k2safe/orbit
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

test: harden version endpoint boundaries

Browse Source
This commit is contained in:
k2safe
2026-09-20 18:50:27 +08:00
parent 6d4b010460
commit 6d194122af
2 changed files with 34 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
internal/transport/httpserver/server_test.go
View File

@@ -26,7 +26,7 @@ func TestVersionIsPublicAndBounded(t *testing.T) {
server := New("127.0.0.1:0", nil) server := New("127.0.0.1:0", nil)
rr := httptest.NewRecorder() rr := httptest.NewRecorder()
server.Handler.ServeHTTP(rr, httptest.NewRequest(http.MethodGet, "/version", nil)) server.Handler.ServeHTTP(rr, httptest.NewRequest(http.MethodGet, "/version", nil))
if rr.Code != http.StatusOK || !strings.Contains(rr.Body.String(), `"http_protocol_version":"1"`) || strings.Contains(rr.Body.String(), "ORBIT_MYSQL_DSN") { if rr.Code != http.StatusOK || rr.Header().Get("Cache-Control") != "no-store" || rr.Header().Get("X-Content-Type-Options") != "nosniff" || rr.Header().Get("Content-Type") != "application/json" || !strings.Contains(rr.Body.String(), `"http_protocol_version":"1"`) || strings.Contains(rr.Body.String(), "ORBIT_MYSQL_DSN") {
t.Fatalf("unexpected version response: %d %s", rr.Code, rr.Body.String()) t.Fatalf("unexpected version response: %d %s", rr.Code, rr.Body.String())
} }
} }

33
sdk/go/client_test.go
View File

@@ -76,3 +76,36 @@ func TestRejectsUnsafeURLsRedirectsAndOversizedResponses(t *testing.T) {
}) })
} }
} }
func TestVersionRejectsHTTPErrorAndOversizedResponse(t *testing.T) {
for _, scenario := range []string{"status", "oversize"} {
t.Run(scenario, func(t *testing.T) {
server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
if r.URL.Path != "/version" {
t.Fatalf("unexpected path %s", r.URL.Path)
}
if scenario == "status" {
w.WriteHeader(http.StatusServiceUnavailable)
_, _ = w.Write([]byte(`{"secret":"must not appear"}`))
return
}
_, _ = w.Write([]byte(strings.Repeat("x", 17000)))
}))
defer server.Close()
client, err := orbit.NewClient(server.URL, orbit.Options{})
if err != nil {
t.Fatal(err)
}
_, err = client.Version(context.Background())
if err == nil || strings.Contains(err.Error(), "secret") {
t.Fatalf("unsafe version error: %v", err)
}
if scenario == "status" {
var status *orbit.HTTPError
if !errors.As(err, &status) || status.StatusCode != http.StatusServiceUnavailable {
t.Fatalf("status error=%v", err)
}
}
})
}
}