sjs/agate
1
0
Fork 0
mirror of https://github.com/samsonjs/agate.git synced 2026-03-25 09:05:50 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Adds tests for secrets serving

Browse source
This commit is contained in:
Michael Nordmeyer 2023-07-05 12:03:05 +02:00 committed by Johann150
parent 5f9761d907
commit a13e8da9e7
No known key found for this signature in database
GPG key ID: 9EE6577A2A06F8F1
4 changed files with 19 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
tests/data/content/.meta
View file

@ -8,3 +8,5 @@ test.gmi: ;lang=en ;charset=us-ascii
gone.txt: 52 This file is no longer available.
# test setting data for files in other directories
example.com/index.gmi: ;lang=en-US
.servable-secret: text/plain
.well-known/servable-secret: text/plain

0
tests/data/content/.servable-secret Normal file
View file

0
tests/data/content/.well-known/servable-secret Normal file
View file

18
tests/tests.rs
View file

@ -451,7 +451,7 @@ fn port_check_skipped() {
#[test]
/// - status for paths with hidden segments is "gone" if file does not exist
fn secret_nonexistent() {
let page = get(&[], "gemini://localhost/.secret").expect("could not get page");
let page = get(&[], "gemini://localhost/.non-existing-secret").expect("could not get page");
assert_eq!(page.header.status, Status::Gone);
}
@ -472,6 +472,22 @@ fn serve_secret() {
assert_eq!(page.header.status, Status::Success);
}
#[test]
/// - secret file served if path is in sidecar
fn serve_secret_meta_config() {
let page = get(&[], "gemini://localhost/.servable-secret").expect("could not get page");
assert_eq!(page.header.status, Status::Success);
}
#[test]
/// - secret file served if path with subdir is in sidecar
fn serve_secret_meta_config_subdir() {
let page = get(&["-C"], "gemini://localhost/.well-known/servable-secret").expect("could not get page");
assert_eq!(page.header.status, Status::Success);
}
#[test]
/// - directory traversal attacks using percent-encoded path separators
/// fail (this addresses a previous vulnerability)