Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
name.bychkov:junit5-fakesmtp
Advanced tools
FakeSMTP for unit-testing smtp clients with JUnit 5
Suppose, your application sends emails to users with such or similar code:
public class SendEmailService {
public void sendMessage(String email, String subject, String body) throws MessagingException {
Properties props = System.getProperties();
props.put("mail.smtp.host", "localhost");
props.put("mail.smtp.port", "25");
Session session = Session.getInstance(props, null);
Message simpleMail = new MimeMessage(session);
simpleMail.setSubject(subject);
simpleMail.setRecipient(Message.RecipientType.TO, new InternetAddress(email));
MimeMultipart mailContent = new MimeMultipart();
MimeBodyPart mailMessage = new MimeBodyPart();
mailMessage.setContent(body, "text/html; charset=utf-8");
mailContent.addBodyPart(mailMessage);
simpleMail.setContent(mailContent);
Transport.send(simpleMail);
}
}
You must be sure this functionality will work correct in future and not break, while the code changes. How can you do this? Every time you can start simple smpt-server locally. After tests runned, see messages and prove it. For small projects this is only uncomfortable, for large - impossible.
These actions can be performed automatically. Use in code of your unit-test special extension and smtp-server will start and stop automatically:
@RegisterExtension
static FakeSmtpJUnitExtension fakeSmtp = new FakeSmtpJUnitExtension();
@Test
public void testSendMessage() {
String expectedReceiver = "test-email-" + new Random().nextInt(Integer.MAX_VALUE) + "@example.com";
String expectedSubject = "test-subject-" + new Random().nextInt(Integer.MAX_VALUE);
try {
SendEmailService testedService = new SendEmailService();
testedService.sendMessage(expectedReceiver, expectedSubject, "text of body");
Assertions.assertEquals(1, fakeSmtp.getMessages().size());
MimeMessage actualMail = fakeSmtp.getMessages().iterator().next();
Assertions.assertEquals(expectedReceiver, actualMail.getAllRecipients()[0].toString());
Assertions.assertEquals(expectedSubject, actualMail.getSubject());
} catch (MessagingException e) {
Assertions.fail(e);
}
}
Add in your pom.xml these modifications
<dependencies>
...
<!-- other dependencies -->
<!-- JUnit 5 dependencies -->
...
<dependency>
<groupId>name.bychkov</groupId>
<artifactId>junit5-fakesmtp</artifactId>
<version>1.0.1</version>
<scope>test</scope>
</dependency>
</dependencies>
<build>
<plugins>
...
<plugin>
<artifactId>maven-surefire-plugin</artifactId>
<version>2.22.0</version>
</plugin>
</plugins>
</build>
Notes:
By default, implementation uses JavaMail realization (namespaces javax.mail.
). If you use Jakarta Mail (namespaces jakarta.mail.
), use dependency with classifier jakarta
:
<dependency>
<groupId>name.bychkov</groupId>
<artifactId>junit5-fakesmtp</artifactId>
<version>1.0.1</version>
<classifier>jakarta</classifier>
<scope>test</scope>
</dependency>
You can see full examples of usage JUnit5-FakeSMTP with JavaMail and Jakarta Mail.
FAQs
FakeSMTP for unit-testing smtp clients with JUnit 5
We found that name.bychkov:junit5-fakesmtp demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.