jbergner
8dc4de3eae
All checks were successful
release-tag / release-image (push) Successful in 2m22s
67 lines
3.0 KiB
Go
67 lines
3.0 KiB
Go
package research
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
"time"
|
|
)
|
|
|
|
func TestExtractHTMLTextRemovesNavigationAndScripts(t *testing.T) {
|
|
title, content := extractHTMLText(`<!doctype html><html><head><title> VPN & Gateway </title><style>.x{}</style><script>alert(1)</script></head><body><header>Menü</header><main><h1>Gateway prüfen</h1><p>Öffnen Sie die Konfiguration.</p><ol><li>Adresse prüfen</li><li>Verbindung testen</li></ol></main><footer>Impressum</footer></body></html>`, 5000)
|
|
if title != "VPN & Gateway" {
|
|
t.Fatalf("unexpected title %q", title)
|
|
}
|
|
for _, forbidden := range []string{"alert(1)", "Menü", "Impressum", ".x{}"} {
|
|
if strings.Contains(content, forbidden) {
|
|
t.Fatalf("forbidden HTML block leaked into content: %q", forbidden)
|
|
}
|
|
}
|
|
for _, expected := range []string{"Gateway prüfen", "Adresse prüfen", "Verbindung testen"} {
|
|
if !strings.Contains(content, expected) {
|
|
t.Fatalf("expected extracted text %q in %q", expected, content)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestFetchPageExtractsFullHTMLWhenPrivateAllowed(t *testing.T) {
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Content-Type", "text/html; charset=utf-8")
|
|
_, _ = w.Write([]byte(`<html><head><title>Herstelleranleitung</title></head><body><main><h1>Audit Logging aktivieren</h1><p>Aktivieren Sie das zentrale Audit Logging in der Administrationskonsole.</p><p>Prüfen Sie anschließend, ob ein Testereignis im zentralen Protokoll erscheint und die Aufbewahrungsrichtlinie greift.</p></main></body></html>`))
|
|
}))
|
|
defer srv.Close()
|
|
|
|
page, diagnostic, err := New("").FetchPage(context.Background(), srv.URL, FetchOptions{AllowPrivate: true, Timeout: time.Second, MaxBytes: 1 << 20, MaxChars: 5000})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if page.Title != "Herstelleranleitung" || !strings.Contains(page.Content, "Audit Logging aktivieren") || diagnostic.HTTPStatus != http.StatusOK {
|
|
t.Fatalf("unexpected page=%+v diagnostic=%+v", page, diagnostic)
|
|
}
|
|
}
|
|
|
|
func TestFetchPageBlocksPrivateAddressByDefault(t *testing.T) {
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
_, _ = w.Write([]byte("should not be fetched"))
|
|
}))
|
|
defer srv.Close()
|
|
_, diagnostic, err := New("").FetchPage(context.Background(), srv.URL, FetchOptions{})
|
|
if err == nil || diagnostic.ErrorKind != "unsafe_url" {
|
|
t.Fatalf("expected private URL rejection, err=%v diagnostic=%+v", err, diagnostic)
|
|
}
|
|
}
|
|
|
|
func TestFetchPageReportsPDFAsUnsupported(t *testing.T) {
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.Header().Set("Content-Type", "application/pdf")
|
|
_, _ = w.Write([]byte("%PDF-1.4"))
|
|
}))
|
|
defer srv.Close()
|
|
_, diagnostic, err := New("").FetchPage(context.Background(), srv.URL+"/manual.pdf", FetchOptions{AllowPrivate: true})
|
|
if err == nil || diagnostic.ErrorKind != "pdf_unsupported" {
|
|
t.Fatalf("expected PDF rejection, err=%v diagnostic=%+v", err, diagnostic)
|
|
}
|
|
}
|