Issue websocket hardening.

1 files changed, 55 insertions, 0 deletions

diff --git a/indra/llcorehttp/tests/test_jsonrpcws.hpp b/indra/llcorehttp/tests/test_jsonrpcws.hpp
index 6cf7932aa0..b21ede1f6b 100644
--- a/indra/llcorehttp/tests/test_jsonrpcws.hpp
+++ b/indra/llcorehttp/tests/test_jsonrpcws.hpp
@@ -24,6 +24,7 @@ public:
     using LLJSONRPCConnection::testInjectPendingRequest;
     using LLJSONRPCConnection::testPendingRequestCount;
     using LLJSONRPCConnection::testSweepTimeouts;
+    using LLJSONRPCConnection::setAuthenticated;
 };
 }
 
@@ -141,6 +142,60 @@ namespace tut
         ensure("timeout callback should be called", callback_called);
         ensure_equals("pending request should be removed", conn.testPendingRequestCount(), (size_t)0);
     }
+
+    template<> template<>
+    void JSONRPCWSTestObjectType::test<6>()
+    {
+        set_test_name("a connection not yet authenticated dispatches nothing, and everything once it is");
+
+        TestJSONRPCConnection conn;
+        ensure("unauthenticated unless told otherwise", !conn.isAuthenticated());
+
+        int calls = 0;
+        conn.registerMethod("object.list",
+            [&](const std::string&, const LLSD&, const LLSD&) -> LLSD
+            {
+                ++calls;
+                return LLSD();
+            });
+
+        conn.setAuthenticated(false);
+        ensure("not authenticated", !conn.isAuthenticated());
+        const LLSD request = LLJSONRPCConnection::makeEnvelope(LLSD("req_1"), "object.list", LLSD::emptyMap(), LLSD(), LLSD());
+        conn.processMessage(request);
+        const LLSD notification = LLJSONRPCConnection::makeEnvelope(LLSD(), "object.list", LLSD::emptyMap(), LLSD(), LLSD());
+        conn.processMessage(notification);
+        ensure_equals("neither a request nor a notification reaches the handler", calls, 0);
+
+        conn.setAuthenticated(true);
+        conn.processMessage(request);
+        ensure_equals("dispatched once authenticated", calls, 1);
+    }
+
+    template<> template<>
+    void JSONRPCWSTestObjectType::test<7>()
+    {
+        set_test_name("a connection not yet authenticated still takes the answers to its own calls");
+
+        TestJSONRPCConnection conn;
+        conn.setAuthenticated(false);
+
+        LLSD answer;
+        conn.testInjectPendingRequest(
+            "rpc_1",
+            LLTimer::getTotalSeconds() + 60.0,
+            [&](const LLSD& result, const LLSD& error)
+            {
+                ensure("no error", error.isUndefined());
+                answer = result;
+            });
+
+        LLSD result;
+        result["challenge_response"] = "secret";
+        conn.processMessage(LLJSONRPCConnection::makeEnvelope(LLSD("rpc_1"), std::string(), LLSD(), result, LLSD()));
+        ensure_equals("the answer reached the caller", answer["challenge_response"].asString(), std::string("secret"));
+        ensure("and it is answered", conn.testPendingRequestCount() == 0);
+    }
 }
 
 #endif
\ No newline at end of file