller => "node", :action => "read", :id => "1" }
18 { :path => "/api/0.6/node/1", :method => :put },
19 { :controller => "node", :action => "update", :id => "1" }
22 { :path => "/api/0.6/node/1", :method => :delete },
23 { :controller => "node", :action => "delete", :id => "1" }
26 { :path => "/api/0.6/nodes", :method => :get },
27 { :controller => "node", :action => "nodes" }
32 # cannot read password from fixture as it is stored as MD5 digest
33 ## First try with no auth
35 # create a node with random lat/lon
36 lat = rand(100) - 50 + rand
37 lon = rand(100) - 50 + rand
38 # normal user has a changeset open, so we'll use that.
39 changeset = changesets(:normal_user_first_change)
40 # create a minimal xml file
41 content("<osm><node lat='#{lat}' lon='#{lon}' changeset='#{changeset.id}'/></osm>")
42 assert_difference('OldNode.count', 0) do
45 # hope for unauthorized
46 assert_response :unauthorized, "node upload did not return unauthorized status"
48 ## Now try with the user which doesn't have their data public
49 basic_authorization(users(:normal_user).email, "test")
51 # create a node with random lat/lon
52 lat = rand(100) - 50 + rand
53 lon = rand(100) - 50 + rand
54 # normal user has a changeset open, so we'll use that.
55 changeset = changesets(:normal_user_first_change)
56 # create a minimal xml file
57 content("<osm><node lat='#{lat}' lon='#{lon}' changeset='#{changeset.id}'/></osm>")
58 assert_difference('Node.count', 0) do
62 assert_require_public_data "node create did not return forbidden status"
64 ## Now try with the user that has the public data
65 basic_authorization(users(:public_user).email, "test")
67 # create a node with random lat/lon
68 lat = rand(100) - 50 + rand
69 lon = rand(100) - 50 + rand
70 # normal user has a changeset open, so we'll use that.
71 changeset = changesets(:public_user_first_change)
72 # create a minimal xml file
73 content("<osm><node lat='#{lat}' lon='#{lon}' changeset='#{changeset.id}'/></osm>")
76 assert_response :success, "node upload did not return success status"
78 # read id of created node and search for it
79 nodeid = @response.body
80 checknode = Node.find(nodeid)
81 assert_not_nil checknode, "uploaded node not found in data base after upload"
83 assert_in_delta lat * 10000000, checknode.latitude, 1, "saved node does not match requested latitude"
84 assert_in_delta lon * 10000000, checknode.longitude, 1, "saved node does not match requested longitude"
85 assert_equal changesets(:public_user_first_change).id, checknode.changeset_id, "saved node does not belong to changeset that it was created in"
86 assert_equal true, checknode.visible, "saved node is not visible"
89 def test_create_invalid_xml
90 ## Only test public user here, as test_create should cover what's the forbiddens
91 ## that would occur here
93 basic_authorization(users(:public_user).email, "test")
94 # normal user has a changeset open, so we'll use that.
