sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-09 15:09:08 +02:00
Code Issues Packages Projects Releases Wiki Activity

[misc] Add upload URL signing and rate limiting (#7502)

Browse Source
This commit is contained in:
Bethuel Mmbaga
2026-09-24 17:34:58 +03:00
committed by GitHub
parent 94106b57ab
commit 0a128cea6f
11 changed files with 488 additions and 47 deletions
Download Patch File Download Diff File Expand all files Collapse all files
upload-server/server/local_test.go
+33 -13
View File
@@ -8,19 +8,28 @@ import (
"os"
"path/filepath"
"testing"
"time"
"github.com/stretchr/testify/require"
"github.com/netbirdio/netbird/upload-server/types"
)
const testSigningKey = "test-signing-key-with-enough-length"
func signedQuery(t *testing.T, objectKey string) string {
t.Helper()
s := &signer{key: []byte(testSigningKey)}
return s.sign(objectKey, time.Now()).Encode()
}
func Test_LocalHandlerGetUploadURL(t *testing.T) {
mockURL := "http://localhost:8080"
t.Setenv("SERVER_URL", mockURL)
t.Setenv("STORE_DIR", t.TempDir())
mux := http.NewServeMux()
err := configureLocalHandlers(mux)
err := configureLocalHandlers(mux, newTestRateLimiter(t))
require.NoError(t, err)
req := httptest.NewRequest(http.MethodGet, types.GetURLPath+"?id=test-file", nil)
@@ -37,7 +46,6 @@ func Test_LocalHandlerGetUploadURL(t *testing.T) {
require.Contains(t, response.URL, "test-file/")
require.NotEmpty(t, response.Key)
require.Contains(t, response.Key, "test-file/")
}
func Test_LocalHandlePutRequest(t *testing.T) {
@@ -45,13 +53,15 @@ func Test_LocalHandlePutRequest(t *testing.T) {
mockURL := "http://localhost:8080"
t.Setenv("SERVER_URL", mockURL)
t.Setenv("STORE_DIR", mockDir)
t.Setenv(signingKeyVar, testSigningKey)
mux := http.NewServeMux()
err := configureLocalHandlers(mux)
err := configureLocalHandlers(mux, newTestRateLimiter(t))
require.NoError(t, err)
fileContent := []byte("test file content")
req := httptest.NewRequest(http.MethodPut, putURLPath+"/uploads/test.txt", bytes.NewReader(fileContent))
req := httptest.NewRequest(http.MethodPut,
putURLPath+"/uploads/test.txt?"+signedQuery(t, "uploads/test.txt"), bytes.NewReader(fileContent))
rec := httptest.NewRecorder()
mux.ServeHTTP(rec, req)
@@ -69,13 +79,16 @@ func Test_LocalHandlePutRequest_PathTraversal(t *testing.T) {
mockURL := "http://localhost:8080"
t.Setenv("SERVER_URL", mockURL)
t.Setenv("STORE_DIR", mockDir)
t.Setenv(signingKeyVar, testSigningKey)
mux := http.NewServeMux()
err := configureLocalHandlers(mux)
err := configureLocalHandlers(mux, newTestRateLimiter(t))
require.NoError(t, err)
fileContent := []byte("malicious content")
req := httptest.NewRequest(http.MethodPut, putURLPath+"/uploads/%2e%2e%2f%2e%2e%2fetc%2fpasswd", bytes.NewReader(fileContent))
req := httptest.NewRequest(http.MethodPut,
putURLPath+"/uploads/%2e%2e%2f%2e%2e%2fetc%2fpasswd?"+signedQuery(t, "uploads/../../etc/passwd"),
bytes.NewReader(fileContent))
rec := httptest.NewRecorder()
mux.ServeHTTP(rec, req)
@@ -90,11 +103,13 @@ func Test_LocalHandlePutRequest_DirTraversal(t *testing.T) {
mockDir := t.TempDir()
t.Setenv("SERVER_URL", "http://localhost:8080")
t.Setenv("STORE_DIR", mockDir)
t.Setenv(signingKeyVar, testSigningKey)
l := &local{url: "http://localhost:8080", dir: mockDir}
l := &local{url: "http://localhost:8080", dir: mockDir, signer: &signer{key: []byte(testSigningKey)}}
body := bytes.NewReader([]byte("bad"))
req := httptest.NewRequest(http.MethodPut, putURLPath+"/x/evil.txt", body)
req := httptest.NewRequest(http.MethodPut,
putURLPath+"/x/evil.txt?"+signedQuery(t, "../../../tmp/evil.txt"), body)
req.SetPathValue("dir", "../../../tmp")
req.SetPathValue("file", "evil.txt")
@@ -111,17 +126,20 @@ func Test_LocalHandlePutRequest_DuplicateFile(t *testing.T) {
mockDir := t.TempDir()
t.Setenv("SERVER_URL", "http://localhost:8080")
t.Setenv("STORE_DIR", mockDir)
t.Setenv(signingKeyVar, testSigningKey)
mux := http.NewServeMux()
err := configureLocalHandlers(mux)
err := configureLocalHandlers(mux, newTestRateLimiter(t))
require.NoError(t, err)
req := httptest.NewRequest(http.MethodPut, putURLPath+"/dir/dup.txt", bytes.NewReader([]byte("first")))
req := httptest.NewRequest(http.MethodPut,
putURLPath+"/dir/dup.txt?"+signedQuery(t, "dir/dup.txt"), bytes.NewReader([]byte("first")))
rec := httptest.NewRecorder()
mux.ServeHTTP(rec, req)
require.Equal(t, http.StatusOK, rec.Code)
req = httptest.NewRequest(http.MethodPut, putURLPath+"/dir/dup.txt", bytes.NewReader([]byte("second")))
req = httptest.NewRequest(http.MethodPut,
putURLPath+"/dir/dup.txt?"+signedQuery(t, "dir/dup.txt"), bytes.NewReader([]byte("second")))
rec = httptest.NewRecorder()
mux.ServeHTTP(rec, req)
require.Equal(t, http.StatusConflict, rec.Code)
@@ -135,13 +153,15 @@ func Test_LocalHandlePutRequest_BodyTooLarge(t *testing.T) {
mockDir := t.TempDir()
t.Setenv("SERVER_URL", "http://localhost:8080")
t.Setenv("STORE_DIR", mockDir)
t.Setenv(signingKeyVar, testSigningKey)
mux := http.NewServeMux()
err := configureLocalHandlers(mux)
err := configureLocalHandlers(mux, newTestRateLimiter(t))
require.NoError(t, err)
largeBody := make([]byte, maxUploadSize+1)
req := httptest.NewRequest(http.MethodPut, putURLPath+"/dir/big.txt", bytes.NewReader(largeBody))
req := httptest.NewRequest(http.MethodPut,
putURLPath+"/dir/big.txt?"+signedQuery(t, "dir/big.txt"), bytes.NewReader(largeBody))
rec := httptest.NewRecorder()
mux.ServeHTTP(rec, req)