+
+
diff --git a/test/integration/validations_test.rb b/test/integration/validations_test.rb
index ca4c910..84776f9 100644
--- a/test/integration/validations_test.rb
+++ b/test/integration/validations_test.rb
@@ -14,6 +14,12 @@ def lint(passport)
JSON.parse(response.body)
end
+ def lint_text(text)
+ post "/api/v1/validate", params: text, headers: { "Content-Type" => "application/json" }
+ assert_response :success
+ JSON.parse(response.body)
+ end
+
def criterion(result, id) = result["criteria"].find { |c| c["id"] == id }
test "reference passport passes all structure checks" do
@@ -88,13 +94,40 @@ def criterion(result, id) = result["criteria"].find { |c| c["id"] == id }
assert_equal "passed", criterion(lint(reference.merge("uniqueProductIdentifier" => "did:web:dpp.example.org:product:4711")), "DPP-ID-054")["result"]
end
+ test "elementIds of the reference passport are unique at each level and in the whole passport" do
+ result = lint(reference)
+ assert_equal "passed", criterion(result, "DPP-DAT-017")["result"]
+ assert_equal "passed", criterion(result, "DPP-DAT-021")["result"]
+ end
+
+ test "an elementId repeated within a collection fails, one used in two collections gives a warning" do
+ passport = reference
+ collection = passport["elements"].first
+ collection["elements"] << collection["elements"].first.merge("value" => "other")
+ result = lint(passport)
+ assert_equal "failed", criterion(result, "DPP-DAT-017")["result"]
+ assert_match(/ModelIdentifier 2 times in ProductIdentification/, criterion(result, "DPP-DAT-017")["messages"].first["message"])
+
+ passport = reference
+ passport["elements"].last["elements"] << passport["elements"].first["elements"].first
+ result = lint(passport)
+ assert_equal "passed", criterion(result, "DPP-DAT-017")["result"]
+ assert_equal "warning", criterion(result, "DPP-DAT-021")["result"]
+ end
+
+ test "a compressed passport posted with a repeated member name fails DPP-DAT-017" do
+ result = lint_text(file_fixture("element_ids/DPP-DAT-017/invalid/compressed-repeated-member.json").read)
+ assert_equal "failed", criterion(result, "DPP-DAT-017")["result"]
+ assert_equal %w[skipped not_evaluated], criterion(result, "DPP-DAT-021").values_at("result", "reason_code")
+ end
+
test "optional facility identifier is skipped when absent" do
assert_equal "skipped", criterion(lint(reference), "DPP-ID-010")["result"]
end
test "checks that request the product identifier need one" do
result = lint(reference)
- %w[DPP-ID-001 DPP-ID-013 DPP-DAT-003 DPP-DAT-016 DPP-SEC-014 DPP-SEC-020].each do |id|
+ %w[DPP-ID-001 DPP-ID-013 DPP-DAT-003 DPP-DAT-016 DPP-SEC-014 DPP-SEC-020 DPP-SEC-021].each do |id|
assert_equal "skipped", criterion(result, id)["result"], id
end
assert_equal "rated by dpp-validator from its daily runs", criterion(result, "DPP-ID-002")["reason"]
diff --git a/test/services/element_ids_check_test.rb b/test/services/element_ids_check_test.rb
new file mode 100644
index 0000000..d6656cf
--- /dev/null
+++ b/test/services/element_ids_check_test.rb
@@ -0,0 +1,98 @@
+require "test_helper"
+
+class ElementIdsCheckTest < ActiveSupport::TestCase
+ LEVEL = { "type" => "element_ids", "unique" => "level" }.freeze
+ PASSPORT = { "type" => "element_ids", "unique" => "passport" }.freeze
+ VECTORS = Rails.root.join("test/fixtures/files/element_ids")
+
+ def outcome(check, text, source: true)
+ ElementIdsCheck.new(check, JSON.parse(text), source: source ? text : nil).outcome
+ end
+
+ def vectors(id, kind) = Dir[VECTORS.join(id, kind, "*.json")].sort
+
+ # Test vectors: DPP-DAT-017 (unique: level) and DPP-DAT-021 (unique: passport).