95 changeset = changesets(:public_user_first_change)
99 # test that the upload is rejected when xml is valid, but osm doc isn't
102 assert_response :bad_request, "node upload did not return bad_request status"
103 assert_equal "Cannot parse valid node from xml string <create/>. XML doesn't contain an osm/node element.", @response.body
105 # test that the upload is rejected when no lat is supplied
106 # create a minimal xml file
107 content("<osm><node lon='#{lon}' changeset='#{changeset.id}'/></osm>")
110 assert_response :bad_request, "node upload did not return bad_request status"
111 assert_equal "Cannot parse valid node from xml string <node lon=\"3.23\" changeset=\"#{changeset.id}\"/>. lat missing", @response.body
113 # test that the upload is rejected when no lon is supplied
114 # create a minimal xml file
115 content("<osm><node lat='#{lat}' changeset='#{changeset.id}'/></osm>")
118 assert_response :bad_request, "node upload did not return bad_request status"
119 assert_equal "Cannot parse valid node from xml string <node lat=\"3.434\" changeset=\"#{changeset.id}\"/>. lon missing", @response.body
121 # test that the upload is rejected when lat is non-numeric
122 # create a minimal xml file
123 content("<osm><node lat='abc' lon='#{lon}' changeset='#{changeset.id}'/></osm>")
126 assert_response :bad_request, "node upload did not return bad_request status"
127 assert_equal "Cannot parse valid node from xml string <node lat=\"abc\" lon=\"#{lon}\" changeset=\"#{changeset.id}\"/>. lat not a number", @response.body
129 # test that the upload is rejected when lon is non-numeric
130 # create a minimal xml file
131 content("<osm><node lat='#{lat}' lon='abc' changeset='#{changeset.id}'/></osm>")
134 assert_response :bad_request, "node upload did not return bad_request status"
135 assert_equal "Cannot parse valid node from xml string <node lat=\"#{lat}\" lon=\"abc\" changeset=\"#{changeset.id}\"/>. lon not a number", @response.body
137 # test that the upload is rejected when we have a tag which is too long
138 content("<osm><node lat='#{lat}' lon='#{lon}' changeset='#{changeset.id}'><tag k='foo' v='#{'x' * 256}'/></node></osm>")
140 assert_response :bad_request, "node upload did not return bad_request status"
141 assert_equal ["NodeTag ", " v: is too long (maximum is 255 characters) (\"#{'x' * 256}\")"], @response.body.split(/[0-9]+,foo:/)
145 # check that a visible node is returned properly
146 get :read, :id => current_nodes(:visible_node).id
147 assert_response :success
149 # check that an invisible node is not returned
150 get :read, :id => current_nodes(:invisible_node).id
151 assert_response :gone
153 # check chat a non-existent node is not returned
155 assert_response :not_found
158 # this tests deletion restrictions - basic deletion is tested in the unit
161 ## first try to delete node without auth
162 delete :delete, :id => current_nodes(:visible_node).id
163 assert_response :unauthorized
165 ## now set auth for the non-data public user
166 basic_authorization(users(:normal_user).email, "test")
168 # try to delete with an invalid (closed) changeset
169 content update_changeset(current_nodes(:visible_node).to_xml,
170 changesets(:normal_user_closed_change).id)
171 delete :delete, :id => current_nodes(:visible_node).id
172 assert_require_public_data("non-public user shouldn't be able to delete node")
174 # try to delete with an invalid (non-existent) changeset
175 content update_changeset(current_nodes(:visible_node).to_xml, 0)
176 delete :delete, :id => current_nodes(:visible_node).id
177 assert_require_public_data("shouldn't be able to delete node, when user's data is private")
179 # valid delete now takes a payload
180 content(nodes(:visible_node).to_xml)
181 delete :delete, :id => current_nodes(:visible_node).id
182 assert_require_public_data("shouldn't be able to delete node when user's data isn't public'")
184 # this won't work since the node is already deleted
185 content(nodes(:invisible_node).to_xml)
186 delete :delete, :id => current_nodes(:invisible_node).id
187 assert_require_public_data
189 # this won't work since the node never existed
190 delete :delete, :id => 0
191 assert_require_public_data
193 ## these test whether nodes which are in-use can be deleted:
195 content(nodes(:used_node_1).to_xml)
196 delete :delete, :id => current_nodes(:used_node_1).id
197 assert_require_public_data
198 "shouldn't be able to delete a node used in a way (#{@response.body})"
