Testing Plone Site Security Policy - Is Your Intranet Doing What You Think It Is?

transcript

understand, develop, deliver. www.netsight.co.uk

Testing Plone Site Security Policy

Matt HamiltonNetsight Internet Solutions, UK

(Is your intranet doing what you think it is?)

What this talk is NOT

• Not talking about security vulnerabilities

• Not talking about code unit testing

• Not talking about penetration testing

So what IS this talk?

It goes something a bit like this:

Is our intranet secure?

Yes of course!

• But is it really?! Lets think about this:

➡ You installed Plone

➡ You created a set of custom content types

➡ You created a custom workflow

➡ Users have group memberships, local roles, etc

So our site is now quite complex in terms of who should be allowed to do what and

Our use-case

Belron.net

• Belron.net Intranet is based around ‘Projects’ and ‘Groups’

Belron.net

- Users have local membership and roles of individual groups and projects

Belron.net

- Projects may be in various ‘states’: Public, Private, Secret

Belron.net

- Users have local roles to their project: Member, Contributor, Reviewer, Owner, Manager

Belron.net

- Content within a project may be in various states: Private, Draft, Pending, Published

Belron.net

- Content within a project may be in various states: Private, Draft, Pending, Published

So....

• If a piece of content is in the pending state, in a private project, in which I am a member and contributor, should I be able to edit it?

So....

• If a piece of content is in the pending state, in a private project, in which I am a member and contributor, should I be able to edit it?

• If a project is in the secret state, and I am a non-member should I be able to view the project description?

Policy decisions

• These are POLICY decisions for the site, not really CODE decisions.

Policy decisions

- ie. these are high level objectives set by analysts/managers not coders

Policy decisions

- ie. these are high level objectives set by analysts/managers not coders

- But they will catch errors in the code or customisation

Coverage

• So, we have 3 project states x 5 local roles x 4 content states = 60 permutations

Coverage

• oh... and in Plone Owner has special meaning on a piece of content... so 120 permutations

Coverage

• And for each one we want to test: can I View, Edit, List, Delete, Add....

Coverage

• And for each one we want to test: can I View, Edit, List, Delete, Add....

• For Belron.net we had approx 1,300 tests needed

An idea...

• What if there was a nice easy way to test all these different permutations in an automated way and drive it all from a manager-friendly spreadsheet and be able to visually see the results?

PolicyTestCase

• Similar to PloneTestCase

• Write a bunch of tests

• Export a spreadsheet as CSV

• Run the tests

• See the results in a table

PolicyTestCaseclass TestDefaultPlone(PolicyTestCase):

def afterSetUp(self):

# Setup the state, eg workflow etc

def ViewContent(self):

# Test we can view the content

def NoViewContent(self):

# Test we can NOT view the content

PolicyTestCase

def test_suite():

from unittest import TestSuite

suite = TestSuite()

csv = open('%s/test_scenarios_simple2.csv' % PACKAGE_HOME)

suite.addTest(makeSuiteFromCSV(TestDefaultPlone, csv))

return suite

Demo and walkthrough of the code

Questions?

Any questions?

Matt Hamiltonmatth@netsight.co.uk

PolicyTestCase: in collective, will do a release real soon now ;)

Testing Plone Site Security Policy - Is Your Intranet Doing What You Think It Is?

Technology