spikard 0.3.6 → 0.5.0

data/vendor/crates/spikard-http/src/cors.rs

@@ -487,4 +487,519 @@ mod tests {
         let result = validate_cors_request(&headers, &config);
         assert!(result.is_ok());
     }
+
+    // SECURITY TESTS: CORS Attack Vectors
+
+    /// SECURITY TEST: Verify credentials=true with wildcard is caught
+    /// This is a critical vulnerability - RFC 6454 forbids this
+    #[test]
+    fn test_credentials_with_wildcard_config_is_security_issue() {
+        let config = CorsConfig {
+            allowed_origins: vec!["*".to_string()],
+            allowed_methods: vec!["GET".to_string()],
+            allowed_headers: vec![],
+            expose_headers: None,
+            max_age: None,
+            allow_credentials: Some(true), // SECURITY BUG: This should not be allowed with wildcard
+        };
+
+        let mut headers = HeaderMap::new();
+        headers.insert("origin", HeaderValue::from_static("https://evil.com"));
+        headers.insert("access-control-request-method", HeaderValue::from_static("GET"));
+
+        let result = handle_preflight(&headers, &config);
+
+        // BUG: This should return 500 or reject the config, but instead succeeds
+        if let Ok(response) = result {
+            let resp_headers = response.headers();
+            let has_credentials = resp_headers
+                .get("access-control-allow-credentials")
+                .map(|v| v == "true")
+                .unwrap_or(false);
+            let origin_header = resp_headers.get("access-control-allow-origin");
+
+            if has_credentials && origin_header.is_some() {
+                let origin_val = origin_header.unwrap().to_str().unwrap_or("");
+                if origin_val == "*" {
+                    panic!("SECURITY VULNERABILITY: credentials=true with origin=* allowed");
+                }
+            }
+        }
+    }
+
+    /// SECURITY TEST: Exact origin matching required
+    /// Subdomain like api.evil.example.com must NOT match example.com
+    #[test]
+    fn test_subdomain_bypass_blocked() {
+        let config = CorsConfig {
+            allowed_origins: vec!["https://example.com".to_string()],
+            allowed_methods: vec!["GET".to_string()],
+            allowed_headers: vec![],
+            expose_headers: None,
+            max_age: None,
+            allow_credentials: None,
+        };
+
+        assert!(!is_origin_allowed("https://api.example.com", &config.allowed_origins));
+        assert!(!is_origin_allowed("https://evil.example.com", &config.allowed_origins));
+        assert!(!is_origin_allowed(
+            "https://sub.sub.example.com",
+            &config.allowed_origins
+        ));
+
+        assert!(is_origin_allowed("https://example.com", &config.allowed_origins));
+    }
+
+    /// SECURITY TEST: Port exact matching required
+    /// localhost:3001 must NOT match localhost:3000
+    #[test]
+    fn test_port_bypass_blocked() {
+        let config = CorsConfig {
+            allowed_origins: vec!["http://localhost:3000".to_string()],
+            allowed_methods: vec!["GET".to_string()],
+            allowed_headers: vec![],
+            expose_headers: None,
+            max_age: None,
+            allow_credentials: None,
+        };
+
+        assert!(!is_origin_allowed("http://localhost:3001", &config.allowed_origins));
+        assert!(!is_origin_allowed("http://localhost:8080", &config.allowed_origins));
+        assert!(!is_origin_allowed("http://localhost:443", &config.allowed_origins));
+
+        assert!(is_origin_allowed("http://localhost:3000", &config.allowed_origins));
+    }
+
+    /// SECURITY TEST: Protocol exact matching required
+    /// http://example.com must NOT match https://example.com
+    #[test]
+    fn test_protocol_downgrade_attack_blocked() {
+        let config = CorsConfig {
+            allowed_origins: vec!["https://example.com".to_string()],
+            allowed_methods: vec!["GET".to_string()],
+            allowed_headers: vec![],
+            expose_headers: None,
+            max_age: None,
+            allow_credentials: None,
+        };
+
+        assert!(!is_origin_allowed("http://example.com", &config.allowed_origins));
+        assert!(!is_origin_allowed("ws://example.com", &config.allowed_origins));
+        assert!(!is_origin_allowed("wss://example.com", &config.allowed_origins));
+
+        assert!(is_origin_allowed("https://example.com", &config.allowed_origins));
+    }
+
+    /// SECURITY TEST: Case sensitivity in origin matching
