-
Notifications
You must be signed in to change notification settings - Fork 423
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Merge branch 'main' into sam/fix-fingerprinting-tests
* main: Enable NetP in production builds (#2232) Report macOS NetP connection attempts & tunnel failures (#2234) Always use black and white colors for the QR code (#2248) Update BSK with autofill 10.0.1 (#2245) Ensure that LinkPresentation framework is called on main thread (#2241) expose window.print handler to page world (#2243) Updates BSK (#2239) Add Geoswitching pixels (#2235) Fix spacing between buttons (#2237) Update all references to develop branch with main (#2231) Update TRK (#2200) Breakage report improvements (#2197) Update BSK reference to include the disable rekeying flag (#2219) Final NetP ship review feedback (#2221) Improve handling lists in Sync (#2192) remove address bar position pixels (#2220) Address Bar Spoofing Tests + Remediation (#2181) Update Sync e2e tests to fit the new UI (#2215) NetP waitlist final touches (#2209)
- Loading branch information
Showing
199 changed files
with
3,480 additions
and
5,315 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -73,3 +73,4 @@ fastlane/test_output | |
| # DuckDuckGo | ||
|
|
||
| Configuration/ExternalDeveloper.xcconfig | ||
| scripts/assets | ||
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| # all.yaml | ||
|
|
||
| appId: com.duckduckgo.mobile.ios | ||
| --- | ||
|
|
||
| # Set up | ||
| - clearState | ||
| - launchApp | ||
| - runFlow: | ||
| when: | ||
| visible: | ||
| text: "Let’s Do It!" | ||
| index: 0 | ||
| file: ../shared/onboarding.yaml | ||
|
|
||
| # Load Site | ||
| - assertVisible: | ||
| id: "searchEntry" | ||
| - tapOn: | ||
| id: "searchEntry" | ||
| - inputText: "https://privacy-test-pages.site/security/address-bar-spoofing/" | ||
| - pressKey: Enter | ||
|
|
||
| # Manage onboarding | ||
| - runFlow: | ||
| when: | ||
| visible: | ||
| text: "Got It" | ||
| index: 0 | ||
| file: ../shared/onboarding_browsing.yaml | ||
|
|
||
| # Run AddressBarSpoofing tests | ||
| - runFlow: ./1_-_AddressBarSpoof,_basicauth.yaml | ||
| - runFlow: ./2_-_AddressBarSpoof,_aboutblank.yaml | ||
| - runFlow: ./3_-_AddressBarSpoof,_appschemes.yaml | ||
| - runFlow: ./4_-_AddressBarSpoof,_b64_html.yaml | ||
| - runFlow: ./5_-_AddressBarSpoof,_downloadpath.yaml | ||
| - runFlow: ./6_-_AddressBarSpoof,_formaction.yaml | ||
| - runFlow: ./7_-_AddressBarSpoof,_pagerewrite.yaml |
35 changes: 35 additions & 0 deletions
35
.maestro/security_tests/1_-_AddressBarSpoof,_basicauth.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,35 @@ | ||
| appId: com.duckduckgo.mobile.ios | ||
| tags: | ||
| - securityTest | ||
| --- | ||
| - doubleTapOn: | ||
| id: "searchEntry" | ||
| - pressKey: Backspace | ||
| # Test 1 - using \u2028 character | ||
| - inputText: "https://privacy-test-pages.site/security/address-bar-spoofing/spoof-basicauth-2028.html" | ||
| - pressKey: Enter | ||
| - tapOn: "run" | ||
| - assertVisible: "Example Domain" | ||
| - copyTextFrom: | ||
| id: "searchEntry" | ||
| - assertTrue: ${maestro.copiedText.indexOf("https://www.google.com") != 0} | ||
| - tapOn: | ||
| id: "searchEntry" | ||
| # Test 2 - using \u2029 character | ||
| - inputText: "https://privacy-test-pages.site/security/address-bar-spoofing/spoof-basicauth-2029.html" | ||
| - pressKey: Enter | ||
| - tapOn: "run" | ||
| - assertVisible: "Example Domain" | ||
| - copyTextFrom: | ||
| id: "searchEntry" | ||
| - assertTrue: ${maestro.copiedText.indexOf("https://www.google.com") != 0} | ||
| - tapOn: | ||
| id: "searchEntry" | ||
| # Test 3 - using repeated " " space character | ||
| - inputText: "https://privacy-test-pages.site/security/address-bar-spoofing/spoof-basicauth-whitespace.html" | ||
