서블릿·JSP 책임

testRuntimeOnly 'org.apache.tomcat.embed:tomcat-embed-jasper'
testRuntimeOnly 'jakarta.servlet.jsp.jstl:jakarta.servlet.jsp.jstl-api'
testRuntimeOnly 'org.glassfish.web:jakarta.servlet.jsp.jstl'

package board.servlet;

import static java.nio.charset.StandardCharsets.UTF_8;
import static org.junit.jupiter.api.Assertions.assertAll;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.assertFalse;
import static org.junit.jupiter.api.Assertions.assertNotEquals;
import static org.junit.jupiter.api.Assertions.assertTrue;

import java.io.IOException;
import java.net.URI;
import java.net.URLEncoder;
import java.net.http.HttpClient;
import java.net.http.HttpRequest;
import java.net.http.HttpResponse;
import java.nio.file.Files;
import java.nio.file.Path;
import java.text.NumberFormat;
import java.time.Duration;
import java.util.Locale;
import java.util.Map;
import java.util.Optional;
import java.util.concurrent.ConcurrentHashMap;
import java.util.concurrent.atomic.AtomicBoolean;
import java.util.concurrent.atomic.AtomicInteger;
import java.util.concurrent.atomic.AtomicLong;
import java.util.concurrent.atomic.AtomicReference;

import jakarta.servlet.RequestDispatcher;
import jakarta.servlet.ServletException;
import jakarta.servlet.http.HttpServlet;
import jakarta.servlet.http.HttpServletRequest;
import jakarta.servlet.http.HttpServletResponse;
import org.junit.jupiter.api.Test;
import org.springframework.boot.SpringApplication;
import org.springframework.boot.SpringBootConfiguration;
import org.springframework.boot.WebApplicationType;
import org.springframework.boot.autoconfigure.EnableAutoConfiguration;
import org.springframework.boot.tomcat.servlet.TomcatServletWebServerFactory;
import org.springframework.boot.web.server.WebServerFactoryCustomizer;
import org.springframework.boot.web.server.servlet.context
        .ServletWebServerApplicationContext;
import org.springframework.boot.web.servlet.ServletRegistrationBean;
import org.springframework.context.annotation.Bean;
import org.springframework.util.FileSystemUtils;
import org.thymeleaf.context.Context;
import org.thymeleaf.spring6.SpringTemplateEngine;
import org.thymeleaf.templatemode.TemplateMode;
import org.thymeleaf.templateresolver.StringTemplateResolver;

public class EmbeddedServletViewBoundaryTest {
    private static final HttpClient CLIENT = HttpClient.newBuilder()
            .connectTimeout(Duration.ofSeconds(5))
            .followRedirects(HttpClient.Redirect.NEVER)
            .version(HttpClient.Version.HTTP_1_1)
            .build();
    private static final String UNSAFE =
            "<script>alert('x')</script>&게시글";

    @Test
    void GET은_typed_model을_fixed_WEB_INF_view로_forward하고_escape한다()
            throws Exception {
        try (var server = RunningServer.start()) {
            var response = get(server, "/posts/42");
            var body = response.body();

            assertAll(
                    () -> assertEquals(200, response.statusCode()),
                    () -> assertTrue(body.contains("&lt;script&gt;")),
                    () -> assertFalse(body.contains("<script>alert")),
                    () -> assertTrue(body.contains("1,200자")),
                    () -> assertTrue(body.contains("긴 글")),
                    () -> assertTrue(body.contains("추천")),
                    () -> assertTrue(body.contains(
                            "<p id=\"forward-uri\">/posts/42</p>")),
                    () -> assertTrue(body.contains(
                            "<p id=\"repository\"></p>")),
                    () -> assertEquals(1, server.store().queryCount.get()),
                    () -> assertEquals(
                            PostPageModel.class,
                            server.probe().lastModelType.get()));
        }
    }