+    /// Origins should match exactly (including case)
+    #[test]
+    fn test_case_sensitive_origin_matching() {
+        let config = CorsConfig {
+            allowed_origins: vec!["https://Example.Com".to_string()],
+            allowed_methods: vec!["GET".to_string()],
+            allowed_headers: vec![],
+            expose_headers: None,
+            max_age: None,
+            allow_credentials: None,
+        };
+
+        assert!(!is_origin_allowed("https://example.com", &config.allowed_origins));
+        assert!(!is_origin_allowed("https://EXAMPLE.COM", &config.allowed_origins));
+
+        assert!(is_origin_allowed("https://Example.Com", &config.allowed_origins));
+    }
+
+    /// SECURITY TEST: Trailing slash normalization
+    /// https://example.com/ should be treated differently from https://example.com
+    #[test]
+    fn test_trailing_slash_origin_not_normalized() {
+        let config = CorsConfig {
+            allowed_origins: vec!["https://example.com".to_string()],
+            allowed_methods: vec!["GET".to_string()],
+            allowed_headers: vec![],
+            expose_headers: None,
+            max_age: None,
+            allow_credentials: None,
+        };
+
+        assert!(!is_origin_allowed("https://example.com/", &config.allowed_origins));
+
+        assert!(is_origin_allowed("https://example.com", &config.allowed_origins));
+    }
+
+    /// SECURITY TEST: NULL origin and wildcard behavior
+    /// Special "null" origin used by file:// and sandboxed iframes
+    /// The current implementation treats "null" as a regular origin string,
+    /// which means it IS allowed by wildcard (not ideal but documents current behavior)
+    #[test]
+    fn test_null_origin_with_wildcard() {
+        let config = CorsConfig {
+            allowed_origins: vec!["*".to_string()],
+            allowed_methods: vec!["GET".to_string()],
+            allowed_headers: vec![],
+            expose_headers: None,
+            max_age: None,
+            allow_credentials: None,
+        };
+
+        // SECURITY NOTE: "null" origin is allowed by wildcard in current implementation
+        assert!(is_origin_allowed("null", &config.allowed_origins));
+
+        let with_explicit_null = CorsConfig {
+            allowed_origins: vec!["null".to_string()],
+            allowed_methods: vec!["GET".to_string()],
+            allowed_headers: vec![],
+            expose_headers: None,
+            max_age: None,
+            allow_credentials: None,
+        };
+        assert!(is_origin_allowed("null", &with_explicit_null.allowed_origins));
+    }
+
+    /// SECURITY TEST: Empty origin is always rejected
+    #[test]
+    fn test_empty_origin_always_rejected() {
+        let config_with_wildcard = CorsConfig {
+            allowed_origins: vec!["*".to_string()],
+            allowed_methods: vec!["GET".to_string()],
+            allowed_headers: vec![],
+            expose_headers: None,
+            max_age: None,
+            allow_credentials: None,
+        };
+        assert!(!is_origin_allowed("", &config_with_wildcard.allowed_origins));
+
+        let config_with_explicit = CorsConfig {
+            allowed_origins: vec!["https://example.com".to_string()],
+            allowed_methods: vec!["GET".to_string()],
+            allowed_headers: vec![],
+            expose_headers: None,
+            max_age: None,
+            allow_credentials: None,
+        };
+        assert!(!is_origin_allowed("", &config_with_explicit.allowed_origins));
+    }
+
+    /// SECURITY TEST: Preflight with invalid origin should reject
+    #[test]
+    fn test_preflight_rejects_invalid_origin() {
+        let config = make_cors_config();
+        let mut headers = HeaderMap::new();
+        headers.insert("origin", HeaderValue::from_static("https://untrusted.com"));
+        headers.insert("access-control-request-method", HeaderValue::from_static("POST"));
+
+        let result = handle_preflight(&headers, &config);
+        assert!(result.is_err());
+
+        let response = *result.unwrap_err();
+        assert_eq!(response.status(), StatusCode::FORBIDDEN);
+    }
+
+    /// SECURITY TEST: Multiple origins - each must be exact match
+    #[test]
+    fn test_multiple_origins_exact_matching() {
+        let config = CorsConfig {
+            allowed_origins: vec!["https://trusted1.com".to_string(), "https://trusted2.com".to_string()],
+            allowed_methods: vec!["GET".to_string()],
