init CTFd source

tests/api/v1/test_csrf.py

@@ -0,0 +1,44 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from flask.testing import FlaskClient
+
+from tests.helpers import create_ctfd, destroy_ctfd, login_as_user
+
+
+def test_api_csrf_failure():
+    """Test that API requests require the CSRF-Token header"""
+    app = create_ctfd()
+    app.test_client_class = FlaskClient
+    with app.app_context():
+        with login_as_user(app, "admin") as client:
+            r = client.post(
+                "/api/v1/challenges",
+                json={
+                    "name": "chal",
+                    "category": "cate",
+                    "description": "desc",
+                    "value": "100",
+                    "state": "hidden",
+                    "type": "standard",
+                },
+            )
+            assert r.status_code == 403
+
+            with client.session_transaction() as sess:
+                nonce = sess.get("nonce")
+
+            r = client.post(
+                "/api/v1/challenges",
+                headers={"CSRF-Token": nonce},
+                json={
+                    "name": "chal",
+                    "category": "cate",
+                    "description": "desc",
+                    "value": "100",
+                    "state": "hidden",
+                    "type": "standard",
+                },
+            )
+            assert r.status_code == 200
+    destroy_ctfd(app)