actionview/test/template/csrf_helper_test.rb


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46

# frozen_string_literal: true

require "abstract_unit"

class CsrfHelperTest < ActiveSupport::TestCase
  cattr_accessor :request_forgery, default: false

  include ActionView::Helpers::CsrfHelper
  include ActionView::Helpers::TagHelper
  include Rails::Dom::Testing::Assertions::DomAssertions

  def test_csrf_meta_tags_without_request_forgery_protection
    assert_dom_equal "", csrf_meta_tags
  end

  def test_csrf_meta_tags_with_request_forgery_protection
    self.request_forgery = true

    assert_dom_equal <<~DOM.chomp, csrf_meta_tags
      <meta name="csrf-param" content="form_token" />
      <meta name="csrf-token" content="secret" />
    DOM
  ensure
    self.request_forgery = false
  end

  def test_csrf_meta_tags_without_protect_against_forgery_method
    self.class.undef_method(:protect_against_forgery?)

    assert_dom_equal "", csrf_meta_tags
  ensure
    self.class.define_method(:protect_against_forgery?) { request_forgery }
  end

  def protect_against_forgery?
    request_forgery
  end

  def form_authenticity_token(*args)
    "secret"
  end

  def request_forgery_protection_token
    "form_token"
  end
end