Migration This is my new public git source viewer. Source coming soon. Please contact with concerns/bugs. Contact me

internal/httpx/httpx_test.go

main · 2.7 KB · 98 lines raw

1 package httpx
2
3 import (
4 "net/http/httptest"
5 "strings"
6 "testing"
7 )
8
9 func TestSecure(t *testing.T) {
10 rec := httptest.NewRecorder()
11 Secure(rec, SecureOptions{ScriptSrc: "'self'", NoStore: true})
12 h := rec.Header()
13
14 if got := h.Get("X-Content-Type-Options"); got != "nosniff" {
15 t.Errorf("X-Content-Type-Options = %q", got)
16 }
17 if got := h.Get("X-Frame-Options"); got != "DENY" {
18 t.Errorf("X-Frame-Options = %q", got)
19 }
20 if got := h.Get("Cache-Control"); got != "no-store" {
21 t.Errorf("Cache-Control = %q", got)
22 }
23 if got := h.Get("Content-Security-Policy"); got == "" ||
24 !strings.Contains(got, "script-src 'self'") || !strings.Contains(got, "base-uri 'none'") {
25 t.Errorf("Content-Security-Policy = %q", got)
26 }
27 }
28
29 func TestSecureDefaultsToNoScript(t *testing.T) {
30 rec := httptest.NewRecorder()
31 Secure(rec, SecureOptions{})
32 if got := rec.Header().Get("Content-Security-Policy"); !strings.Contains(got, "script-src 'none'") {
33 t.Errorf("Content-Security-Policy = %q, want script-src 'none'", got)
34 }
35 if got := rec.Header().Get("Cache-Control"); got != "" {
36 t.Errorf("Cache-Control = %q, want unset", got)
37 }
38 }
39
40 func TestSameOrigin(t *testing.T) {
41 cases := []struct {
42 name string
43 fetch string
44 origin string
45 want bool
46 }{
47 {name: "no headers", want: true},
48 {name: "same origin", fetch: "same-origin", origin: "https://git.example", want: true},
49 {name: "cross site", fetch: "cross-site", want: false},
50 {name: "different origin", origin: "https://evil.example", want: false},
51 }
52
53 for _, tc := range cases {
54 t.Run(tc.name, func(t *testing.T) {
55 r := httptest.NewRequest("POST", "https://git.example/admin/notices", nil)
56 if tc.fetch != "" {
57 r.Header.Set("Sec-Fetch-Site", tc.fetch)
58 }
59 if tc.origin != "" {
60 r.Header.Set("Origin", tc.origin)
61 }
62 if got := SameOrigin(r); got != tc.want {
63 t.Fatalf("SameOrigin() = %v, want %v", got, tc.want)
64 }
65 })
66 }
67 }
68
69 func TestIsHTTPSAndAbsoluteURL(t *testing.T) {
70 r := httptest.NewRequest("GET", "http://git.example/share/new", nil)
71 r.Host = "git.example"
72 if IsHTTPS(r) {
73 t.Fatal("plain request reported HTTPS")
74 }
75 if got := AbsoluteURL(r, "/share/view/token"); got != "http://git.example/share/view/token" {
76 t.Fatalf("AbsoluteURL() = %q", got)
77 }
78
79 r.Header.Set("X-Forwarded-Proto", "https")
80 if !IsHTTPS(r) {
81 t.Fatal("proxied HTTPS request not recognized")
82 }
83 if got := AbsoluteURL(r, "/share/view/token"); got != "https://git.example/share/view/token" {
84 t.Fatalf("AbsoluteURL() = %q", got)
85 }
86 }
87
88 func TestRemoteIP(t *testing.T) {
89 r := httptest.NewRequest("GET", "/", nil)
90 r.RemoteAddr = "203.0.113.9:54321"
91 if got := RemoteIP(r); got != "203.0.113.9" {
92 t.Fatalf("RemoteIP() = %q", got)
93 }
94 r.RemoteAddr = "unix"
95 if got := RemoteIP(r); got != "unix" {
96 t.Fatalf("RemoteIP() = %q", got)
97 }
98 }