security fix

2026-07-13 00:57:35 -03:00
parent 9001b47204
commit 92c5c2ace6
3 changed files with 164 additions and 0 deletions
@@ -0,0 +1,73 @@
+package main
+
+import (
+	"crypto/hmac"
+	"crypto/sha256"
+	"encoding/hex"
+	"testing"
+	"time"
+)
+
+func TestAdminPasswordHashAndLegacyUpgrade(t *testing.T) {
+	password := "correct-horse-battery-staple"
+	hash, err := hashAdminPassword(password)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if valid, upgrade := verifyAdminPassword(hash, password); !valid || upgrade {
+		t.Fatalf("bcrypt verification = valid %v, upgrade %v", valid, upgrade)
+	}
+	if valid, _ := verifyAdminPassword(hash, "wrong-password"); valid {
+		t.Fatal("wrong bcrypt password was accepted")
+	}
+	legacy := legacyAdminPasswordHash(password)
+	if valid, upgrade := verifyAdminPassword(legacy, password); !valid || !upgrade {
+		t.Fatalf("legacy verification = valid %v, upgrade %v", valid, upgrade)
+	}
+}
+
+func TestTLSDomainRejectsTraversal(t *testing.T) {
+	for _, value := range []string{"../root", `..\\root`, "/absolute", "host\nname"} {
+		if _, _, err := normalizeTLSDomain(value, true); err == nil {
+			t.Fatalf("normalizeTLSDomain(%q) accepted unsafe value", value)
+		}
+	}
+	if domain, _, err := normalizeTLSDomain("vpn.example.com", false); err != nil || domain != "vpn.example.com" {
+		t.Fatalf("valid domain rejected: %q, %v", domain, err)
+	}
+}
+
+func TestManagedServerURLValidation(t *testing.T) {
+	for _, value := range []string{
+		"ftp://example.com", "https://user:pass@example.com", "https://example.com/admin", "http://169.254.10.20",
+	} {
+		if _, err := validateManagedServerBaseURL(value); err == nil {
+			t.Fatalf("validateManagedServerBaseURL(%q) accepted unsafe value", value)
+		}
+	}
+	if got, err := validateManagedServerBaseURL("https://node.example.com/"); err != nil || got != "https://node.example.com" {
+		t.Fatalf("valid managed server URL = %q, %v", got, err)
+	}
+}
+
+func TestMPSignatureRequiresSecretAndValidHMAC(t *testing.T) {
+	const (
+		secret    = "test-secret-with-enough-entropy"
+		dataID    = "123456789"
+		requestID = "request-123"
+	)
+	ts := time.Now().Format("150405")
+	manifest := "id:" + dataID + ";request-id:" + requestID + ";ts:" + ts + ";"
+	mac := hmac.New(sha256.New, []byte(secret))
+	_, _ = mac.Write([]byte(manifest))
+	signature := "ts=" + ts + ",v1=" + hex.EncodeToString(mac.Sum(nil))
+	if !verifyMPSignature(signature, requestID, dataID, secret) {
+		t.Fatal("valid Mercado Pago signature was rejected")
+	}
+	if verifyMPSignature(signature, requestID, dataID, "") {
+		t.Fatal("unsigned webhook mode was accepted")
+	}
+	if verifyMPSignature(signature, requestID, dataID, "wrong-secret") {
+		t.Fatal("signature with wrong secret was accepted")
+	}
+}