+            allowed_headers: vec![],
+            expose_headers: None,
+            max_age: None,
+            allow_credentials: None,
+        };
+
+        assert!(is_origin_allowed("https://trusted1.com", &config.allowed_origins));
+        assert!(is_origin_allowed("https://trusted2.com", &config.allowed_origins));
+
+        assert!(!is_origin_allowed(
+            "https://trusted1.com.evil.com",
+            &config.allowed_origins
+        ));
+        assert!(!is_origin_allowed("https://trusted3.com", &config.allowed_origins));
+        assert!(!is_origin_allowed("https://trusted.com", &config.allowed_origins));
+    }
+
+    /// SECURITY TEST: Wildcard origin should allow any origin (but check config)
+    #[test]
+    fn test_wildcard_allows_all_but_check_credentials() {
+        let config = CorsConfig {
+            allowed_origins: vec!["*".to_string()],
+            allowed_methods: vec!["GET".to_string()],
+            allowed_headers: vec![],
+            expose_headers: None,
+            max_age: None,
+            allow_credentials: None,
+        };
+
+        assert!(is_origin_allowed("https://example.com", &config.allowed_origins));
+        assert!(is_origin_allowed("https://evil.com", &config.allowed_origins));
+        assert!(is_origin_allowed("http://localhost:3000", &config.allowed_origins));
+
+        assert!(!is_origin_allowed("", &config.allowed_origins));
+    }
+
+    /// SECURITY TEST: Preflight response headers must match config exactly
+    #[test]
+    fn test_preflight_response_has_correct_allowed_origins() {
+        let config = CorsConfig {
+            allowed_origins: vec!["https://trusted.com".to_string()],
+            allowed_methods: vec!["GET".to_string(), "POST".to_string()],
+            allowed_headers: vec!["content-type".to_string()],
+            expose_headers: None,
+            max_age: Some(3600),
+            allow_credentials: Some(false),
+        };
+
+        let mut headers = HeaderMap::new();
+        headers.insert("origin", HeaderValue::from_static("https://trusted.com"));
+        headers.insert("access-control-request-method", HeaderValue::from_static("POST"));
+        headers.insert(
+            "access-control-request-headers",
+            HeaderValue::from_static("content-type"),
+        );
+
+        let result = handle_preflight(&headers, &config);
+        assert!(result.is_ok());
+
+        let response = result.unwrap();
+        let resp_headers = response.headers();
+
+        assert_eq!(
+            resp_headers.get("access-control-allow-origin").unwrap(),
+            "https://trusted.com"
+        );
+
+        assert!(
+            resp_headers
+                .get("access-control-allow-methods")
+                .unwrap()
+                .to_str()
+                .unwrap()
+                .contains("GET")
+        );
+        assert!(
+            resp_headers
+                .get("access-control-allow-methods")
+                .unwrap()
+                .to_str()
+                .unwrap()
+                .contains("POST")
+        );
+
+        assert!(resp_headers.get("access-control-allow-credentials").is_none());
+    }
+
+    /// SECURITY TEST: Origin not in allowed list must be rejected in preflight
+    #[test]
+    fn test_preflight_all_origins_require_validation() {
+        let config = CorsConfig {
+            allowed_origins: vec!["https://trusted.com".to_string()],
+            allowed_methods: vec!["GET".to_string()],
+            allowed_headers: vec![],
+            expose_headers: None,
+            max_age: None,
+            allow_credentials: None,
+        };
+
+        let test_cases = vec![
+            "https://trusted.com",
+            "https://evil.com",
+            "https://trusted.com.evil",
+            "http://trusted.com",
+            "",
+        ];
+
+        for origin in test_cases {
+            let mut headers = HeaderMap::new();
+            headers.insert(
+                "origin",
+                HeaderValue::from_str(origin).unwrap_or_else(|_| HeaderValue::from_static("")),
+            );
+            headers.insert("access-control-request-method", HeaderValue::from_static("GET"));
+
+            let result = handle_preflight(&headers, &config);
+
+            if origin == "https://trusted.com" {
+                assert!(result.is_ok(), "Valid origin {} should be allowed", origin);
+            } else {
+                assert!(result.is_err(), "Invalid origin {} should be rejected", origin);