201 content(nodes(:node_used_by_relationship).to_xml)
202 delete :delete, :id => current_nodes(:node_used_by_relationship).id
203 assert_require_public_data
204 "shouldn't be able to delete a node used in a relation (#{@response.body})"
206 ## now set auth for the public data user
207 basic_authorization(users(:public_user).email, "test")
209 # try to delete with an invalid (closed) changeset
210 content update_changeset(current_nodes(:visible_node).to_xml,
211 changesets(:normal_user_closed_change).id)
212 delete :delete, :id => current_nodes(:visible_node).id
213 assert_response :conflict
215 # try to delete with an invalid (non-existent) changeset
216 content update_changeset(current_nodes(:visible_node).to_xml, 0)
217 delete :delete, :id => current_nodes(:visible_node).id
218 assert_response :conflict
220 # try to delete a node with a different ID
221 content(nodes(:public_visible_node).to_xml)
222 delete :delete, :id => current_nodes(:visible_node).id
223 assert_response :bad_request,
224 "should not be able to delete a node with a different ID from the XML"
226 # try to delete a node rubbish in the payloads
228 delete :delete, :id => current_nodes(:visible_node).id
229 assert_response :bad_request,
230 "should not be able to delete a node without a valid XML payload"
232 # valid delete now takes a payload
233 content(nodes(:public_visible_node).to_xml)
234 delete :delete, :id => current_nodes(:public_visible_node).id
235 assert_response :success
237 # valid delete should return the new version number, which should
238 # be greater than the old version number
239 assert @response.body.to_i > current_nodes(:public_visible_node).version,
240 "delete request should return a new version number for node"
242 # deleting the same node twice doesn't work
243 content(nodes(:public_visible_node).to_xml)
244 delete :delete, :id => current_nodes(:public_visible_node).id
245 assert_response :gone
247 # this won't work since the node never existed
248 delete :delete, :id => 0
249 assert_response :not_found
251 ## these test whether nodes which are in-use can be deleted:
253 content(nodes(:used_node_1).to_xml)
254 delete :delete, :id => current_nodes(:used_node_1).id
255 assert_response :precondition_failed,
256 "shouldn't be able to delete a node used in a way (#{@response.body})"
257 assert_equal "Precondition failed: Node 3 is still used by ways 1,3.", @response.body
260 content(nodes(:node_used_by_relationship).to_xml)
261 delete :delete, :id => current_nodes(:node_used_by_relationship).id
262 assert_response :precondition_failed,
263 "shouldn't be able to delete a node used in a relation (#{@response.body})"
264 assert_equal "Precondition failed: Node 5 is still used by relations 1,3.", @response.body
268 # tests whether the API works and prevents incorrect use while trying
271 ## First test with no user credentials
272 # try and update a node without authorisation
273 # first try to delete node without auth
274 content current_nodes(:visible_node).to_xml
275 put :update, :id => current_nodes(:visible_node).id
276 assert_response :unauthorized
278 ## Second test with the private user
281 basic_authorization(users(:normal_user).email, "test")
283 ## trying to break changesets
285 # try and update in someone else's changeset
286 content update_changeset(current_nodes(:visible_node).to_xml,
287 changesets(:public_user_first_change).id)
288 put :update, :id => current_nodes(:visible_node).id
289 assert_require_public_data "update with other user's changeset should be forbidden when date isn't public"
291 # try and update in a closed changeset
292 content update_changeset(current_nodes(:visible_node).to_xml,
293 changesets(:normal_user_closed_change).id)
294 put :update, :id => current_nodes(:visible_node).id
295 assert_require_public_data "update with closed changeset should be forbidden, when data isn't public"
297 # try and update in a non-existant changeset
298 content update_changeset(current_nodes(:visible_node).to_xml, 0)
299 put :update, :id => current_nodes(:visible_node).id
300 assert_require_public_data("update with changeset=0 should be forbidden, when data isn't public")
302 ## try and submit invalid updates
303 content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lat', 91.0)
304 put :update, :id => current_nodes(:visible_node).id
305 assert_require_public_data "node at lat=91 should be forbidden, when data isn't public"
