View Javadoc

1   /**
2    * Copyright 2005-2013 The Kuali Foundation
3    *
4    * Licensed under the Educational Community License, Version 2.0 (the "License");
5    * you may not use this file except in compliance with the License.
6    * You may obtain a copy of the License at
7    *
8    * http://www.opensource.org/licenses/ecl2.php
9    *
10   * Unless required by applicable law or agreed to in writing, software
11   * distributed under the License is distributed on an "AS IS" BASIS,
12   * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13   * See the License for the specific language governing permissions and
14   * limitations under the License.
15   */
16  package edu.samplu.krad.demo.travel.account;
17  
18  import org.kuali.rice.testtools.selenium.SmokeTestBase;
19  import org.junit.Test;
20  
21  /**
22   * @author Kuali Rice Team (rice.collab@kuali.org)
23   */
24  public class DemoTravelAccountMaintenanceNewSmokeTest extends SmokeTestBase {
25  
26      /**
27       * //div[@class='fancybox-item fancybox-close']
28       */
29      public static final String FANCY_BOX_CLOSE_XPATH = "//div[@class='fancybox-item fancybox-close']";
30      
31      /**
32       * //div[@class='fancybox-item fancybox-close']
33       */
34      public static final String FANCY_BOX_IFRAME_XPATH = "//iframe[@class='fancybox-iframe']";
35  
36      /**
37       * /kr-krad/maintenance?methodToCall=start&dataObjectClassName=org.kuali.rice.krad.demo.travel.dataobject.TravelAccount&hideReturnLink=true
38       */
39      public static final String BOOKMARK_URL = "/kr-krad/maintenance?methodToCall=start&dataObjectClassName=org.kuali.rice.krad.demo.travel.dataobject.TravelAccount&hideReturnLink=true";
40  
41      /**
42       * Description field
43       */
44      public static final String DESCRIPTION_FIELD = "document.documentHeader.documentDescription";
45  
46      /**
47       * Explanation field
48       */
49      public static final String EXPLANATION_FIELD = "document.documentHeader.explanation";
50  
51      /**
52       * Organization document number field
53       */
54      public static final String ORGANIZATION_DOCUMENT_NUMBER_FIELD = "document.documentHeader.organizationDocumentNumber";
55  
56      /**
57       * Travel account name field
58       */
59      public static final String TRAVEL_ACCOUNT_NAME_FIELD = "document.newMaintainableObject.dataObject.name";
60  
61      /**
62       * Travel account nUMBER field
63       */
64      public static final String TRAVEL_ACCOUNT_NUMBER_FIELD = "document.newMaintainableObject.dataObject.number";
65  
66      /**
67       * Travel account type code field
68       */
69      public static final String TRAVEL_ACCOUNT_TYPE_CODE_FIELD = "document.newMaintainableObject.dataObject.accountTypeCode";
70  
71      /**
72       * Travel sub account field
73       */
74      public static final String SUB_ACCOUNT_FIELD_XPATH = "//div[@data-label='Travel Sub Account Number']/fieldset/input";
75  
76      /**
77       * Travel sub account name field
78       */
79      public static final String SUB_ACCOUNT_NAME_FIELD_XPATH = "//div[@data-label='Sub Account Name']/input";
80  
81      /**
82       * Subsidized percent
83       */
84      public static final String SUBSIDIZED_PERCENT_FIELD = "document.newMaintainableObject.dataObject.subsidizedPercent";
85  
86      /**
87       * Date created.
88       */
89      public static final String DATE_CREATED_FIELD = "document.newMaintainableObject.dataObject.createDate";
90  
91      /**
92       * Fiscal officer ID
93       */
94      public static final String FISCAL_OFFICER_ID_FIELD = "document.newMaintainableObject.dataObject.fiscalOfficer.principalName";
95  
96      @Override
97      public String getBookmarkUrl() {
98          return BOOKMARK_URL;
99      }
100 
101     protected void navigate() throws Exception {
102         waitAndClickById("Demo-DemoLink", "");
103         waitAndClickByLinkText("Account Maintenance (New)");
104     }
105 
106     protected void testTravelAccountMaintenanceNew() throws Exception {
107         waitAndTypeByName("document.documentHeader.documentDescription","Travel Account Maintenance New Test Document");
108         waitAndTypeByName("document.newMaintainableObject.dataObject.number","a1");
109         assertTextPresent("Travel Account Maintenance");
110     }
111 
112     protected void testTravelAccountMaintenanceEditXss() throws Exception {
113         waitAndTypeByName(DESCRIPTION_FIELD,"\"/><script>alert('!')</script>");
114         waitAndTypeByName(EXPLANATION_FIELD,"\"/><script>alert('!')</script>");
115         waitAndTypeByName(ORGANIZATION_DOCUMENT_NUMBER_FIELD,"\"/><script>alert('!')</script>");
116         waitAndTypeByName(TRAVEL_ACCOUNT_NAME_FIELD,"blah");
117         waitAndTypeByName(TRAVEL_ACCOUNT_NUMBER_FIELD,"blah");
118         selectByName(TRAVEL_ACCOUNT_TYPE_CODE_FIELD,"Clearing Account Type");
119         waitAndTypeByXpath(SUB_ACCOUNT_FIELD_XPATH,"a1");
120         waitAndTypeByXpath(SUB_ACCOUNT_NAME_FIELD_XPATH,"\"/><script>alert('!')</script>");
121         waitAndTypeByName(SUBSIDIZED_PERCENT_FIELD,"\"/><script>alert('!')</script>");
122         waitAndTypeByName(DATE_CREATED_FIELD,"\"/><script>alert('!')</script>");
123         waitAndTypeByName(FISCAL_OFFICER_ID_FIELD,"\"/><script>alert('!')</script>");
124         waitAndClickButtonByText("Save");
125         Thread.sleep(1000);
126         if(isAlertPresent())    {
127             fail("XSS vulnerability identified.");
128         }
129     }
130 
131     public boolean isAlertPresent()
132     {
133         try
134         {
135             driver.switchTo().alert();
136             return true;
137         }   // try
138         catch (Exception Ex)
139         {
140             return false;
141         }   // catch
142     }
143 
144     @Test
145     public void testDemoTravelAccountMaintenanceNewBookmark() throws Exception {
146         testTravelAccountMaintenanceEditXss();
147         testTravelAccountMaintenanceNew();
148         passed();
149     }
150 
151 //    @Test
152     public void testDemoTravelAccountMaintenanceNewNav() throws Exception {
153         testTravelAccountMaintenanceEditXss();
154         testTravelAccountMaintenanceNew();
155         passed();
156     }
157 }