+ test "DPP-DAT-017 test vectors: valid ones pass, invalid ones fail" do
+ assert_operator vectors("DPP-DAT-017", "valid").size, :>=, 4
+ vectors("DPP-DAT-017", "valid").each do |file|
+ o = outcome(LEVEL, File.read(file))
+ assert_nil o.skipped, file
+ assert_empty o.messages, file
+ end
+ assert_operator vectors("DPP-DAT-017", "invalid").size, :>=, 4
+ vectors("DPP-DAT-017", "invalid").each do |file|
+ o = outcome(LEVEL, File.read(file))
+ assert_equal ["violation"], o.messages.map { |m| m[:severity] }, file
+ end
+ end
+
+ test "DPP-DAT-021 test vectors: valid ones pass, the others give a warning" do
+ vectors("DPP-DAT-021", "valid").each do |file|
+ assert_empty outcome(PASSPORT, File.read(file)).messages, file
+ end
+ assert_operator vectors("DPP-DAT-021", "warning").size, :>=, 2
+ vectors("DPP-DAT-021", "warning").each do |file|
+ assert_equal ["warning"], outcome(PASSPORT, File.read(file)).messages.map { |m| m[:severity] }, file
+ end
+ end
+
+ test "the reference passport passes both" do
+ text = file_fixture("reference-passport.json").read
+ assert_empty outcome(LEVEL, text).messages
+ assert_empty outcome(PASSPORT, text).messages
+ end
+
+ test "messages name the repeated elementId, how often and where" do
+ text = VECTORS.join("DPP-DAT-017/invalid/full-collection-language-variants.json").read
+ assert_equal "elementId repeated within one level: SafetyInstructions 2 times in ProductInformation",
+ outcome(LEVEL, text).messages.first[:message]
+ text = VECTORS.join("DPP-DAT-017/invalid/full-top-level-repeated.json").read
+ assert_match(/ModelIdentifier 2 times at the top level of the passport/, outcome(LEVEL, text).messages.first[:message])
+ text = VECTORS.join("DPP-DAT-017/invalid/full-multi-valued-item-repeated.json").read
+ assert_match(%r{efficiencyRating2 2 times in EnergyPerformance/efficiencyRatings}, outcome(LEVEL, text).messages.first[:message])
+ text = VECTORS.join("DPP-DAT-021/warning/full-same-id-in-two-collections.json").read
+ assert_equal "elementId used at more than one place of the passport: name at 2 places (Manufacturer/name, Importer/name)",
+ outcome(PASSPORT, text).messages.first[:message]
+ end
+
+ test "a repeated elementId is reported once by the level check, not again as a second place" do
+ text = VECTORS.join("DPP-DAT-017/invalid/full-collection-language-variants.json").read
+ assert_empty outcome(PASSPORT, text).messages
+ end
+
+ test "compressed serialization: repeated member names in the passport as delivered fail" do
+ text = VECTORS.join("DPP-DAT-017/invalid/compressed-repeated-member.json").read
+ assert_equal "member name repeated within one JSON object: maxPressure 2 times in the object at $['performanceMetrics']",
+ outcome(LEVEL, text).messages.first[:message]
+ end
+
+ test "compressed serialization without the passport as delivered is skipped" do
+ text = VECTORS.join("DPP-DAT-017/valid/compressed-unique.json").read
+ o = outcome(LEVEL, text, source: false)
+ assert_equal "not_evaluated", o.code
+ assert_match(/not available as delivered/, o.skipped)
+ end
+
+ test "the passport-wide check skips the compressed serialization" do
+ o = outcome(PASSPORT, VECTORS.join("DPP-DAT-017/valid/compressed-unique.json").read)
+ assert_equal "not_evaluated", o.code
+ assert_match(/compressed serialization/, o.skipped)
+ end
+
+ test "the full serialization is checked on the parsed passport, without the bytes" do
