mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-08-09 18:32:52 +00:00
Anso
ed553f1f19
Updates the backend listen port, Vite dev proxy target, Docker EXPOSE, compose port mapping, .env.example default, GitHub Actions smoke-test default, healthcheck URLs, and every doc/example reference. Test fixtures that include example URLs were updated for consistency, though their assertions are port-agnostic. The rate-limit value of 3000 in middleware/rateLimiters.ts and the 3000 entry in WEB_UI_PORTS (which detects user containers like Grafana) are intentionally untouched.
97 lines
3.0 KiB
TypeScript
97 lines
3.0 KiB
TypeScript
/**
|
|
* Tests for node management API - focusing on api_url validation (SSRF fix C2).
|
|
*/
|
|
import { describe, it, expect, beforeAll, afterAll } from 'vitest';
|
|
import request from 'supertest';
|
|
import jwt from 'jsonwebtoken';
|
|
import { setupTestDb, cleanupTestDb, TEST_USERNAME, TEST_JWT_SECRET } from './helpers/setupTestDb';
|
|
|
|
let tmpDir: string;
|
|
let app: import('express').Express;
|
|
let authHeader: string;
|
|
|
|
beforeAll(async () => {
|
|
tmpDir = await setupTestDb();
|
|
({ app } = await import('../index'));
|
|
const token = jwt.sign({ username: TEST_USERNAME }, TEST_JWT_SECRET, { expiresIn: '1m' });
|
|
authHeader = `Bearer ${token}`;
|
|
});
|
|
|
|
afterAll(() => {
|
|
cleanupTestDb(tmpDir);
|
|
});
|
|
|
|
describe('POST /api/nodes - api_url SSRF validation (C2 fix)', () => {
|
|
it('rejects localhost api_url', async () => {
|
|
const res = await request(app)
|
|
.post('/api/nodes')
|
|
.set('Authorization', authHeader)
|
|
.send({ name: 'bad-node', type: 'remote', api_url: 'http://localhost:6379' });
|
|
expect(res.status).toBe(400);
|
|
expect(res.body.error).toMatch(/loopback/i);
|
|
});
|
|
|
|
it('rejects 127.0.0.1 api_url', async () => {
|
|
const res = await request(app)
|
|
.post('/api/nodes')
|
|
.set('Authorization', authHeader)
|
|
.send({ name: 'bad-node-2', type: 'remote', api_url: 'http://127.0.0.1:5432' });
|
|
expect(res.status).toBe(400);
|
|
});
|
|
|
|
it('rejects non-http scheme', async () => {
|
|
const res = await request(app)
|
|
.post('/api/nodes')
|
|
.set('Authorization', authHeader)
|
|
.send({ name: 'bad-node-3', type: 'remote', api_url: 'ftp://example.com' });
|
|
expect(res.status).toBe(400);
|
|
expect(res.body.error).toMatch(/http/i);
|
|
});
|
|
|
|
it('rejects malformed URL', async () => {
|
|
const res = await request(app)
|
|
.post('/api/nodes')
|
|
.set('Authorization', authHeader)
|
|
.send({ name: 'bad-node-4', type: 'remote', api_url: 'not-a-url' });
|
|
expect(res.status).toBe(400);
|
|
});
|
|
|
|
it('accepts valid LAN IP', async () => {
|
|
const res = await request(app)
|
|
.post('/api/nodes')
|
|
.set('Authorization', authHeader)
|
|
.send({
|
|
name: 'lan-node',
|
|
type: 'remote',
|
|
api_url: 'http://192.168.1.50:1852',
|
|
api_token: 'sometoken',
|
|
});
|
|
// Should succeed (201 or 200) - not a validation error
|
|
expect(res.status).not.toBe(400);
|
|
});
|
|
|
|
it('requires api_url for remote nodes', async () => {
|
|
const res = await request(app)
|
|
.post('/api/nodes')
|
|
.set('Authorization', authHeader)
|
|
.send({ name: 'missing-url', type: 'remote' });
|
|
expect(res.status).toBe(400);
|
|
});
|
|
});
|
|
|
|
describe('Stack name validation on GET routes (H3 fix)', () => {
|
|
it('rejects path traversal in GET /api/stacks/:stackName', async () => {
|
|
const res = await request(app)
|
|
.get('/api/stacks/..%2F..%2Fetc%2Fpasswd')
|
|
.set('Authorization', authHeader);
|
|
expect(res.status).toBe(400);
|
|
});
|
|
|
|
it('rejects dots in stack name', async () => {
|
|
const res = await request(app)
|
|
.get('/api/stacks/.hidden')
|
|
.set('Authorization', authHeader);
|
|
expect(res.status).toBe(400);
|
|
});
|
|
});
|