mirror of
https://github.com/MHSanaei/3x-ui.git
synced 2026-06-06 05:04:22 +00:00
5ffd896a7c
Adds SanitizeHTTPURL / SanitizePublicHTTPURL to reject private-range and loopback targets before any outbound HTTP request (node probe, xray download, outbound test, external traffic inform, tgbot API server, panel updater). Forwarded headers (X-Real-IP, X-Forwarded-For, X-Forwarded-Host) are now only trusted when the direct connection arrives from a CIDR in TrustedProxyCIDRs. CSP policy is tightened with a per-request nonce. HTTP server gains read/write/idle timeouts. Panel updater downloads the script to a temp file instead of piping curl into shell. Xray archive download adds a size cap and response-code check. backuptotgbot is changed from GET to POST.
92 lines
2.5 KiB
Go
92 lines
2.5 KiB
Go
package service
|
|
|
|
import (
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/mhsanaei/3x-ui/v3/database"
|
|
)
|
|
|
|
func setupSettingTestDB(t *testing.T) {
|
|
t.Helper()
|
|
if err := database.InitDB(filepath.Join(t.TempDir(), "x-ui.db")); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
t.Cleanup(func() {
|
|
if err := database.CloseDB(); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
})
|
|
}
|
|
|
|
func TestGetAllSettingViewRedactsSecrets(t *testing.T) {
|
|
setupSettingTestDB(t)
|
|
s := &SettingService{}
|
|
if err := s.saveSetting("tgBotToken", "telegram-secret"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := s.saveSetting("twoFactorToken", "totp-secret"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := s.saveSetting("ldapPassword", "ldap-secret"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := s.saveSetting("apiToken", "api-secret"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
view, err := s.GetAllSettingView()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if view.TgBotToken != "" || view.TwoFactorToken != "" || view.LdapPassword != "" {
|
|
t.Fatalf("settings view leaked secrets: %#v", view)
|
|
}
|
|
if !view.HasTgBotToken || !view.HasTwoFactorToken || !view.HasLdapPassword || !view.HasApiToken {
|
|
t.Fatalf("settings view did not report configured secret flags: %#v", view)
|
|
}
|
|
}
|
|
|
|
func TestUpdateAllSettingPreservesRedactedSecrets(t *testing.T) {
|
|
setupSettingTestDB(t)
|
|
s := &SettingService{}
|
|
if err := s.saveSetting("tgBotToken", "telegram-secret"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := s.saveSetting("ldapPassword", "ldap-secret"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := s.saveSetting("twoFactorEnable", "true"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if err := s.saveSetting("twoFactorToken", "totp-secret"); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
view, err := s.GetAllSettingView()
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
settings := &view.AllSetting
|
|
if err := s.UpdateAllSetting(settings); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if got, _ := s.GetTgBotToken(); got != "telegram-secret" {
|
|
t.Fatalf("tg token = %q, want preserved secret", got)
|
|
}
|
|
if got, _ := s.GetLdapPassword(); got != "ldap-secret" {
|
|
t.Fatalf("ldap password = %q, want preserved secret", got)
|
|
}
|
|
if got, _ := s.GetTwoFactorToken(); got != "totp-secret" {
|
|
t.Fatalf("2fa token = %q, want preserved secret", got)
|
|
}
|
|
}
|
|
|
|
func TestSanitizePublicHTTPURLBlocksPrivateAddressUnlessAllowed(t *testing.T) {
|
|
if _, err := SanitizePublicHTTPURL("http://127.0.0.1:8080/hook", false); err == nil {
|
|
t.Fatal("expected localhost URL to be blocked")
|
|
}
|
|
if got, err := SanitizePublicHTTPURL("http://127.0.0.1:8080/hook", true); err != nil || got != "http://127.0.0.1:8080/hook" {
|
|
t.Fatalf("allowPrivate result = %q, %v", got, err)
|
|
}
|
|
}
|