gsadmin/rustfs
1
0
Fork 0
mirror of https://github.com/rustfs/rustfs.git synced 2026-08-23 04:39:04 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(e2e): require tier SSRF guard evidence

Browse Source
This commit is contained in:
overtrue
2026-08-23 05:40:27 +08:00
parent fd6046faf2
commit d299b82b21
1 changed files with 8 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
crates/e2e_test/src/security_boundary_test.rs
+8 -9
View File
@@ -228,12 +228,8 @@ async fn test_concurrent_object_operations() -> Result<(), Box<dyn Error + Send
/// Internal/private endpoints must be rejected as remote tier backends (SSRF). /// Internal/private endpoints must be rejected as remote tier backends (SSRF).
/// ///
/// This issues a real admin AddTier call (`PUT /rustfs/admin/v3/tier`) for each /// This issues a real admin AddTier call (`PUT /rustfs/admin/v3/tier`) for each
/// internal/private endpoint and asserts the server rejects it (non-2xx, so the /// internal/private endpoint and asserts the request reaches the outbound URL
/// signed request helper returns an error). An internal endpoint must never be /// guard. Connectivity or credential failures do not prove SSRF protection.
/// accepted as a tier backend. The rejection may originate from explicit
/// SSRF/internal-address filtering or from the backend connectivity/credential
/// validation performed during AddTier; either way the security-relevant
/// outcome — the internal endpoint is not accepted — is asserted here.
/// ///
/// The admin API is exercised via signed `awscurl` requests, matching the /// The admin API is exercised via signed `awscurl` requests, matching the
/// pattern used by the other admin-API E2E tests in this crate; the test is /// pattern used by the other admin-API E2E tests in this crate; the test is
@@ -274,10 +270,13 @@ async fn test_tiering_url_validation() -> Result<(), Box<dyn Error + Send + Sync
}) })
.to_string(); .to_string();
let result = awscurl_put(&tier_url, &body, &env.access_key, &env.secret_key).await; let err = awscurl_put(&tier_url, &body, &env.access_key, &env.secret_key)
.await
.expect_err("AddTier must reject internal endpoints");
let rendered = err.to_string();
assert!( assert!(
result.is_err(), rendered.contains("TierAddFailed") && rendered.contains("tier endpoint is not allowed"),
"AddTier must reject internal endpoint {endpoint}, but it was accepted: {result:?}" "AddTier rejected {endpoint} outside the outbound URL guard: {rendered}"
); );
} }