Files
nezha_domains/model/alertrule_test.go
T
naiba 0759f5c801 fix(alert): prevent divide-by-zero panic and unbounded growth on zero-duration rule
A general alert rule with Duration:0 (accepted by the API, no minimum
validation) drove fail*100/total with total==0, panicking with an integer
divide-by-zero inside checkStatus, which has no recover and would take down the
whole alert goroutine — a config-reachable DoS by any user able to create alert
rules. Skip duration<=0 rules in Check via continue (not boundCheck, which would
pollute hasPassedRule and skip sibling valid rules). Also trim the sample slice
when max<=0 in alertsentinel, otherwise it appended every tick without ever
trimming. Adds regression tests for zero-only and mixed rule sets.
2026-06-05 02:42:49 +00:00

363 lines
7.0 KiB
Go

package model
import (
"slices"
"testing"
)
type arSt struct {
msg string
rule *AlertRule
points [][]bool
expD int
exp bool
}
func TestAlertRules(t *testing.T) {
t.Run("CycleRules", testCycleRules)
t.Run("OfflineRules", testOfflineRules)
t.Run("GeneralRules", testGeneralRules)
t.Run("CombinedRules", testCombinedRules)
}
func testCycleRules(t *testing.T) {
cases := []arSt{
{
rule: &AlertRule{
Rules: []*Rule{
{
Type: "_cycle",
},
},
},
msg: "CyclePass",
points: [][]bool{{false}, {true}},
expD: 1,
exp: true,
},
{
rule: &AlertRule{
Rules: []*Rule{
{
Type: "_cycle",
},
},
},
msg: "CycleFail",
points: [][]bool{{true}, {false}},
expD: 1,
exp: false,
},
}
for _, c := range cases {
d, passed := c.rule.Check(c.points)
assertEq(t, c.msg, c.expD, d)
assertEq(t, c.msg, c.exp, passed)
}
}
func testOfflineRules(t *testing.T) {
cases := []arSt{
{
rule: &AlertRule{
Rules: []*Rule{
{
Type: "offline",
Duration: 10,
},
},
},
msg: "OfflineLast",
points: append([][]bool{{true}}, repeat([]bool{false}, 9)...),
expD: 10,
exp: true,
},
{
rule: &AlertRule{
Rules: []*Rule{
{
Type: "offline",
Duration: 10,
},
},
},
msg: "OfflineMiddle",
points: mod(repeat([]bool{false}, 10), true, 5),
expD: 5,
exp: true,
},
{
rule: &AlertRule{
Rules: []*Rule{
{
Type: "offline",
Duration: 10,
},
},
},
msg: "OfflineFirst",
points: mod(repeat([]bool{false}, 10), true, 9),
expD: 1,
exp: true,
},
{
rule: &AlertRule{
Rules: []*Rule{
{
Type: "offline",
Duration: 10,
},
},
},
msg: "OfflineBoundCheck",
points: repeat([]bool{false}, 9),
expD: 0,
exp: true,
},
}
for _, c := range cases {
d, passed := c.rule.Check(c.points)
assertEq(t, c.msg, c.expD, d)
assertEq(t, c.msg, c.exp, passed)
}
}
func testGeneralRules(t *testing.T) {
cases := []arSt{
{
rule: &AlertRule{
Rules: []*Rule{
{
Duration: 10,
},
},
},
msg: "GeneralFail",
points: repeat([]bool{false}, 10),
expD: 10,
exp: false,
},
{
rule: &AlertRule{
Rules: []*Rule{
{
Duration: 10,
},
},
},
msg: "GeneralFail80%",
points: slices.Concat(repeat([]bool{false}, 8), repeat([]bool{true}, 2)),
expD: 10,
exp: false,
},
{
rule: &AlertRule{
Rules: []*Rule{
{
Duration: 10,
},
},
},
msg: "GeneralPass30%",
points: slices.Concat(repeat([]bool{false}, 7), repeat([]bool{true}, 3)),
expD: 10,
exp: true,
},
{
rule: &AlertRule{
Rules: []*Rule{
{
Duration: 10,
},
},
},
msg: "GeneralPass",
points: slices.Concat(repeat([]bool{false}, 4), repeat([]bool{true}, 6)),
expD: 10,
exp: true,
},
{
rule: &AlertRule{
Rules: []*Rule{
{
Duration: 10,
},
},
},
msg: "GeneralBoundCheck",
points: repeat([]bool{false}, 9),
expD: 0,
exp: true,
},
}
for _, c := range cases {
d, passed := c.rule.Check(c.points)
