@@ -1331,56 +1331,65 @@ func Test_CSRF_Cookie_Injection_Exploit(t *testing.T) {
1331
1331
}
1332
1332
1333
1333
// TODO: use this test case and make the unsafe header value bug from https://github.com/gofiber/fiber/issues/2045 reproducible and permanently fixed/tested by this testcase
1334
- // func Test_CSRF_UnsafeHeaderValue(t *testing.T) {
1335
- // t.Parallel()
1336
- // app := fiber.New()
1337
-
1338
- // app.Use(New())
1339
- // app.Get("/", func(c fiber.Ctx) error {
1340
- // return c.SendStatus(fiber.StatusOK)
1341
- // })
1342
- // app.Get("/test", func(c fiber.Ctx) error {
1343
- // return c.SendStatus(fiber.StatusOK)
1344
- // })
1345
- // app.Post("/", func(c fiber.Ctx) error {
1346
- // return c.SendStatus(fiber.StatusOK)
1347
- // })
1348
-
1349
- // resp, err := app.Test(httptest.NewRequest(fiber.MethodGet, "/", nil))
1350
- // require.NoError(t, err)
1351
- // require.Equal(t, fiber.StatusOK, resp.StatusCode)
1352
-
1353
- // var token string
1354
- // for _, c := range resp.Cookies() {
1355
- // if c.Name != ConfigDefault.CookieName {
1356
- // continue
1357
- // }
1358
- // token = c.Value
1359
- // break
1360
- // }
1361
-
1362
- // fmt.Println("token", token)
1363
-
1364
- // getReq := httptest.NewRequest(fiber.MethodGet, "/", nil)
1365
- // getReq.Header.Set(HeaderName, token)
1366
- // resp, err = app.Test(getReq)
1367
-
1368
- // getReq = httptest.NewRequest(fiber.MethodGet, "/test", nil)
1369
- // getReq.Header.Set("X-Requested-With", "XMLHttpRequest")
1370
- // getReq.Header.Set(fiber.HeaderCacheControl, "no")
1371
- // getReq.Header.Set(HeaderName, token)
1372
-
1373
- // resp, err = app.Test(getReq)
1374
-
1375
- // getReq.Header.Set(fiber.HeaderAccept, "*/*")
1376
- // getReq.Header.Del(HeaderName)
1377
- // resp, err = app.Test(getReq)
1378
-
1379
- // postReq := httptest.NewRequest(fiber.MethodPost, "/", nil)
1380
- // postReq.Header.Set("X-Requested-With", "XMLHttpRequest")
1381
- // postReq.Header.Set(HeaderName, token)
1382
- // resp, err = app.Test(postReq)
1383
- // }
1334
+ func Test_CSRF_UnsafeHeaderValue (t * testing.T ) {
1335
+ t .SkipNow ()
1336
+ t .Parallel ()
1337
+ app := fiber .New ()
1338
+
1339
+ app .Use (New ())
1340
+ app .Get ("/" , func (c fiber.Ctx ) error {
1341
+ return c .SendStatus (fiber .StatusOK )
1342
+ })
1343
+ app .Get ("/test" , func (c fiber.Ctx ) error {
1344
+ return c .SendStatus (fiber .StatusOK )
1345
+ })
1346
+ app .Post ("/" , func (c fiber.Ctx ) error {
1347
+ return c .SendStatus (fiber .StatusOK )
1348
+ })
1349
+
1350
+ resp , err := app .Test (httptest .NewRequest (fiber .MethodGet , "/" , nil ))
1351
+ require .NoError (t , err )
1352
+ require .Equal (t , fiber .StatusOK , resp .StatusCode )
1353
+
1354
+ var token string
1355
+ for _ , c := range resp .Cookies () {
1356
+ if c .Name != ConfigDefault .CookieName {
1357
+ continue
1358
+ }
1359
+ token = c .Value
1360
+ break
1361
+ }
1362
+
1363
+ t .Log ("token" , token )
1364
+
1365
+ getReq := httptest .NewRequest (fiber .MethodGet , "/" , nil )
1366
+ getReq .Header .Set (HeaderName , token )
1367
+ resp , err = app .Test (getReq )
1368
+ require .NoError (t , err )
1369
+ require .Equal (t , fiber .StatusOK , resp .StatusCode )
1370
+
1371
+ getReq = httptest .NewRequest (fiber .MethodGet , "/test" , nil )
1372
+ getReq .Header .Set ("X-Requested-With" , "XMLHttpRequest" )
1373
+ getReq .Header .Set (fiber .HeaderCacheControl , "no" )
1374
+ getReq .Header .Set (HeaderName , token )
1375
+
1376
+ resp , err = app .Test (getReq )
1377
+ require .NoError (t , err )
1378
+ require .Equal (t , fiber .StatusOK , resp .StatusCode )
1379
+
1380
+ getReq .Header .Set (fiber .HeaderAccept , "*/*" )
1381
+ getReq .Header .Del (HeaderName )
1382
+ resp , err = app .Test (getReq )
1383
+ require .NoError (t , err )
1384
+ require .Equal (t , fiber .StatusOK , resp .StatusCode )
1385
+
1386
+ postReq := httptest .NewRequest (fiber .MethodPost , "/" , nil )
1387
+ postReq .Header .Set ("X-Requested-With" , "XMLHttpRequest" )
1388
+ postReq .Header .Set (HeaderName , token )
1389
+ resp , err = app .Test (postReq )
1390
+ require .NoError (t , err )
1391
+ require .Equal (t , fiber .StatusOK , resp .StatusCode )
1392
+ }
1384
1393
1385
1394
// go test -v -run=^$ -bench=Benchmark_Middleware_CSRF_Check -benchmem -count=4
1386
1395
func Benchmark_Middleware_CSRF_Check (b * testing.B ) {
0 commit comments