marktvogt.de/backend/internal/pkg/validate/validate_security_test.go

package validate_test

import (
	"net/http"
	"net/http/httptest"
	"strings"
	"testing"

	"github.com/gin-gonic/gin"

	"marktvogt.de/backend/internal/middleware"
	"marktvogt.de/backend/internal/pkg/apierror"
	"marktvogt.de/backend/internal/pkg/validate"
)

func init() {
	gin.SetMode(gin.TestMode)
}

type bindReq struct {
	Name string `json:"name" validate:"required,max=64"`
}

// PoC for audit H11: unknown JSON fields are rejected. Pre-fix, gin's
// ShouldBindJSON silently dropped them — letting an attacker probe for hidden
// admin flags or send oversized payloads with junk keys.
func TestBindJSON_H11_RejectsUnknownFields(t *testing.T) {
	t.Parallel()
	r := gin.New()
	r.POST("/p", func(c *gin.Context) {
		var in bindReq
		if apiErr := validate.BindJSON(c, &in); apiErr != nil {
			c.AbortWithStatusJSON(apiErr.Status, apierror.NewResponse(apiErr))
			return
		}
		c.Status(http.StatusOK)
	})

	w := httptest.NewRecorder()
	r.ServeHTTP(w, httptest.NewRequest(http.MethodPost, "/p", strings.NewReader(`{"name":"ok","secretAdminFlag":true}`)))
	if w.Code != http.StatusBadRequest {
		t.Fatalf("unknown field must be rejected: status=%d body=%s", w.Code, w.Body.String())
	}
}

// PoC for audit H11: trailing garbage after a valid JSON object is rejected.
// `{"a":1}{"b":2}` must not silently parse as the first object.
func TestBindJSON_H11_RejectsTrailingTokens(t *testing.T) {
	t.Parallel()
	r := gin.New()
	r.POST("/p", func(c *gin.Context) {
		var in bindReq
		if apiErr := validate.BindJSON(c, &in); apiErr != nil {
			c.AbortWithStatusJSON(apiErr.Status, apierror.NewResponse(apiErr))
			return
		}
		c.Status(http.StatusOK)
	})

	w := httptest.NewRecorder()
	r.ServeHTTP(w, httptest.NewRequest(http.MethodPost, "/p", strings.NewReader(`{"name":"ok"}{"name":"smuggled"}`)))
	if w.Code != http.StatusBadRequest {
		t.Fatalf("trailing token must be rejected: status=%d body=%s", w.Code, w.Body.String())
	}
}

// PoC for audit H11 wired through middleware: an oversized body returns 413
// with the canonical apierror shape.
func TestBindJSON_H11_BodyLimit413(t *testing.T) {
	t.Parallel()
	r := gin.New()
	r.Use(middleware.BodyLimitBytes(32))
	r.POST("/p", func(c *gin.Context) {
		var in bindReq
		if apiErr := validate.BindJSON(c, &in); apiErr != nil {
			c.AbortWithStatusJSON(apiErr.Status, apierror.NewResponse(apiErr))
			return
		}
		c.Status(http.StatusOK)
	})

	body := `{"name":"` + strings.Repeat("A", 1024) + `"}`
	w := httptest.NewRecorder()
	r.ServeHTTP(w, httptest.NewRequest(http.MethodPost, "/p", strings.NewReader(body)))
	if w.Code != http.StatusRequestEntityTooLarge {
		t.Fatalf("oversized body: want 413, got %d body=%s", w.Code, w.Body.String())
	}
}

// PoC for audit H11: requests with a valid small body still pass through cleanly.
func TestBindJSON_H11_HappyPath(t *testing.T) {
	t.Parallel()
	r := gin.New()
	r.Use(middleware.BodyLimitBytes(1 << 20))
	r.POST("/p", func(c *gin.Context) {
		var in bindReq
		if apiErr := validate.BindJSON(c, &in); apiErr != nil {
			c.AbortWithStatusJSON(apiErr.Status, apierror.NewResponse(apiErr))
			return
		}
		c.Status(http.StatusOK)
	})
	w := httptest.NewRecorder()
	r.ServeHTTP(w, httptest.NewRequest(http.MethodPost, "/p", strings.NewReader(`{"name":"alice"}`)))
	if w.Code != http.StatusOK {
		t.Fatalf("happy path: want 200, got %d body=%s", w.Code, w.Body.String())
	}
}