Open Source Release
32 lines
1002 B
Go
32 lines
1002 B
Go
package settings
|
|
|
|
import "testing"
|
|
|
|
func TestValidateTGAPIBaseURL(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
url string
|
|
wantErr bool
|
|
}{
|
|
{"empty clears the field, always allowed", "", false},
|
|
{"self-hosted docker service", "http://telegram-bot-api:8081", false},
|
|
{"telegram's own API", "https://api.telegram.org", false},
|
|
{"malformed URL", "://not-a-url", true},
|
|
{"arbitrary attacker host", "http://evil.example.com", true},
|
|
{"internal service by IP, not the allowlisted hostname", "http://169.254.169.254/latest/meta-data", true},
|
|
{"non-http(s) scheme", "file:///etc/passwd", true},
|
|
{"host-only, no scheme", "telegram-bot-api", true},
|
|
}
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
err := validateTGAPIBaseURL(tc.url)
|
|
if tc.wantErr && err == nil {
|
|
t.Errorf("validateTGAPIBaseURL(%q) = nil, want error", tc.url)
|
|
}
|
|
if !tc.wantErr && err != nil {
|
|
t.Errorf("validateTGAPIBaseURL(%q) = %v, want nil", tc.url, err)
|
|
}
|
|
})
|
|
}
|
|
}
|