41 lines
1.4 KiB
Go
41 lines
1.4 KiB
Go
package main
|
|
|
|
import (
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
)
|
|
|
|
func TestAllowedOriginWildcard(t *testing.T) {
|
|
t.Setenv("CANVAS_CORS_ORIGINS", "*")
|
|
context, _ := gin.CreateTestContext(httptest.NewRecorder())
|
|
context.Request = httptest.NewRequest("GET", "http://backend/api/health", nil)
|
|
if !allowedOrigin(context, "https://example.com") {
|
|
t.Fatal("wildcard CORS should allow a valid HTTPS origin")
|
|
}
|
|
if allowedOrigin(context, "ftp://example.com") {
|
|
t.Fatal("wildcard CORS should reject non-HTTP origins")
|
|
}
|
|
}
|
|
|
|
func TestAllowedOriginUsesForwardedHost(t *testing.T) {
|
|
t.Setenv("CANVAS_CORS_ORIGINS", "")
|
|
context, _ := gin.CreateTestContext(httptest.NewRecorder())
|
|
context.Request = httptest.NewRequest("GET", "http://backend/api/health", nil)
|
|
context.Request.Header.Set("X-Forwarded-Host", " canvas.example.com, proxy.internal")
|
|
if !allowedOrigin(context, "https://canvas.example.com") {
|
|
t.Fatal("forwarded public host should be treated as same-origin")
|
|
}
|
|
}
|
|
|
|
func TestRedactCanvasSharePath(t *testing.T) {
|
|
got := redactCanvasSharePath("/api/public/canvas-shares/private-token/resources/resource-1/file")
|
|
if got != "/api/public/canvas-shares/:token/resources/resource-1/file" {
|
|
t.Fatalf("unexpected redacted path: %s", got)
|
|
}
|
|
if got := redactCanvasSharePath("/api/tasks"); got != "/api/tasks" {
|
|
t.Fatalf("unrelated path changed: %s", got)
|
|
}
|
|
}
|