Add extra test cases with wildcards

AikidoSec · Feb 7, 2025 · 41bae61 · 41bae61
1 parent ab304a7
commit 41bae61
Showing 1 changed file with 68 additions and 0 deletions.
diff --git a/agent_api/src/test/java/vulnerabilities/SkipVulnerabilityScanDeciderTest.java b/agent_api/src/test/java/vulnerabilities/SkipVulnerabilityScanDeciderTest.java
@@ -28,6 +28,13 @@ private List<Endpoint> createEndpoints(boolean protectionForcedOff1, boolean pro
         endpoints.add(new Endpoint("GET", "/", 3, 1000, Collections.emptyList(), false, false, false));
         return endpoints;
     }
+    private List<Endpoint> createEndpointsWildcardMethod(boolean protectionForcedOff1, boolean protectionForcedOff2) {
+        List<Endpoint> endpoints = new ArrayList<>();
+        endpoints.add(new Endpoint("*", "/api/login", 3, 1000, Collections.emptyList(), false, protectionForcedOff1, true));
+        endpoints.add(new Endpoint("*", "/api/*", 1, 1000, Collections.emptyList(), false, protectionForcedOff2, true));
+        endpoints.add(new Endpoint("GET", "/", 3, 1000, Collections.emptyList(), false, false, false));
+        return endpoints;
+    }
 
     @BeforeEach
     public void setUp() {
@@ -81,6 +88,29 @@ public void testShouldSkipVulnerabilityScan_ProtectionForcedOff_1() {
         ));
     }
 
+    @Test
+    public void testShouldSkipVulnerabilityScan_ProtectionForcedOff_1_WildCard() {
+        // Mock the ThreadCacheObject to return a matched endpoint
+        ThreadCacheObject mockThreadCache = mock(ThreadCacheObject.class);
+        when(mockThreadCache.getEndpoints()).thenReturn(createEndpointsWildcardMethod(true, false));
+
+        ThreadCache.set(mockThreadCache);
+        assertTrue(SkipVulnerabilityScanDecider.shouldSkipVulnerabilityScan(
+                new EmptySampleContextObject("", "/api/login", "POST")
+        ));
+
+        ThreadCache.set(mockThreadCache);
+        assertFalse(SkipVulnerabilityScanDecider.shouldSkipVulnerabilityScan(
+                new EmptySampleContextObject("", "/api/login2", "POST")
+        ));
+
+        when(mockThreadCache.getEndpoints()).thenReturn(createEndpointsWildcardMethod(false, false));
+        ThreadCache.set(mockThreadCache);
+        assertFalse(SkipVulnerabilityScanDecider.shouldSkipVulnerabilityScan(
+                new EmptySampleContextObject("", "/api/login", "POST")
+        ));
+    }
+
     @Test
     public void testShouldSkipVulnerabilityScan_ProtectionForcedOff_2() {
         // Mock the ThreadCacheObject to return a matched endpoint
@@ -129,6 +159,44 @@ public void testShouldSkipVulnerabilityScan_ProtectionForcedOff_2() {
         ));
     }
 
+    @Test
+    public void testShouldSkipVulnerabilityScan_ProtectionForcedOff_WildcardMethod() {
+        // Mock the ThreadCacheObject to return a matched endpoint
+        ThreadCacheObject mockThreadCache = mock(ThreadCacheObject.class);
+        when(mockThreadCache.getEndpoints()).thenReturn(createEndpointsWildcardMethod(false, true));
+
+        ThreadCache.set(mockThreadCache);
+        assertTrue(SkipVulnerabilityScanDecider.shouldSkipVulnerabilityScan(
+                new EmptySampleContextObject("", "/api/login", "POST")
+        ));
+
+        ThreadCache.set(mockThreadCache);
+        assertTrue(SkipVulnerabilityScanDecider.shouldSkipVulnerabilityScan(
+                new EmptySampleContextObject("", "/api/login2", "POST")
+        ));
+
+        ThreadCache.set(mockThreadCache);
+        assertTrue(SkipVulnerabilityScanDecider.shouldSkipVulnerabilityScan(
+                new EmptySampleContextObject("", "/api/", "POST")
+        ));
+
+        when(mockThreadCache.getEndpoints()).thenReturn(createEndpointsWildcardMethod(true, true));
+        ThreadCache.set(mockThreadCache);
+        assertTrue(SkipVulnerabilityScanDecider.shouldSkipVulnerabilityScan(
+                new EmptySampleContextObject("", "/api/login", "POST")
+        ));
+
+        ThreadCache.set(mockThreadCache);
+        assertTrue(SkipVulnerabilityScanDecider.shouldSkipVulnerabilityScan(
+                new EmptySampleContextObject("", "/api/login2", "POST")
+        ));
+
+        ThreadCache.set(mockThreadCache);
+        assertTrue(SkipVulnerabilityScanDecider.shouldSkipVulnerabilityScan(
+                new EmptySampleContextObject("", "/api/", "POST")
+        ));
+    }
+
     @Test
     public void testShouldSkipVulnerabilityScan_NoConditionsMet() {