test_configure_ldap.py

#!/usr/bin/env python3
"""Tests for configure_ldap.py.

This module tests the LDAP configuration script for Redmine.
IMPORTANT: This script has SQL injection vulnerabilities that should be tested.
"""

import subprocess
from unittest.mock import MagicMock

from pytest_mock import MockFixture

from scripts.redmine.configure_ldap import configure_ldap


class TestConfigureLdap:
    """Tests for configure_ldap function."""

    def test_configure_ldap_success(self, mocker: MockFixture) -> None:
        """Test successful LDAP configuration."""
        # Mock environment variables
        mocker.patch.dict(
            "os.environ",
            {
                "REDMINE_DB_HOST": "localhost",
                "REDMINE_DB_PORT": "5432",
                "REDMINE_DB_USER": "redmine",
                "REDMINE_DB_NAME": "redmine",
                "REDMINE_DB_PASSWORD": "secret",
            },
        )

        # Mock file operations for .pgpass
        _mock_fdopen = mocker.patch("os.fdopen")
        _mock_chmod = mocker.patch("os.chmod")
        _mock_unlink = mocker.patch("os.unlink")
        mocker.patch("tempfile.mkstemp", return_value=(999, "/tmp/pgpass_test.tmp"))

        mock_run = mocker.patch("subprocess.run")
        mock_run.return_value = MagicMock(stdout="INSERT 0 1", stderr="", returncode=0)

        result = configure_ldap(
            namespace="dev",
            ldap_name="FreeIPA",
            ldap_host="freeipa.example.com",
            ldap_port=636,
            bind_dn="uid=admin,cn=users,dc=example,dc=com",
            bind_password="secret123",
            base_dn="cn=users,dc=example,dc=com",
            use_tls=True,
        )

        assert result is True
        mock_run.assert_called_once()

        # Verify psql command structure (direct DB connection)
        call_args = mock_run.call_args
        cmd = call_args[0][0]
        assert cmd[0] == "psql"
        assert "-h" in cmd
        assert "localhost" in cmd
        assert "-U" in cmd
        assert "redmine" in cmd

    def test_configure_ldap_with_tls_disabled(self, mocker: MockFixture) -> None:
        """Test LDAP configuration with TLS disabled."""
        mock_run = mocker.patch("subprocess.run")
        mock_run.return_value = MagicMock(stdout="INSERT 0 1", returncode=0)

        result = configure_ldap(
            namespace="dev",
            ldap_name="FreeIPA",
            ldap_host="freeipa.example.com",
            ldap_port=389,
            bind_dn="uid=admin,cn=users,dc=example,dc=com",
            bind_password="secret",
            base_dn="cn=users,dc=example,dc=com",
            use_tls=False,
        )

        assert result is True

        # Verify TLS is set to false in SQL
        call_args = mock_run.call_args
        cmd = call_args[0][0]
        sql_cmd = cmd[-1]
        assert "false" in sql_cmd.lower()

    def test_configure_ldap_subprocess_failure(self, mocker: MockFixture) -> None:
        """Test handling of subprocess failure."""
        mock_run = mocker.patch("subprocess.run")
        mock_run.side_effect = subprocess.CalledProcessError(1, ["kubectl"], stderr="connection refused")

        result = configure_ldap(
            namespace="dev",
            ldap_name="FreeIPA",
            ldap_host="freeipa.example.com",
            ldap_port=636,
            bind_dn="uid=admin,cn=users,dc=example,dc=com",
            bind_password="secret",
            base_dn="cn=users,dc=example,dc=com",
        )

        assert result is False

    def test_configure_ldap_sql_structure(self, mocker: MockFixture) -> None:
        """Test that SQL contains required fields."""
        mock_run = mocker.patch("subprocess.run")
        mock_run.return_value = MagicMock(stdout="INSERT 0 1", returncode=0)

        configure_ldap(
            namespace="dev",
            ldap_name="TestLDAP",
            ldap_host="ldap.test.com",
            ldap_port=636,
            bind_dn="cn=admin,dc=test,dc=com",
            bind_password="testpass",
            base_dn="dc=test,dc=com",
        )

        call_args = mock_run.call_args
        cmd = call_args[0][0]
        sql_cmd = cmd[-1]

        # Verify SQL contains expected fields
        assert "DELETE FROM auth_sources WHERE type = 'AuthSourceLdap'" in sql_cmd
        assert "INSERT INTO auth_sources" in sql_cmd
        assert "AuthSourceLdap" in sql_cmd
        assert "TestLDAP" in sql_cmd
        assert "ldap.test.com" in sql_cmd
        assert "636" in sql_cmd
        assert "cn=admin,dc=test,dc=com" in sql_cmd
        assert "dc=test,dc=com" in sql_cmd

    def test_configure_ldap_default_attributes(self, mocker: MockFixture) -> None:
        """Test that default LDAP attributes are set correctly."""
        mock_run = mocker.patch("subprocess.run")
        mock_run.return_value = MagicMock(stdout="INSERT 0 1", returncode=0)

        configure_ldap(
            namespace="dev",
            ldap_name="FreeIPA",
            ldap_host="freeipa.example.com",
            ldap_port=636,
            bind_dn="uid=admin",
            bind_password="secret",
            base_dn="dc=example,dc=com",
        )

        call_args = mock_run.call_args
        cmd = call_args[0][0]
        sql_cmd = cmd[-1]

        # Verify default attribute mappings
        assert "uid" in sql_cmd  # attr_login
        assert "givenName" in sql_cmd  # attr_firstname
        assert "sn" in sql_cmd  # attr_lastname
        assert "mail" in sql_cmd  # attr_mail
        assert "(objectClass=person)" in sql_cmd  # filter


class TestConfigureLdapSqlInjection:
    """Tests for SQL injection vulnerabilities.