    @Test
    void WEB_INF는_직접_요청하면_404이고_view_parameter로_바뀌지_않는다()
            throws Exception {
        try (var server = RunningServer.start()) {
            var direct = get(server, "/WEB-INF/views/post-detail.jsp");
            var routed = get(
                    server,
                    "/posts/42?view=/WEB-INF/views/escaping-probe.jsp");

            assertAll(
                    () -> assertEquals(404, direct.statusCode()),
                    () -> assertEquals(200, routed.statusCode()),
                    () -> assertTrue(routed.body().contains(
                            "<main id=\"post-detail\">")),
                    () -> assertFalse(routed.body().contains(
                            "<p id=\"raw\">")),
                    () -> assertEquals(1, server.store().queryCount.get()));
        }
    }

    @Test
    void 검증_실패_POST는_같은_request의_입력과_error를_forward한다()
            throws Exception {
        try (var server = RunningServer.start()) {
            var title = "<x";
            var response = post(
                    server,
                    "/posts",
                    "title=" + URLEncoder.encode(title, UTF_8));

            assertAll(
                    () -> assertEquals(422, response.statusCode()),
                    () -> assertTrue(response.body().contains(
                            "value=\"&lt;x\"")),
                    () -> assertTrue(response.body().contains(
                            "제목은 3자 이상이어야 합니다")),
                    () -> assertTrue(response.body().contains(
                            "<p id=\"forward-uri\">/posts</p>")),
                    () -> assertTrue(response.body().contains(
                            "<p id=\"marker\">"
                                    + server.probe().lastPostMarker.get()
                                    + "</p>")),
                    () -> assertEquals(0, server.store().commandCount.get()));
        }
    }

    @Test
    void 성공_POST는_303_Location_뒤_new_GET에서_model을_다시_만든다()
            throws Exception {
        try (var server = RunningServer.start()) {
            var created = post(
                    server,
                    "/posts",
                    "title=" + URLEncoder.encode("새 게시글", UTF_8));
            var location = created.headers()
                    .firstValue("Location")
                    .orElseThrow();
            var redirected = get(created.request().uri().resolve(location));

            assertAll(
                    () -> assertEquals(303, created.statusCode()),
                    () -> assertTrue(location.endsWith("/posts/43")),
                    () -> assertEquals(200, redirected.statusCode()),
                    () -> assertTrue(redirected.body().contains("새 게시글")),
                    () -> assertTrue(redirected.body().contains(
                            "<p id=\"post-only\"></p>")),
                    () -> assertEquals("GET", server.probe().lastGetMethod.get()),
                    () -> assertNotEquals(
                            server.probe().lastPostMarker.get(),
                            server.probe().lastGetMarker.get()),
                    () -> assertEquals(1, server.store().commandCount.get()),
                    () -> assertEquals(1, server.store().queryCount.get()));
        }
    }

    @Test
    void forward는_미커밋_buffer를_지우고_commit_뒤에는_거부된다()
            throws Exception {
        try (var server = RunningServer.start()) {
            var beforeCommit = get(
                    server, "/diagnostics/forward-before-commit");
            var afterCommit = get(
                    server, "/diagnostics/forward-after-commit");

            assertAll(
                    () -> assertEquals(200, beforeCommit.statusCode()),
                    () -> assertFalse(beforeCommit.body().contains("STALE")),
                    () -> assertTrue(beforeCommit.body().contains(
                            "<p id=\"escaped\">&lt;script&gt;")),
                    () -> assertEquals(200, afterCommit.statusCode()),
                    () -> assertEquals("PARTIAL", afterCommit.body()),
                    () -> assertTrue(
                            server.probe().committedForwardRejected.get()));
        }
    }

