public_git/oauth2-proxy
1
0
Fork 0
mirror of https://github.com/oauth2-proxy/oauth2-proxy.git synced 2026-10-22 04:32:02 +02:00
Code Issues Projects Releases Wiki Activity

Merge commit from fork

Browse Source 
Signed-off-by: Jan Larwig <jan@larwig.com>
This commit is contained in:
Jan Larwig
2026-04-13 18:29:01 +02:00
committed by GitHub
parent cc0e0335ea
commit bdfde725c6
5 changed files with 92 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
oauthproxy_test.go
+52
View File
@@ -2679,9 +2679,11 @@ func TestAllowedRequest(t *testing.T) {
}
opts.SkipAuthRegex = []string{
"^/skip/auth/regex$",
"^/public/.*/endpoint$",
}
opts.SkipAuthRoutes = []string{
"GET=^/skip/auth/routes/get",
"^/foo/.*/bar$",
}
err := validation.Validate(opts)
assert.NoError(t, err)
@@ -2714,6 +2716,18 @@ func TestAllowedRequest(t *testing.T) {
url: "/wrong/denied",
allowed: false,
},
{
name: "Regex allowed with fragment-free path",
method: "GET",
url: "/public/legit/endpoint",
allowed: true,
},
{
name: "Regex denied when path contains encoded fragment suffix",
method: "GET",
url: "/public/secret%23/endpoint",
allowed: false,
},
{
name: "Route allowed",
method: "GET",
@@ -2738,6 +2752,18 @@ func TestAllowedRequest(t *testing.T) {
url: "/skip/auth/routes/wrong/path",
allowed: false,
},
{
name: "Route allowed with fragment-free path",
method: "GET",
url: "/foo/public/bar",
allowed: true,
},
{
name: "Route denied when path contains encoded fragment suffix",
method: "GET",
url: "/foo/secret%23/bar",
allowed: false,
},
}
for _, tc := range testCases {
@@ -2778,9 +2804,11 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
}
opts.SkipAuthRegex = []string{
"^/skip/auth/regex$",
"^/public/.*/endpoint$",
}
opts.SkipAuthRoutes = []string{
"GET=^/skip/auth/routes/get",
"^/foo/.*/bar$",
}
err := validation.Validate(opts)
assert.NoError(t, err)
@@ -2813,6 +2841,18 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
url: "/wrong/denied",
allowed: false,
},
{
name: "Regex allowed with fragment-free path",
method: "GET",
url: "/public/legit/endpoint",
allowed: true,
},
{
name: "Regex denied when X-Forwarded-Uri contains an encoded fragment suffix",
method: "GET",
url: "/public/secret%23/endpoint",
allowed: false,
},
{
name: "Route allowed",
method: "GET",
@@ -2837,6 +2877,18 @@ func TestAllowedRequestWithForwardedUriHeader(t *testing.T) {
url: "/skip/auth/routes/wrong/path",
allowed: false,
},
{
name: "Route allowed with fragment-free path",
method: "GET",
url: "/foo/public/bar",
allowed: true,
},
{
name: "Route denied when X-Forwarded-Uri contains an encoded fragment suffix",
method: "GET",
url: "/foo/secret%23/bar",
allowed: false,
},
}
for _, tc := range testCases {