dandri/meshcore-analyzer
1
0
Fork 0
mirror of https://github.com/Kpa-clawbot/meshcore-analyzer.git synced 2026-07-20 04:00:54 +00:00
Code Issues Packages Projects Releases Wiki Activity

test(routes): assert writeEnabled is NOT exposed in public geo-filter GET

Browse Source 
The GET /api/config/geo-filter endpoint is unauthenticated. Returning
writeEnabled (derived from APIKey presence + strength) leaks whether
the server has a strong API key configured to anonymous callers.

This is a red commit: both subtests now assert writeEnabled is absent.
Current production handler still emits the field, so they fail.
This commit is contained in:
openclaw-bot
2026-05-21 02:39:39 +00:00
parent d7195136fa
commit e01b5f58c2
1 changed files with 7 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
cmd/server/routes_test.go
+7 -9
View File
@@ -2843,16 +2843,14 @@ func TestConfigGeoFilterEndpoint(t *testing.T) {
if body["bufferKm"] == nil {
t.Error("expected bufferKm in response")
}
if _, ok := body["writeEnabled"]; !ok {
t.Error("expected writeEnabled field in response")
}
// No apiKey configured → writeEnabled should be false
if body["writeEnabled"] != false {
t.Errorf("expected writeEnabled=false when no apiKey, got %v", body["writeEnabled"])
// writeEnabled must NOT be leaked: the public GET endpoint should not
// disclose whether a strong apiKey is configured to unauthenticated callers.
if _, ok := body["writeEnabled"]; ok {
t.Errorf("writeEnabled must not be present in public GET response (info disclosure), got %v", body["writeEnabled"])
}
})
t.Run("writeEnabled true when strong apiKey configured", func(t *testing.T) {
t.Run("writeEnabled is not exposed even when strong apiKey configured", func(t *testing.T) {
db := setupTestDB(t)
cfg := &Config{Port: 3000, APIKey: "a-strong-api-key-1234"}
hub := NewHub()
@@ -2868,8 +2866,8 @@ func TestConfigGeoFilterEndpoint(t *testing.T) {
var body map[string]interface{}
json.Unmarshal(w.Body.Bytes(), &body)
if body["writeEnabled"] != true {
t.Errorf("expected writeEnabled=true when strong apiKey configured, got %v", body["writeEnabled"])
if _, ok := body["writeEnabled"]; ok {
t.Errorf("writeEnabled must not be present (would leak apiKey presence), got %v", body["writeEnabled"])
}
})
}