    @Test
    void JSP_raw_EL과_c_out의_escaped_text를_실제_Jasper로_구분한다()
            throws Exception {
        try (var server = RunningServer.start()) {
            var response = get(server, "/diagnostics/jsp-escaping");
            var body = response.body();

            assertAll(
                    () -> assertEquals(200, response.statusCode()),
                    () -> assertTrue(body.contains(
                            "<p id=\"raw\"><script>alert('x')</script>")),
                    () -> assertTrue(body.contains(
                            "<p id=\"escaped\">&lt;script&gt;")),
                    () -> assertTrue(body.contains("&amp;게시글</p>")),
                    () -> assertEquals(3,
                            body.split("id=\"(?:raw|escaped)\"", -1).length));
        }
    }

    @Test
    void Thymeleaf_th_text와_th_utext의_출력_경계를_구분한다() {
        var resolver = new StringTemplateResolver();
        resolver.setTemplateMode(TemplateMode.HTML);
        resolver.setCacheable(false);
        var engine = new SpringTemplateEngine();
        engine.setTemplateResolver(resolver);
        var context = new Context(Locale.KOREA);
        context.setVariable("unsafe", "<em>model</em>&");

        var html = engine.process(
                "<p id=\"escaped\" th:text=\"${unsafe}\"></p>"
                        + "<p id=\"raw\" th:utext=\"${unsafe}\"></p>",
                context);

        assertAll(
                () -> assertTrue(html.contains(
                        "<p id=\"escaped\">&lt;em&gt;model&lt;/em&gt;&amp;</p>")),
                () -> assertTrue(html.contains(
                        "<p id=\"raw\"><em>model</em>&</p>")));
    }

    private static HttpResponse<String> get(
            RunningServer server,
            String path)
            throws IOException, InterruptedException {
        return get(URI.create(server.origin() + path));
    }

    private static HttpResponse<String> get(URI uri)
            throws IOException, InterruptedException {
        return send(uri, "GET", null);
    }

    private static HttpResponse<String> post(
            RunningServer server,
            String path,
            String formBody)
            throws IOException, InterruptedException {
        return send(URI.create(server.origin() + path), "POST", formBody);
    }

    private static HttpResponse<String> send(
            URI uri,
            String method,
            String body)
            throws IOException, InterruptedException {
        var builder = HttpRequest.newBuilder(uri)
                .timeout(Duration.ofSeconds(10));
        if (body == null) {
            builder.method(method, HttpRequest.BodyPublishers.noBody());
        } else {
            builder.header(
                    "Content-Type",
                    "application/x-www-form-urlencoded;charset=UTF-8");
            builder.method(method, HttpRequest.BodyPublishers.ofString(
                    body, UTF_8));
        }
        return CLIENT.send(
                builder.build(),
                HttpResponse.BodyHandlers.ofString(UTF_8));
    }

    public record RunningServer(
            ServletWebServerApplicationContext context,
            String origin,
            BoardStore store,
            ViewProbe probe,
            ViewFiles files)
            implements AutoCloseable {
        static RunningServer start() throws IOException {
            var files = ViewFiles.create();
            var store = new BoardStore();
            var probe = new ViewProbe();
            var mapper = new PostPageMapper();
            var application = new SpringApplication(TestApplication.class);
            application.setWebApplicationType(WebApplicationType.SERVLET);
            application.setRegisterShutdownHook(false);
            application.setDefaultProperties(Map.of(
                    "server.address", "127.0.0.1",
                    "server.port", "0",
                    "server.tomcat.basedir",
                            files.root().resolve("tomcat").toString(),
                    "spring.main.banner-mode", "off",
                    "logging.level.root", "OFF"));
            application.addInitializers(context -> {
                var beans = context.getBeanFactory();
                beans.registerSingleton("viewFiles", files);
                beans.registerSingleton("boardStore", store);
                beans.registerSingleton("viewProbe", probe);
                beans.registerSingleton("postPageMapper", mapper);
            });

            try {
                var context = (ServletWebServerApplicationContext)
                        application.run();
                return new RunningServer(
                        context,
                        "http://127.0.0.1:"
                                + context.getWebServer().getPort(),
                        store,
                        probe,
                        files);
            } catch (RuntimeException failure) {
                files.close();
                throw failure;
            }
        }

