tao.chenandClaude
2c39091706
Phase 3 (httpclient): - shared Client (Timeout + MaxResponseBytes 截断) - SSRF: 16 段私网 CIDR (含 169.254/::ffff:0:0/96 IPv4-mapped) + hostname allowlist (精确/后缀/*. 通配) + scheme 校验 (仅 http/https) - auth 适配器: none / simple (YARN user.name) / basic (SetBasicAuth) - DoWithRedirect: 跨主机跳转保留 Authorization, max 5 默认 - 19 个测试全绿 (httptest 模拟) Phase 4 (admin + audit): - internal/audit: Entry + Repo.Insert/List + MarshalDetails, snake_case JSON - internal/middleware: AdminAuth/AgentAuth (constant-time 比对) - internal/admin: 6 端点 (GET/POST/PUT/DELETE /admin/clusters, GET /admin/audit) + 写操作触发 audit_log (含 before/after diff) + AuthPassword 空=保留旧密码 + 校验: 必填字段 + auth_type 枚举 + rate_limit>=0 - main.go: 挂载 storage.Open + admin.Mount - L fix: audit.Entry 加 json tag (smoke test 发现大写 key 不规范) Co-Authored-By: Claude <noreply@anthropic.com>
80 lines
1.8 KiB
Go
80 lines
1.8 KiB
Go
package httpclient
|
|
|
|
import (
|
|
"net"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
)
|
|
|
|
func TestCheckURL_RejectsLoopback(t *testing.T) {
|
|
err := CheckURL("http://127.0.0.1:8080/path")
|
|
if err == nil {
|
|
t.Fatal("expected error for loopback URL")
|
|
}
|
|
}
|
|
|
|
func TestCheckURL_RejectsLinkLocal(t *testing.T) {
|
|
err := CheckURL("http://169.254.169.254/latest/meta-data")
|
|
if err == nil {
|
|
t.Fatal("expected error for link-local URL")
|
|
}
|
|
}
|
|
|
|
func TestCheckURL_AllowsAllowlisted(t *testing.T) {
|
|
err := CheckURL("http://127.0.0.1:8080", "127.0.0.1")
|
|
if err != nil {
|
|
t.Fatalf("expected allowlisted host to pass: %v", err)
|
|
}
|
|
if !matchAllowedHost("rm.example.com", "*.example.com") {
|
|
t.Fatal("expected *.example.com to match rm.example.com")
|
|
}
|
|
}
|
|
|
|
func TestCheckURL_RejectsBadScheme(t *testing.T) {
|
|
cases := []string{"file:///etc/passwd", "gopher://x", "ftp://x"}
|
|
for _, raw := range cases {
|
|
err := CheckURL(raw)
|
|
if err == nil {
|
|
t.Errorf("expected error for %q", raw)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestCheckURL_RejectsEmptyHost(t *testing.T) {
|
|
err := CheckURL("http:///path")
|
|
if err == nil {
|
|
t.Fatal("expected error for URL with empty host")
|
|
}
|
|
}
|
|
|
|
func TestCheckURL_AcceptsPublic(t *testing.T) {
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(http.StatusOK)
|
|
}))
|
|
defer srv.Close()
|
|
|
|
err := CheckURL(srv.URL, "127.0.0.1")
|
|
if err != nil {
|
|
t.Fatalf("expected allowlisted server URL to pass: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestIsPrivateIP(t *testing.T) {
|
|
cases := []struct {
|
|
ip string
|
|
want bool
|
|
}{
|
|
{"10.1.2.3", true},
|
|
{"8.8.8.8", false},
|
|
{"::1", true},
|
|
{"2001:db8::1", false},
|
|
}
|
|
for _, tc := range cases {
|
|
got := isPrivateIP(net.ParseIP(tc.ip))
|
|
if got != tc.want {
|
|
t.Errorf("isPrivateIP(%q) = %v, want %v", tc.ip, got, tc.want)
|
|
}
|
|
}
|
|
}
|