# Copyright (C) 2013 Dmitry Yakimenko (detunized@gmail.com). # Licensed under the terms of the MIT license. See LICENCE for details. require "spec_helper" describe LastPass::Fetcher do let(:username) { "username" } let(:password) { "password" } let(:key_iteration_count) { 5000 } let(:hash) { "7880a04588cfab954aa1a2da98fd9c0d2c6eba4c53e36a94510e6dbf30759256" } let(:session_id) { "53ru,Hb713QnEVM5zWZ16jMvxS0" } let(:session) { LastPass::Session.new session_id, key_iteration_count } let(:blob_response) { "TFBBVgAAAAMxMjJQUkVNAAAACjE0MTQ5" } let(:blob_bytes) { blob_response.decode64 } let(:blob) { LastPass::Blob.new blob_bytes, key_iteration_count } let(:login_post_data) { {method: "mobile", web: 1, xml: 1, username: username, hash: hash, iterations: key_iteration_count} } let(:google_authenticator_code) { "123456" } let(:yubikey_password) { "emdbwzemyisymdnevznyqhqnklaqheaxszzvtnxjrmkb" } let(:login_post_data_with_google_authenticator_code) { login_post_data.merge({otp: google_authenticator_code})} let(:login_post_data_with_yubikey_password) { login_post_data.merge({otp: yubikey_password}) } describe ".request_iteration_count" do it "makes a POST request" do expect(web_client = double("web_client")).to receive(:post) .with("https://lastpass.com/iterations.php", query: {email: username}) .and_return(http_ok(key_iteration_count.to_s)) LastPass::Fetcher.request_iteration_count username, web_client end it "returns key iteration count" do expect( LastPass::Fetcher.request_iteration_count username, double("web_client", post: http_ok(key_iteration_count.to_s)) ).to eq key_iteration_count end it "raises an exception on HTTP error" do expect { LastPass::Fetcher.request_iteration_count username, double("web_client", post: http_error) }.to raise_error LastPass::NetworkError end it "raises an exception on invalid key iteration count" do expect { LastPass::Fetcher.request_iteration_count username, double("web_client", post: http_ok("not a number")) }.to raise_error LastPass::InvalidResponseError, "Key iteration count is invalid" end it "raises an exception on zero key iteration count" do expect { LastPass::Fetcher.request_iteration_count username, double("web_client", post: http_ok("0")) }.to raise_error LastPass::InvalidResponseError, "Key iteration count is not positive" end it "raises an exception on negative key iteration count" do expect { LastPass::Fetcher.request_iteration_count username, double("web_client", post: http_ok("-1")) }.to raise_error LastPass::InvalidResponseError, "Key iteration count is not positive" end end describe ".request_login" do def verify_post_request multifactor_password, post_data web_client = double("web_client") expect(web_client).to receive(:post) .with("https://lastpass.com/login.php", format: :xml, body: post_data) .and_return(http_ok("ok" => {"sessionid" => session_id})) LastPass::Fetcher.request_login username, password, key_iteration_count, multifactor_password, web_client end it "makes a POST request" do verify_post_request nil, login_post_data end it "makes a POST request with Google Authenticator code" do verify_post_request google_authenticator_code, login_post_data_with_google_authenticator_code end it "makes a POST request with Yubikey password" do verify_post_request yubikey_password, login_post_data_with_yubikey_password end it "returns a session" do expect(request_login_with_xml "").to eq session end it "raises an exception on HTTP error" do expect { request_login_with_error }.to raise_error LastPass::NetworkError end it "raises an exception when response is not a hash" do expect { request_login_with_ok "not a hash" }.to raise_error LastPass::InvalidResponseError end it "raises an exception on unknown response schema" do expect { request_login_with_xml "" }.to raise_error LastPass::UnknownResponseSchemaError end it "raises an exception on unknown response schema" do expect { request_login_with_xml "" }.to raise_error LastPass::UnknownResponseSchemaError end it "raises an exception on unknown response schema" do expect { request_login_with_xml "" } .to raise_error LastPass::UnknownResponseSchemaError end it "raises an exception on unknown username" do message = "Unknown email address." expect { request_login_with_lastpass_error "unknownemail", message } .to raise_error LastPass::LastPassUnknownUsernameError, message end it "raises an exception on invalid password" do message = "Invalid password!" expect { request_login_with_lastpass_error "unknownpassword", message } .to