Repository: SergioBenitez/Rocket
File: examples/templating/src/tests.rs (Rust)

Code before:
    for method in &[Post, Put, Delete, Options, Trace, Connect, Patch] {
        let context = context! { uri: format!("/{}", kind) };
        let expected = Template::show(client.rocket(), format!("{}/error/404", kind), &context);

        let response = client.req(*method, format!("/{}", kind)).dispatch();
        assert_eq!(response.status(), Status::NotFound);
        assert_eq!(response.into_string(), expected);
    }
}

fn test_name(base: &str) {
    // Check that the /hello/<name> route works.
    let client = Client::tracked(rocket()).unwrap();
    let response = client.get(format!("/{}/hello/Jack%20Daniels", base)).dispatch();
    assert_eq!(response.status(), Status::Ok);
    assert!(response.into_string().unwrap().contains("Hi Jack Daniels!"));
}

fn test_404(base: &str) {
    // Check that the error catcher works.
    let client = Client::tracked(rocket()).unwrap();
    for bad_path in &["/hello", "/foo/bar", "/404"] {
        let path = format!("/{}{}", base, bad_path);

        let escaped_path_upper = RawStr::new(&path).html_escape();
        let escaped_path_lower = escaped_path_upper.to_lowercase();

        let response = client.get(&path).dispatch();
        assert_eq!(response.status(), Status::NotFound);
        let response = response.into_string().unwrap();

        assert!(response.contains(base));        
        assert!(
            response.contains(&format!("{} does not exist", path)) ||
            response.contains(&format!("{} does not exist", escaped_path_upper)) ||
            response.contains(&format!("{} does not exist", escaped_path_lower))
        );
    }
}

fn test_about(base: &str) {
    let client = Client::tracked(rocket()).unwrap();
    let response = client.get(format!("/{}/about", base)).dispatch();
    assert!(response.into_string().unwrap().contains("About - Here's another page!"));
}

#[test]
fn test_index() {
    let client = Client::tracked(rocket()).unwrap();
    let response = client.get("/").dispatch().into_string().unwrap();
    assert!(response.contains("Tera"));

Review comment (security):
I've ran this modified test with command `cargo test -- --nocapture`:

```rust
fn test_404(base: &str) {
    // Check that the error catcher works.
    let client = Client::tracked(rocket()).unwrap();
    for bad_path in &["/hello", "/foo/bar", "/404"] {
        let path = format!("/{}{}", base, bad_path);
        let escaped_path = RawStr::new(&path).html_escape();

        let response = client.get(&path).dispatch();
        assert_eq!(response.status(), Status::NotFound);
        let response = response.into_string().unwrap();
        
        println!("path: '{}'", path);
        println!("escaped_path: '{}'", escaped_path);
        println!("response body: {:?}", response);
    }
}
```

And the case is different for the HTML escaped characters in escaped_path and response.

For `tera`:
```
path: '/tera/foo/bar'
escaped_path: '&#x2F;tera&#x2F;foo&#x2F;bar'
response body: "... The page at &#x2F;tera&#x2F;foo&#x2F;bar does not exist! ..."
```

For `minijinja`:
```
path: '/minijinja/foo/bar'
escaped_path: '&#x2F;minijinja&#x2F;foo&#x2F;bar'
response body: "... The page at &#x2f;minijinja&#x2f;foo&#x2f;bar does not exist! ..."
```

Is this good enough or is there a better solution?


Code after:
    for method in &[Post, Put, Delete, Options, Trace, Connect, Patch] {
        let context = context! { uri: format!("/{}", kind) };
        let expected = Template::show(client.rocket(), format!("{}/error/404", kind), &context);

        let response = client.req(*method, format!("/{}", kind)).dispatch();
        assert_eq!(response.status(), Status::NotFound);
        assert_eq!(response.into_string(), expected);
    }
}

fn test_name(base: &str) {
    // Check that the /hello/<name> route works.
    let client = Client::tracked(rocket()).unwrap();
    let response = client.get(format!("/{}/hello/Jack%20Daniels", base)).dispatch();
    assert_eq!(response.status(), Status::Ok);
    assert!(response.into_string().unwrap().contains("Hi Jack Daniels!"));
}

fn test_404(base: &str) {
    // Check that the error catcher works.
    let client = Client::tracked(rocket()).unwrap();
    for bad_path in &["/hello", "/foo/bar", "/404"] {
        let path = format!("/{}{}", base, bad_path);
        let escaped_path = RawStr::new(&path).html_escape().to_lowercase();

        let response = client.get(&path).dispatch();
        assert_eq!(response.status(), Status::NotFound);
        let response = response.into_string().unwrap().to_lowercase();

        assert!(response.contains(base));
        assert! {
            response.contains(&format!("{} does not exist", path))
                || response.contains(&format!("{} does not exist", escaped_path))
        };
    }
}

fn test_about(base: &str) {
    let client = Client::tracked(rocket()).unwrap();
    let response = client.get(format!("/{}/about", base)).dispatch();
    assert!(response.into_string().unwrap().contains("About - Here's another page!"));
}

#[test]
fn test_index() {
    let client = Client::tracked(rocket()).unwrap();
    let response = client.get("/").dispatch().into_string().unwrap();
    assert!(response.contains("Tera"));
    assert!(response.contains("Handlebars"));
    assert!(response.contains("MiniJinja"));
}