v0.31.0

src/cache/tests/http_invalidation_tests.rs

@@ -0,0 +1,41 @@
+mod http_invalidation_tests {
+    use super::*;
+    #[test]
+    fn default_deny_and_strict_ipv4_ipv6_cidr_validation() {
+        let mut cache = Settings::default();
+        assert!(!cache.permits_http_invalidation("127.0.0.1".parse().unwrap()));
+        cache.http_invalidation_allowed_cidrs = vec!["192.0.2.42".into(), "2001:db8:10::/64".into()];
+        cache.validate().unwrap();
+        assert!(cache.permits_http_invalidation("192.0.2.42".parse().unwrap()));
+        assert!(!cache.permits_http_invalidation("192.0.2.43".parse().unwrap()));
+        assert!(cache.permits_http_invalidation("2001:db8:10::1".parse().unwrap()));
+        assert!(!cache.permits_http_invalidation("2001:db8:11::1".parse().unwrap()));
+        for invalid in ["0.0.0.0/0", "::/0", "127.0.0.1; 8.8.8.8", "not-an-ip", "10.0.0.0/33"] {
+            cache.http_invalidation_allowed_cidrs = vec![invalid.into()];
+            assert!(cache.validate().is_err(), "must reject {invalid}");
+        }
+        cache.http_invalidation_allowed_cidrs = vec!["192.0.2.42".into(), "192.0.2.42/32".into()];
+        assert!(cache.validate().is_err(), "duplicate ranges");
+        let old: Settings = serde_json::from_value(serde_json::json!({})).unwrap();
+        assert!(old.http_invalidation_allowed_cidrs.is_empty());
+    }
+    #[test]
+    fn url_qualified_invalidation_matches_only_the_requested_scheme_and_host() {
+        let requested = InvalidationRequest {
+            operation: InvalidationOperation::Purge,
+            selector: InvalidationSelector::Exact,
+            value: "https://a.example/a?v=1".into(),
+            host: Some("a.example".into()),
+            vhost: Some("frontend-1".into()),
+            ttl_seconds: None,
+            confirm_wide: false,
+        };
+        let matcher = normalized_matcher(&requested).unwrap();
+        assert_eq!(matcher.value, "/a?v=1");
+        assert_eq!(matcher.scheme.as_deref(), Some("https"));
+        assert!(host_matches(&matcher, "https", "a.example", "a.example"));
+        assert!(!host_matches(&matcher, "http", "a.example", "a.example"));
+        assert!(!host_matches(&matcher, "https", "b.example", "b.example"));
+    }
+
+}