7690f07a2b
Comprehensive security hardening from audit findings: - Add validation tags to all DTO request structs (max lengths, ranges, enums) - Replace unsafe type assertions with MustGetAuthUser helper across all handlers - Remove query-param token auth from admin middleware (prevents URL token leakage) - Add request validation calls in handlers that were missing c.Validate() - Remove goroutines in handlers (timezone update now synchronous) - Add sanitize middleware and path traversal protection (path_utils) - Stop resetting admin passwords on migration restart - Warn on well-known default SECRET_KEY - Add ~30 new test files covering security regressions, auth safety, repos, and services - Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
60 lines
1.8 KiB
Go
60 lines
1.8 KiB
Go
package middleware
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestSanitizeSortColumn_AllowedColumn_Passes(t *testing.T) {
|
|
allowed := []string{"created_at", "updated_at", "name"}
|
|
result := SanitizeSortColumn("created_at", allowed, "created_at")
|
|
assert.Equal(t, "created_at", result)
|
|
}
|
|
|
|
func TestSanitizeSortColumn_CaseInsensitive(t *testing.T) {
|
|
allowed := []string{"created_at", "updated_at", "name"}
|
|
result := SanitizeSortColumn("Created_At", allowed, "created_at")
|
|
assert.Equal(t, "created_at", result)
|
|
}
|
|
|
|
func TestSanitizeSortColumn_SQLInjection_ReturnsDefault(t *testing.T) {
|
|
allowed := []string{"created_at", "updated_at", "name"}
|
|
|
|
tests := []struct {
|
|
name string
|
|
input string
|
|
}{
|
|
{"drop table", "created_at; DROP TABLE auth_user; --"},
|
|
{"union select", "name UNION SELECT * FROM auth_user"},
|
|
{"or 1=1", "name OR 1=1"},
|
|
{"semicolon", "created_at;"},
|
|
{"subquery", "(SELECT password FROM auth_user LIMIT 1)"},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
result := SanitizeSortColumn(tt.input, allowed, "created_at")
|
|
assert.Equal(t, "created_at", result, "SQL injection attempt should return default")
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestSanitizeSortColumn_Empty_ReturnsDefault(t *testing.T) {
|
|
allowed := []string{"created_at", "updated_at", "name"}
|
|
result := SanitizeSortColumn("", allowed, "created_at")
|
|
assert.Equal(t, "created_at", result)
|
|
}
|
|
|
|
func TestSanitizeSortColumn_Whitespace_ReturnsDefault(t *testing.T) {
|
|
allowed := []string{"created_at", "updated_at", "name"}
|
|
result := SanitizeSortColumn(" ", allowed, "created_at")
|
|
assert.Equal(t, "created_at", result)
|
|
}
|
|
|
|
func TestSanitizeSortColumn_UnknownColumn_ReturnsDefault(t *testing.T) {
|
|
allowed := []string{"created_at", "updated_at", "name"}
|
|
result := SanitizeSortColumn("nonexistent_column", allowed, "created_at")
|
|
assert.Equal(t, "created_at", result)
|
|
}
|