43 lines
1.2 KiB
Go
43 lines
1.2 KiB
Go
package api
|
|
|
|
import (
|
|
"encoding/json"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
// #34: the unlock cookie must be bound to the paste it unlocks, not a
|
|
// forgeable static value. A forged 'pw_<id>=1' cookie must not bypass the
|
|
// password check on the paste page.
|
|
func TestForgedUnlockCookieDoesNotBypassPassword(t *testing.T) {
|
|
globalLimiter = newLimiter()
|
|
s := testServer(t)
|
|
h := s.routes()
|
|
|
|
rec := httptest.NewRecorder()
|
|
req := httptest.NewRequest("POST", "/api/pastes", strings.NewReader(`{"content":"SECRETPASTECONTENT","password":"hunter2"}`))
|
|
h.ServeHTTP(rec, req)
|
|
if rec.Code != 201 {
|
|
t.Fatalf("create: got %d", rec.Code)
|
|
}
|
|
var created struct {
|
|
ID string `json:"id"`
|
|
}
|
|
json.Unmarshal(rec.Body.Bytes(), &created)
|
|
id := created.ID
|
|
|
|
// request the page with a forged unlock cookie in the old format
|
|
rec = httptest.NewRecorder()
|
|
req = httptest.NewRequest("GET", "/"+id, nil)
|
|
req.AddCookie(&http.Cookie{Name: "pw_" + id, Value: "1"})
|
|
h.ServeHTTP(rec, req)
|
|
if rec.Code == 200 && strings.Contains(rec.Body.String(), "SECRETPASTECONTENT") {
|
|
t.Fatal("forged pw_<id>=1 cookie bypassed password protection")
|
|
}
|
|
if rec.Code != 200 {
|
|
t.Logf("forged-cookie request returned %d (page still locked) — good", rec.Code)
|
|
}
|
|
}
|