assertEq(t, c.msg, c.expD, d)
assertEq(t, c.msg, c.exp, passed)
}
}
func testCombinedRules(t *testing.T) {
cases := []arSt{
{
rule: &AlertRule{
Rules: []*Rule{
{
Type: "offline",
Duration: 10,
},
{
Duration: 10,
},
},
},
msg: "OfflineGeneralOfflinePass",
points: slices.Concat(repeat([]bool{false, true}, 2), repeat([]bool{true, false}, 8)),
expD: 1,
exp: true,
},
{
rule: &AlertRule{
Rules: []*Rule{
{
Type: "offline",
Duration: 10,
},
{
Duration: 10,
},
},
},
msg: "OfflineGeneralOfflineFail",
points: slices.Concat(repeat([]bool{false, false}, 2), repeat([]bool{false, true}, 8)),
expD: 10,
exp: true,
},
{
rule: &AlertRule{
Rules: []*Rule{
{
Duration: 10,
},
{
Type: "offline",
Duration: 10,
},
},
},
msg: "GeneralOffline",
points: slices.Concat(repeat([]bool{false, true}, 2), repeat([]bool{true, false}, 8)),
expD: 10,
exp: true,
},
{
rule: &AlertRule{
Rules: []*Rule{
{
Duration: 10,
},
{
Duration: 30,
},
},
},
msg: "GeneralGeneral",
points: slices.Concat(repeat([]bool{false, true}, 2), repeat([]bool{false, false}, 28)),
expD: 30,
exp: false,
},
{
rule: &AlertRule{
Rules: []*Rule{
{
Duration: 10,
},
{
Duration: 30,
},
},
},
msg: "CombinedBoundCheck",
points: slices.Concat(repeat([]bool{false, true}, 2), repeat([]bool{false, false}, 27)),
expD: 10,
exp: true,
},
}
for _, c := range cases {
d, passed := c.rule.Check(c.points)
assertEq(t, c.msg, c.expD, d)
assertEq(t, c.msg, c.exp, passed)
}
}
func repeat[S ~[]E, E any](x S, count int) []S {
var slices []S
for range count {
tmp := make([]E, len(x))
copy(tmp, x)
slices = append(slices, tmp)
}
return slices
}
func mod[S ~[][]E, E any](x S, val E, i int) S {
x[i][0] = val
return x
}
func assertEq(t *testing.T, msg string, exp, act any) {
t.Helper()
if exp != act {
t.Fatalf("failed to test for %s. exp=[%v] but act=[%v]", msg, exp, act)
}
}
// TestAlertRule_ZeroDurationGeneralRule guards against a config-reachable DoS:
// a general rule with Duration:0 (the API validates Duration as "optional" with
// no minimum) previously hit fail*100/total with total==0, panicking with an
// integer divide-by-zero inside checkStatus — which has no recover and would
// take down the whole alert goroutine. boundCheck now treats duration<=0 as a
// passed (no-op) rule, so Check must return without panicking.
func TestAlertRule_ZeroDurationGeneralRule(t *testing.T) {
defer func() {
if r := recover(); r != nil {
t.Fatalf("Check panicked on a Duration:0 general rule (config-reachable DoS): %v", r)
}
}()
rule := &AlertRule{
Rules: []*Rule{{Type: "cpu", Duration: 0}},
}
// The only contract here is "do not panic". A zero-duration rule is skipped,
// so it contributes nothing to the verdict and max stays 0.
maxD, _ := rule.Check([][]bool{{true}, {false}})
if maxD != 0 {
t.Fatalf("a skipped Duration:0 rule must not contribute to max, got %d", maxD)
}
}
// Mixing a valid rule with a zero-duration rule must also be safe: the zero
// rule is skipped, the real rule still drives the verdict.
func TestAlertRule_ZeroDurationMixedWithValidRule(t *testing.T) {
defer func() {
if r := recover(); r != nil {
t.Fatalf("Check panicked on a mixed zero/valid rule set: %v", r)
}
}()
rule := &AlertRule{
Rules: []*Rule{
{Type: "cpu", Duration: 0},
{Type: "cpu", Duration: 3},
},
}
maxD, _ := rule.Check([][]bool{{true, false}, {true, false}, {true, false}})
if maxD != 3 {
t.Fatalf("the valid Duration:3 rule must still set max=3, got %d", maxD)
}
}