bdeshi/khosra
0
0
Fork 0
Code Issues Pull Requests Releases Activity

answer 404 for a static path the root refuses

Browse Source 
Found by /invariants: a symlink under static/ pointing outside the site root
answered 500. The guard held — os.Root refused it and no bytes escaped — but the
response confirmed the path was there, where every other miss answers 404. Same
reasoning as a hidden bundle answering 404 rather than 403 (ADR-0024).

serveStatic now stats through the rooted FS first, so a directory, a missing
file, and a refused name are one answer. That also folds the old noListing and
staticFS into one function, since "cannot serve this" was already their shared
job.

The test uses a real temp directory rather than a MapFS, because the guard under
test belongs to os.Root; verified it fails with 500 against the previous code
before keeping it.

Splitting web_test.go at the seam the package already had — resolve_test.go for
what a path means, web_test.go for what happens once it resolves — because it
crossed FILE_LOC_WARN. Same response as content.go at entry 9.
This commit is contained in:
bdeshi
2026-08-01 02:23:35 +06:00
parent 7117d70b45
commit d80885a412
4 changed files with 148 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
internal/web/web_test.go
+43 -79
View File
@@ -4,6 +4,8 @@ import (
"fmt"
"net/http"
"net/http/httptest"
"os"
"path/filepath"
"strings"
"testing"
"testing/fstest"
@@ -48,18 +50,6 @@ func TestServeBundleAtItsPermalink(t *testing.T) {
}
}
func TestSlashlessPathRedirectsPermanently(t *testing.T) {
h := testHandler(t)
rec := httptest.NewRecorder()
h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/pages/about", nil))
if rec.Code != http.StatusMovedPermanently {
t.Fatalf("got %d, want 301", rec.Code)
}
if loc := rec.Header().Get("Location"); loc != "/pages/about/" {
t.Errorf("Location = %q", loc)
}
}
func TestUnknownPathsAre404(t *testing.T) {
h := testHandler(t)
for _, path := range []string{"/", "/nope/", "/pages/nope", "/pages/about/deeper/"} {
@@ -124,45 +114,6 @@ func TestMissingVariantFallsBackAndSaysSo(t *testing.T) {
}
}
func TestDefaultLanguagePrefixRedirectsToRoot(t *testing.T) {
h := multilingualHandler(t)
for path, want := range map[string]string{
"/en/pages/about/": "/pages/about/",
"/en/pages/about": "/pages/about/",
} {
rec := httptest.NewRecorder()
h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, path, nil))
if rec.Code != http.StatusMovedPermanently {
t.Errorf("GET %s = %d, want 301: /en/… must never be live (ADR-0009)", path, rec.Code)
continue
}
if loc := rec.Header().Get("Location"); loc != want {
t.Errorf("GET %s → %q, want %q", path, loc, want)
}
}
}
func TestPrefixedSlashlessPathRedirectsWithItsPrefix(t *testing.T) {
h := multilingualHandler(t)
rec := httptest.NewRecorder()
h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/bn/pages/about", nil))
if rec.Code != http.StatusMovedPermanently {
t.Fatalf("got %d, want 301", rec.Code)
}
if loc := rec.Header().Get("Location"); loc != "/bn/pages/about/" {
t.Errorf("Location = %q, want /bn/pages/about/", loc)
}
}
func TestUnknownLanguagePrefixIsNotALanguage(t *testing.T) {
h := multilingualHandler(t)
rec := httptest.NewRecorder()
h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/fr/pages/about/", nil))
if rec.Code != http.StatusNotFound {
t.Errorf("got %d, want 404: fr is not a language this site has", rec.Code)
}
}
func aliasHandler(t *testing.T) http.Handler {
t.Helper()
fsys := fstest.MapFS{
@@ -269,18 +220,6 @@ func TestPaginationSplitsAndLinks(t *testing.T) {
}
}
func TestPageOneIsNeverItsOwnURL(t *testing.T) {
h := listingHandler(t, 3)
rec := httptest.NewRecorder()
h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/posts/page/1/", nil))
if rec.Code != http.StatusMovedPermanently {
t.Fatalf("got %d, want 301 (ADR-0028)", rec.Code)
}
if loc := rec.Header().Get("Location"); loc != "/posts/" {
t.Errorf("Location = %q, want /posts/", loc)
}
}
func TestPagePastTheEndIs404(t *testing.T) {
h := listingHandler(t, 3)
rec := httptest.NewRecorder()
@@ -320,6 +259,47 @@ func TestStaticFilesAreServedAndDirectoriesAreNot(t *testing.T) {
}
}
func TestAStaticPathThatEscapesTheRootIs404(t *testing.T) {
// A real directory, not a MapFS: the guard being tested belongs to os.Root (ADR-0031), and the point is
// what the *response* is when it refuses — a miss, never an error page that confirms the path.
dir := t.TempDir()
if err := os.MkdirAll(filepath.Join(dir, "static"), 0o755); err != nil {
t.Fatal(err)
}
if err := os.WriteFile(filepath.Join(dir, "static", "ok.css"), []byte("body{}"), 0o644); err != nil {
t.Fatal(err)
}
outside := filepath.Join(dir, "outside.txt")
if err := os.WriteFile(outside, []byte("secret"), 0o644); err != nil {
t.Fatal(err)
}
if err := os.Symlink(outside, filepath.Join(dir, "static", "escape.txt")); err != nil {
t.Skipf("symlinks unavailable: %v", err)
}
fsys, err := content.OpenSite(dir)
if err != nil {
t.Fatal(err)
}
r, err := render.New(fsys)
if err != nil {
t.Fatal(err)
}
h := Handler(content.NewSite(nil), r, fsys)
for path, want := range map[string]int{
"/static/ok.css": http.StatusOK,
"/static/escape.txt": http.StatusNotFound,
} {
rec := httptest.NewRecorder()
h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, path, nil))
if rec.Code != want {
t.Errorf("GET %s = %d, want %d", path, rec.Code, want)
}
if strings.Contains(rec.Body.String(), "secret") {
t.Fatalf("GET %s served bytes from outside the root", path)
}
}
}
func seriesHandler(t *testing.T) http.Handler {
t.Helper()
fsys := fstest.MapFS{
@@ -460,19 +440,3 @@ func TestSectionNarrowedTagListing(t *testing.T) {
t.Errorf("narrowing to comics should drop the posts entry:\n%s", body)
}
}
func TestTagPathsCanonicaliseAndMiss(t *testing.T) {
h := tagHandler(t)
rec := httptest.NewRecorder()
h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, "/tags/monsoon", nil))
if rec.Code != http.StatusMovedPermanently || rec.Header().Get("Location") != "/tags/monsoon/" {
t.Errorf("slashless tag path = %d %q", rec.Code, rec.Header().Get("Location"))
}
for _, path := range []string{"/tags/nothing/", "/tags/", "/posts/tags/nothing/"} {
rec := httptest.NewRecorder()
h.ServeHTTP(rec, httptest.NewRequest(http.MethodGet, path, nil))
if rec.Code != http.StatusNotFound {
t.Errorf("GET %s = %d, want 404", path, rec.Code)
}
}
}