mirror of
https://github.com/juanfont/headscale.git
synced 2026-08-07 15:58:45 +09:00
Kristoffer Dalby
a9d5ec6202
ogen's SecurityError message echoes the operation name and internal security text. Map it to a clean 401 so the unauthorized body stays small and leaks nothing.
33 lines
831 B
Go
33 lines
831 B
Go
package apiv1
|
|
|
|
import (
|
|
"errors"
|
|
"net/http"
|
|
"strings"
|
|
"testing"
|
|
|
|
"github.com/ogen-go/ogen/ogenerrors"
|
|
)
|
|
|
|
var errSecurityNotSatisfied = errors.New(
|
|
`operation ListUsers: security "": security requirement is not satisfied`,
|
|
)
|
|
|
|
// TestClassifySecurityErrorIsMinimal ensures a failed security requirement
|
|
// becomes a clean 401 that does not leak ogen's internal operation/security
|
|
// message.
|
|
func TestClassifySecurityErrorIsMinimal(t *testing.T) {
|
|
secErr := &ogenerrors.SecurityError{Err: errSecurityNotSatisfied}
|
|
|
|
esc := classify(secErr)
|
|
|
|
if esc.StatusCode != http.StatusUnauthorized {
|
|
t.Fatalf("status = %d, want 401", esc.StatusCode)
|
|
}
|
|
|
|
detail := esc.Response.Detail.Or("")
|
|
if strings.Contains(detail, "operation") || strings.Contains(detail, "ListUsers") {
|
|
t.Errorf("401 detail leaks internals: %q", detail)
|
|
}
|
|
}
|