| - pressKey: Enter | ||
| - tapOn: "run" | ||
| - assertVisible: "Example Domain" | ||
| - copyTextFrom: | ||
| id: "searchEntry" | ||
| - assertTrue: ${maestro.copiedText.indexOf("https://www.google.com") != 0} |
17 changes: 17 additions & 0 deletions
17
.maestro/security_tests/2_-_AddressBarSpoof,_aboutblank.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,17 @@ | ||
| appId: com.duckduckgo.mobile.ios | ||
| tags: | ||
| - securityTest | ||
| --- | ||
| - doubleTapOn: | ||
| id: "searchEntry" | ||
| - pressKey: Backspace | ||
| - inputText: "https://privacy-test-pages.site/security/address-bar-spoofing/spoof-about-blank-rewrite.html" | ||
| - pressKey: Enter | ||
| - tapOn: "Start" | ||
| # This test is expected to load "about:blank" not spoof the address bar with duckduckgo.com with the spoofed content. | ||
| - extendedWaitUntil: | ||
| visible: "Not DDG." # Spoofed content is visible | ||
| timeout: 10000 | ||
| - copyTextFrom: | ||
| id: "searchEntry" | ||
| - assertTrue: ${maestro.copiedText == "about:blank"} |
30 changes: 30 additions & 0 deletions
30
.maestro/security_tests/3_-_AddressBarSpoof,_appschemes.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,30 @@ | ||
| appId: com.duckduckgo.mobile.ios | ||
| tags: | ||
| - securityTest | ||
| --- | ||
| # Test 1 | ||
| - tapOn: | ||
| id: "searchEntry" | ||
| - pressKey: Backspace | ||
| - inputText: "https://privacy-test-pages.site/security/address-bar-spoofing/spoof-application-scheme.html" | ||
| - pressKey: Enter | ||
| - tapOn: "Start" | ||
| # This will try to open another app | ||
| - assertVisible: "Cancel" | ||
| - tapOn: "Cancel" | ||
| - copyTextFrom: | ||
| id: "searchEntry" | ||
| - assertTrue: ${maestro.copiedText == "https://duckduckgo.com/"} # Should navigate directly here. | ||
| - assertNotVisible: "Not DDG." # HTML content shouldn't be spoofed. | ||
| - tapOn: | ||
| id: "searchEntry" | ||
| # Test 2 | ||
| - inputText: "https://privacy-test-pages.site/security/address-bar-spoofing/spoof-unsupported-scheme.html" | ||
| - pressKey: Enter | ||
| - tapOn: "Start" | ||
| # This will try to open another app | ||
| - assertVisible: "Cancel" | ||
| - tapOn: "Cancel" | ||
| - copyTextFrom: | ||
| id: "searchEntry" | ||
| - assertTrue: ${maestro.copiedText == "https://privacy-test-pages.site/security/address-bar-spoofing/spoof-unsupported-scheme.html"} |
15 changes: 15 additions & 0 deletions
15
.maestro/security_tests/4_-_AddressBarSpoof,_b64_html.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| appId: com.duckduckgo.mobile.ios | ||
| tags: | ||
| - securityTest | ||
| --- | ||
| # Test 1 | ||
| - doubleTapOn: | ||
| id: "searchEntry" | ||
| - pressKey: Backspace | ||
| - inputText: "https://privacy-test-pages.site/security/address-bar-spoofing/spoof-open-b64-html.html" | ||
| - pressKey: Enter | ||
| - tapOn: "Start" | ||
| # This test is expected to do nothing: loading base64 encoded HTML content in a new tab is blocked. | ||
| - copyTextFrom: | ||
| id: "searchEntry" | ||
| - assertTrue: ${maestro.copiedText == "https://privacy-test-pages.site/security/address-bar-spoofing/spoof-open-b64-html.html"} |
39 changes: 39 additions & 0 deletions
39
.maestro/security_tests/5_-_AddressBarSpoof,_downloadpath.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,39 @@ | ||
| appId: com.duckduckgo.mobile.ios | ||
| tags: | ||
| - securityTest | ||
| --- | ||
| # Test 1 | ||
| - doubleTapOn: | ||
| id: "searchEntry" | ||
| - pressKey: Backspace | ||
| - inputText: "https://privacy-test-pages.site/security/address-bar-spoofing/spoof-js-download-url.html" | ||
| - pressKey: Enter | ||
| - tapOn: "Start" | ||
| # Download Acceptance Flow: | ||
| - extendedWaitUntil: | ||
