1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
|
# frozen_string_literal: true
require_relative "test_helper"
class HostAuthorization < Minitest::Test
describe "in development environment" do
setup do
Sinatra::Base.set :environment, :development
end
%w[
127.0.0.1
127.0.0.1:3000
[::1]
[::1]:3000
localhost
localhost:3000
foo.localhost
foo.test
].each do |development_host|
it "allows a host like '#{development_host}'" do
mock_app do
get("/") { "OK" }
end
headers = { "HTTP_HOST" => development_host }
request = Rack::MockRequest.new(@app)
response = request.get("/", headers)
assert_equal 200, response.status
assert_equal "OK", response.body
end
end
it "stops non-development hosts by default" do
mock_app { get("/") { "OK" } }
get "/", { "HTTP_HOST" => "example.com" }
assert_equal 403, response.status
assert_equal "Host not permitted", body
end
it "allows any requests when no permitted hosts are specified" do
mock_app do
set :host_authorization, { permitted_hosts: [] }
get("/") { "OK" }
end
get "/", { "HTTP_HOST" => "example.com" }
assert_equal 200, response.status
assert_equal "OK", body
end
end
describe "in non-development environments" do
it "allows requests based on the permitted hosts specified" do
allowed_host = "allowed.org"
mock_app do
set :host_authorization, { permitted_hosts: [allowed_host] }
get("/") { "OK" }
end
headers = { "HTTP_HOST" => allowed_host }
request = Rack::MockRequest.new(@app)
response = request.get("/", headers)
assert_equal 200, response.status
assert_equal "OK", response.body
end
it "stops requests based on the permitted hosts specified" do
allowed_host = "allowed.org"
mock_app do
set :host_authorization, { permitted_hosts: [allowed_host] }
get("/") { "OK" }
end
headers = { "HTTP_HOST" => "bad-host.org" }
request = Rack::MockRequest.new(@app)
response = request.get("/", headers)
assert_equal 403, response.status
assert_equal "Host not permitted", response.body
end
it "defaults to permit any hosts" do
mock_app do
get("/") { "OK" }
end
headers = { "HTTP_HOST" => "some-host.org" }
request = Rack::MockRequest.new(@app)
response = request.get("/", headers)
assert_equal 200, response.status
assert_equal "OK", response.body
end
it "stops the request using the configured response" do
allowed_host = "allowed.org"
status = 418
message = "No coffee for you"
mock_app do
set :host_authorization, {
permitted_hosts: [allowed_host],
status: status,
message: message,
}
get("/") { "OK" }
end
headers = { "HTTP_HOST" => "bad-host.org" }
request = Rack::MockRequest.new(@app)
response = request.get("/", headers)
assert_equal status, response.status
assert_equal message, response.body
end
it "allows custom logic with 'allow_if'" do
allowed_host = "allowed.org"
mock_app do
set :host_authorization, {
permitted_hosts: [allowed_host],
allow_if: ->(env) do
request = Sinatra::Request.new(env)
request.path == "/allowed"
end
}
get("/") { "OK" }
get("/allowed") { "OK" }
end
headers = { "HTTP_HOST" => "some-host.org" }
request = Rack::MockRequest.new(@app)
response = request.get("/allowed", headers)
assert_equal 200, response.status
assert_equal "OK", response.body
request = Rack::MockRequest.new(@app)
response = request.get("/", headers)
assert_equal 403, response.status
end
end
end
|
