36 lines
1.3 KiB
Go
36 lines
1.3 KiB
Go
package api
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
|
|
"chfs-ng/internal/auth"
|
|
"chfs-ng/internal/storage"
|
|
)
|
|
|
|
func TestRootAndAPIDoc(t *testing.T) {
|
|
s := &Server{Store: storage.Local{Root: t.TempDir()}, Auth: &auth.Manager{Guest: &auth.Account{Mask: auth.Read}}, HTMLTitle: "My Files", HTMLNotice: "`<strong>Hello</strong>`"}
|
|
h := s.Handler()
|
|
r := httptest.NewRecorder()
|
|
h.ServeHTTP(r, httptest.NewRequest(http.MethodGet, "/", nil))
|
|
if r.Code != 200 || !strings.Contains(r.Body.String(), "<title>My Files</title>") || !strings.Contains(r.Body.String(), "<strong>Hello</strong>") {
|
|
t.Fatalf("root: %d %s", r.Code, r.Body.String())
|
|
}
|
|
r = httptest.NewRecorder()
|
|
h.ServeHTTP(r, httptest.NewRequest(http.MethodGet, "/asset/api.html", nil))
|
|
if r.Code != 200 || !strings.Contains(r.Body.String(), "/chfs/files") {
|
|
t.Fatalf("api doc: %d %s", r.Code, r.Body.String())
|
|
}
|
|
}
|
|
|
|
func TestRootEscapesPlainNotice(t *testing.T) {
|
|
s := &Server{Store: storage.Local{Root: t.TempDir()}, Auth: &auth.Manager{Guest: &auth.Account{Mask: auth.Read}}, HTMLNotice: `<script>alert(1)</script>`}
|
|
r := httptest.NewRecorder()
|
|
s.Handler().ServeHTTP(r, httptest.NewRequest(http.MethodGet, "/", nil))
|
|
if strings.Contains(r.Body.String(), `<script>alert(1)</script>`) {
|
|
t.Fatal("plain notice was not escaped")
|
|
}
|
|
}
|