alice.pds.demo.boltless.dev
This repository has no description
901 B
25 lines
did:plc:3fwecdnvtcscjnrx2p4n7a…
1package xrpc
2
3import (
4 "net/http"
5 "net/http/httptest"
6 "strings"
7 "testing"
8)
9
10func TestRepoArchiveChecksParamsBeforeResolvingTheRepo(t *testing.T) {
11 for query, wantMessage := range map[string]string{
12 "format=tar.xz": "only tar.gz and zip formats are supported",
13 "ref=--output=/tmp/evil": "ref starts with a dash",
14 "prefix=../../evil": "prefix escapes the archive root",
15 "ref=refs/heads/main&format=zip": "repo parameter",
16 } {
17 rec := httptest.NewRecorder()
18 (&Xrpc{}).RepoArchive(rec, httptest.NewRequest(http.MethodGet, "/xrpc/sh.tangled.repo.archive?"+query, nil))
19
20 body := rec.Body.String()
21 if rec.Code != http.StatusBadRequest || !strings.Contains(body, "InvalidRequest") || !strings.Contains(body, wantMessage) {
22 t.Errorf("%s: status %d with body %s, want 400 InvalidRequest mentioning %q", query, rec.Code, body, wantMessage)
23 }
24 }
25}