+ text = VECTORS.join("DPP-DAT-017/invalid/full-top-level-repeated.json").read
+ assert_equal ["violation"], outcome(LEVEL, text, source: false).messages.map { |m| m[:severity] }
+ end
+
+ test "unreadable bytes skip the compressed check" do
+ o = ElementIdsCheck.new(LEVEL, { "dppStatus" => "Active" }, source: '{"dppStatus": "Active",}').outcome
+ assert_equal "not_evaluated", o.code
+ assert_match(/cannot be read/, o.skipped)
+ end
+
+ test "more than ten findings are cut short" do
+ elements = (1..12).flat_map { |i| [{ "elementId" => "e#{i}" }, { "elementId" => "e#{i}" }] }
+ o = ElementIdsCheck.new(LEVEL, { "elements" => elements }).outcome
+ assert_match(/e10 2 times at the top level of the passport and 2 more\z/, o.messages.first[:message])
+ end
+end
diff --git a/test/services/html_check_device_test.rb b/test/services/html_check_device_test.rb
new file mode 100644
index 0000000..b76ed90
--- /dev/null
+++ b/test/services/html_check_device_test.rb
@@ -0,0 +1,122 @@
+require "test_helper"
+
+# html with device_features: forbidden (DPP-SEC-021): static search for
+# browser interfaces that use functions of the reader's device.
+class HtmlCheckDeviceTest < ActiveSupport::TestCase
+ UPI = "https://dpp.example.org/01/09520123456788/21/0001".freeze
+ CHECK = { "type" => "html", "device_features" => "forbidden" }.freeze
+ VECTORS = Rails.root.join("test/fixtures/files/html/DPP-SEC-021")
+
+ # The page for the product identifier; scripts under /scripts/ from the
+ # test vectors; every other URL is recorded and answered with 404.
+ class FakeResolver
+ attr_reader :requested
+
+ def initialize(page, scripts: {}) = (@page, @scripts, @requested = page, scripts, [])
+
+ def get(url, accept: nil)
+ @requested << [url, accept]
+ return response(url, 200, "text/html; charset=utf-8", @page) if url == UPI
+ return response(url, 200, "text/javascript", @scripts[url]) if @scripts.key?(url)
+
+ response(url, 404, "text/plain", "not found")
+ end
+
+ def response(url, status, type, body) = HttpResolver::Response.new(url: url, status: status, content_type: type, body: body, headers: {})
+ end
+
+ def scripts
+ Dir[VECTORS.join("scripts", "*.js")].to_h { |f| ["https://dpp.example.org/scripts/#{File.basename(f)}", File.read(f)] }
+ end
+
+ def outcome(html, check: CHECK)
+ resolver = FakeResolver.new(html, scripts: scripts)
+ [HtmlCheck.new(check, UPI, resolver).outcome, resolver]
+ end
+
+ def page(head = "", body = "") = "#{head}#{body}"
+
+ def finding(html) = outcome(html).first.messages.first&.dig(:message)
+
+ test "DPP-SEC-021 test vectors: valid ones pass, invalid ones fail" do
+ valid = Dir[VECTORS.join("valid", "*.html")].sort
+ invalid = Dir[VECTORS.join("invalid", "*.html")].sort
+ assert_operator valid.size, :>=, 5
+ assert_operator invalid.size, :>=, 8
+ valid.each { |f| assert_empty outcome(File.read(f)).first.messages, f }
+ invalid.each { |f| assert_equal ["violation"], outcome(File.read(f)).first.messages.map { |m| m[:severity] }, f }
+ end
+
+ test "findings name the function, the interface and the place" do
+ assert_equal "the HTML view uses functions of the reader's device: location (.geolocation in inline script 1)",
+ finding(VECTORS.join("invalid/inline-script-location.html").read)
+ assert_match(/notifications \(Notification\.requestPermission in attribute onclick of button\)/,
+ finding(VECTORS.join("invalid/event-handler-notifications.html").read))
