pentest: bind unlock cookie to HMAC per-paste token; serve only safe content types on /raw and can items with nosniff (#34)

pentest_helpers_test.go

@@ -0,0 +1,16 @@
+package main
+
+import (
+	"encoding/json"
+	"testing"
+)
+
+// test helpers for pentest tests (#34)
+func jsonField(tb testing.TB, body, field string) string {
+	var m map[string]any
+	if err := json.Unmarshal([]byte(body), &m); err != nil {
+		tb.Fatalf("bad json: %v", err)
+	}
+	v, _ := m[field].(string)
+	return v
+}