Skip to content

Commit

Permalink
Use Playwright
Browse files Browse the repository at this point in the history
  • Loading branch information
nanasess committed Dec 21, 2021
1 parent ef6b938 commit ab3ac03
Show file tree
Hide file tree
Showing 13 changed files with 862 additions and 3,250 deletions.
23 changes: 19 additions & 4 deletions .github/workflows/penetration-test.yml
Original file line number Diff line number Diff line change
@@ -1,5 +1,13 @@
name: Penetration testing for EC-CUBE
on:
push:
branches:
- '*'
tags:
- '*'
paths:
- '**'
- '!*.md'
schedule:
- cron: '0 15 * * 1'

Expand All @@ -12,9 +20,9 @@ jobs:
matrix:
operating-system: [ ubuntu-18.04 ]
group:
- 'test/front_login/contact.test.ts'
# - 'test/front_login/contact.test.ts'
- 'test/front_guest/contact.test.ts'
- 'test/admin/order_mail.test.ts'
# - 'test/admin/order_mail.test.ts'

steps:
- name: Checkout
Expand All @@ -34,12 +42,19 @@ jobs:
- name: yarn install
working-directory: zap/selenium/ci/TypeScript
run: yarn install
run: |
yarn install
yarn run playwright install --with-deps chromium
yarn playwright install-deps chromium
- name: Penetration testing
working-directory: zap/selenium/ci/TypeScript
env:
GROUP: ${{ matrix.group }}
run: yarn jest ${GROUP}
HTTP_PROXY: 127.0.0.1:8090
HTTPS_PROXY: 127.0.0.1:8090
CI: 1
FORCE_COLOR: 1
run: yarn playwright test ${GROUP}
- env:
GROUP: ${{ matrix.group }}
if: always()
Expand Down
3 changes: 3 additions & 0 deletions zap/selenium/ci/TypeScript/.gitignore
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
node_modules/
test-results/
playwright-report/
13 changes: 5 additions & 8 deletions zap/selenium/ci/TypeScript/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -3,14 +3,14 @@
OWASP ZAP のアクティブスキャンを自動化するプログラムです。
OWASP ZAP を使用したペネトレーションテストを自動化する手段として、 [OWASP ZAP Full Scan
](https://github.com/marketplace/actions/owasp-zap-full-scan) がありますが、EC-CUBE の場合は日本語入力が必須であったり、[特殊な遷移パターン](https://doc4.ec-cube.net/penetration-testing/testing/attention#%E7%89%B9%E6%AE%8A%E3%81%AA%E9%81%B7%E7%A7%BB%E3%83%91%E3%82%BF%E3%83%BC%E3%83%B3)があるため、十分にスキャンできません。
この対策として、Selenium と連携させて自動化します。
この対策として、Playwright と連携させて自動化します。

## スキャンの流れ

以下のような流れでスキャンを実行します。

1. OWASP ZAP の API を使用して、コンテキストや自動ログインを設定する
2. Selenium で OWASP ZAP の Proxy を通してクロールする
2. Playwright で OWASP ZAP の Proxy を通してクロールする
3. クロールしたページに対してアクティブスキャンを実行する
4. OWASP ZAP のセッションを保存する

Expand All @@ -19,9 +19,6 @@ High 以上のアラートが出た場合はテストが失敗します。

### ローカル環境での実行方法

*前提として [chromedriverをインストール](https://chromedriver.chromium.org)し、 PATH を通しておく必要があります。*
ローカル環境で実行する場合は以下のコマンドを使用します。

```shell
## docker-compose を使用して EC-CUBE をインストールします
cd path/to/ec-cube
Expand All @@ -41,11 +38,11 @@ docker-compose -f docker-compose.yml -f docker-compose.pgsql.yml -f docker-compo

## yarn でテストを実行します。
cd zap/selenium/ci/TypeScript
yarn install
yarn jest
yarn install && yarn create playwright # (初回のみ)
HTTP_PROXY=127.0.0.1:8090 HTTPS_PROXY=127.0.0.1:8090 yarn playwright test

## (Optional) 個別にテストする場合は、テストのファイル名を指定してください。
yarn jest test/admin/order_mail.test.ts
yarn playwright test test/front_guest/contact.test.ts
```

#### 実行中に OWASP ZAP を操作したい場合
Expand Down
6 changes: 0 additions & 6 deletions zap/selenium/ci/TypeScript/babel.config.js

This file was deleted.