        @Override
        public void close() throws IOException {
            context.close();
            files.close();
        }
    }

    @SpringBootConfiguration(proxyBeanMethods = false)
    @EnableAutoConfiguration
    public static class TestApplication {
        @Bean
        WebServerFactoryCustomizer<TomcatServletWebServerFactory>
                documentRoot(ViewFiles files) {
            return factory -> {
                factory.setDocumentRoot(files.root().toFile());
                factory.setRegisterDefaultServlet(true);
            };
        }

        @Bean
        ServletRegistrationBean<PostPageServlet> postPageServlet(
                BoardStore store,
                PostPageMapper mapper,
                ViewProbe probe) {
            var registration = new ServletRegistrationBean<>(
                    new PostPageServlet(store, store, mapper, probe),
                    "/posts",
                    "/posts/*");
            registration.setName("postPageServlet");
            return registration;
        }

        @Bean
        ServletRegistrationBean<DispatchProbeServlet> dispatchProbeServlet(
                ViewProbe probe) {
            var registration = new ServletRegistrationBean<>(
                    new DispatchProbeServlet(probe),
                    "/diagnostics/*");
            registration.setName("dispatchProbeServlet");
            return registration;
        }
    }

    public static final class PostPageServlet extends HttpServlet {
        private static final String DETAIL_VIEW =
                "/WEB-INF/views/post-detail.jsp";
        private static final String FORM_VIEW =
                "/WEB-INF/views/post-form.jsp";
        private final PostQuery query;
        private final PostCommand command;
        private final PostPageMapper mapper;
        private final ViewProbe probe;

        PostPageServlet(
                PostQuery query,
                PostCommand command,
                PostPageMapper mapper,
                ViewProbe probe) {
            this.query = query;
            this.command = command;
            this.mapper = mapper;
            this.probe = probe;
        }

        @Override
        protected void doGet(
                HttpServletRequest request,
                HttpServletResponse response)
                throws ServletException, IOException {
            var path = request.getPathInfo();
            if (path == null || path.length() < 2) {
                response.sendError(HttpServletResponse.SC_NOT_FOUND);
                return;
            }

            final long id;
            try {
                id = Long.parseLong(path.substring(1));
            } catch (NumberFormatException invalidId) {
                response.sendError(HttpServletResponse.SC_BAD_REQUEST);
                return;
            }

            var post = query.find(id);
            if (post.isEmpty()) {
                response.sendError(HttpServletResponse.SC_NOT_FOUND);
                return;
            }
            var model = mapper.toModel(post.orElseThrow());
            var marker = requestMarker("GET", request);
            request.setAttribute("post", model);
            request.setAttribute("requestMarker", marker);
            probe.lastModelType.set(model.getClass());
            probe.lastGetMethod.set(request.getMethod());
            probe.lastGetMarker.set(marker);
            request.getRequestDispatcher(DETAIL_VIEW)
                    .forward(request, response);
        }

        @Override
        protected void doPost(
                HttpServletRequest request,
                HttpServletResponse response)
                throws ServletException, IOException {
            var title = Optional.ofNullable(request.getParameter("title"))
                    .orElse("");
            var marker = requestMarker("POST", request);
            probe.lastPostMarker.set(marker);
            request.setAttribute("requestMarker", marker);

            if (title.strip().length() < 3) {
                response.setStatus(422);
                request.setAttribute(
                        "form",
                        new PostFormModel(
                                title,
                                "제목은 3자 이상이어야 합니다"));
                request.getRequestDispatcher(FORM_VIEW)
                        .forward(request, response);
                return;
            }

            var id = command.create(title.strip());
            request.setAttribute("postRequestOnly", "must-not-cross");
            response.sendRedirect(
                    response.encodeRedirectURL(
                            request.getContextPath() + "/posts/" + id),
                    HttpServletResponse.SC_SEE_OTHER);
        }

        private static String requestMarker(
                String method,
                HttpServletRequest request) {
            return method + ":" + System.identityHashCode(request);
        }
    }

    public static final class DispatchProbeServlet extends HttpServlet {
        private static final String ESCAPING_VIEW =
                "/WEB-INF/views/escaping-probe.jsp";
        private final ViewProbe probe;

