unkin-agent
ab723147c9
Remote proxying drops the query string, so paginated JSON APIs (e.g. Galaxy `versions/?limit=&offset=`) cannot be served. Forwarding the raw query would let arbitrary params mint unbounded cache entries and bypass path-anchored blocklists. - add `provider.QueryForwarder`, mapping each forwarded param for a path to a validator that canonicalises or rejects its value - forward only validated params upstream and into the cache key, single-valued and in sorted order - classify on the bare path so blocklist/allowlist/mutability patterns ignore the query - evict a path together with its `path?...` query variants - leave providers without `QueryForwarder` unchanged Reviewed-on: #146 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
71 lines
2.4 KiB
Go
71 lines
2.4 KiB
Go
package proxy
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"git.unkin.net/unkin/artifactapi/internal/provider"
|
|
_ "git.unkin.net/unkin/artifactapi/internal/provider/generic"
|
|
"git.unkin.net/unkin/artifactapi/pkg/models"
|
|
)
|
|
|
|
func TestClassifierBranches(t *testing.T) {
|
|
gp, err := provider.Get(models.PackageGeneric)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
c := NewClassifier(gp)
|
|
|
|
if c.Classify(models.Remote{Blocklist: []string{`\.exe$`}}, "x.exe") != ClassDenied {
|
|
t.Error("blocklist match should be denied")
|
|
}
|
|
// Allowlist present but path doesn't match -> denied.
|
|
allow := models.Remote{Patterns: []string{`^allowed/`}}
|
|
if c.Classify(allow, "other/x") != ClassDenied {
|
|
t.Error("non-allowlisted path should be denied")
|
|
}
|
|
if c.Classify(allow, "allowed/x") != ClassImmutable {
|
|
t.Error("allowlisted generic path should be immutable")
|
|
}
|
|
if c.Classify(models.Remote{MutablePatterns: []string{`index$`}}, "a/index") != ClassMutable {
|
|
t.Error("mutable pattern override failed")
|
|
}
|
|
if c.Classify(models.Remote{ImmutablePatterns: []string{`\.bin$`}}, "a.bin") != ClassImmutable {
|
|
t.Error("immutable pattern failed")
|
|
}
|
|
// An invalid regex is skipped (not treated as a match) rather than denying.
|
|
if c.Classify(models.Remote{Blocklist: []string{`[invalid`}}, "anything") == ClassDenied {
|
|
t.Error("invalid blocklist regex should be skipped, not deny everything")
|
|
}
|
|
}
|
|
|
|
func TestClassifierIgnoresForwardedQuery(t *testing.T) {
|
|
gp, err := provider.Get(models.PackageGeneric)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
c := NewClassifier(gp)
|
|
if got := c.Classify(models.Remote{Blocklist: []string{`\.exe$`}}, "x.exe?limit=1"); got != ClassDenied {
|
|
t.Errorf("blocklist bypassed by query: %v", got)
|
|
}
|
|
allow := models.Remote{Patterns: []string{`/versions/$`}}
|
|
if got := c.Classify(allow, "a/versions/?limit=1&offset=100"); got != ClassImmutable {
|
|
t.Errorf("allowlisted paginated path = %v, want immutable", got)
|
|
}
|
|
if got := c.Classify(models.Remote{MutablePatterns: []string{`/versions/$`}}, "a/versions/?offset=100"); got != ClassMutable {
|
|
t.Errorf("mutable pattern on paginated path = %v, want mutable", got)
|
|
}
|
|
}
|
|
|
|
func TestClassificationString(t *testing.T) {
|
|
for c, want := range map[Classification]string{
|
|
ClassImmutable: "immutable",
|
|
ClassMutable: "mutable",
|
|
ClassDenied: "denied",
|
|
Classification(99): "unknown",
|
|
} {
|
|
if c.String() != want {
|
|
t.Errorf("Classification(%d).String() = %q, want %q", c, c.String(), want)
|
|
}
|
|
}
|
|
}
|