307 content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lat', -91.0)
308 put :update, :id => current_nodes(:visible_node).id
309 assert_require_public_data "node at lat=-91 should be forbidden, when data isn't public"
311 content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lon', 181.0)
312 put :update, :id => current_nodes(:visible_node).id
313 assert_require_public_data "node at lon=181 should be forbidden, when data isn't public"
315 content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lon', -181.0)
316 put :update, :id => current_nodes(:visible_node).id
317 assert_require_public_data "node at lon=-181 should be forbidden, when data isn't public"
319 ## finally, produce a good request which should work
320 content current_nodes(:visible_node).to_xml
321 put :update, :id => current_nodes(:visible_node).id
322 assert_require_public_data "should have failed with a forbidden when data isn't public"
324 ## Finally test with the public user
326 # try and update a node without authorisation
327 # first try to delete node without auth
328 content current_nodes(:visible_node).to_xml
329 put :update, :id => current_nodes(:visible_node).id
330 assert_response :forbidden
333 basic_authorization(users(:public_user).email, "test")
335 ## trying to break changesets
337 # try and update in someone else's changeset
338 content update_changeset(current_nodes(:visible_node).to_xml,
339 changesets(:normal_user_first_change).id)
340 put :update, :id => current_nodes(:visible_node).id
341 assert_response :conflict, "update with other user's changeset should be rejected"
343 # try and update in a closed changeset
344 content update_changeset(current_nodes(:visible_node).to_xml,
345 changesets(:normal_user_closed_change).id)
346 put :update, :id => current_nodes(:visible_node).id
347 assert_response :conflict, "update with closed changeset should be rejected"
349 # try and update in a non-existant changeset
350 content update_changeset(current_nodes(:visible_node).to_xml, 0)
351 put :update, :id => current_nodes(:visible_node).id
352 assert_response :conflict, "update with changeset=0 should be rejected"
354 ## try and submit invalid updates
355 content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lat', 91.0)
356 put :update, :id => current_nodes(:visible_node).id
357 assert_response :bad_request, "node at lat=91 should be rejected"
359 content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lat', -91.0)
360 put :update, :id => current_nodes(:visible_node).id
361 assert_response :bad_request, "node at lat=-91 should be rejected"
363 content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lon', 181.0)
364 put :update, :id => current_nodes(:visible_node).id
365 assert_response :bad_request, "node at lon=181 should be rejected"
367 content xml_attr_rewrite(current_nodes(:visible_node).to_xml, 'lon', -181.0)
368 put :update, :id => current_nodes(:visible_node).id
369 assert_response :bad_request, "node at lon=-181 should be rejected"
371 ## next, attack the versioning
372 current_node_version = current_nodes(:visible_node).version
374 # try and submit a version behind
375 content xml_attr_rewrite(current_nodes(:visible_node).to_xml,
376 'version', current_node_version - 1)
377 put :update, :id => current_nodes(:visible_node).id
378 assert_response :conflict, "should have failed on old version number"
380 # try and submit a version ahead
381 content xml_attr_rewrite(current_nodes(:visible_node).to_xml,
382 'version', current_node_version + 1)
383 put :update, :id => current_nodes(:visible_node).id
384 assert_response :conflict, "should have failed on skipped version number"
386 # try and submit total crap in the version field
387 content xml_attr_rewrite(current_nodes(:visible_node).to_xml,
388 'version', 'p1r4t3s!')
389 put :update, :id => current_nodes(:visible_node).id
390 assert_response :conflict,
391 "should not be able to put 'p1r4at3s!' in the version field"
393 ## try an update with the wrong ID
394 content current_nodes(:public_visible_node).to_xml
395 put :update, :id => current_nodes(:visible_node).id
396 assert_response :bad_request,
397 "should not be able to update a node with a different ID from the XML"
399 ## try an update with a minimal valid XML doc which isn't a well-formed OSM doc.
401 put :update, :id => current_nodes(:visible_node).id
402 assert_response :bad_request,
403 "should not be able to update a node with non-OSM XML doc."