        DispatchProbeServlet(ViewProbe probe) {
            this.probe = probe;
        }

        @Override
        protected void doGet(
                HttpServletRequest request,
                HttpServletResponse response)
                throws ServletException, IOException {
            response.setCharacterEncoding(UTF_8.name());
            response.setContentType("text/html");
            switch (request.getPathInfo()) {
                case "/forward-before-commit" -> {
                    response.getWriter().write("STALE");
                    request.setAttribute("unsafe", UNSAFE);
                    request.getRequestDispatcher(ESCAPING_VIEW)
                            .forward(request, response);
                }
                case "/forward-after-commit" -> {
                    response.getWriter().write("PARTIAL");
                    response.flushBuffer();
                    try {
                        request.getRequestDispatcher(ESCAPING_VIEW)
                                .forward(request, response);
                    } catch (IllegalStateException committed) {
                        probe.committedForwardRejected.set(true);
                    }
                }
                case "/jsp-escaping" -> {
                    request.setAttribute("unsafe", UNSAFE);
                    request.getRequestDispatcher(ESCAPING_VIEW)
                            .forward(request, response);
                }
                default -> response.sendError(
                        HttpServletResponse.SC_NOT_FOUND);
            }
        }
    }

    public interface PostQuery {
        Optional<PostProjection> find(long id);
    }

    public interface PostCommand {
        long create(String title);
    }

    public static final class BoardStore implements PostQuery, PostCommand {
        private final Map<Long, StoredPost> posts = new ConcurrentHashMap<>();
        private final AtomicLong nextId = new AtomicLong(43);
        final AtomicInteger queryCount = new AtomicInteger();
        final AtomicInteger commandCount = new AtomicInteger();

        BoardStore() {
            posts.put(42L, new StoredPost(
                    42L,
                    UNSAFE,
                    1_200,
                    true,
                    "server-only-secret"));
        }

        @Override
        public Optional<PostProjection> find(long id) {
            queryCount.incrementAndGet();
            return Optional.ofNullable(posts.get(id))
                    .map(post -> new PostProjection(
                            post.id(),
                            post.title(),
                            post.contentLength(),
                            post.recommended()));
        }

        @Override
        public long create(String title) {
            commandCount.incrementAndGet();
            var id = nextId.getAndIncrement();
            posts.put(id, new StoredPost(
                    id,
                    title,
                    title.length(),
                    false,
                    "created-secret"));
            return id;
        }
    }

    public static final class PostPageMapper {
        PostPageModel toModel(PostProjection post) {
            var formattedLength = NumberFormat
                    .getIntegerInstance(Locale.KOREA)
                    .format(post.contentLength())
                    + "자";
            return new PostPageModel(
                    post.id(),
                    post.title(),
                    formattedLength,
                    post.contentLength() >= 60,
                    post.recommended());
        }
    }

    public record PostPageModel(
            long id,
            String title,
            String displayLength,
            boolean longPost,
            boolean recommended) {
        public long getId() {
            return id;
        }

        public String getTitle() {
            return title;
        }

        public String getDisplayLength() {
            return displayLength;
        }

        public boolean isLongPost() {
            return longPost;
        }

        public boolean isRecommended() {
            return recommended;
        }
    }

    public record PostFormModel(String title, String error) {
        public String getTitle() {
            return title;
        }

