sneak
efdb5eeb2b
check / check (pull_request) Successful in 2m35s
With the s3.* config form and an endpoint written without a scheme, use_ssl being omitted built an http:// endpoint, while config.example.yml documented use_ssl as defaulting to true. Over plain HTTP a network observer sees manifests, object names, sizes and the access key id, and can alter responses. use_ssl is now *bool: omitted (nil) means the default, TLS; only an explicit use_ssl: false forces plain HTTP. This matches the s3:// URL form, which already defaults to TLS. The config init template dropped its misleading use_ssl line from the s3:// block (that key is never read for URLs; ?ssl=false controls TLS there) and points at ?ssl=false instead. Model: opus-4-8
62 lines
1.5 KiB
Go
62 lines
1.5 KiB
Go
package storage_test
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
|
|
"sneak.berlin/go/vaultik/internal/config"
|
|
"sneak.berlin/go/vaultik/internal/storage"
|
|
)
|
|
|
|
// legacyS3Config returns a minimal s3.* (no storage_url) configuration with a
|
|
// scheme-less endpoint. useSSL mirrors the config file: nil means the key is
|
|
// omitted, a pointer means it was written explicitly.
|
|
func legacyS3Config(useSSL *bool) *config.Config {
|
|
return &config.Config{
|
|
S3: config.S3Config{
|
|
Endpoint: "s3.example.com",
|
|
Bucket: "bucket",
|
|
AccessKeyID: "key",
|
|
SecretAccessKey: "secret",
|
|
Region: "us-east-1",
|
|
UseSSL: useSSL,
|
|
},
|
|
}
|
|
}
|
|
|
|
// endpointScheme builds the storer from cfg and returns the scheme its
|
|
// resolved endpoint carries (Info().Location is "endpoint/bucket").
|
|
func endpointScheme(t *testing.T, cfg *config.Config) string {
|
|
t.Helper()
|
|
|
|
storer, err := storage.NewStorer(cfg)
|
|
if err != nil {
|
|
t.Fatalf("NewStorer: %v", err)
|
|
}
|
|
|
|
location := storer.Info().Location
|
|
switch {
|
|
case strings.HasPrefix(location, "https://"):
|
|
return "https"
|
|
case strings.HasPrefix(location, "http://"):
|
|
return "http"
|
|
default:
|
|
t.Fatalf("endpoint has no http(s) scheme: %q", location)
|
|
|
|
return ""
|
|
}
|
|
}
|
|
|
|
func TestLegacyS3SchemelessEndpointDefaultsToTLS(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
if got := endpointScheme(t, legacyS3Config(nil)); got != "https" {
|
|
t.Errorf("use_ssl omitted: got %q scheme, want https", got)
|
|
}
|
|
|
|
no := false
|
|
if got := endpointScheme(t, legacyS3Config(&no)); got != "http" {
|
|
t.Errorf("use_ssl: false: got %q scheme, want http", got)
|
|
}
|
|
}
|