    IMPORTANT: These tests document the SQL injection vulnerability in the current
    implementation. The script uses string formatting for SQL queries which is unsafe.
    """

    def test_sql_injection_in_ldap_name(self, mocker: MockFixture) -> None:
        """Test that malicious LDAP name could cause SQL injection."""
        mock_run = mocker.patch("subprocess.run")
        mock_run.return_value = MagicMock(stdout="", returncode=0)

        # This malicious input could break out of the SQL string
        malicious_name = "FreeIPA'; DROP TABLE auth_sources; --"

        configure_ldap(
            namespace="dev",
            ldap_name=malicious_name,
            ldap_host="freeipa.example.com",
            ldap_port=636,
            bind_dn="uid=admin",
            bind_password="secret",
            base_dn="dc=example,dc=com",
        )

        # Check that the malicious input is in the SQL (demonstrating vulnerability)
        call_args = mock_run.call_args
        cmd = call_args[0][0]
        sql_cmd = cmd[-1]

        # This test documents the vulnerability - malicious input goes straight into SQL
        assert malicious_name in sql_cmd

    def test_sql_injection_in_bind_password(self, mocker: MockFixture) -> None:
        """Test that malicious password could cause SQL injection."""
        mock_run = mocker.patch("subprocess.run")
        mock_run.return_value = MagicMock(stdout="", returncode=0)

        # Password with SQL injection attempt
        malicious_password = "secret'; UPDATE users SET admin=true; --"

        configure_ldap(
            namespace="dev",
            ldap_name="FreeIPA",
            ldap_host="freeipa.example.com",
            ldap_port=636,
            bind_dn="uid=admin",
            bind_password=malicious_password,
            base_dn="dc=example,dc=com",
        )

        call_args = mock_run.call_args
        cmd = call_args[0][0]
        sql_cmd = cmd[-1]

        # Documents vulnerability - password is not escaped
        assert malicious_password in sql_cmd

    def test_sql_injection_in_ldap_host(self, mocker: MockFixture) -> None:
        """Test that malicious host could cause SQL injection."""
        mock_run = mocker.patch("subprocess.run")
        mock_run.return_value = MagicMock(stdout="", returncode=0)

        malicious_host = (
            "evil.com', 636, '', '', '', 'uid', 'givenName', 'sn', 'mail', "
            "true, true, '', 15, true); DELETE FROM auth_sources; --"
        )

        configure_ldap(
            namespace="dev",
            ldap_name="FreeIPA",
            ldap_host=malicious_host,
            ldap_port=636,
            bind_dn="uid=admin",
            bind_password="secret",
            base_dn="dc=example,dc=com",
        )

        call_args = mock_run.call_args
        cmd = call_args[0][0]
        sql_cmd = cmd[-1]

        # Documents vulnerability
        assert malicious_host in sql_cmd


class TestConfigureLdapEdgeCases:
    """Tests for edge cases and boundary conditions."""

    def test_configure_ldap_with_special_chars_in_dn(self, mocker: MockFixture) -> None:
        """Test handling of special characters in DN."""
        mock_run = mocker.patch("subprocess.run")
        mock_run.return_value = MagicMock(stdout="INSERT 0 1", returncode=0)

        result = configure_ldap(
            namespace="dev",
            ldap_name="FreeIPA",
            ldap_host="freeipa.example.com",
            ldap_port=636,
            bind_dn="uid=admin+cn=backup,ou=special users,dc=example,dc=com",
            bind_password="pass=word+special",
            base_dn="ou=special users,dc=example,dc=com",
        )

        assert result is True

    def test_configure_ldap_empty_password(self, mocker: MockFixture) -> None:
        """Test with empty bind password (anonymous bind)."""
        mock_run = mocker.patch("subprocess.run")
        mock_run.return_value = MagicMock(stdout="INSERT 0 1", returncode=0)

        result = configure_ldap(
            namespace="dev",
            ldap_name="FreeIPA",
            ldap_host="freeipa.example.com",
            ldap_port=636,
            bind_dn="",
            bind_password="",
            base_dn="dc=example,dc=com",
        )

        assert result is True

    def test_configure_ldap_non_standard_port(self, mocker: MockFixture) -> None:
        """Test with non-standard LDAP port."""
        mock_run = mocker.patch("subprocess.run")
        mock_run.return_value = MagicMock(stdout="INSERT 0 1", returncode=0)

        result = configure_ldap(
            namespace="dev",
            ldap_name="CustomLDAP",
            ldap_host="ldap.custom.com",
            ldap_port=3269,  # Global Catalog SSL port
            bind_dn="cn=admin",
            bind_password="secret",
            base_dn="dc=custom,dc=com",
        )

        assert result is True

        call_args = mock_run.call_args
        cmd = call_args[0][0]
        sql_cmd = cmd[-1]
        assert "3269" in sql_cmd

    def test_configure_ldap_unicode_values(self, mocker: MockFixture) -> None:
        """Test handling of unicode characters."""
        mock_run = mocker.patch("subprocess.run")
        mock_run.return_value = MagicMock(stdout="INSERT 0 1", returncode=0)

        result = configure_ldap(
            namespace="dev",
            ldap_name="日本語LDAP",
            ldap_host="ldap.例え.jp",
            ldap_port=636,
            bind_dn="uid=管理者,dc=例え,dc=jp",
            bind_password="パスワード",
            base_dn="dc=例え,dc=jp",
        )

        assert result is True