19 changes: 5 additions & 14 deletions zap/selenium/ci/TypeScript/package.json
Original file line number Diff line number Diff line change
@@ -1,20 +1,11 @@
{
"name": "TypeScript",
"version": "1.0.0",
"name": "zscan-eccube",
"version": "0.0.1",
"main": "index.js",
"license": "MIT",
"devDependencies": {
"@babel/core": "^7.15.5",
"@babel/preset-env": "^7.15.4",
"@babel/preset-typescript": "^7.15.0",
"@types/jest": "^27.0.1",
"@types/request-promise-native": "^1.0.18",
"@types/selenium-webdriver": "^4.0.15",
"babel-jest": "^27.1.0",
"jest": "^27.1.0",
"selenium-webdriver": "^4.0.0-rc-1",
"ts-jest": "^27.0.5",
"typescript": "^4.4.2",
"@playwright/test": "^1.17.1",
"zaproxy": "^1.0.1"
}
},
"scripts": {}
}
111 changes: 111 additions & 0 deletions zap/selenium/ci/TypeScript/playwright.config.ts
Original file line number Diff line number Diff line change
@@ -0,0 +1,111 @@
import { PlaywrightTestConfig, devices } from '@playwright/test';

/**
* See https://playwright.dev/docs/test-configuration.
*/
const config: PlaywrightTestConfig = {

testDir: './test',

/* Maximum time one test can run for. */
timeout: 600 * 1000,

expect: {

/**
* Maximum time expect() should wait for the condition to be met.
* For example in `await expect(locator).toHaveText();`
*/
timeout: 5000
},

/* Fail the build on CI if you accidentally left test.only in the source code. */
forbidOnly: !!process.env.CI,

/* Retry on CI only */
retries: process.env.CI ? 2 : 0,

/* Opt out of parallel tests on CI. */
workers: process.env.CI ? 1 : undefined,

/* Reporter to use. See https://playwright.dev/docs/test-reporters */
reporter: process.env.CI ? 'github' : 'line',

/* Shared settings for all the projects below. See https://playwright.dev/docs/api/class-testoptions. */
use: {

/* Maximum time each action such as `click()` can take. Defaults to 0 (no limit). */
actionTimeout: 0,

/* Base URL to use in actions like `await page.goto('/')`. */
// baseURL: 'http://localhost:3000',

/* Collect trace when retrying the failed test. See https://playwright.dev/docs/trace-viewer */
trace: 'on-first-retry',
ignoreHTTPSErrors: true
},

/* Configure projects for major browsers */
projects: [
{
name: 'chromium',

/* Project-specific settings. */
use: {
...devices['Desktop Chrome'],
},
},

// {
// name: 'firefox',
// use: {
// ...devices['Desktop Firefox'],
// },
// },

// {
// name: 'webkit',
// use: {
// ...devices['Desktop Safari'],
// },
// },

/* Test against mobile viewports. */
// {
// name: 'Mobile Chrome',
// use: {
// ...devices['Pixel 5'],
// },
// },
// {
// name: 'Mobile Safari',
// use: {
// ...devices['iPhone 12'],
// },
// },

/* Test against branded browsers. */
// {
// name: 'Microsoft Edge',
// use: {
// channel: 'msedge',
// },
// },
// {
// name: 'Google Chrome',
// use: {
// channel: 'chrome',
// },
// },
],

/* Folder for test artifacts such as screenshots, videos, traces, etc. */
// outputDir: 'test-results/',

/* Run your local dev server before starting the tests */
// webServer: {
// command: 'npm run start',
// port: 3000,
// },
};
export default config;
80 changes: 0 additions & 80 deletions zap/selenium/ci/TypeScript/test/admin/order_mail.test.ts

This file was deleted.

Loading

0 comments on commit ab3ac03

Please sign in to comment.