safehttp/response_test.go at main · ayuhito/safehttp · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
package safehttp_test

import (
	"context"
	"errors"
	"io"
	"net/http"
	"net/http/httptest"
	"testing"

	safehttp "github.com/ayuhito/safehttp"
	"github.com/stretchr/testify/require"
)

func TestResponseBodyLimit(t *testing.T) {
	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, req *http.Request) {
		switch req.URL.Path {
		case "/exact":
			_, err := io.WriteString(w, "abc")
			if err != nil {
				panic(err)
			}
		case "/large":
			_, err := io.WriteString(w, "abcd")
			if err != nil {
				panic(err)
			}
		default:
			http.NotFound(w, req)
		}
	}))
	t.Cleanup(server.Close)

	client, err := safehttp.NewClient(localServerOptions(t, server.URL, safehttp.MaxResponseBytes(3))...)
	require.NoError(t, err)

	req, err := http.NewRequestWithContext(context.Background(), http.MethodGet, server.URL+"/exact", nil)
	require.NoError(t, err)

	resp, err := client.Do(req)
	require.NoError(t, err)

	body, err := io.ReadAll(resp.Body)
	require.NoError(t, resp.Body.Close())
	require.NoError(t, err)
	require.Equal(t, "abc", string(body))

	req, err = http.NewRequestWithContext(context.Background(), http.MethodGet, server.URL+"/large", nil)
	require.NoError(t, err)

	resp, err = client.Do(req)
	require.NoError(t, err)

	body, err = io.ReadAll(resp.Body)
	require.NoError(t, resp.Body.Close())
	require.Equal(t, "abc", string(body))

	maxBytesErr, ok := errors.AsType[*http.MaxBytesError](err)
	require.True(t, ok)
	require.Equal(t, int64(3), maxBytesErr.Limit)
}