superidou
9501751792
三轮审查修复(60+ 项),相对远端 main(b536672)的关键变更:
- 安全: 数据面 SSRF 拨号防护(防 DNS rebinding)/上游凭据剥离/登录防枚举
与锁定态统一/可信代理(X-Forwarded-For)限流加固/会话版本失效机制/
撤销即时传播/弱密钥拒绝启动/脱敏字节级重写(保签名契约)
- 业务逻辑: 裸 body 上传 panic/bootstrap 审计管线卡死/定价通配符优先级/
全局工具可见性/调度器停机补跑/TOTP 挑战令牌消费顺序/熔断探针语义/
>4MB 响应 token 计量/管理员重置密码作废会话 等
- 前端: 新 logo(语枢 AI 网关主题)/Provider 凭据异常警示/删除入口/
后端错误消息透传/localStorage 敏感数据收敛
- 部署: CREDENTIAL_MASTER_KEY 持久化与弱值拒绝/Provider DELETE 接口/
nginx 安全头/worker 内存限制
- 新增迁移 000029(key_hash 索引)/000030(usage_daily 币种维度)
59 lines
2.0 KiB
Go
59 lines
2.0 KiB
Go
package identity
|
|
|
|
import (
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"net/netip"
|
|
"testing"
|
|
)
|
|
|
|
func TestClientIP(t *testing.T) {
|
|
// 可信代理:环回 + RFC1918(docker-compose nginx 同网段场景)。
|
|
trusted := []netip.Prefix{
|
|
netip.MustParsePrefix("127.0.0.0/8"),
|
|
netip.MustParsePrefix("10.0.0.0/8"),
|
|
netip.MustParsePrefix("172.16.0.0/12"),
|
|
netip.MustParsePrefix("192.168.0.0/16"),
|
|
}
|
|
limiter := NewLoginLimiter(nil, 0, 0, trusted)
|
|
|
|
cases := []struct {
|
|
name string
|
|
remoteAddr string
|
|
xfwd string
|
|
want string
|
|
}{
|
|
{"xfwd first value from trusted proxy", "10.0.0.1:52341", "203.0.113.9, 10.0.0.2", "203.0.113.9"},
|
|
{"xfwd single from trusted proxy", "10.0.0.1:52341", "198.51.100.7", "198.51.100.7"},
|
|
{"xfwd with spaces from trusted proxy", "10.0.0.1:52341", " 192.0.2.5 ", "192.0.2.5"},
|
|
{"xfwd ignored from untrusted public peer", "203.0.113.9:8080", "198.51.100.7", "203.0.113.9"},
|
|
{"xfwd ignored from CGNAT peer outside trust", "100.64.0.5:8080", "198.51.100.7", "100.64.0.5"},
|
|
{"no xfwd falls back to remote", "203.0.113.9:8080", "", "203.0.113.9"},
|
|
{"no xfwd and no port", "[2001:db8::1]:443", "", "2001:db8::1"},
|
|
{"trusted peer without xfwd uses peer", "172.20.0.2:8080", "", "172.20.0.2"},
|
|
}
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
req := httptest.NewRequest(http.MethodPost, "/", nil)
|
|
req.RemoteAddr = tc.remoteAddr
|
|
if tc.xfwd != "" {
|
|
req.Header.Set("X-Forwarded-For", tc.xfwd)
|
|
}
|
|
if got := limiter.ClientIP(req); got != tc.want {
|
|
t.Fatalf("ClientIP() = %q, want %q", got, tc.want)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestClientIPNoTrustedProxies(t *testing.T) {
|
|
// 未配置可信代理时(如网关端口直接暴露):任何对端的 XFF 都被忽略。
|
|
limiter := NewLoginLimiter(nil, 0, 0, nil)
|
|
req := httptest.NewRequest(http.MethodPost, "/", nil)
|
|
req.RemoteAddr = "203.0.113.9:8080"
|
|
req.Header.Set("X-Forwarded-For", "198.51.100.7")
|
|
if got := limiter.ClientIP(req); got != "203.0.113.9" {
|
|
t.Fatalf("ClientIP() = %q, want %q", got, "203.0.113.9")
|
|
}
|
|
}
|