+ assert_match(%r{camera, microphone or screen \(\.mediaDevices in https://dpp\.example\.org/scripts/scanner\.js\)},
+ finding(VECTORS.join("invalid/own-script-camera.html").read))
+ assert_match(%r{motion or orientation sensors \(devicemotion in https://dpp\.example\.org/scripts/sensors\.js\)},
+ finding(VECTORS.join("invalid/modulepreload-sensors.html").read))
+ assert_match(/iframe allow grants camera\z/, finding(VECTORS.join("invalid/iframe-allow-camera.html").read))
+ assert_match(/file input with capture/, finding(VECTORS.join("invalid/file-input-capture.html").read))
+ assert_match(/device behaviour \(navigator\.vibrate in attribute href of a\)/,
+ finding(VECTORS.join("invalid/javascript-url-vibration.html").read))
+ assert_match(/permission element/, finding(VECTORS.join("invalid/permission-element.html").read))
+ end
+
+ test "only scripts from the page's own host are fetched, as */*" do
+ _, resolver = outcome(page('' \
+ ''))
+ assert_equal [[UPI, "text/html"], ["https://dpp.example.org/scripts/render.js", "*/*"]], resolver.requested
+ end
+
+ test "at most ten scripts are fetched" do
+ tags = (1..12).map { |i| %() }.join
+ _, resolver = outcome(page(tags))
+ assert_equal 11, resolver.requested.size
+ end
+
+ test "a script that cannot be retrieved is not checked" do
+ assert_empty outcome(page('')).first.messages
+ end
+
+ test "each interface group is recognised" do
+ {
+ "navigator.geolocation.watchPosition(f)" => "location",
+ "navigator.mediaDevices.getDisplayMedia()" => "camera, microphone or screen",
+ "reg.pushManager.subscribe()" => "notifications",
+ "new Notification('x')" => "notifications",
+ "navigator.contacts.select(['tel'])" => "contacts",
+ "navigator.bluetooth.requestDevice({})" => "Bluetooth, USB, serial, HID or NFC",
+ "new NDEFReader()" => "Bluetooth, USB, serial, HID or NFC",
+ "DeviceOrientationEvent.requestPermission()" => "motion or orientation sensors",
+ "new Gyroscope({ frequency: 60 })" => "motion or orientation sensors",
+ "window.ondeviceorientation = f" => "motion or orientation sensors",
+ "navigator.connection.effectiveType" => "context or network information",
+ "navigator.getBattery()" => "context or network information",
+ "new IdleDetector()" => "context or network information",
+ "navigator.credentials.get({ otp: { transport: ['sms'] } })" => "one-time codes from SMS",
+ "addEventListener('beforeinstallprompt', f)" => "app installation",
+ "navigator.wakeLock.request('screen')" => "device behaviour"
+ }.each do |code, label|
+ assert_equal [label], HtmlCheck.device_uses(code).map(&:first), code
+ end
+ end
+
+ test "ordinary code and words without interface calls are not counted" do
+ ["const location = window.location.href;", "fetch('/dpp.json').then(r => r.json())",
+ "document.title = 'geolocation of the factory';", "navigator.language", "Notification"].each do |code|
+ assert_empty HtmlCheck.device_uses(code), code
+ end
+ end
+
+ test "a page without device use passes, together with external_resources" do
+ o, = outcome(page(''), check: CHECK.merge("external_resources" => "forbidden"))
+ assert_empty o.messages
+ end
+
+ test "both options give a message each" do
+ o, = outcome(page(''),
+ check: CHECK.merge("external_resources" => "forbidden"))
+ assert_equal 2, o.messages.size
+ end
+end
diff --git a/test/services/json_duplicates_test.rb b/test/services/json_duplicates_test.rb