+            }
+        }
+    }
+
+    /// SECURITY TEST: Requested headers must be in allowed list
+    #[test]
+    fn test_preflight_validates_all_requested_headers() {
+        let config = CorsConfig {
+            allowed_origins: vec!["https://trusted.com".to_string()],
+            allowed_methods: vec!["POST".to_string()],
+            allowed_headers: vec!["content-type".to_string(), "authorization".to_string()],
+            expose_headers: None,
+            max_age: None,
+            allow_credentials: None,
+        };
+
+        let test_cases = vec![
+            ("content-type", true),
+            ("authorization", true),
+            ("content-type, authorization", true),
+            ("x-custom-header", false),
+            ("content-type, x-custom", false),
+        ];
+
+        for (headers_str, should_pass) in test_cases {
+            let mut headers = HeaderMap::new();
+            headers.insert("origin", HeaderValue::from_static("https://trusted.com"));
+            headers.insert("access-control-request-method", HeaderValue::from_static("POST"));
+            headers.insert(
+                "access-control-request-headers",
+                HeaderValue::from_str(headers_str).unwrap(),
+            );
+
+            let result = handle_preflight(&headers, &config);
+
+            if should_pass {
+                assert!(
+                    result.is_ok(),
+                    "Preflight with valid headers '{}' should pass",
+                    headers_str
+                );
+            } else {
+                assert!(
+                    result.is_err(),
+                    "Preflight with invalid headers '{}' should fail",
+                    headers_str
+                );
+            }
+        }
+    }
+
+    /// SECURITY TEST: add_cors_headers should respect origin validation
+    #[test]
+    fn test_add_cors_headers_respects_origin() {
+        let config = CorsConfig {
+            allowed_origins: vec!["https://trusted.com".to_string()],
+            allowed_methods: vec!["GET".to_string()],
+            allowed_headers: vec![],
+            expose_headers: Some(vec!["x-custom".to_string()]),
+            max_age: None,
+            allow_credentials: Some(true),
+        };
+
+        let mut response = Response::new(Body::empty());
+
+        add_cors_headers(&mut response, "https://trusted.com", &config);
+
+        let headers = response.headers();
+        assert_eq!(
+            headers.get("access-control-allow-origin").unwrap(),
+            "https://trusted.com"
+        );
+        assert_eq!(headers.get("access-control-expose-headers").unwrap(), "x-custom");
+        assert_eq!(headers.get("access-control-allow-credentials").unwrap(), "true");
+    }
+
+    /// SECURITY TEST: validate_cors_request respects allowed origins
+    #[test]
+    fn test_validate_cors_request_origin_must_match() {
+        let config = CorsConfig {
+            allowed_origins: vec!["https://trusted.com".to_string()],
+            allowed_methods: vec!["GET".to_string()],
+            allowed_headers: vec![],
+            expose_headers: None,
+            max_age: None,
+            allow_credentials: None,
+        };
+
+        let mut headers = HeaderMap::new();
+        headers.insert("origin", HeaderValue::from_static("https://trusted.com"));
+        assert!(validate_cors_request(&headers, &config).is_ok());
+
+        let mut headers = HeaderMap::new();
+        headers.insert("origin", HeaderValue::from_static("https://evil.com"));
+        assert!(validate_cors_request(&headers, &config).is_err());
+
+        let headers = HeaderMap::new();
+        assert!(validate_cors_request(&headers, &config).is_ok());
+    }
+
+    /// SECURITY TEST: Preflight without requested method should fail
+    #[test]
+    fn test_preflight_requires_access_control_request_method() {
+        let config = make_cors_config();
+        let mut headers = HeaderMap::new();
+        headers.insert("origin", HeaderValue::from_static("https://example.com"));
+
+        let result = handle_preflight(&headers, &config);
+        assert!(result.is_ok());
+    }
+
+    /// SECURITY TEST: Case-insensitive method matching
+    #[test]
+    fn test_preflight_method_case_insensitive() {
+        let config = CorsConfig {
+            allowed_origins: vec!["https://example.com".to_string()],
+            allowed_methods: vec!["GET".to_string(), "POST".to_string()],
+            allowed_headers: vec![],
