first commit

.venv/Lib/site-packages/notebook/auth/tests/test_login.py

@@ -0,0 +1,48 @@
+"""Tests for login redirects"""
+
+import requests
+from tornado.httputil import url_concat
+
+from notebook.tests.launchnotebook import NotebookTestBase
+
+
+class LoginTest(NotebookTestBase):
+    def login(self, next):
+        first = requests.get(self.base_url() + "login")
+        first.raise_for_status()
+        resp = requests.post(
+            url_concat(
+                self.base_url() + "login",
+                {'next': next},
+            ),
+            allow_redirects=False,
+            data={
+                "password": self.token,
+                "_xsrf": first.cookies.get("_xsrf", ""),
+            },
+            cookies=first.cookies,
+        )
+        resp.raise_for_status()
+        return resp.headers['Location']
+
+    def test_next_bad(self):
+        for bad_next in (
+            "//some-host",
+            "//host" + self.url_prefix + "tree",
+            "https://google.com",
+            "/absolute/not/base_url",
+        ):
+            url = self.login(next=bad_next)
+            self.assertEqual(url, self.url_prefix)
+        assert url
+
+    def test_next_ok(self):
+        for next_path in (
+            "tree/",
+            "//" + self.url_prefix + "tree",
+            "notebooks/notebook.ipynb",
+            "tree//something",
+        ):
+            expected = self.url_prefix + next_path
+            actual = self.login(next=expected)
+            self.assertEqual(actual, expected)

.venv/Lib/site-packages/notebook/auth/tests/test_security.py

@@ -0,0 +1,25 @@
+from ..security import passwd, passwd_check
+
+def test_passwd_structure():
+    p = passwd('passphrase')
+    algorithm, hashed = p.split(':')
+    assert algorithm == 'argon2'
+    assert hashed.startswith('$argon2id$')
+
+def test_roundtrip():
+    p = passwd('passphrase')
+    assert passwd_check(p, 'passphrase') == True
+
+def test_bad():
+    p = passwd('passphrase')
+    assert passwd_check(p, p) == False
+    assert passwd_check(p, 'a:b:c:d') == False
+    assert passwd_check(p, 'a:b') == False
+
+def test_passwd_check_unicode():
+    # GH issue #4524
+    phash = 'sha1:23862bc21dd3:7a415a95ae4580582e314072143d9c382c491e4f'
+    assert passwd_check(phash, "łe¶ŧ←↓→")
+    phash = ('argon2:$argon2id$v=19$m=10240,t=10,p=8$'
+             'qjjDiZUofUVVnrVYxacnbA$l5pQq1bJ8zglGT2uXP6iOg')
+    assert passwd_check(phash, "łe¶ŧ←↓→")