v0.25.1

src/basic_auth/tests.rs

@@ -0,0 +1,79 @@
+mod tests {
+    use super::*;
+    #[test]
+    fn rejects_ambiguous_headers_and_injection() {
+        let mut h = HeaderMap::new();
+        h.insert(
+            "authorization",
+            HeaderValue::from_static("Basic dXNlcjpwYXNz"),
+        );
+        assert_eq!(credentials(&h).unwrap().0, "user");
+        h.append(
+            "authorization",
+            HeaderValue::from_static("Basic dXNlcjpwYXNz"),
+        );
+        assert!(credentials(&h).is_none());
+        assert!(Settings {
+            realm: "bad\r\nheader".into(),
+            ..Default::default()
+        }
+        .compile()
+        .is_err());
+        assert!(Settings {
+            enabled: true,
+            ..Default::default()
+        }
+        .compile()
+        .is_err());
+    }
+    #[tokio::test]
+    async fn validates_and_strips_or_forwards_only_verified_credentials() {
+        let hash = crate::auth::hash_password_offline("sufficiently-long-password".into())
+            .await
+            .unwrap();
+        let mut settings = Settings {
+            enabled: true,
+            users: vec![User {
+                username: "alice".into(),
+                password_hash: hash,
+            }],
+            ..Default::default()
+        };
+        for forward in [false, true] {
+            settings.forward_credentials = forward;
+            let auth = settings.compile().unwrap().unwrap();
+            let mut h = HeaderMap::new();
+            let raw = HeaderValue::from_str(&format!(
+                "Basic {}",
+                STANDARD.encode("alice:sufficiently-long-password")
+            ))
+            .unwrap();
+            h.insert("authorization", raw.clone());
+            h.insert("remote-user", HeaderValue::from_static("spoof"));
+            let verified = auth
+                .authorize(
+                    &mut h,
+                    true,
+                    "127.0.0.1".parse().unwrap(),
+                    Arc::new(Semaphore::new(2)),
+                    &Limits::default(),
+                )
+                .await
+                .unwrap();
+            assert!(!h.contains_key("authorization"));
+            auth.apply_upstream(&mut h, verified);
+            assert_eq!(h.get("authorization"), forward.then_some(&raw));
+            assert!(!h.contains_key("remote-user"));
+        }
+    }
+    #[test]
+    fn bounds_ip_limiter() {
+        let limits = Limits::default();
+        let ip = "127.0.0.1".parse().unwrap();
+        for _ in 0..10 {
+            limits.failed(ip);
+        }
+        assert!(limits.blocked(ip));
+        assert!(!limits.blocked("127.0.0.2".parse().unwrap()));
+    }
+}