mirror of
https://github.com/J3vb/OwnCord.git
synced 2026-09-03 03:50:00 +03:00
jevb
a40b42bbed
CRITICAL (5): - Hub panic recovery now calls h.Stop() after 3 panics (ws/hub.go) - Ring buffer EventsSince returns non-nil empty slice for current seq (ws/ringbuffer.go) - PTT event listener stores unsubscribe handle to prevent leak (ptt.ts) - verifyTotp respects config.allowSelfSigned instead of hardcoding (api.ts) - ptt_listen_for_key uses spawn_blocking to avoid thread pool starvation (ptt.rs) HIGH - Server (13): - TOTP rate-limit checked after body decode; counters reset on success - TOTP enable returns 409 if already enabled (must disable first) - Global search pre-computes accessible channel IDs for FTS WHERE clause - DeleteAccount queries roles by name instead of hard-coded IDs - BackupToSafe uses absClean in VACUUM INTO - Voice camera slot uses atomic EnableCameraIfUnderLimit DB method - readPump snapshots voiceChID before unregister for TOCTOU safety - Voice join sets state after token send; rollback takes broadcast flag - Updater download uses probe pattern instead of overflow write - Webhook checks Authorization header before reading body - Storage.Save adds fsync and fixes double-close - Default WS origin denies cross-origin (was: accept all) HIGH - Client (6): - WS reconnect uses generation counter to discard stale events - AudioPipeline uses generation counter against stale worklet callbacks - Screenshare mute state preserved across reconnect (not full leave) - handleVoiceToken uses iterative loop instead of unbounded recursion - store.ts re-entrancy guard with pending update queue - Notification AudioContext cleaned up on logout Reviewed by 4 parallel agents across Server Core, Server Realtime, Client & Tauri, and Security. 55 total findings; 24 CRITICAL+HIGH fixed here, 31 MEDIUM+LOW tracked in vault backlog (T-265–T-295).
71 lines
2.6 KiB
Go
71 lines
2.6 KiB
Go
package ws_test
|
|
|
|
import (
|
|
"testing"
|
|
|
|
"github.com/owncord/server/ws"
|
|
)
|
|
|
|
// TestOriginAcceptOptions_WildcardEnablesInsecureSkipVerify verifies that
|
|
// when the allowed origins list contains only "*", InsecureSkipVerify is true
|
|
// (preserving the previous opt-in permissive behaviour).
|
|
func TestOriginAcceptOptions_WildcardEnablesInsecureSkipVerify(t *testing.T) {
|
|
opts := ws.OriginAcceptOptions([]string{"*"})
|
|
if !opts.InsecureSkipVerify {
|
|
t.Error("OriginAcceptOptions([\"*\"]).InsecureSkipVerify = false, want true")
|
|
}
|
|
if len(opts.OriginPatterns) != 0 {
|
|
t.Errorf("OriginAcceptOptions([\"*\"]).OriginPatterns = %v, want empty", opts.OriginPatterns)
|
|
}
|
|
}
|
|
|
|
// TestOriginAcceptOptions_ExplicitOrigins sets OriginPatterns and does NOT
|
|
// skip origin verification.
|
|
func TestOriginAcceptOptions_ExplicitOrigins(t *testing.T) {
|
|
origins := []string{"https://example.com", "https://app.example.com"}
|
|
opts := ws.OriginAcceptOptions(origins)
|
|
|
|
if opts.InsecureSkipVerify {
|
|
t.Error("OriginAcceptOptions(explicit).InsecureSkipVerify = true, want false")
|
|
}
|
|
if len(opts.OriginPatterns) != 2 {
|
|
t.Errorf("OriginAcceptOptions(explicit) len(OriginPatterns) = %d, want 2", len(opts.OriginPatterns))
|
|
}
|
|
for i, p := range opts.OriginPatterns {
|
|
if p != origins[i] {
|
|
t.Errorf("OriginPatterns[%d] = %q, want %q", i, p, origins[i])
|
|
}
|
|
}
|
|
}
|
|
|
|
// TestOriginAcceptOptions_EmptyList denies cross-origin by default (secure).
|
|
func TestOriginAcceptOptions_EmptyList(t *testing.T) {
|
|
opts := ws.OriginAcceptOptions([]string{})
|
|
if opts.InsecureSkipVerify {
|
|
t.Error("OriginAcceptOptions([]) should deny cross-origin (InsecureSkipVerify=false)")
|
|
}
|
|
}
|
|
|
|
// TestOriginAcceptOptions_NilList same as empty — deny by default.
|
|
func TestOriginAcceptOptions_NilList(t *testing.T) {
|
|
opts := ws.OriginAcceptOptions(nil)
|
|
if opts.InsecureSkipVerify {
|
|
t.Error("OriginAcceptOptions(nil) should deny cross-origin (InsecureSkipVerify=false)")
|
|
}
|
|
}
|
|
|
|
// TestOriginAcceptOptions_MixedWithWildcard if "*" appears anywhere in the
|
|
// list we treat the whole list as wildcard (security: explicit wins over forged mix).
|
|
func TestOriginAcceptOptions_MixedWithWildcard(t *testing.T) {
|
|
opts := ws.OriginAcceptOptions([]string{"https://example.com", "*"})
|
|
if !opts.InsecureSkipVerify {
|
|
t.Error("OriginAcceptOptions with '*' in list should use InsecureSkipVerify=true")
|
|
}
|
|
}
|
|
|
|
// TestOriginAcceptOptions_ReturnsAcceptOptions ensures the return type is the
|
|
// correct websocket.AcceptOptions value (compile-time check via assignment).
|
|
func TestOriginAcceptOptions_ReturnsAcceptOptions(t *testing.T) {
|
|
_ = ws.OriginAcceptOptions([]string{"https://example.com"})
|
|
}
|