bbs.profullstack/agentbbs
1
0
Fork 0
mirror of https://github.com/profullstack/agentbbs.git synced 2026-08-13 22:37:28 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 3

Require POST for file web mutations (#82)
Some checks failed
CI / build (push) Has been cancelled
Details
deploy / deploy (push) Has been cancelled
Details
test / test (push) Has been cancelled
Details

Browse source
This commit is contained in:
Luna Ops 2026-07-07 20:41:16 +08:00 • committed by GitHub
parent ee06082ce1
commit ff9eef907d
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
2 changed files with 50 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

32
internal/files/web_test.go
View file

@ -124,6 +124,38 @@ func TestWebRoundTrip(t *testing.T) {
}
}
func TestWebMutationsRejectGet(t *testing.T) {
h, _ := webTestHandler(t)
cookie := loginCookie(t, h)
uploadTo(t, h, cookie, "/me", "keep.txt", "keep me")
for _, target := range []string{
"/upload?dir=/me",
"/mkdir?dir=/me&name=from-get",
"/delete?path=/me/keep.txt",
} {
rr := httptest.NewRecorder()
req := httptest.NewRequest(http.MethodGet, target, nil)
req.AddCookie(cookie)
h.ServeHTTP(rr, req)
if rr.Code != http.StatusMethodNotAllowed {
t.Fatalf("GET %s: want 405, got %d", target, rr.Code)
}
}
rr := httptest.NewRecorder()
req := httptest.NewRequest(http.MethodGet, "/?path=/me", nil)
req.AddCookie(cookie)
h.ServeHTTP(rr, req)
body := rr.Body.String()
if !strings.Contains(body, "keep.txt") {
t.Fatal("GET /delete removed the file")
}
if strings.Contains(body, "from-get") {
t.Fatal("GET /mkdir created a directory")
}
}
// loginCookie logs alice in and returns her session cookie.
func loginCookie(t *testing.T, h http.Handler) *http.Cookie {
t.Helper()