new file mode 100644
index 0000000..bd4dfa5
--- /dev/null
+++ b/test/services/json_duplicates_test.rb
@@ -0,0 +1,39 @@
+require "test_helper"
+
+class JsonDuplicatesTest < ActiveSupport::TestCase
+ test "no repeated names" do
+ assert_empty JsonDuplicates.find('{"a": 1, "b": {"a": 2}, "c": [{"a": 1}, {"a": 2}]}')
+ end
+
+ test "a repeated name with its normalized path and count" do
+ assert_equal [{ path: "$['b'][1]", name: "x", count: 3 }],
+ JsonDuplicates.find('{"a":1,"b":[{"x":1},{"x":1,"x":2,"x":3}]}')
+ end
+
+ test "names are compared after their escapes are resolved" do
+ assert_equal [{ path: "$", name: "a", count: 2 }], JsonDuplicates.find('{"a": 1, "a": 2}')
+ end
+
+ test "paths escape quotes, backslashes and control characters" do
+ found = JsonDuplicates.find(%({"it's\\\\\\n": {"k": 1, "k": 2}}))
+ assert_equal "$['it\\'s\\\\\\n']", found.first[:path]
+ end
+
+ test "strings, numbers and literals are skipped, also with escaped quotes" do
+ assert_empty JsonDuplicates.find(%([1, -2.5e3, true, false, null, "a\\"b", {"q": "}"}]))
+ end
+
+ test "a byte order mark is accepted" do
+ assert_empty JsonDuplicates.find("{\"a\": 1}")
+ end
+
+ test "text that is not one JSON value is refused" do
+ ['{"a": 1,}', '{"a" 1}', "[1 2]", '{"a": 1} x', "nul", "\xFF".b].each do |text|
+ assert_raises(JsonDuplicates::Invalid, text) { JsonDuplicates.find(text) }
+ end
+ end
+
+ test "very deep nesting is refused" do
+ assert_raises(JsonDuplicates::Invalid) { JsonDuplicates.find(("[" * 600) + ("]" * 600)) }
+ end
+end
diff --git a/test/services/passport_linter_test.rb b/test/services/passport_linter_test.rb
index a562dab..735239d 100644
--- a/test/services/passport_linter_test.rb
+++ b/test/services/passport_linter_test.rb
@@ -156,4 +156,25 @@ def lint(responses, check = CHECK)
assert_equal "skipped", result[:result]
assert_match(/uses a feature outside the portable subset of CRITERIA-FORMAT.md that dpplint does not evaluate \(lookahead\)/, result[:reason])
end
+
+ test "element_ids criteria check the passport as delivered: the response bytes, or the posted body" do
+ text = File.read(Rails.root.join("test/fixtures/files/element_ids/DPP-DAT-017/invalid/compressed-repeated-member.json"))
+ check = { "type" => "element_ids", "unique" => "level" }
+ linter = -> { PassportLinter.new(catalogue: FakeCatalogue.new([criterion(check).merge("id" => "DPP-DAT-017")])) }
+ posted = linter.call.run(passport: JSON.parse(text), source: text)[:criteria].first
+ assert_equal "failed", posted[:result]
+ assert_match(/maxPressure 2 times/, posted[:messages].first[:message])
+ assert_equal "failed", linter.call.run(passport: JSON.parse(text), raw: text.b)[:criteria].first[:result]
+ without = linter.call.run(passport: JSON.parse(text))[:criteria].first
+ assert_equal %w[skipped not_evaluated], without.values_at(:result, :reason_code)
+ end
+
+ test "a warning of an element_ids criterion leaves it counted as passed" do
+ text = File.read(Rails.root.join("test/fixtures/files/element_ids/DPP-DAT-021/warning/full-same-id-in-two-collections.json"))
+ check = { "type" => "element_ids", "unique" => "passport" }
+ report = PassportLinter.new(catalogue: FakeCatalogue.new([criterion(check).merge("id" => "DPP-DAT-021")]))
+ .run(passport: JSON.parse(text))
+ assert_equal "warning", report[:criteria].first[:result]
+ assert_equal "1 of 1 automated checks passed", report[:summary][:text]
+ end
end