#NEWLINE# def test_push_abuse( self ) : #NEWLINE# #INDENT# 'Test a user pushing to an unauthorized application' #NEWLINE# url = '/v1/apps' #NEWLINE# response = self . client . post ( url , HTTP_AUTHORIZATION = 'token {}' . format ( self . token ) ) #NEWLINE# self . assertEqual ( response . status_code , 201 ) #NEWLINE# app_id = response . data [ 'id' ] #NEWLINE# ( username , password ) = ( 'eviluser' , 'password' ) #NEWLINE# ( first_name , last_name ) = ( 'Evil' , 'User' ) #NEWLINE# email = 'evil@deis.io' #NEWLINE# submit = { #NEWLINE# #INDENT# 'username' : username , #NEWLINE# 'password' : password , #NEWLINE# 'first_name' : first_name , #NEWLINE# 'last_name' : last_name , #NEWLINE# 'email' : email , #NEWLINE# #UNINDENT# } #NEWLINE# url = '/v1/auth/register' #NEWLINE# response = self . client . post ( url , json . dumps ( submit ) , content_type = 'application/json' ) #NEWLINE# self . assertEqual ( response . status_code , 201 ) #NEWLINE# body = { #NEWLINE# #INDENT# 'sha' : 'df1e628f2244b73f9cdf944f880a2b3470a122f4' , #NEWLINE# 'fingerprint' : '88:25:ed:67:56:91:3d:c6:1b:7f:42:c6:9b:41:24:99' , #NEWLINE# 'receive_user' : 'eviluser' , #NEWLINE# 'receive_repo' : '{app_id}' . format ( ** locals ( ) ) , #NEWLINE# 'ssh_connection' : '10.0.1.10 50337 172.17.0.143 22' , #NEWLINE# 'ssh_original_command' : "git-receive-pack '{app_id}.git'" . format ( ** locals ( ) ) , #NEWLINE# #UNINDENT# } #NEWLINE# url = '/v1/hooks/push' . format ( ** locals ( ) ) #NEWLINE# response = self . client . post ( url , json . dumps ( body ) , content_type = 'application/json' , HTTP_X_DEIS_BUILDER_AUTH = settings . BUILDER_KEY ) #NEWLINE# self . assertEqual ( response . status_code , 403 )