1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
|
package config
import (
"os"
"path/filepath"
"reflect"
"strings"
"testing"
)
func TestSaveLoadRoundTrip(t *testing.T) {
path := filepath.Join(t.TempDir(), "nested", "config.json")
want := Settings{
Host: "news.example.org",
Port: "563",
UseTLS: true,
SMTPHost: "qee4i7sags6phsvb2yodwecfj7noimfhhalsjktsvikrwotxzis3raad.onion",
SMTPPort: "25",
SMTPRecipient: "mail2news@mail2news.tcpreset.net",
Username: "reader",
ProxyType: "SOCKS5",
ProxyAddress: "127.0.0.1:9050",
DisplayName: "Aegis User",
Email: "reader@example.org",
Subscriptions: []string{"comp.lang.go", "sci.crypt"},
}
if err := Save(path, want); err != nil {
t.Fatalf("Save() error = %v", err)
}
info, err := os.Stat(path)
if err != nil {
t.Fatal(err)
}
if got := info.Mode().Perm(); got != 0o600 {
t.Fatalf("mode = %o, want 600", got)
}
got, err := Load(path)
if err != nil {
t.Fatalf("Load() error = %v", err)
}
if !reflect.DeepEqual(got, want) {
t.Fatalf("Load() = %#v, want %#v", got, want)
}
}
func TestPasswordCannotBePersisted(t *testing.T) {
settingsType := reflect.TypeOf(Settings{})
if _, ok := settingsType.FieldByName("Password"); ok {
t.Fatal("Settings must not contain a persistent Password field")
}
path := filepath.Join(t.TempDir(), "config.json")
if err := Save(path, Default()); err != nil {
t.Fatal(err)
}
data, err := os.ReadFile(path)
if err != nil {
t.Fatal(err)
}
if strings.Contains(strings.ToLower(string(data)), "password") {
t.Fatal("saved settings unexpectedly mention a password")
}
}
func TestValidateRejectsProtocolInjection(t *testing.T) {
settings := Default()
settings.Username = "user\r\nQUIT"
if err := settings.Validate(); err == nil {
t.Fatal("Validate() accepted a username with protocol injection")
}
if err := ValidateGroupName("comp.lang.go\r\nPOST"); err == nil {
t.Fatal("ValidateGroupName() accepted protocol injection")
}
}
func TestValidateRejectsAuthenticationWithoutTLS(t *testing.T) {
settings := Default()
settings.UseTLS = false
settings.Username = "reader"
if err := settings.Validate(); err == nil {
t.Fatal("Validate() accepted authentication without TLS")
}
}
func TestValidateRejectsCompressionWithTLS(t *testing.T) {
settings := Default()
settings.UseCompression = true
if err := settings.Validate(); err == nil {
t.Fatal("Validate() accepted compression over TLS")
}
}
func TestValidateRequiresProxyForOnionSMTP(t *testing.T) {
settings := Default()
settings.SMTPHost = "mail.example.onion"
settings.SMTPPort = "465"
settings.SMTPMode = ""
settings.ProxyType = "DIRECT"
if err := settings.Validate(); err == nil {
t.Fatal("Validate() accepted direct .onion SMTP")
}
}
func TestValidateAllowsCleartextOnionSMTPThroughSharedProxy(t *testing.T) {
settings := Default()
settings.SMTPHost = "mail.example.onion"
settings.SMTPPort = "25"
settings.SMTPMode = ""
settings.ProxyType = "SOCKS5"
settings.ProxyAddress = "127.0.0.1:9050"
if err := settings.Validate(); err != nil {
t.Fatalf("Validate() rejected cleartext onion SMTP through SOCKS5: %v", err)
}
}
|
