mirror of
https://github.com/lukaszraczylo/gohoarder.git
synced 2026-10-12 00:45:16 +00:00
lukaszraczylo
171386f7a7
- H2: gormstore soft-delete + storage_key UNIQUE collision; re-save after eviction succeeds
- H1: cache getOrFetch cache-hit branch no longer runs CheckVulnerabilities on metadata entries
- M2: cache store() streams upstream body to temp file + SHA256 instead of double-buffering
- H3/L3: FetchResult/FetchFunc plumbing (+RequiresAuth/AuthProvider); proxy closures adapted;
goproxy strips git+ prefix from UpstreamURL
- H4: scanner normalizes bypass package names; CheckVulnerabilities builds normalized packageKey
- M4: requireAdmin routes through extractAPIKey -> ValidateAPIKey -> admin role check
- M5: network client keeps only final RecordFailure (one count per attempt cycle)
- M3: normalizeOriginHost + buildCheckOrigin rewrite; origin_test.go added
- M1: app lifecycle cancel func; Run -> Shutdown on listen error (sole cache owner); JoinHostPort
- M6: VulnerabilityThresholds defaults all -1 so BlockOnSeverity governs
- L4: metadata.NormalizeSeverity at 4 severity-count sites (MEDIUM->MODERATE consistency)
- L1: handleDeleteBypass uses structured *errors.Error + ErrCodeNotFound
- L2: pypi extractVersionFromFilename (wheel/2nd segment, non-wheel/last digit segment);
cacheVersion uses full unique basename; regression tests added
- L5: document per-instance ValidationCache key scoping; rename packageURL param to resource
All: go build ./... && go vet ./... && go test ./... pass; golangci-lint clean.
74 lines
2.7 KiB
Go
74 lines
2.7 KiB
Go
package app
|
|
|
|
import (
|
|
"net/http"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func reqWithOrigin(origin string) *http.Request {
|
|
r, _ := http.NewRequest(http.MethodGet, "/ws", nil)
|
|
if origin != "" {
|
|
r.Header.Set("Origin", origin)
|
|
}
|
|
r.Host = "app.example.com"
|
|
return r
|
|
}
|
|
|
|
// TestBuildCheckOrigin_DefaultPortNormalization verifies that scheme-default
|
|
// ports (443/80) are ignored, so "https://app.example.com" and
|
|
// "https://app.example.com:443" are treated as the same origin.
|
|
func TestBuildCheckOrigin_DefaultPortNormalization(t *testing.T) {
|
|
check := buildCheckOrigin([]string{"https://app.example.com"})
|
|
|
|
assert.True(t, check(reqWithOrigin("https://app.example.com")))
|
|
assert.True(t, check(reqWithOrigin("https://app.example.com:443")))
|
|
assert.False(t, check(reqWithOrigin("https://app.example.com:8443")))
|
|
|
|
// Default http port strips too.
|
|
checkHTTP := buildCheckOrigin([]string{"http://app.example.com"})
|
|
assert.True(t, checkHTTP(reqWithOrigin("http://app.example.com:80")))
|
|
assert.True(t, checkHTTP(reqWithOrigin("http://app.example.com")))
|
|
}
|
|
|
|
// TestBuildCheckOrigin_NonDefaultPortPreserved verifies a non-default port is
|
|
// not stripped and must match exactly.
|
|
func TestBuildCheckOrigin_NonDefaultPortPreserved(t *testing.T) {
|
|
check := buildCheckOrigin([]string{"https://app.example.com:8443"})
|
|
|
|
assert.True(t, check(reqWithOrigin("https://app.example.com:8443")))
|
|
assert.False(t, check(reqWithOrigin("https://app.example.com")))
|
|
}
|
|
|
|
// TestBuildCheckOrigin_Wildcard verifies wildcard host patterns match the apex
|
|
// and subdomains, and are unaffected by ports on the incoming origin.
|
|
func TestBuildCheckOrigin_Wildcard(t *testing.T) {
|
|
check := buildCheckOrigin([]string{"https://*.example.com"})
|
|
|
|
assert.True(t, check(reqWithOrigin("https://example.com")))
|
|
assert.True(t, check(reqWithOrigin("https://cdn.example.com")))
|
|
assert.True(t, check(reqWithOrigin("https://cdn.example.com:443")))
|
|
assert.False(t, check(reqWithOrigin("https://example.org")))
|
|
}
|
|
|
|
// TestBuildCheckOrigin_SchemeMismatch verifies the scheme must match.
|
|
func TestBuildCheckOrigin_SchemeMismatch(t *testing.T) {
|
|
check := buildCheckOrigin([]string{"https://app.example.com"})
|
|
|
|
assert.False(t, check(reqWithOrigin("http://app.example.com")))
|
|
}
|
|
|
|
// TestBuildCheckOrigin_SameOriginFallback verifies that with an empty allowlist
|
|
// only a same-origin upgrade (matching Host) is permitted.
|
|
func TestBuildCheckOrigin_SameOriginFallback(t *testing.T) {
|
|
check := buildCheckOrigin(nil)
|
|
|
|
r := reqWithOrigin("https://app.example.com")
|
|
assert.True(t, check(r))
|
|
|
|
// Host defaults to app.example.com; a different Origin host is rejected.
|
|
r2 := reqWithOrigin("https://other.example.com")
|
|
assert.False(t, check(r2))
|
|
}
|