Merge branch 'master' of https://github.com/pixelated/pixelated-user-agent

# By Felix Hammerl (13) and Thais Siqueira (3)
# Via Christoph (1) and Thais Siqueira (1)
* 'master' of https://github.com/pixelated/pixelated-user-agent:
  Sets SSL certifications to false.
  Fixes pep8 errors and update requests to 2.9.1.
  Update locust test to run after xsrf token implementation.
  Issue #620: Adapt unit tests to CSS changes
  Issue #620: Refactor palceholder
  Issue #620: Remove former main css file
  Issue #620: Spike growl CSS modularization
  Issue #617: Highlight search terms by altering mail content
  Issue #617: Allow only >=3 alphanumeric characters in search field
  Issue #617: Restrict searching to alphanumeric characters
  Issue #617: Remove highlighting for sandboxed content
  Issue #617: Add sandbox to build scripts
  Issue #617: Add sandbox to user-agent
  Issue #617: Create sandbox resouces
  Issue #617: Add iframe-resizer
  Issue #617: Serve content from Sandbox resource

6 files changed, 140 insertions, 19 deletions

diff --git a/service/pixelated/resources/root_resource.py b/service/pixelated/resources/root_resource.py
index 86435d89..109dc08e 100644
--- a/service/pixelated/resources/root_resource.py
+++ b/service/pixelated/resources/root_resource.py
@@ -20,6 +20,7 @@ from string import Template
 
 from pixelated.resources import BaseResource, UnAuthorizedResource
 from pixelated.resources.attachments_resource import AttachmentsResource
+from pixelated.resources.sandbox_resource import SandboxResource
 from pixelated.resources.contacts_resource import ContactsResource
 from pixelated.resources.features_resource import FeaturesResource
 from pixelated.resources.feedback_resource import FeedbackResource
@@ -75,6 +76,7 @@ class RootResource(BaseResource):
         return csrf_input and csrf_input == xsrf_token
 
     def initialize(self, portal=None, disclaimer_banner=None):
+        self._child_resources.add('sandbox', SandboxResource(self._static_folder))
         self._child_resources.add('assets', File(self._static_folder))
         self._child_resources.add('keys', KeysResource(self._services_factory))
         self._child_resources.add(AttachmentsResource.BASE_URL, AttachmentsResource(self._services_factory))
diff --git a/service/pixelated/resources/sandbox_resource.py b/service/pixelated/resources/sandbox_resource.py
new file mode 100644
index 00000000..28e8c9be
--- /dev/null
+++ b/service/pixelated/resources/sandbox_resource.py
@@ -0,0 +1,34 @@
+#
+# Copyright (c) 2016 ThoughtWorks, Inc.
+#
+# Pixelated is free software: you can redistribute it and/or modify
+# it under the terms of the GNU Affero General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# Pixelated is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU Affero General Public License for more details.
+#
+# You should have received a copy of the GNU Affero General Public License
+# along with Pixelated. If not, see <http://www.gnu.org/licenses/>.
+
+from twisted.web.static import File
+
+
+class SandboxResource(File):
+    CSP_HEADER_VALUES = "sandbox allow-popups allow-scripts;" \
+                        "default-src 'self';" \
+                        "style-src *;" \
+                        "script-src  *;" \
+                        "font-src *;" \
+                        "img-src *;" \
+                        "object-src 'none';" \
+                        "connect-src 'none';"
+
+    def render_GET(self, request):
+        request.setHeader('Content-Security-Policy', self.CSP_HEADER_VALUES)
+        request.setHeader('X-Content-Security-Policy', self.CSP_HEADER_VALUES)
+        request.setHeader('X-Webkit-CSP', self.CSP_HEADER_VALUES)
+        return super(SandboxResource, self).render_GET(request)
diff --git a/service/requirements.txt b/service/requirements.txt
index 95a0f4f8..b74b7f94 100644
--- a/service/requirements.txt
+++ b/service/requirements.txt
@@ -4,7 +4,7 @@ https://launchpad.net/dirspec/stable-13-10/13.10/+download/dirspec-13.10.tar.gz
 --allow-external dirspec --allow-unverified dirspec
 https://launchpad.net/u1db/stable-13-10/13.10/+download/u1db-13.10.tar.bz2
 pyasn1==0.1.8
-requests==2.0.0
+requests==2.9.1
 srp==1.0.4
 whoosh==2.5.7
 pycryptopp
diff --git a/service/test/functional/features/steps/mail_view.py b/service/test/functional/features/steps/mail_view.py
index 82fc28af..c0e9e22b 100644
--- a/service/test/functional/features/steps/mail_view.py
+++ b/service/test/functional/features/steps/mail_view.py
@@ -25,8 +25,11 @@ def impl(context, subject):
 
