marktvogt.de/backend/internal/middleware/wave2_security_test.go

package middleware_test

import (
	"bytes"
	"net/http"
	"net/http/httptest"
	"testing"

	"github.com/gin-gonic/gin"

	"marktvogt.de/backend/internal/middleware"
)

const apexOrigin = "https://marktvogt.de"

// PoC for audit C3: a CORS pattern intended for the apex domain must NOT match
// a maliciously-suffixed origin. Pre-fix, regexp.Compile("marktvogt\\.de") ran
// MatchString as a substring, so https://marktvogt.de.evil.example was accepted.
// Post-fix, NewCORSConfig wraps every pattern with \A…\z so origin spoofing is
// impossible regardless of how the operator wrote the pattern.
func TestCORS_C3_AnchorsPreventSubstringSpoofing(t *testing.T) {
	t.Parallel()

	// Operator supplies a pattern that includes scheme + host. Without the
	// audit-fix wrap, regexp.MatchString would accept any origin containing
	// "https://marktvogt.de" as a substring (e.g. evil.example/?x=https://marktvogt.de).
	cfg, err := middleware.NewCORSConfig(nil, []string{`https://marktvogt\.de`})
	if err != nil {
		t.Fatalf("NewCORSConfig: %v", err)
	}

	r := gin.New()
	r.Use(middleware.CORS(cfg))
	r.GET("/test", func(c *gin.Context) { c.Status(http.StatusOK) })

	bad := []string{
		"https://marktvogt.de.evil.example",
		"https://marktvogt.de.attacker",
		"https://marktvogt.de@evil.example",
		"https://marktvogt.de/something\nhttps://evil.example",
	}
	for _, origin := range bad {
		req := httptest.NewRequest(http.MethodGet, "/test", nil)
		req.Header.Set("Origin", origin)
		w := httptest.NewRecorder()
		r.ServeHTTP(w, req)
		if got := w.Header().Get("Access-Control-Allow-Origin"); got != "" {
			t.Errorf("origin %q: must not match anchored pattern, but ACAO=%q", origin, got)
		}
	}

	// Exact origin still matches.
	req := httptest.NewRequest(http.MethodGet, "/test", nil)
	req.Header.Set("Origin", apexOrigin)
	w := httptest.NewRecorder()
	r.ServeHTTP(w, req)
	if got := w.Header().Get("Access-Control-Allow-Origin"); got != apexOrigin {
		t.Errorf("legit origin still must match: ACAO=%q", got)
	}
}

// PoC for audit C3 against the CSRF middleware: a state-changing cookie request
// from a substring-spoofed origin must be rejected.
func TestCSRF_C3_SubstringSpoofedOriginRejected(t *testing.T) {
	t.Parallel()
	cfg, err := middleware.NewCORSConfig([]string{apexOrigin}, []string{`https://marktvogt\.de`})
	if err != nil {
		t.Fatalf("NewCORSConfig: %v", err)
	}

	r := gin.New()
	r.Use(middleware.CSRF(cfg))
	r.POST("/sensitive", func(c *gin.Context) { c.Status(http.StatusOK) })

	req := httptest.NewRequest(http.MethodPost, "/sensitive", nil)
	req.Header.Set("Origin", "https://marktvogt.de.evil.example")
	w := httptest.NewRecorder()
	r.ServeHTTP(w, req)
	if w.Code != http.StatusForbidden {
		t.Fatalf("CSRF must reject spoofed origin: status=%d body=%s", w.Code, w.Body.String())
	}
}

// PoC for audit H11: requests larger than the configured limit are rejected
// before the handler decodes them (no OOM blast surface).
func TestBodyLimitBytes_H11_RejectsOversized(t *testing.T) {
	t.Parallel()
	r := gin.New()
	r.Use(middleware.BodyLimitBytes(64))
	r.POST("/echo", func(c *gin.Context) {
		// Force a read so MaxBytesReader's error materialises.
		buf := make([]byte, 1<<20)
		n, err := c.Request.Body.Read(buf)
		if err != nil {
			// MaxBytesReader closes the body with an error; surface as 413.
			c.AbortWithStatus(http.StatusRequestEntityTooLarge)
			return
		}
		c.Data(http.StatusOK, "text/plain", buf[:n])
	})

	body := bytes.Repeat([]byte("A"), 1024) // 1 KiB body, limit is 64 B
	req := httptest.NewRequest(http.MethodPost, "/echo", bytes.NewReader(body))
	w := httptest.NewRecorder()
	r.ServeHTTP(w, req)
	if w.Code != http.StatusRequestEntityTooLarge {
		t.Fatalf("oversized body: want 413, got %d", w.Code)
	}
}