| visible: "Save to Downloads" | ||
| timeout: 10000 | ||
| - tapOn: "Save to Downloads" | ||
| - copyTextFrom: | ||
| id: "searchEntry" | ||
| - assertTrue: ${maestro.copiedText == "about:blank"} # Downloads should occur in empty origin. | ||
| # Restart | ||
| - tapOn: | ||
| id: "searchEntry" | ||
| - inputText: "https://privacy-test-pages.site/security/address-bar-spoofing/spoof-js-download-url.html" | ||
| - pressKey: Enter | ||
| # Download Cancel Flow: | ||
| - tapOn: "Start" | ||
| - extendedWaitUntil: | ||
| visible: "Cancel" | ||
| timeout: 10000 | ||
| - tapOn: "Cancel" | ||
| # Should be on about:blank | ||
| - copyTextFrom: | ||
| id: "searchEntry" | ||
| - assertTrue: ${maestro.copiedText == "about:blank"} | ||
| # Return to last test page | ||
| - tapOn: | ||
| id: "searchEntry" | ||
| - inputText: "https://privacy-test-pages.site/security/address-bar-spoofing/spoof-js-download-url.html" | ||
| - pressKey: Enter |
16 changes: 16 additions & 0 deletions
16
.maestro/security_tests/6_-_AddressBarSpoof,_formaction.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| appId: com.duckduckgo.mobile.ios | ||
| tags: | ||
| - securityTest | ||
| --- | ||
| # Test 1 | ||
| - doubleTapOn: | ||
| id: "searchEntry" | ||
| - pressKey: Backspace | ||
| - inputText: "https://privacy-test-pages.site/security/address-bar-spoofing/spoof-form-action.html" | ||
| - pressKey: Enter | ||
| - tapOn: "run" | ||
| # Should navigate to duckduckgo.com without any spoofed HTML document content. | ||
| - copyTextFrom: | ||
| id: "searchEntry" | ||
| - assertTrue: ${maestro.copiedText == "https://duckduckgo.com/"} | ||
| - assertNotVisible: "Not DDG." |
16 changes: 16 additions & 0 deletions
16
.maestro/security_tests/7_-_AddressBarSpoof,_pagerewrite.yaml
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,16 @@ | ||
| appId: com.duckduckgo.mobile.ios | ||
| tags: | ||
| - securityTest | ||
| --- | ||
| # Test 1 | ||
| - doubleTapOn: | ||
| id: "searchEntry" | ||
| - pressKey: Backspace | ||
| - inputText: "https://privacy-test-pages.site/security/address-bar-spoofing/spoof-js-page-rewrite.html" | ||
| - pressKey: Enter | ||
| - tapOn: "Start" | ||
| # Now check the address bar hasn't been updated too early resulting in spoofed content | ||
| - copyTextFrom: | ||
| id: "searchEntry" | ||
| - assertTrue: ${maestro.copiedText == "https://privacy-test-pages.site/security/address-bar-spoofing/spoof-js-page-rewrite.html"} | ||
| - assertNotVisible: "DDG." |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,10 +1,14 @@ | ||
| appId: com.duckduckgo.mobile.ios | ||
| --- | ||
|
|
||
| - assertVisible: Sync & Back Up | ||
| - tapOn: Sync & Back Up | ||
| - assertVisible: Sync & Back Up | ||
| - tapOn: Start Sync & Back Up | ||
| - assertVisible: All Set! | ||
| - assertVisible: Sync & Backup | ||
| - tapOn: Sync & Backup | ||
| - assertVisible: Sync & Backup | ||
| - tapOn: Sync and Back Up This Device | ||
| - assertVisible: You can sync with your other devices later. | ||
| - tapOn: Turn on Sync & Backup | ||
| - assertVisible: Save Recovery Code | ||
| - tapOn: Copy Code | ||
| - tapOn: Next | ||
| - assertVisible: Save Recovery Code? | ||
| - assertVisible: Your Data is Synced! | ||
| - tapOn: Done |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1,9 +1,10 @@ | ||
| appId: com.duckduckgo.mobile.ios | ||
| --- | ||
|
|
||
| - assertVisible: Sync & Back Up | ||
| - assertVisible: Sync & Backup | ||
| - scroll | ||
| - tapOn: | ||
| point: 50%,91% # TODO: Revisit after new setup flow has been implemented. | ||
| - assertVisible: Delete Server Data? | ||
| - tapOn: Delete Server Data | ||
| - tapOn: Delete Server Data | ||
| - assertVisible: Begin Syncing |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.