package coreruleset_test

import (
	"net/http"
	"testing"
)

// forgejoSearches are Forgejo's searches whose q skips some rules: the
// wiki's, from the fifteenth change, and the searches for a name, from the
// eighth.
//
//nolint:gochecknoglobals // a constant cannot be a list
var forgejoSearches = []string{
	"/alice/tools/wiki/search",
	"/explore/repos",
	"/explore/users",
	"/alice/tools/branches",
	"/alice/-/packages",
	"/api/v1/packages/alice",
	"/alice",
}

// forgejoAttacks are an SQL injection, a path traversal, a script injection
// and a shell command after a ";", as query values.
//
//nolint:gochecknoglobals // a constant cannot be a list
var forgejoAttacks = []string{
	sqlInjection, "..%2Fcustom%2Fconf%2Fapp.ini", scriptInjection, commandInjection,
}

func TestForgejoAttacksAreRefusedInItsSearches(t *testing.T) {
	t.Parallel()

	const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default

	defaults, bodies := atDefaults(t), readingBodies(t)

	for _, path := range forgejoSearches {
		for _, attack := range forgejoAttacks {
			if got := inspect(t, defaults, get(path+"?q="+attack)); got.Score < threshold {
				t.Errorf("GET %s?q=%s let through: %+v", path, attack, got)
			}

			// The same field in a form data body.
			r := request{http.MethodPost, path, []string{formData}}
			if got, _ := inspectBody(t, bodies, r, "q="+attack); got.Score < threshold {
				t.Errorf("POST %s q=%s let through: %+v", path, attack, got)
			}
		}
	}
}