7690f07a2b
Comprehensive security hardening from audit findings: - Add validation tags to all DTO request structs (max lengths, ranges, enums) - Replace unsafe type assertions with MustGetAuthUser helper across all handlers - Remove query-param token auth from admin middleware (prevents URL token leakage) - Add request validation calls in handlers that were missing c.Validate() - Remove goroutines in handlers (timezone update now synchronous) - Add sanitize middleware and path traversal protection (path_utils) - Stop resetting admin passwords on migration restart - Warn on well-known default SECRET_KEY - Add ~30 new test files covering security regressions, auth safety, repos, and services - Add deploy/ config, audit digests, and AUDIT_FINDINGS documentation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
56 lines
1.6 KiB
Go
56 lines
1.6 KiB
Go
package services
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/assert"
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestSafeResolvePath_Normal_Resolves(t *testing.T) {
|
|
result, err := SafeResolvePath("/var/uploads", "images/photo.jpg")
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "/var/uploads/images/photo.jpg", result)
|
|
}
|
|
|
|
func TestSafeResolvePath_SubdirPath_Resolves(t *testing.T) {
|
|
result, err := SafeResolvePath("/var/uploads", "documents/2024/report.pdf")
|
|
require.NoError(t, err)
|
|
assert.Equal(t, "/var/uploads/documents/2024/report.pdf", result)
|
|
}
|
|
|
|
func TestSafeResolvePath_DotDotTraversal_Blocked(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
input string
|
|
}{
|
|
{"simple dotdot", "../etc/passwd"},
|
|
{"nested dotdot", "../../etc/shadow"},
|
|
{"embedded dotdot", "images/../../etc/passwd"},
|
|
{"deep dotdot", "a/b/c/../../../../etc/passwd"},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
_, err := SafeResolvePath("/var/uploads", tt.input)
|
|
assert.Error(t, err, "path traversal should be blocked: %s", tt.input)
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestSafeResolvePath_AbsolutePath_Blocked(t *testing.T) {
|
|
_, err := SafeResolvePath("/var/uploads", "/etc/passwd")
|
|
assert.Error(t, err, "absolute paths should be blocked")
|
|
}
|
|
|
|
func TestSafeResolvePath_EmptyPath_Blocked(t *testing.T) {
|
|
_, err := SafeResolvePath("/var/uploads", "")
|
|
assert.Error(t, err, "empty paths should be blocked")
|
|
}
|
|
|
|
func TestSafeResolvePath_CurrentDir_Blocked(t *testing.T) {
|
|
// "." resolves to the base dir itself — this is not a file, so block it
|
|
_, err := SafeResolvePath("/var/uploads", ".")
|
|
assert.Error(t, err, "bare current directory should be blocked")
|
|
}
|