+            expose_headers: None,
+            max_age: None,
+            allow_credentials: None,
+        };
+
+        let test_cases = vec!["GET", "get", "Get", "POST", "post"];
+
+        for method in test_cases {
+            let mut headers = HeaderMap::new();
+            headers.insert("origin", HeaderValue::from_static("https://example.com"));
+            headers.insert("access-control-request-method", HeaderValue::from_str(method).unwrap());
+
+            let result = handle_preflight(&headers, &config);
+            assert!(
+                result.is_ok(),
+                "Method '{}' should be allowed (case-insensitive)",
+                method
+            );
+        }
+    }
+
+    /// SECURITY TEST: Ensure preflight max-age is set correctly
+    #[test]
+    fn test_preflight_max_age_header() {
+        let config = CorsConfig {
+            allowed_origins: vec!["https://example.com".to_string()],
+            allowed_methods: vec!["GET".to_string()],
+            allowed_headers: vec![],
+            expose_headers: None,
+            max_age: Some(7200),
+            allow_credentials: None,
+        };
+
+        let mut headers = HeaderMap::new();
+        headers.insert("origin", HeaderValue::from_static("https://example.com"));
+        headers.insert("access-control-request-method", HeaderValue::from_static("GET"));
+
+        let result = handle_preflight(&headers, &config);
+        assert!(result.is_ok());
+
+        let response = result.unwrap();
+        assert_eq!(response.headers().get("access-control-max-age").unwrap(), "7200");
+    }
+
+    /// SECURITY TEST: Wildcard partial patterns should not work
+    /// *.example.com style patterns are not supported (good!)
+    #[test]
+    fn test_wildcard_patterns_not_supported() {
+        let config = CorsConfig {
+            allowed_origins: vec!["*.example.com".to_string()],
+            allowed_methods: vec!["GET".to_string()],
+            allowed_headers: vec![],
+            expose_headers: None,
+            max_age: None,
+            allow_credentials: None,
+        };
+
+        assert!(!is_origin_allowed("https://api.example.com", &config.allowed_origins));
+        assert!(!is_origin_allowed("https://example.com", &config.allowed_origins));
+
+        assert!(is_origin_allowed("*.example.com", &config.allowed_origins));
+    }
 }

data/vendor/crates/spikard-http/src/debug.rs

@@ -61,3 +61,68 @@ macro_rules! debug_log_value {
         }
     };
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::sync::Mutex;
+    use std::sync::atomic::Ordering;
+
+    static FLAG_LOCK: Mutex<()> = Mutex::new(());
+
+    struct DebugFlagGuard {
+        previous_flag: bool,
+        previous_env: Option<String>,
+    }
+
+    impl Drop for DebugFlagGuard {
+        fn drop(&mut self) {
+            DEBUG_ENABLED.store(self.previous_flag, Ordering::Relaxed);
+            if let Some(prev) = &self.previous_env {
+                unsafe { std::env::set_var("SPIKARD_DEBUG", prev) };
+            } else {
+                unsafe { std::env::remove_var("SPIKARD_DEBUG") };
+            }
+        }
+    }
+
+    #[test]
+    fn init_enables_debug_when_requested() {
+        let _lock = FLAG_LOCK.lock().unwrap();
+        let previous = DEBUG_ENABLED.load(Ordering::Relaxed);
+        let previous_env = std::env::var("SPIKARD_DEBUG").ok();
+        let _guard = DebugFlagGuard {
+            previous_flag: previous,
+            previous_env,
+        };
+
+        unsafe { std::env::set_var("SPIKARD_DEBUG", "1") };
+
+        init();
+
+        assert!(is_enabled(), "init should enable debug in test builds");
+    }
+
+    #[test]
+    fn macros_respect_debug_flag() {
+        let _lock = FLAG_LOCK.lock().unwrap();
+        let previous = DEBUG_ENABLED.load(Ordering::Relaxed);
+        let previous_env = std::env::var("SPIKARD_DEBUG").ok();
+        let _guard = DebugFlagGuard {
+            previous_flag: previous,
+            previous_env,
+        };
+
+        DEBUG_ENABLED.store(false, Ordering::Relaxed);
+        debug_log!("should not print while disabled");
+        debug_log_module!("middleware", "disabled branch");
+        debug_log_value!("key", 1_u8);
+        assert!(!is_enabled());
+
+        DEBUG_ENABLED.store(true, Ordering::Relaxed);
+        debug_log!("now printing {}", 2);
+        debug_log_module!("router", "enabled branch");
+        debug_log_value!("value", 3_i32);
+        assert!(is_enabled());
+    }
+}