clawbot
82bab57dfe
check / check (push) Waiting to run
A target's settings move from the per-type JSON string in targets.config to columns: url, headers, timeout_seconds, forward_query, archive_expiry and archive_rotation. A column a type does not use stays empty. headers holds the header map as JSON text through GORM's JSON serializer, and archive_expiry holds a time.Duration, 0 meaning never, so nothing that reads a target parses it. The forms check each setting once, with the same refusals and messages, and the edit form is filled from the columns, so the per-type config structs, their parsers and the "could not be read" branches are gone. A delivery task carries the six settings in place of the JSON string. Model: opus-5-5
135 lines
3.3 KiB
Go
135 lines
3.3 KiB
Go
package delivery_test
|
|
|
|
import (
|
|
"context"
|
|
"log/slog"
|
|
"net/http"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
"sneak.berlin/go/webhooker/internal/delivery"
|
|
)
|
|
|
|
// newSSRFTestEngine builds an Engine whose shared client
|
|
// carries the SSRF-safe transport, mirroring production.
|
|
func newSSRFTestEngine() *delivery.Engine {
|
|
log := slog.New(slog.DiscardHandler)
|
|
|
|
client := &http.Client{
|
|
Timeout: 30 * time.Second,
|
|
Transport: delivery.NewTestGuard().
|
|
NewSSRFSafeTransport(),
|
|
}
|
|
|
|
return delivery.NewTestEngine(log, client, 1)
|
|
}
|
|
|
|
// TestClientForRequest_TimeoutKeepsSSRFGuard asserts that a
|
|
// client returned by clientForRequest for a config with a
|
|
// per-target timeout still refuses connections to
|
|
// private/reserved addresses (the timeout must not drop the
|
|
// SSRF-safe transport).
|
|
func TestClientForRequest_TimeoutKeepsSSRFGuard(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
engine := newSSRFTestEngine()
|
|
|
|
blocked := []string{
|
|
loopbackHookURL,
|
|
metadataURL,
|
|
"http://[fe80::1]/hook",
|
|
}
|
|
|
|
for _, target := range blocked {
|
|
t.Run(target, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
client := engine.ExportClientForRequest(5, nil)
|
|
|
|
require.NotSame(t, engine.ExportClient(), client,
|
|
"a per-target timeout must yield a "+
|
|
"distinct client",
|
|
)
|
|
|
|
assert.Equal(t,
|
|
5*time.Second, client.Timeout,
|
|
"the per-target timeout must be applied",
|
|
)
|
|
|
|
assert.Same(t,
|
|
engine.ExportClient().Transport,
|
|
client.Transport,
|
|
"the SSRF-safe transport must be reused, "+
|
|
"not dropped",
|
|
)
|
|
|
|
req, err := http.NewRequestWithContext(
|
|
context.Background(),
|
|
http.MethodPost, target, nil,
|
|
)
|
|
require.NoError(t, err)
|
|
|
|
resp, doErr := client.Do(req)
|
|
if resp != nil {
|
|
_ = resp.Body.Close()
|
|
}
|
|
|
|
require.Error(t, doErr,
|
|
"request to %s must be blocked", target,
|
|
)
|
|
|
|
assert.Contains(t, doErr.Error(), "blocked",
|
|
"error must come from the SSRF guard",
|
|
)
|
|
})
|
|
}
|
|
}
|
|
|
|
// TestClientForRequest_NoTimeoutUnchanged asserts that a
|
|
// request with neither a per-target timeout nor an origin-scoped
|
|
// header gets the shared SSRF-safe client unchanged: there is then
|
|
// nothing for a redirect policy to strip.
|
|
func TestClientForRequest_NoTimeoutUnchanged(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
engine := newSSRFTestEngine()
|
|
|
|
client := engine.ExportClientForRequest(0, nil)
|
|
|
|
assert.Same(t, engine.ExportClient(), client,
|
|
"without a per-target timeout the shared client "+
|
|
"must be returned unchanged",
|
|
)
|
|
}
|
|
|
|
// TestClientForRequest_HeadersKeepSSRFGuard asserts that the
|
|
// redirect policy an origin-scoped header installs is added to a
|
|
// client that still carries the SSRF-safe transport. The guard is
|
|
// a dial hook, so keeping it is what makes each redirect hop pass
|
|
// the private-IP check too.
|
|
func TestClientForRequest_HeadersKeepSSRFGuard(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
engine := newSSRFTestEngine()
|
|
|
|
client := engine.ExportClientForRequest(
|
|
0, []string{probeHeaderName},
|
|
)
|
|
|
|
require.NotNil(t, client.CheckRedirect,
|
|
"an origin-scoped header must install a redirect policy",
|
|
)
|
|
|
|
assert.Same(t,
|
|
engine.ExportClient().Transport, client.Transport,
|
|
"the SSRF-safe transport must be reused, not dropped",
|
|
)
|
|
|
|
assert.Equal(t,
|
|
engine.ExportClient().Timeout, client.Timeout,
|
|
"the shared client's timeout must be inherited",
|
|
)
|
|
}
|