88 lines
2.1 KiB
Ruby
88 lines
2.1 KiB
Ruby
# frozen_string_literal: true
|
|
|
|
require 'spec_helper'
|
|
require "rack/test"
|
|
|
|
RSpec.describe Gitlab::Middleware::HandleNullBytes do
|
|
let(:null_byte) { "\u0000" }
|
|
let(:error_400) { [400, {}, ["Bad Request"]] }
|
|
let(:app) { double(:app) }
|
|
|
|
subject { described_class.new(app) }
|
|
|
|
before do
|
|
allow(app).to receive(:call) do |args|
|
|
args
|
|
end
|
|
end
|
|
|
|
def env_for(params = {})
|
|
Rack::MockRequest.env_for('/', { params: params })
|
|
end
|
|
|
|
context 'with null bytes in params' do
|
|
it 'rejects null bytes in a top level param' do
|
|
env = env_for(name: "null#{null_byte}byte")
|
|
|
|
expect(subject.call(env)).to eq error_400
|
|
end
|
|
|
|
it "responds with 400 BadRequest for hashes with strings" do
|
|
env = env_for(name: { inner_key: "I am #{null_byte} bad" })
|
|
|
|
expect(subject.call(env)).to eq error_400
|
|
end
|
|
|
|
it "responds with 400 BadRequest for arrays with strings" do
|
|
env = env_for(name: ["I am #{null_byte} bad"])
|
|
|
|
expect(subject.call(env)).to eq error_400
|
|
end
|
|
|
|
it "responds with 400 BadRequest for arrays containing hashes with string values" do
|
|
env = env_for(name: [
|
|
{
|
|
inner_key: "I am #{null_byte} bad"
|
|
}
|
|
])
|
|
|
|
expect(subject.call(env)).to eq error_400
|
|
end
|
|
|
|
it "gives up and does not 400 with too deeply nested params" do
|
|
env = env_for(name: [
|
|
{
|
|
inner_key: { deeper_key: [{ hash_inside_array_key: "I am #{null_byte} bad" }] }
|
|
}
|
|
])
|
|
|
|
expect(subject.call(env)).not_to eq error_400
|
|
end
|
|
end
|
|
|
|
context 'without null bytes in params' do
|
|
it "does not respond with a 400 for strings" do
|
|
env = env_for(name: "safe name")
|
|
|
|
expect(subject.call(env)).not_to eq error_400
|
|
end
|
|
|
|
it "does not respond with a 400 with no params" do
|
|
env = env_for
|
|
|
|
expect(subject.call(env)).not_to eq error_400
|
|
end
|
|
end
|
|
|
|
context 'when disabled via env flag' do
|
|
before do
|
|
stub_env('REJECT_NULL_BYTES', '1')
|
|
end
|
|
|
|
it 'does not respond with a 400 no matter what' do
|
|
env = env_for(name: "null#{null_byte}byte")
|
|
|
|
expect(subject.call(env)).not_to eq error_400
|
|
end
|
|
end
|
|
end
|