v0.34.6

src/proxy/tests/cache_fast_path_tests.rs

@@ -86,6 +86,45 @@ mod cache_fast_path_tests {
         config
     }
 
+    #[tokio::test]
+    async fn content_type_policy_denies_before_local_web_server_and_cache_and_updates_live() {
+        let directory = TempDir::new().unwrap();
+        let mut config = web_config(&directory, true);
+        config.vhosts[0].content_type_policy = crate::vhost::ContentTypePolicy {
+            enabled: true,
+            blocked: vec!["multipart/form-data".into(), "image/*".into()],
+        };
+        let fixture = Fixture::new(config).await;
+        // Warm the cache before testing a header-denied cache hit.
+        assert_eq!(fixture.get("/style.css", &[]).await.status, StatusCode::OK);
+        assert_eq!(fixture.get("/style.css", &[]).await.status, StatusCode::OK);
+        assert_eq!(fixture.get("/style.css", &[("content-type", "multipart/form-data; boundary=example")]).await.status, StatusCode::FORBIDDEN);
+        assert_eq!(fixture.get("/style.css", &[("content-type", "IMAGE/PNG")]).await.status, StatusCode::FORBIDDEN);
+        assert_eq!(fixture.send(Method::POST, "/style.css", &[("content-type", "multipart/form-data; boundary=x")], Body::from("sample")).await.status, StatusCode::FORBIDDEN);
+        assert_eq!(fixture.get("/style.css", &[("content-type", "text/plain")]).await.status, StatusCode::OK);
+        assert_eq!(fixture.get("/style.css", &[("content-type", "application/json, multipart/form-data")]).await.status, StatusCode::FORBIDDEN);
+        fixture.change(|config| config.vhosts[0].content_type_policy.enabled = false).await;
+        assert_eq!(fixture.get("/style.css", &[("content-type", "multipart/form-data")]).await.status, StatusCode::OK);
+        fixture.stop().await;
+    }
+
+    #[tokio::test]
+    async fn content_type_policy_denies_before_reverse_proxy_upstream_request() {
+        let origin = origin().await;
+        let mut config = config_for(origin.addr, false);
+        config.vhosts[0].content_type_policy = crate::vhost::ContentTypePolicy {
+            enabled: true, blocked: vec!["multipart/form-data".into()],
+        };
+        let fixture = Fixture::new(config).await;
+        let blocked = fixture.send(Method::POST, "/", &[("content-type", "Multipart/Form-Data; boundary=abc")], Body::from("--abc\r\n")).await;
+        assert_eq!(blocked.status, StatusCode::FORBIDDEN);
+        assert_eq!(origin.requests.load(Ordering::Relaxed), 0);
+        let allowed = fixture.get("/", &[("content-type", "application/json")]).await;
+        assert_eq!(allowed.status, StatusCode::OK);
+        assert_eq!(origin.requests.load(Ordering::Relaxed), 1);
+        fixture.stop().await;
+    }
+
     #[tokio::test]
     async fn web_cache_disabled_keeps_get_head_range_conditionals_and_observability() {
         let directory = TempDir::new().unwrap();