405 ## finally, produce a good request which should work
406 content current_nodes(:public_visible_node).to_xml
407 put :update, :id => current_nodes(:public_visible_node).id
408 assert_response :success, "a valid update request failed"
412 # test fetching multiple nodes
414 # check error when no parameter provided
416 assert_response :bad_request
418 # check error when no parameter value provided
419 get :nodes, :nodes => ""
420 assert_response :bad_request
422 # test a working call
423 get :nodes, :nodes => "1,2,4,15,17"
424 assert_response :success
425 assert_select "osm" do
426 assert_select "node", :count => 5
427 assert_select "node[id='1'][visible='true']", :count => 1
428 assert_select "node[id='2'][visible='false']", :count => 1
429 assert_select "node[id='4'][visible='true']", :count => 1
430 assert_select "node[id='15'][visible='true']", :count => 1
431 assert_select "node[id='17'][visible='false']", :count => 1
434 # check error when a non-existent node is included
435 get :nodes, :nodes => "1,2,4,15,17,400"
436 assert_response :not_found
440 # test adding tags to a node
441 def test_duplicate_tags
443 basic_authorization(users(:public_user).email, "test")
445 # add an identical tag to the node
446 tag_xml = XML::Node.new("tag")
447 tag_xml['k'] = current_node_tags(:public_v_t1).k
448 tag_xml['v'] = current_node_tags(:public_v_t1).v
450 # add the tag into the existing xml
451 node_xml = current_nodes(:public_visible_node).to_xml
452 node_xml.find("//osm/node").first << tag_xml
456 put :update, :id => current_nodes(:public_visible_node).id
457 assert_response :bad_request,
458 "adding duplicate tags to a node should fail with 'bad request'"
459 assert_equal "Element node/#{current_nodes(:public_visible_node).id} has duplicate tags with key #{current_node_tags(:t1).k}", @response.body
462 # test whether string injection is possible
463 def test_string_injection
464 ## First try with the non-data public user
465 basic_authorization(users(:normal_user).email, "test")
466 changeset_id = changesets(:normal_user_first_change).id
468 # try and put something into a string that the API might
469 # use unquoted and therefore allow code injection...
470 content "<osm><node lat='0' lon='0' changeset='#{changeset_id}'>" +
471 '<tag k="#{@user.inspect}" v="0"/>' +
474 assert_require_public_data "Shouldn't be able to create with non-public user"
476 ## Then try with the public data user
477 basic_authorization(users(:public_user).email, "test")
478 changeset_id = changesets(:public_user_first_change).id
480 # try and put something into a string that the API might
481 # use unquoted and therefore allow code injection...
482 content "<osm><node lat='0' lon='0' changeset='#{changeset_id}'>" +
483 '<tag k="#{@user.inspect}" v="0"/>' +
486 assert_response :success
487 nodeid = @response.body
489 # find the node in the database
490 checknode = Node.find(nodeid)
491 assert_not_nil checknode, "node not found in data base after upload"
493 # and grab it using the api
494 get :read, :id => nodeid
495 assert_response :success
496 apinode = Node.from_xml(@response.body)
497 assert_not_nil apinode, "downloaded node is nil, but shouldn't be"
499 # check the tags are not corrupted
500 assert_equal checknode.tags, apinode.tags
501 assert apinode.tags.include?('#{@user.inspect}')
504 def basic_authorization(user, pass)
505 @request.env["HTTP_AUTHORIZATION"] = "Basic %s" % Base64.encode64("#{user}:#{pass}")
509 @request.env["RAW_POST_DATA"] = c.to_s
513 # update the changeset_id of a node element
514 def update_changeset(xml, changeset_id)
515 xml_attr_rewrite(xml, 'changeset', changeset_id)
519 # update an attribute in the node element
520 def xml_attr_rewrite(xml, name, value)
521 xml.find("//osm/node").first[name] = value.to_s
528 parser = XML::Parser.string(xml)