87 lines
3.2 KiB
Go
87 lines
3.2 KiB
Go
package wechatcallback
|
|
|
|
import (
|
|
"crypto/sha256"
|
|
"encoding/base64"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestWriteAuthorizationResult(t *testing.T) {
|
|
for _, test := range []struct {
|
|
name string
|
|
authorized bool
|
|
status int
|
|
message string
|
|
}{
|
|
{"authorized", true, http.StatusOK, "等待确认绑定"},
|
|
{"expired", false, http.StatusBadRequest, "请重新扫码"},
|
|
} {
|
|
t.Run(test.name, func(t *testing.T) {
|
|
response := httptest.NewRecorder()
|
|
Write(response, test.authorized)
|
|
if response.Code != test.status {
|
|
t.Fatalf("授权结果状态码错误：%d", response.Code)
|
|
}
|
|
body := response.Body.String()
|
|
for _, expected := range []string{test.message, `lang="zh-CN"`, `width=device-width, initial-scale=1`, "回到发起扫码的 Smail 页面", "<style>" + pageCSS + "</style>"} {
|
|
if !strings.Contains(body, expected) {
|
|
t.Fatalf("结果页缺少预期内容：%s", expected)
|
|
}
|
|
}
|
|
for _, forbidden := range []string{"<script", "<iframe", "<form", "http://", "https://", "#ZgotmplZ", "&#x", "绑定成功"} {
|
|
if strings.Contains(body, forbidden) {
|
|
t.Fatalf("结果页包含不应出现的内容：%s", forbidden)
|
|
}
|
|
}
|
|
if test.authorized && !strings.Contains(body, "本次授权不会自动绑定账号") {
|
|
t.Fatal("授权成功页面必须明确仍需原会话确认")
|
|
}
|
|
if strings.Count(body, `<li>`) != 2 {
|
|
t.Fatal("结果页应仅展示两步操作指引")
|
|
}
|
|
for _, expected := range []string{`aria-labelledby="next-step-title"`, `id="next-step-title"`, "无需在微信中登录 Smail"} {
|
|
if !strings.Contains(body, expected) {
|
|
t.Fatalf("结果页缺少操作引导：%s", expected)
|
|
}
|
|
}
|
|
if test.authorized && (!strings.Contains(body, "核对微信昵称") || !strings.Contains(body, "「确认绑定」")) {
|
|
t.Fatal("授权成功页面必须引导核对昵称并手动确认")
|
|
}
|
|
if !test.authorized && !strings.Contains(body, "以原页面状态为准") {
|
|
t.Fatal("失效页面不能将重复回调误报为已经解除绑定")
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestWriteResultSecurityHeaders(t *testing.T) {
|
|
for _, authorized := range []bool{true, false} {
|
|
response := httptest.NewRecorder()
|
|
Write(response, authorized)
|
|
for name, expected := range map[string]string{
|
|
"Content-Type": "text/html; charset=utf-8",
|
|
"Cache-Control": "no-store",
|
|
"Referrer-Policy": "no-referrer",
|
|
"X-Content-Type-Options": "nosniff",
|
|
"X-Frame-Options": "DENY",
|
|
} {
|
|
if response.Header().Get(name) != expected {
|
|
t.Fatalf("结果页安全响应头不符：%s", name)
|
|
}
|
|
}
|
|
digest := sha256.Sum256([]byte(pageCSS))
|
|
policy := response.Header().Get("Content-Security-Policy")
|
|
for _, expected := range []string{"default-src 'none'", "base-uri 'none'", "form-action 'none'", "frame-ancestors 'none'", "style-src 'sha256-" + base64.StdEncoding.EncodeToString(digest[:]) + "'"} {
|
|
if !strings.Contains(policy, expected) {
|
|
t.Fatalf("结果页内容安全策略缺少约束：%s", expected)
|
|
}
|
|
}
|
|
if strings.Contains(policy, "unsafe-inline") {
|
|
t.Fatal("仅允许内嵌样式的固定摘要，不应放开任意内联内容")
|
|
}
|
|
}
|
|
}
|