dhkatzandClaude Opus 5.5
2280ad6314
CI / build (push) Successful in 34s
The shop's T5 filter (maturity_rating "t5") is answered from the hub's products, fetched so they can be
shown and tried on; buying T5 products adds them to the hub library, and product.php details for
community products are answered here.
The client sends some product IDs as floats ("2000000008.0"): product.php passed the worn community
product to IMVU that way. Every ID is now read either way, and products.Guard refuses any request to
IMVU that still names a local ID given out. T5DE_PROXY_DUMP logs request and response bodies.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
33 lines
1.1 KiB
Go
33 lines
1.1 KiB
Go
package products
|
|
|
|
import (
|
|
"fmt"
|
|
"net/http"
|
|
"net/url"
|
|
"testing"
|
|
|
|
"git.t5de.dev/t5de/t5de-proxy/internal/proxy"
|
|
)
|
|
|
|
func TestGuard(t *testing.T) {
|
|
h, _ := newHarness(t)
|
|
local := h.p.byProductID("blue-coat").local
|
|
g := Guard{Products: h.p}
|
|
check := func(rawURL, body string, refused bool) {
|
|
t.Helper()
|
|
u, _ := url.Parse(rawURL)
|
|
req, _ := http.NewRequest("POST", rawURL, nil)
|
|
x := &proxy.Exchange{URL: u, Request: req, Body: []byte(body)}
|
|
g.Intercept(x)
|
|
if (x.Response != nil) != refused {
|
|
t.Errorf("%s %s: refused %v", rawURL, body, x.Response != nil)
|
|
}
|
|
}
|
|
check("https://client-dynamic.imvu.com/api/new.php", fmt.Sprintf(`{"pids": [80, %d.0]}`, local), true)
|
|
check(fmt.Sprintf("https://api.imvu.com/product/product-%d", local), "", true)
|
|
check(fmt.Sprintf("https://client-dynamic.imvu.com/api/x.php?ids=1%%2C%d", local), "", true)
|
|
check("https://client-dynamic.imvu.com/api/new.php", `{"pids": [80, 2000000777]}`, false) // not given out
|
|
check("https://client-dynamic.imvu.com/api/new.php", fmt.Sprintf(`{"n": "1%d"}`, local), false)
|
|
check(fmt.Sprintf("https://hub.example/%d", local), "", false) // only IMVU's hosts
|
|
}
|