rogee
aeddedf2a3
Restructure the monorepo into clear top-level directories: - backend/: Go module root (cmd, internal, pkg, configs, migrations, docs/swagger, scripts, tests, go.mod, Makefile, .air.toml) - deploy/: Docker (Dockerfile, docker-compose*), quickstart, fluentd - docs/: project documentation + reports/ (moved from repo root) - AGENTS.md: new AI coding-agent guide at repo root Update all references to the new layout: - Dockerfile: COPY backend/go.mod, COPY backend/ (context = repo root) - docker-compose files: context ../.., dockerfile deploy/docker/Dockerfile, env_file ../../.env, volume mounts ../../backend:/app - deploy/quickstart/compose.yaml: dockerfile deploy/docker/Dockerfile - CI: working-directory: backend for go commands, file deploy/docker/Dockerfile, coverage path backend/coverage.out, health_check backend/scripts/ - backend/Makefile: docker target uses -f ../deploy/docker/Dockerfile ../ - README: architecture tree, quickstart, config paths updated Move root stray scripts (rename_models.*, run_m11_tests.sh, verify_build.sh, gorm_bool_main.go) to backend/scripts/legacy/. All moves via git mv to preserve history. Build, vet, SQLite tests, and docker compose config verified.
64 lines
1.7 KiB
Go
64 lines
1.7 KiB
Go
package middleware
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/gin-gonic/gin"
|
|
"github.com/stretchr/testify/assert"
|
|
)
|
|
|
|
func TestXSSProtection_DefaultConfig(t *testing.T) {
|
|
cfg := DefaultXSSProtectionConfig()
|
|
assert.NotNil(t, cfg.HTMLPolicy)
|
|
assert.True(t, cfg.SanitizeJSONResponse)
|
|
assert.True(t, cfg.SanitizeInputFields)
|
|
}
|
|
|
|
func TestXSSProtection_SanitizeHTML(t *testing.T) {
|
|
cfg := DefaultXSSProtectionConfig()
|
|
result := SanitizeHTML("<script>alert('xss')</script><b>safe</b>", cfg.HTMLPolicy)
|
|
assert.NotContains(t, result, "<script>")
|
|
}
|
|
|
|
func TestXSSProtection_Middleware(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
cfg := DefaultXSSProtectionConfig()
|
|
r := gin.New()
|
|
r.Use(XSSProtectionMiddleware(cfg))
|
|
r.POST("/test", func(c *gin.Context) { c.JSON(200, gin.H{"ok": true}) })
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodPost, "/test?name=<script>alert(1)</script>", nil)
|
|
r.ServeHTTP(w, req)
|
|
assert.Equal(t, 200, w.Code)
|
|
}
|
|
|
|
func TestXSSProtection_SanitizeQuery(t *testing.T) {
|
|
gin.SetMode(gin.TestMode)
|
|
cfg := DefaultXSSProtectionConfig()
|
|
r := gin.New()
|
|
r.Use(XSSProtectionMiddleware(cfg))
|
|
r.GET("/test", func(c *gin.Context) {
|
|
name := c.Query("name")
|
|
c.JSON(200, gin.H{"name": name})
|
|
})
|
|
|
|
w := httptest.NewRecorder()
|
|
req := httptest.NewRequest(http.MethodGet, "/test?name=<script>alert(1)</script>", nil)
|
|
r.ServeHTTP(w, req)
|
|
assert.Equal(t, 200, w.Code)
|
|
}
|
|
|
|
func TestUGCPolicy(t *testing.T) {
|
|
p := UGCPolicy()
|
|
assert.NotNil(t, p)
|
|
}
|
|
|
|
func TestShouldSanitizeField(t *testing.T) {
|
|
cfg := DefaultXSSProtectionConfig()
|
|
assert.True(t, shouldSanitizeField("name", cfg))
|
|
assert.True(t, shouldSanitizeField("content", cfg))
|
|
assert.False(t, shouldSanitizeField("id", cfg))
|
|
} |