test: harden version endpoint boundaries

sdk/go/client_test.go

@@ -76,3 +76,36 @@ func TestRejectsUnsafeURLsRedirectsAndOversizedResponses(t *testing.T) {
 		})
 	}
 }
+
+func TestVersionRejectsHTTPErrorAndOversizedResponse(t *testing.T) {
+	for _, scenario := range []string{"status", "oversize"} {
+		t.Run(scenario, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+				if r.URL.Path != "/version" {
+					t.Fatalf("unexpected path %s", r.URL.Path)
+				}
+				if scenario == "status" {
+					w.WriteHeader(http.StatusServiceUnavailable)
+					_, _ = w.Write([]byte(`{"secret":"must not appear"}`))
+					return
+				}
+				_, _ = w.Write([]byte(strings.Repeat("x", 17000)))
+			}))
+			defer server.Close()
+			client, err := orbit.NewClient(server.URL, orbit.Options{})
+			if err != nil {
+				t.Fatal(err)
+			}
+			_, err = client.Version(context.Background())
+			if err == nil || strings.Contains(err.Error(), "secret") {
+				t.Fatalf("unsafe version error: %v", err)
+			}
+			if scenario == "status" {
+				var status *orbit.HTTPError
+				if !errors.As(err, &status) || status.StatusCode != http.StatusServiceUnavailable {
+					t.Fatalf("status error=%v", err)
+				}
+			}
+		})
+	}
+}