fix(CI): Add integration tests for GHSA-h3c9-cmh8-7qpj

Signed-off-by: Joas Schilling <[email protected]>

tests/Integration/features/bootstrap/FeatureContext.php

@@ -29,6 +29,8 @@
 use GuzzleHttp\Client;
 use GuzzleHttp\Cookie\CookieJar;
 use GuzzleHttp\Exception\ClientException;
+use GuzzleHttp\Exception\ServerException;
+use GuzzleHttp\RequestOptions;
 use PHPUnit\Framework\Assert;
 use Psr\Http\Message\ResponseInterface;
 
@@ -65,6 +67,29 @@ public function cleanUpBetweenTests() {
 		// TODO: Remove all created tags and workflows?
 	}
 
+	/**
+	 * @Given /^user "([^"]*)" creates (global|user) flow with (\d+)$/
+	 */
+	public function createFlow(string $user, string $scope, int $statusCode, TableNode $tableNode) {
+		$this->setCurrentUser($user);
+
+		$formData = $tableNode->getRowsHash();
+
+		$checks = [];
+		foreach ($formData as $key => $value) {
+			if (strpos($key, 'checks-') === 0) {
+				$checks[] = json_decode($value, true);
+				unset($formData[$key]);
+			}
+		}
+
+		$formData['checks'] = $checks;
+		$formData['events'] = [];
+
+		$this->sendingToWith('POST', '/apps/workflowengine/api/v1/workflows/' . $scope, $formData);
+		Assert::assertSame($statusCode, $this->response->getStatusCode(), 'HTTP status code mismatch');
+	}
+
 	/**
 	 * User management
 	 */
@@ -149,10 +174,10 @@ public function sendingTo(string $verb, string $url): void {
 	 * @When /^sending "([^"]*)" to "([^"]*)" with$/
 	 * @param string $verb
 	 * @param string $url
-	 * @param TableNode|null $body
+	 * @param array|null $body
 	 * @param array $headers
 	 */
-	public function sendingToWith(string $verb, string $url, ?TableNode $body = null, array $headers = []): void {
+	public function sendingToWith(string $verb, string $url, ?array $body = null, array $headers = []): void {
 		$fullUrl = $this->baseUrl . 'ocs/v2.php' . $url;
 		$client = new Client();
 		$options = [];
@@ -163,19 +188,21 @@ public function sendingToWith(string $verb, string $url, ?TableNode $body = null
 			$options['auth'] = [$this->currentUser, '123456'];
 		}
 
-		if ($body instanceof TableNode) {
-			$fd = $body->getRowsHash();
-			$options['form_params'] = $fd;
+		if (is_array($body)) {
+			$options[RequestOptions::JSON] = $body;
 		}
 
 		$options['headers'] = array_merge($headers, [
 			'OCS-APIREQUEST' => 'true',
+			'Accept' => 'application/json',
 		]);
 
 		try {
-			$this->response = $client->request($verb, $fullUrl, $options);
+			$this->response = $client->{$verb}($fullUrl, $options);
 		} catch (ClientException $ex) {
 			$this->response = $ex->getResponse();
+		} catch (ServerException $ex) {
+			$this->response = $ex->getResponse();
 		}
 	}
 

tests/Integration/features/manage-workflows.feature

@@ -0,0 +1,33 @@
+Feature: manage-workflows
+  Background:
+    Given user "test1" exists
+    Given as user "test1"
+
+  Scenario: Admin creates a global flow
+    Given user "admin" creates global flow with 200
+    | name      | Admin flow                       |
+    | class     | OCA\FilesAccessControl\Operation |
+    | entity    | OCA\WorkflowEngine\Entity\File   |
+    | events    | []                               |
+    | operation | deny                             |
+    | checks-0  | {"class":"OCA\\WorkflowEngine\\Check\\FileName", "operator": "is", "value": "a"} |
+
+  Scenario: Users can not create a global flow
+    Given user "test1" creates global flow with 403
+    | name      | User flow                        |
+    | class     | OCA\FilesAccessControl\Operation |
+    | entity    | OCA\WorkflowEngine\Entity\File   |
+    | events    | []                               |
+    | operation | deny                             |
+    | checks-0  | {"class":"OCA\\WorkflowEngine\\Check\\FileName", "operator": "is", "value": "a"} |
+
+  # https://github.com/nextcloud/security-advisories/security/advisories/GHSA-h3c9-cmh8-7qpj
+  Scenario: Users can not create a user flow
+    Given user "test1" creates user flow with 400
+    | name      | User flow                        |
+    | class     | OCA\FilesAccessControl\Operation |
+    | entity    | OCA\WorkflowEngine\Entity\File   |
+    | events    | []                               |
+    | operation | deny                             |
+    | checks-0  | {"class":"OCA\\WorkflowEngine\\Check\\FileName", "operator": "is", "value": "a"} |
+