Federated via graft
1.2 kB
39 lines
1package activitypub
2
3import "testing"
4
5func TestValidateExternalURLRejectsUnsafeTargets(t *testing.T) {
6 cases := []struct {
7 name string
8 url string
9 }{
10 {"plain http", "http://example.social/users/alice"},
11 {"loopback IP", "https://127.0.0.1/actors/x"},
12 {"IPv6 loopback", "https://[::1]/actors/x"},
13 {"localhost", "https://localhost/actors/x"},
14 {"private range 10.x", "https://10.0.0.5/actors/x"},
15 {"private range 192.168.x", "https://192.168.1.1/actors/x"},
16 {"cloud metadata address", "https://169.254.169.254/latest/meta-data/"},
17 {"no host", "https:///actors/x"},
18 {"not a URL", "not a url at all"},
19 }
20 for _, tc := range cases {
21 t.Run(tc.name, func(t *testing.T) {
22 if err := ValidateExternalURL(tc.url); err == nil {
23 t.Fatalf("expected %q to be rejected, got nil error", tc.url)
24 }
25 })
26 }
27}
28
29func TestValidateExternalURLAllowsPublicHTTPS(t *testing.T) {
30 cases := []string{
31 "https://example.social/users/alice",
32 "https://mastodon.social/users/alice#main-key",
33 }
34 for _, u := range cases {
35 if err := ValidateExternalURL(u); err != nil {
36 t.Errorf("expected %q to be allowed, got error: %v", u, err)
37 }
38 }
39}