mirror of
https://github.com/lukaszraczylo/traefikoidc.git
synced 2026-10-14 04:07:46 +00:00
lukaszraczylo
4d23d618f5
- RESP -ERR no longer closes healthy conn / aborts batch; global cap replacement-aware - global health-check pass serialized (latent data race); MemoryMonitor via ResourceManager - token-exchange retry, open-circuit rejections counted as failures - TLS-posture matching transport reuse (no silent InsecureSkipVerify handoff)
42 lines
1.3 KiB
Go
42 lines
1.3 KiB
Go
package utils
|
|
|
|
import "testing"
|
|
|
|
// TestR176_SanitizeForwardedHostRejectsPathDelimiters regresses
|
|
// sanitizeForwardedHost: it previously only rejected control/whitespace
|
|
// characters, so a crafted X-Forwarded-Host like "example.com/path" (or
|
|
// with '?', '#', '@') survived and its delimiter was spliced verbatim into
|
|
// the host part of a redirect URL (used as redirect_uri /
|
|
// post_logout_redirect_uri and matched by the IdP). Valid host
|
|
// characters — alphanumerics, '-', '.', ':', '[', ']' (port / IPv6) —
|
|
// must still pass.
|
|
func TestR176_SanitizeForwardedHostRejectsPathDelimiters(t *testing.T) {
|
|
valid := []string{
|
|
"example.com",
|
|
"example.com:8443",
|
|
"api.v2.example.co.uk",
|
|
"10.0.0.1",
|
|
"[2001:db8::1]",
|
|
"[fe80::1]:8080",
|
|
}
|
|
for _, in := range valid {
|
|
if got := sanitizeForwardedHost(in); got != in {
|
|
t.Fatalf("valid host %q was rejected: got %q", in, got)
|
|
}
|
|
}
|
|
|
|
invalid := []string{
|
|
"example.com/path", // path injection
|
|
"example.com?x=1", // query injection
|
|
"example.com#frag", // fragment injection
|
|
"[email protected]", // userinfo injection
|
|
"example.com\\path",
|
|
"example.com /evil", // embedded space + path
|
|
}
|
|
for _, in := range invalid {
|
|
if got := sanitizeForwardedHost(in); got != "" {
|
|
t.Fatalf("host %q must be rejected (delimiter would poison the redirect base), got %q", in, got)
|
|
}
|
|
}
|
|
}
|