 @then('I see that the body reads \'{expected_body}\'')
 def impl(context, expected_body):
-    e = find_element_by_css_selector(context, '#mail-view .bodyArea')
+    find_element_by_css_selector(context, '#read-sandbox')
+    context.browser.switch_to_frame('read-sandbox')
+    e = find_element_by_css_selector(context, 'body')
     assert e.text == expected_body
+    context.browser.switch_to_default_content()
 
 
 @then('that email has the \'{tag}\' tag')
diff --git a/service/test/load/locustfile.py b/service/test/load/locustfile.py
index 68e39433..0c2ed518 100644
--- a/service/test/load/locustfile.py
+++ b/service/test/load/locustfile.py
@@ -1,6 +1,5 @@
 import os
 import json
-import time
 from random import randint
 
 from leap.auth import SRPAuth
@@ -9,9 +8,13 @@ from locust import HttpLocust, TaskSet, task
 from pixelated.resources.login_resource import LoginResource
 
 LEAP_PROVIDER = os.environ.get('LEAP_PROVIDER', 'dev.pixelated-project.org')
-LEAP_SERVER_HOST = os.environ.get('LEAP_SERVER_HOST', 'https://api.%s:4430' % LEAP_PROVIDER)
-LEAP_VERIFY_CERTIFICATE = os.environ.get('LEAP_VERIFY_CERTIFICATE', '~/.leap/ca.crt')
-MAX_NUMBER_USER = os.environ.get('MAX_NUMBER_USER', 10000)
+LEAP_SERVER_HOST = os.environ.get(
+    'LEAP_SERVER_HOST',
+    'https://api.%s:4430' % LEAP_PROVIDER)
+LEAP_VERIFY_CERTIFICATE = os.environ.get(
+    'LEAP_VERIFY_CERTIFICATE',
+    '~/.leap/ca.crt')
+MAX_NUMBER_USER = os.environ.get('MAX_NUMBER_USER', 100)
 INVITES_FILENAME = os.environ.get('INVITES_FILENAME', '/tmp/invite_codes.txt')
 INVITES_ENABLED = os.environ.get('INVITES_ENABLED', 'true') == 'true'
 
@@ -23,53 +26,94 @@ def load_invite_from_number(number):
 
 
 class UserBehavior(TaskSet):
+    def __init__(self, *args, **kwargs):
+        super(UserBehavior, self).__init__(*args, **kwargs)
+        self.cookies = {}
+
     def on_start(self):
-        """ on_start is called when a Locust start before any task is scheduled """
         self.login()
 
     def _get_or_create_user(self, number):
-        srp_auth = SRPAuth(LEAP_SERVER_HOST, os.path.expanduser(LEAP_VERIFY_CERTIFICATE))
+        srp_auth = SRPAuth(
+            LEAP_SERVER_HOST,
+            os.path.expanduser(LEAP_VERIFY_CERTIFICATE))
         username, password = ('loadtest%d' % number), ('password_%d' % number)
         try:
             srp_auth.authenticate(username, password)
         except SRPAuthenticationError:
-            invite_code = load_invite_from_number(number) if INVITES_ENABLED else None
+            invite_code = None
+            if INVITES_ENABLED:
+                invite_code = load_invite_from_number(number)
+
             srp_auth.register(username, password, invite_code)
         return username, password
 
     def login(self):
         number = randint(1, int(MAX_NUMBER_USER))
         username, password = self._get_or_create_user(number)
-        self.client.post("/%s" % LoginResource.BASE_URL, {"username": username, "password": password})
+        response = self.client.post(
+            "/%s" % LoginResource.BASE_URL,
+            {"username": username, "password": password},
+            verify=False)
+        self.cookies.update(response.cookies.get_dict())
+        resp = self.client.get("/", verify=False)
+        self.cookies.update(resp.cookies.get_dict())
         self.username = username
-        time.sleep(5)
 
