mirror of
https://github.com/Buriburizaem0n/nezha_domains.git
synced 2026-11-04 16:40:21 +00:00
xvkong233
3ad985f36e
The initial selective strip covered only the Authorization header, but the dashboard also accepts its JWT via the ?token= query parameter and the nz-jwt cookie (jwt.go TokenLookup channels). A dashboard credential arriving through those channels would still reach a NAT backend. Apply the same classify-then-strip rule to all three channels at NAT ingress: values verified as dashboard-issued are removed, foreign values are preserved byte-for-byte. Adds a ServeNAT flow test exercising the live classifier and a wiring test pinning the gate injection in main().
28 lines
977 B
Go
28 lines
977 B
Go
package main
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/nezhahq/nezha/cmd/dashboard/rpc"
|
|
)
|
|
|
|
// TestWireNATDashboardCredentialGate pins the NAT ingress wiring contract:
|
|
// main() must connect the real dashboard-credential classifiers
|
|
// (controller.IsDashboardCredential / controller.IsDashboardCredentialValue)
|
|
// through wireNATDashboardCredentialGate before any listener serves traffic.
|
|
// That the wired functions really classify per channel is pinned end to end
|
|
// by the controller package's real-classifier NAT flow test.
|
|
func TestWireNATDashboardCredentialGate(t *testing.T) {
|
|
if rpc.NATDashboardCredentialGateWired() {
|
|
t.Fatal("NAT dashboard credential gate already wired before the test")
|
|
}
|
|
|
|
wireNATDashboardCredentialGate()
|
|
|
|
if !rpc.NATDashboardCredentialGateWired() {
|
|
t.Fatal("wireNATDashboardCredentialGate left the NAT dashboard credential gate unwired")
|
|
}
|
|
// Leave the process in the wired state main() establishes.
|
|
t.Cleanup(wireNATDashboardCredentialGate)
|
|
}
|