def test_next_url(): app = Flask("test") app.add_url_rule("/success", "success") app.config["SECRET_KEY"] = "testing" app.config["MULTIPASS_SUCCESS_ENDPOINT"] = "success" multipass = Multipass(app) with app.test_request_context(): # default url - not in session assert multipass._get_next_url() == "/success" multipass.set_next_url() # default url - in session assert multipass._get_next_url() == "/success" request.args = {"next": "/private"} # next url specified, but not in session yet assert multipass._get_next_url() == "/success" multipass.set_next_url() # removed from session after retrieving it once assert multipass._get_next_url() == "/private" assert multipass._get_next_url() == "/success"
def test_next_url(): app = Flask('test') app.add_url_rule('/success', 'success') app.config['SECRET_KEY'] = 'testing' app.config['MULTIPASS_SUCCESS_ENDPOINT'] = 'success' multipass = Multipass(app) with app.test_request_context(): # default url - not in session assert multipass._get_next_url() == '/success' multipass.set_next_url() # default url - in session assert multipass._get_next_url() == '/success' request.args = {'next': '/private'} # next url specified, but not in session yet assert multipass._get_next_url() == '/success' multipass.set_next_url() # removed from session after retrieving it once assert multipass._get_next_url() == '/private' assert multipass._get_next_url() == '/success'
def test_next_url_invalid(): app = Flask('test') app.add_url_rule('/success', 'success') app.config['SECRET_KEY'] = 'testing' app.config['MULTIPASS_SUCCESS_ENDPOINT'] = 'success' multipass = Multipass(app) with app.test_request_context(): request.args = {'next': '//evil.com'} multipass.set_next_url() assert multipass._get_next_url() == '/success'
def test_next_url(): app = Flask('test') app.add_url_rule('/success', 'success') app.config['SECRET_KEY'] = 'testing' app.config['MULTIPASS_SUCCESS_ENDPOINT'] = 'success' multipass = Multipass(app) with app.test_request_context(): # default url - not in session assert multipass._get_next_url() == '/success' multipass._set_next_url() # default url - in session assert multipass._get_next_url() == '/success' request.args = {'next': '/private'} # next url specified, but not in session yet assert multipass._get_next_url() == '/success' multipass._set_next_url() # removed from session after retrieving it once assert multipass._get_next_url() == '/private' assert multipass._get_next_url() == '/success'