ITWorx Pulse release export
bd774932d5
Public source validation / validate (push) Failing after 3m8s
45 lines
1.5 KiB
Go
45 lines
1.5 KiB
Go
package backupapi
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/itworx/pulse/internal/backup"
|
|
)
|
|
|
|
func TestHandlerRejectsUnconfiguredBackupWithoutDisclosure(t *testing.T) {
|
|
handler := Handler{}
|
|
request := httptest.NewRequest(http.MethodPost, "/api/v1/system/backups", nil)
|
|
response := httptest.NewRecorder()
|
|
handler.ServeHTTP(response, request)
|
|
if response.Code != http.StatusServiceUnavailable || !strings.Contains(response.Body.String(), "BACKUP_UNAVAILABLE") {
|
|
t.Fatalf("response = %d %s", response.Code, response.Body.String())
|
|
}
|
|
if strings.Contains(response.Body.String(), "PULSE_") || strings.Contains(response.Body.String(), "password") {
|
|
t.Fatal("configuration detail leaked")
|
|
}
|
|
}
|
|
|
|
func TestHandlerRejectsUnsupportedMethod(t *testing.T) {
|
|
handler := Handler{Manager: &backup.Manager{}}
|
|
request := httptest.NewRequest(http.MethodDelete, "/api/v1/system/backups", nil)
|
|
response := httptest.NewRecorder()
|
|
handler.ServeHTTP(response, request)
|
|
if response.Code != http.StatusMethodNotAllowed {
|
|
t.Fatalf("response = %d, want method not allowed", response.Code)
|
|
}
|
|
}
|
|
|
|
func TestPublicResultOmitsServerPath(t *testing.T) {
|
|
payload, err := json.Marshal(toPublic(backup.Result{BackupID: "id", Path: "C:/private/backups/pulse.zip", SHA256: "checksum"}))
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if strings.Contains(string(payload), "private/backups") || strings.Contains(string(payload), "path") {
|
|
t.Fatalf("server path leaked: %s", payload)
|
|
}
|
|
}
|