133728e barerepo 1mo
1
package webhook
133728e barerepo 1mo
3
import (
133728e barerepo 1mo
4
"context"
133728e barerepo 1mo
5
"strings"
133728e barerepo 1mo
6
"testing"
133728e barerepo 1mo
9
// Chapter 23.3 names the ranges a webhook may never reach. Each is here.
133728e barerepo 1mo
10
func TestDeniedAddresses(t *testing.T) {
133728e barerepo 1mo
11
for _, addr := range []string{
133728e barerepo 1mo
12
"127.0.0.1:443", "127.9.9.9:443", "10.1.2.3:443", "172.16.0.1:443",
133728e barerepo 1mo
13
"172.31.255.255:443", "192.168.1.1:443", "169.254.169.254:443",
133728e barerepo 1mo
14
"100.64.0.1:443", "[::1]:443", "[fc00::1]:443", "[fe80::1]:443",
133728e barerepo 1mo
15
"0.0.0.0:443", "[::]:443", "224.0.0.1:443",
133728e barerepo 1mo
16
} {
133728e barerepo 1mo
17
if err := AllowedAddr(addr); err == nil {
133728e barerepo 1mo
18
t.Errorf("%s was allowed", addr)
133728e barerepo 1mo
21
for _, addr := range []string{
133728e barerepo 1mo
22
"93.184.216.34:443", "8.8.8.8:443", "172.32.0.1:443", "[2606:2800::1]:443",
133728e barerepo 1mo
23
} {
133728e barerepo 1mo
24
if err := AllowedAddr(addr); err != nil {
133728e barerepo 1mo
25
t.Errorf("%s was refused: %v", addr, err)
133728e barerepo 1mo
30
// The check is on the resolved address, and localhost is a plain name that answers loopback.
133728e barerepo 1mo
31
func TestResolvedNotSpelled(t *testing.T) {
133728e barerepo 1mo
32
ctx := context.Background()
133728e barerepo 1mo
33
if err := Allowed(ctx, "https://localhost/hook"); err == nil {
133728e barerepo 1mo
34
t.Error("localhost was allowed")
133728e barerepo 1mo
36
if err := Allowed(ctx, "https://127.0.0.1/hook"); err == nil {
133728e barerepo 1mo
37
t.Error("a loopback literal was allowed")
133728e barerepo 1mo
41
func TestSchemeAndShape(t *testing.T) {
133728e barerepo 1mo
42
ctx := context.Background()
133728e barerepo 1mo
43
for _, u := range []string{
133728e barerepo 1mo
44
"http://example.com/hook", // plain http would send the signature in clear
133728e barerepo 1mo
45
"file:///etc/passwd",
133728e barerepo 1mo
46
"gopher://example.com/",
133728e barerepo 1mo
47
"https://",
133728e barerepo 1mo
48
"not a url at all",
133728e barerepo 1mo
49
"ftp://example.com/",
133728e barerepo 1mo
50
} {
133728e barerepo 1mo
51
if err := Allowed(ctx, u); err == nil {
133728e barerepo 1mo
52
t.Errorf("%q was allowed", u)
133728e barerepo 1mo
57
// The config names the secret and never holds it, so the server's value must reproduce it.
133728e barerepo 1mo
58
func TestSign(t *testing.T) {
133728e barerepo 1mo
59
got := Sign("s3cret", []byte(`{"a":1}`))
133728e barerepo 1mo
60
if !strings.HasPrefix(got, "sha256=") || len(got) != 71 {
133728e barerepo 1mo
61
t.Errorf("signature looks wrong: %s", got)
133728e barerepo 1mo
63
if Sign("s3cret", []byte(`{"a":1}`)) != got {
133728e barerepo 1mo
64
t.Error("signing is not deterministic")
133728e barerepo 1mo
66
if Sign("other", []byte(`{"a":1}`)) == got {
133728e barerepo 1mo
67
t.Error("a different secret produced the same signature")
133728e barerepo 1mo
69
if Sign("s3cret", []byte(`{"a":2}`)) == got {
133728e barerepo 1mo
70
t.Error("a different body produced the same signature")
133728e barerepo 1mo
74
func TestDeniedRangesAreListed(t *testing.T) {
133728e barerepo 1mo
75
got := strings.Join(DeniedRanges(), " ")
133728e barerepo 1mo
76
for _, want := range []string{"127.0.0.0/8", "169.254.0.0/16", "fc00::/7", "100.64.0.0/10"} {
133728e barerepo 1mo
77
if !strings.Contains(got, want) {
133728e barerepo 1mo
78
t.Errorf("%s is not in the list shown to operators", want)