unkin-agent
bf8228e9f2
NuGet index rewrites embed the client Host and X-Forwarded-Proto into per-request JSON, so a shared cache could store one host's URLs, a forged header could inject content, HEAD skipped the rewrite, and immutable flat-container blobs were re-validated as mutable. - set `no-store`, `Vary: Host, X-Forwarded-Proto` and the rewritten Content-Length on GET and HEAD - share `v1.Scheme()` (first X-Forwarded-Proto value, `http`/`https` only) across nuget, cargo, virtual redirects and the terraform registry - reject non host[:port] Host headers and JSON-escape the injected base URL - classify `.snupkg`, `readme` and `icon` flat-container blobs as immutable requires unkin/artifactapi#148 merged first Reviewed-on: #149 Co-authored-by: unkin-agent <unkin-agent@unkin.net> Co-committed-by: unkin-agent <unkin-agent@unkin.net>
35 lines
948 B
Go
35 lines
948 B
Go
package v1
|
|
|
|
import (
|
|
"crypto/tls"
|
|
"net/http"
|
|
"testing"
|
|
)
|
|
|
|
func TestScheme(t *testing.T) {
|
|
if got := Scheme(&http.Request{TLS: &tls.ConnectionState{}}); got != "https" {
|
|
t.Errorf("TLS request scheme = %q, want https", got)
|
|
}
|
|
r := &http.Request{Header: http.Header{"X-Forwarded-Proto": {"https"}}}
|
|
if got := Scheme(r); got != "https" {
|
|
t.Errorf("X-Forwarded-Proto scheme = %q, want https", got)
|
|
}
|
|
for fwd, want := range map[string]string{
|
|
"https, http": "https",
|
|
"http, https": "http",
|
|
"HTTPS": "https",
|
|
" https ": "https",
|
|
"javascript": "http",
|
|
"ftp": "http",
|
|
"https;evil": "http",
|
|
} {
|
|
r := &http.Request{Header: http.Header{"X-Forwarded-Proto": {fwd}}}
|
|
if got := Scheme(r); got != want {
|
|
t.Errorf("X-Forwarded-Proto %q scheme = %q, want %s", fwd, got, want)
|
|
}
|
|
}
|
|
if got := Scheme(&http.Request{Header: http.Header{}}); got != "http" {
|
|
t.Errorf("default scheme = %q, want http", got)
|
|
}
|
|
}
|