Add more OAuth unit tests (#5946)

4 files changed, 125 insertions, 5 deletions

diff --git a/model/access.go b/model/access.go
index 85417fce9..520417f4e 100644
--- a/model/access.go
+++ b/model/access.go
@@ -51,7 +51,7 @@ func (ad *AccessData) IsValid() *AppError {
 		return NewLocAppError("AccessData.IsValid", "model.access.is_valid.refresh_token.app_error", nil, "")
 	}
 
-	if len(ad.RedirectUri) > 256 {
+	if len(ad.RedirectUri) == 0 || len(ad.RedirectUri) > 256 || !IsValidHttpUrl(ad.RedirectUri) {
 		return NewLocAppError("AccessData.IsValid", "model.access.is_valid.redirect_uri.app_error", nil, "")
 	}
 
diff --git a/model/access_test.go b/model/access_test.go
index 0eca302ba..77b4cf15b 100644
--- a/model/access_test.go
+++ b/model/access_test.go
@@ -27,12 +27,32 @@ func TestAccessIsValid(t *testing.T) {
 	ad := AccessData{}
 
 	if err := ad.IsValid(); err == nil {
-		t.Fatal("should have failed")
+		t.Fatal()
+	}
+
+	ad.ClientId = NewRandomString(28)
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed Client Id")
+	}
+
+	ad.ClientId = ""
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed Client Id")
 	}
 
 	ad.ClientId = NewId()
 	if err := ad.IsValid(); err == nil {
-		t.Fatal("should have failed")
+		t.Fatal()
+	}
+
+	ad.UserId = NewRandomString(28)
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed User Id")
+	}
+
+	ad.UserId = ""
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed User Id")
 	}
 
 	ad.UserId = NewId()
@@ -40,7 +60,37 @@ func TestAccessIsValid(t *testing.T) {
 		t.Fatal("should have failed")
 	}
 
+	ad.Token = NewRandomString(22)
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed Token")
+	}
+
 	ad.Token = NewId()
+	if err := ad.IsValid(); err == nil {
+		t.Fatal()
+	}
+
+	ad.RefreshToken = NewRandomString(28)
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed Refresh Token")
+	}
+
+	ad.RefreshToken = NewId()
+	if err := ad.IsValid(); err == nil {
+		t.Fatal()
+	}
+
+	ad.RedirectUri = ""
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed Redirect URI not set")
+	}
+
+	ad.RedirectUri = NewRandomString(28)
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed invalid URL")
+	}
+
+	ad.RedirectUri = "http://example.com"
 	if err := ad.IsValid(); err != nil {
 		t.Fatal(err)
 	}
diff --git a/model/authorize.go b/model/authorize.go
index 2b4017e9c..3f259718b 100644
--- a/model/authorize.go
+++ b/model/authorize.go
@@ -49,7 +49,7 @@ func (ad *AuthData) IsValid() *AppError {
 		return NewLocAppError("AuthData.IsValid", "model.authorize.is_valid.create_at.app_error", nil, "client_id="+ad.ClientId)
 	}
 
-	if len(ad.RedirectUri) > 256 {
+	if len(ad.RedirectUri) == 0 || len(ad.RedirectUri) > 256 || !IsValidHttpUrl(ad.RedirectUri) {
 		return NewLocAppError("AuthData.IsValid", "model.authorize.is_valid.redirect_uri.app_error", nil, "client_id="+ad.ClientId)
 	}
 
diff --git a/model/authorize_test.go b/model/authorize_test.go
index 3fedc37e4..82a48332c 100644
--- a/model/authorize_test.go
+++ b/model/authorize_test.go
@@ -39,28 +39,98 @@ func TestAuthIsValid(t *testing.T) {
 		t.Fatal()
 	}
 
+	ad.ClientId = NewRandomString(28)
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed Client Id")
+	}
+
 	ad.ClientId = NewId()
 	if err := ad.IsValid(); err == nil {
 		t.Fatal()
 	}
 
+	ad.UserId = NewRandomString(28)
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed User Id")
+	}
+
 	ad.UserId = NewId()
 	if err := ad.IsValid(); err == nil {
 		t.Fatal()
 	}
 
+	ad.Code = NewRandomString(129)
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed Code to long")
+	}
+
+	ad.Code = ""
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed Code not set")
+	}
+
 	ad.Code = NewId()
 	if err := ad.IsValid(); err == nil {
 		t.Fatal()
 	}
 
+	ad.ExpiresIn = 0
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed invalid ExpiresIn")
+	}
+
 	ad.ExpiresIn = 1
 	if err := ad.IsValid(); err == nil {
 		t.Fatal()
 	}
 
+	ad.CreateAt = 0
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed Invalid Create At")
+	}
+
 	ad.CreateAt = 1
-	if err := ad.IsValid(); err != nil {
+	if err := ad.IsValid(); err == nil {
 		t.Fatal()
 	}
+
+	ad.State = NewRandomString(129)
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed invalid State")
+	}
+
+	ad.State = NewRandomString(128)
+	if err := ad.IsValid(); err == nil {
+		t.Fatal(err)
+	}
+
+	ad.Scope = NewRandomString(129)
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed invalid Scope")
+	}
+
+	ad.Scope = NewRandomString(128)
+	if err := ad.IsValid(); err == nil {
+		t.Fatal()
+	}
+
+	ad.RedirectUri = ""
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed Redirect URI not set")
+	}
+
+	ad.RedirectUri = NewRandomString(28)
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed invalid URL")
+	}
+
+	ad.RedirectUri = NewRandomString(257)
+	if err := ad.IsValid(); err == nil {
+		t.Fatal("Should have failed invalid URL")
+	}
+
+	ad.RedirectUri = "http://example.com"
+	if err := ad.IsValid(); err != nil {
+		t.Fatal(err)
+	}
 }