raise_error LastPass::LastPassInvalidPasswordError, message end it "raises an exception on missing Google Authenticator code" do message = "Google Authenticator authentication required! " + "Upgrade your browser extension so you can enter it." expect { request_login_with_lastpass_error "googleauthrequired", message } .to raise_error LastPass::LastPassIncorrectGoogleAuthenticatorCodeError, message end it "raises an exception on incorrect Google Authenticator code" do message = "Google Authenticator authentication failed!" expect { request_login_with_lastpass_error "googleauthfailed", message } .to raise_error LastPass::LastPassIncorrectGoogleAuthenticatorCodeError, message end it "raises an exception on missing/incorrect Yubikey password" do message = "Your account settings have restricted you from logging in " + "from mobile devices that do not support YubiKey authentication." expect { request_login_with_lastpass_error "yubikeyrestricted", message } .to raise_error LastPass::LastPassIncorrectYubikeyPasswordError, message end it "raises an exception on unknown LastPass error with a message" do message = "Unknow error message" expect { request_login_with_lastpass_error "Unknown cause", message } .to raise_error LastPass::LastPassUnknownError, message end it "raises an exception on unknown LastPass error without a message" do cause = "Unknown casue" expect { request_login_with_lastpass_error cause } .to raise_error LastPass::LastPassUnknownError, cause end end describe ".fetch" do it "makes a GET request" do expect(web_client = double("web_client")).to receive(:get) .with("https://lastpass.com/getaccts.php?mobile=1&b64=1&hash=0.0&hasplugin=3.0.23&requestsrc=android", format: :plain, cookies: {"PHPSESSID" => session_id}) .and_return(http_ok(blob_response)) LastPass::Fetcher.fetch session, web_client end it "returns a blob" do expect(LastPass::Fetcher.fetch session, double("web_client", get: http_ok(blob_response))) .to eq blob end it "raises an exception on HTTP error" do expect { LastPass::Fetcher.fetch session, double("web_client", get: http_error) } .to raise_error LastPass::NetworkError end end describe ".make_key" do it "generates correct keys" do def key iterations LastPass::Fetcher.make_key "postlass@gmail.com", "pl1234567890", iterations end expect(key 1).to eq "C/Bh2SGWxI8JDu54DbbpV8J9wa6pKbesIb9MAXkeF3Y=".decode64 expect(key 5).to eq "pE9goazSCRqnWwcixWM4NHJjWMvB5T15dMhe6ug1pZg=".decode64 expect(key 10).to eq "n9S0SyJdrMegeBHtkxUx8Lzc7wI6aGl+y3/udGmVey8=".decode64 expect(key 50).to eq "GwI8/kNy1NjIfe3Z0VAZfF78938UVuCi6xAL3MJBux0=".decode64 expect(key 100).to eq "piGdSULeHMWiBS3QJNM46M5PIYwQXA6cNS10pLB3Xf8=".decode64 expect(key 500).to eq "OfOUvVnQzB4v49sNh4+PdwIFb9Fr5+jVfWRTf+E2Ghg=".decode64 expect(key 1000).to eq "z7CdwlIkbu0XvcB7oQIpnlqwNGemdrGTBmDKnL9taPg=".decode64 end end describe ".make_hash" do it "generates correct hashes" do def hash iterations LastPass::Fetcher.make_hash "postlass@gmail.com", "pl1234567890", iterations end expect(hash 1).to eq "a1943cfbb75e37b129bbf78b9baeab4ae6dd08225776397f66b8e0c7a913a055" expect(hash 5).to eq "a95849e029a7791cfc4503eed9ec96ab8675c4a7c4e82b00553ddd179b3d8445" expect(hash 10).to eq "0da0b44f5e6b7306f14e92de6d629446370d05afeb1dc07cfcbe25f169170c16" expect(hash 50).to eq "1d5bc0d636da4ad469cefe56c42c2ff71589facb9c83f08fcf7711a7891cc159" expect(hash 100).to eq "82fc12024acb618878ba231a9948c49c6f46e30b5a09c11d87f6d3338babacb5" expect(hash 500).to eq "3139861ae962801b59fc41ff7eeb11f84ca56d810ab490f0d8c89d9d9ab07aa6" expect(hash 1000).to eq "03161354566c396fcd624a424164160e890e96b4b5fa6d942fc6377ab613513b" end end # # Helpers # private def mock_response type, code, body double response: type.new("1.1", code, ""), parsed_response: body end def http_ok body mock_response Net::HTTPOK, 200, body end def http_error body = "" mock_response Net::HTTPNotFound, 404, body end def xml text MultiXml.parse text end def lastpass_error cause, message if message %Q{} else %Q{} end end def request_login_with_lastpass_error cause, message = nil request_login_with_xml lastpass_error cause, message end def request_login_with_xml text request_login_with_ok xml text end def request_login_with_ok response request_login_with_response http_ok response end def request_login_with_error request_login_with_response http_error end def request_login_with_response response LastPass::Fetcher.request_login username, password, key_iteration_count, nil, double("web_client", post: response) end end