smail
f60d3b0880
Some checks are pending
Security Checks / security (push) Waiting to run
统一 frontend、backend、test、test-log 和 out 目录，更新构建、部署及测试入口；纳入配置管理兼容与首次安全引导修复；排除本机配置、密钥和测试产物。
53 lines
1.5 KiB
Go
53 lines
1.5 KiB
Go
package externalemail
|
|
|
|
import (
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestVaultEncryptsAndFingerprintsWithoutPlaintext(t *testing.T) {
|
|
vault := NewVaultWithKeys([]byte(strings.Repeat("a", 32)), []byte(strings.Repeat("b", 32)))
|
|
ciphertext, err := vault.Encrypt("User@example.com")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if strings.Contains(ciphertext, "User@example.com") || strings.Contains(ciphertext, "user@example.com") {
|
|
t.Fatal("ciphertext contains plaintext email")
|
|
}
|
|
first, err := vault.Fingerprint("User@example.com")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
second, err := vault.Fingerprint("user@example.com")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
if !EqualFingerprint(first, second) {
|
|
t.Fatal("normalized fingerprints differ")
|
|
}
|
|
decrypted, err := vault.Decrypt(ciphertext)
|
|
if err != nil || decrypted != "user@example.com" {
|
|
t.Fatalf("decrypted email = %q, error = %v", decrypted, err)
|
|
}
|
|
}
|
|
|
|
func TestVaultRejectsTamperingAndInvalidEmail(t *testing.T) {
|
|
vault := NewVaultWithKeys([]byte(strings.Repeat("a", 32)), []byte(strings.Repeat("b", 32)))
|
|
if _, err := vault.Encrypt("bad"); err == nil {
|
|
t.Fatal("invalid email accepted")
|
|
}
|
|
ciphertext, err := vault.Encrypt("user@example.com")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
last := ciphertext[len(ciphertext)-1]
|
|
replacement := byte('A')
|
|
if last == replacement {
|
|
replacement = 'B'
|
|
}
|
|
tampered := ciphertext[:len(ciphertext)-1] + string(replacement)
|
|
if _, err := vault.Decrypt(tampered); err == nil {
|
|
t.Fatal("tampered ciphertext accepted")
|
|
}
|
|
}
|