        public String getError() {
            return error;
        }
    }

    private record StoredPost(
            long id,
            String title,
            int contentLength,
            boolean recommended,
            String internalSecret) {}

    public record PostProjection(
            long id,
            String title,
            int contentLength,
            boolean recommended) {}

    public static final class ViewProbe {
        final AtomicReference<Class<?>> lastModelType =
                new AtomicReference<>();
        final AtomicReference<String> lastPostMarker =
                new AtomicReference<>();
        final AtomicReference<String> lastGetMarker =
                new AtomicReference<>();
        final AtomicReference<String> lastGetMethod =
                new AtomicReference<>();
        final AtomicBoolean committedForwardRejected =
                new AtomicBoolean(false);
    }

    public record ViewFiles(Path root) implements AutoCloseable {
        private static final String DETAIL_JSP = """
                <%@ page contentType="text/html;charset=UTF-8" pageEncoding="UTF-8" %>
                <%@ taglib prefix="c" uri="jakarta.tags.core" %>
                <!doctype html>
                <html lang="ko">
                <head><meta charset="utf-8"><title>게시글 상세</title></head>
                <body>
                  <main id="post-detail">
                    <h1><c:out value="${post.title}" /></h1>
                    <p><c:out value="${post.displayLength}" /></p>
                    <c:if test="${post.longPost}"><strong>긴 글</strong></c:if>
                    <c:if test="${post.recommended}"><strong>추천</strong></c:if>
                    <p id="forward-uri"><c:out value="${requestScope['jakarta.servlet.forward.request_uri']}" /></p>
                    <p id="post-only"><c:out value="${postRequestOnly}" /></p>
                    <p id="repository"><c:out value="${repository}" /></p>
                  </main>
                </body>
                </html>
                """;
        private static final String FORM_JSP = """
                <%@ page contentType="text/html;charset=UTF-8" pageEncoding="UTF-8" %>
                <%@ taglib prefix="c" uri="jakarta.tags.core" %>
                <!doctype html>
                <html lang="ko">
                <head><meta charset="utf-8"><title>게시글 등록</title></head>
                <body>
                  <form method="post" action="/posts">
                    <label>제목 <input name="title" value="<c:out value="${form.title}" />"></label>
                    <p role="alert"><c:out value="${form.error}" /></p>
                  </form>
                  <p id="forward-uri"><c:out value="${requestScope['jakarta.servlet.forward.request_uri']}" /></p>
                  <p id="marker"><c:out value="${requestMarker}" /></p>
                </body>
                </html>
                """;
        private static final String ESCAPING_JSP = """
                <%@ page contentType="text/html;charset=UTF-8" pageEncoding="UTF-8" %>
                <%@ taglib prefix="c" uri="jakarta.tags.core" %>
                <!doctype html>
                <html lang="ko">
                <head><meta charset="utf-8"><title>escaping probe</title></head>
                <body>
                  <p id="raw">${unsafe}</p>
                  <p id="escaped"><c:out value="${unsafe}" /></p>
                </body>
                </html>
                """;

        static ViewFiles create() throws IOException {
            var root = Files.createTempDirectory("b77-views-")
                    .toRealPath();
            var views = Files.createDirectories(
                    root.resolve("WEB-INF/views"));
            Files.writeString(
                    views.resolve("post-detail.jsp"), DETAIL_JSP, UTF_8);
            Files.writeString(
                    views.resolve("post-form.jsp"), FORM_JSP, UTF_8);
            Files.writeString(
                    views.resolve("escaping-probe.jsp"),
                    ESCAPING_JSP,
                    UTF_8);
            return new ViewFiles(root);
        }

        @Override
        public void close() throws IOException {
            if (!root.getFileName().toString().startsWith("b77-views-")) {
                throw new IOException("unexpected temporary root: " + root);
            }
            FileSystemUtils.deleteRecursively(root);
        }
    }
}