fen
d7b51f02b6
The deletion token was accepted via the ?token= query parameter on both
DELETE /api/pastes/{id} and /redeem, and round-tripped through the paste
URL after creation. URL-carried bearer secrets leak into reverse-proxy
access logs and browser history.
- API: deletion tokens are now accepted only via the Authorization header
(Bearer/Token/bare); query params are ignored on both endpoints
- Web create flow: token moves to the browser via a short-lived tok_<id>
HttpOnly cookie instead of the redirect URL; the paste view reads it
from the cookie, never from ?token=
- Web view: the delete button calls redeem() which takes the token from
sessionStorage and sends it as an Authorization header
- Tests: correct token in query must be rejected (403/400); header path
still deletes/redeems; extraction unit cases updated
Fixes #143
101 lines
2.7 KiB
Go
101 lines
2.7 KiB
Go
package api
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestBurnAfterRead(t *testing.T) {
|
|
s := testServer(t)
|
|
h := s.routes()
|
|
|
|
req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"vanish","burn_after_read":true}`))
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
if rec.Code != 201 {
|
|
t.Fatalf("create: %d", rec.Code)
|
|
}
|
|
var created struct{ ID string `json:"id"` }
|
|
json.Unmarshal(rec.Body.Bytes(), &created)
|
|
|
|
// first read ok
|
|
req = httptest.NewRequest("GET", "/api/pastes/"+created.ID, nil)
|
|
rec = httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
if rec.Code != 200 {
|
|
t.Fatalf("first read: %d", rec.Code)
|
|
}
|
|
|
|
// second read gone
|
|
req = httptest.NewRequest("GET", "/api/pastes/"+created.ID, nil)
|
|
rec = httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
if rec.Code != 404 {
|
|
t.Fatalf("second read expected 404, got %d", rec.Code)
|
|
}
|
|
}
|
|
|
|
func TestDeletionTokenRedeem(t *testing.T) {
|
|
s := testServer(t)
|
|
h := s.routes()
|
|
|
|
req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"x"}`))
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
var created struct {
|
|
ID string `json:"id"`
|
|
DeletionToken string `json:"deletion_token"`
|
|
}
|
|
json.Unmarshal(rec.Body.Bytes(), &created)
|
|
if created.DeletionToken == "" {
|
|
t.Fatal("no deletion token in create response")
|
|
}
|
|
|
|
// wrong token (#143: token goes in the Authorization header, not the URL)
|
|
req = httptest.NewRequest("DELETE", "/api/pastes/"+created.ID+"/redeem", nil)
|
|
req.Header.Set("Authorization", "Bearer wrong")
|
|
rec = httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
if rec.Code != 403 {
|
|
t.Fatalf("wrong token: %d", rec.Code)
|
|
}
|
|
|
|
// right token: hard delete
|
|
req = httptest.NewRequest("DELETE", "/api/pastes/"+created.ID+"/redeem", nil)
|
|
req.Header.Set("Authorization", "Bearer "+created.DeletionToken)
|
|
rec = httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
if rec.Code != 200 {
|
|
t.Fatalf("redeem: %d", rec.Code)
|
|
}
|
|
|
|
// gone for good: even soft-deleted lookup returns nothing, and row count is 0
|
|
var n int
|
|
n = s.store.QueryInt(`SELECT COUNT(*) FROM pastes WHERE id=?`, created.ID)
|
|
if n != 0 {
|
|
t.Fatal("row still exists after redeem")
|
|
}
|
|
}
|
|
|
|
func TestNonBurnPasteUnaffectedByRead(t *testing.T) {
|
|
s := testServer(t)
|
|
h := s.routes()
|
|
|
|
req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"normal"}`))
|
|
rec := httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
var created struct{ ID string `json:"id"` }
|
|
json.Unmarshal(rec.Body.Bytes(), &created)
|
|
|
|
for i := 0; i < 3; i++ {
|
|
req = httptest.NewRequest("GET", "/api/pastes/"+created.ID, nil)
|
|
rec = httptest.NewRecorder()
|
|
h.ServeHTTP(rec, req)
|
|
if rec.Code != 200 {
|
|
t.Fatalf("read %d: %d", i, rec.Code)
|
|
}
|
|
}
|
|
}
|