mirror of
https://github.com/yusing/godoxy.git
synced 2026-04-13 20:19:41 +02:00
e0cba8f415
Validate GODOXY_LOCAL_API_ADDR before starting the unauthenticated local API. Loopback listeners still succeed by default; addresses that bind all interfaces, unspecified IPs, LAN hosts, or non-loopback names need GODOXY_LOCAL_API_ALLOW_NON_LOOPBACK=true. When that opt-in is set and the host is not loopback, log a warning so non-local exposure is obvious. Wire common.LocalAPIAllowNonLoopback from LOCAL_API_ALLOW_NON_LOOPBACK and document it (with a risk note) in .env.example. Add TestValidateLocalAPIAddr for loopback, wildcard, LAN, and hostname cases with the allow flag on and off.
78 lines
1.5 KiB
Go
78 lines
1.5 KiB
Go
package config
|
|
|
|
import "testing"
|
|
|
|
func TestValidateLocalAPIAddr(t *testing.T) {
|
|
tests := []struct {
|
|
name string
|
|
addr string
|
|
allowNonLoopback bool
|
|
wantErr bool
|
|
}{
|
|
{
|
|
name: "localhost",
|
|
addr: "localhost:8888",
|
|
},
|
|
{
|
|
name: "ipv4_loopback",
|
|
addr: "127.0.0.1:8888",
|
|
},
|
|
{
|
|
name: "ipv6_loopback",
|
|
addr: "[::1]:8888",
|
|
},
|
|
{
|
|
name: "all_interfaces",
|
|
addr: ":8888",
|
|
wantErr: true,
|
|
},
|
|
{
|
|
name: "all_interfaces_allowed",
|
|
addr: ":8888",
|
|
allowNonLoopback: true,
|
|
},
|
|
{
|
|
name: "ipv4_unspecified",
|
|
addr: "0.0.0.0:8888",
|
|
wantErr: true,
|
|
},
|
|
{
|
|
name: "ipv4_unspecified_allowed",
|
|
addr: "0.0.0.0:8888",
|
|
allowNonLoopback: true,
|
|
},
|
|
{
|
|
name: "lan_ip",
|
|
addr: "192.168.1.10:8888",
|
|
wantErr: true,
|
|
},
|
|
{
|
|
name: "lan_ip_allowed",
|
|
addr: "192.168.1.10:8888",
|
|
allowNonLoopback: true,
|
|
},
|
|
{
|
|
name: "hostname_not_loopback",
|
|
addr: "godoxy.internal:8888",
|
|
wantErr: true,
|
|
},
|
|
{
|
|
name: "hostname_not_loopback_allowed",
|
|
addr: "godoxy.internal:8888",
|
|
allowNonLoopback: true,
|
|
},
|
|
}
|
|
|
|
for _, tt := range tests {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
err := validateLocalAPIAddr(tt.addr, tt.allowNonLoopback)
|
|
if tt.wantErr && err == nil {
|
|
t.Fatalf("expected error for %q", tt.addr)
|
|
}
|
|
if !tt.wantErr && err != nil {
|
|
t.Fatalf("unexpected error for %q: %v", tt.addr, err)
|
|
}
|
|
})
|
|
}
|
|
}
|