     @task(1)
     def index(self):
-        self.client.get("/")
+        self.client.get("/", verify=False)
 
     @task(2)
     def mail_box(self):
-        self.client.get("/mails?q=tag:'inbox'&p=1&w=25")
+        self.client.get("/mails?q=tag:'inbox'&p=1&w=25", verify=False)
 
     @task(3)
     def send_mail(self):
-        payload = {"tags": ["drafts"], "body": "some text lorem ipsum", "attachments": [], "ident": "",
-                   "header": {"to": ["%s@%s" % (self.username, LEAP_PROVIDER)], "cc": [], "bcc": [], "subject": "load testing"}}
-        with self.client.post('/mails', json=payload, catch_response=True) as email_response:
+        payload = {
+            "tags": ["drafts"],
+            "body": "some text lorem ipsum",
+            "attachments": [],
+            "ident": "",
+            "header": {
+                "to": ["%s@%s" % (self.username, LEAP_PROVIDER)],
+                "cc": [],
+                "bcc": [],
+                "subject": "load testing"}}
+
+        self.cookies.update(
+            self.client.get("/", verify=False).cookies.get_dict())
+        print(self.cookies)
+        with self.client.post(
+            '/mails',
+            json=payload,
+            catch_response=True,
+            cookies=self.cookies,
+            headers={
+                'X-Requested-With': 'XMLHttpRequest',
+                'X-XSRF-TOKEN': self.cookies['XSRF-TOKEN']}) as email_response:
             if email_response.status_code == 201:
                 email_id = json.loads(email_response.content)['ident']
                 print email_id
                 self.delete_mail(email_id)
             else:
-                email_response.failure('Error: email not Sent, status code: %s' % email_response.status_code)
+                email_response.failure(
+                    'Error: email not Sent, status code: %s' % (
+                        email_response.status_code))
 
     def delete_mail(self, ident):
         payload = {"idents": [ident]}
-        self.client.post('/mails/delete', json=payload)
+        self.client.post(
+            '/mails/delete',
+            json=payload,
+            cookies=self.cookies,
+            verify=False,
+            headers={
+                'X-Requested-With': 'XMLHttpRequest',
+                'X-XSRF-TOKEN': self.cookies['XSRF-TOKEN']})
 
 
 class WebsiteUser(HttpLocust):
     task_set = UserBehavior
-    min_wait = 3000
+    min_wait = 5000
     max_wait = 15000
diff --git a/service/test/unit/resources/test_sandbox_resource.py b/service/test/unit/resources/test_sandbox_resource.py
new file mode 100644
index 00000000..3db43e12
--- /dev/null
+++ b/service/test/unit/resources/test_sandbox_resource.py
@@ -0,0 +1,38 @@
+import os
+import unittest
+
+from twisted.internet import defer
+from twisted.web.test.requesthelper import DummyRequest
+
+from pixelated.resources.sandbox_resource import SandboxResource
+from test.unit.resources import DummySite
+
+
+class TestSandBoxResource(unittest.TestCase):
+    def setUp(self):
+        static_folder = os.path.dirname(os.path.abspath(__file__))
+        self.resource = SandboxResource(static_folder)
+        self.resource.isLeaf = True
+        self.web = DummySite(self.resource)
+
+    @defer.inlineCallbacks
+    def test_render_GET_should_set_sandbox_csp_header(self):
+        request = DummyRequest(['/sandbox'])
+        request.method = 'GET'
+        request.isSecure = lambda: True
+        request.redirect = lambda _: 'irrelevant'
+
+        expected_csp_headers = "sandbox allow-popups allow-scripts;" \
+                               "default-src 'self';" \
+                               "style-src *;" \
+                               "script-src  *;" \
+                               "font-src *;" \
+                               "img-src *;" \
+                               "object-src 'none';" \
+                               "connect-src 'none';"
+
+        yield self.web.get(request)
+
+        self.assertEquals(expected_csp_headers, request.outgoingHeaders.get('X-Content-Security-Policy'.lower()))
+        self.assertEquals(expected_csp_headers, request.outgoingHeaders.get('Content-Security-Policy'.lower()))
+        self.assertEquals(expected_csp_headers, request.outgoingHeaders.get('X-Webkit-CSP'.lower()))