fix: prevent loopback Run release URLs

2026-09-05 18:11:58 +08:00
parent 4923308fb4
commit cf836715e2
10 changed files with 133 additions and 12 deletions
@@ -23,6 +23,94 @@ type generatedPackageConfig struct {
 	AuthKey          string
 }

+func TestRunReleasePlatformURLUsesExternalDefault(t *testing.T) {
+	t.Setenv("PLATFORM_RUN_RELEASE_URL", "")
+
+	value, err := runReleasePlatformURL()
+	if err != nil {
+		t.Fatalf("resolve default Run release URL: %v", err)
+	}
+	if value != defaultRunReleasePlatformURL {
+		t.Fatalf("unexpected default Run release URL %q", value)
+	}
+}
+
+func TestRunReleasePlatformURLRejectsTargetLocalAddresses(t *testing.T) {
+	for _, value := range []string{
+		"http://127.0.0.1:18080",
+		"http://127.0.0.2:18080",
+		"http://localhost:18080",
+		"https://platform.localhost/",
+		"http://[::1]:18080",
+		"http://0.0.0.0:18080",
+		"http://[::]:18080",
+	} {
+		t.Run(value, func(t *testing.T) {
+			t.Setenv("PLATFORM_RUN_RELEASE_URL", value)
+			if _, err := runReleasePlatformURL(); err == nil || !strings.Contains(err.Error(), "reachable from the target server") {
+				t.Fatalf("expected target-local URL %q to be rejected, got %v", value, err)
+			}
+		})
+	}
+}
+
+func TestRunReleasePlatformURLAcceptsExternalHTTPURL(t *testing.T) {
+	t.Setenv("PLATFORM_RUN_RELEASE_URL", "http://platform.example.test:8080/control")
+
+	value, err := runReleasePlatformURL()
+	if err != nil {
+		t.Fatalf("resolve external Run release URL: %v", err)
+	}
+	if value != "http://platform.example.test:8080/control" {
+		t.Fatalf("unexpected external Run release URL %q", value)
+	}
+}
+
+func TestRunReleasePlatformURLRejectsInvalidURLForms(t *testing.T) {
+	for _, value := range []string{
+		"ftp://platform.example.test",
+		"https://operator@platform.example.test",
+		"https://platform.example.test/?token=value",
+		"https://platform.example.test/?",
+		"https://platform.example.test/#fragment",
+		"https://platform.example.test/#",
+	} {
+		t.Run(value, func(t *testing.T) {
+			t.Setenv("PLATFORM_RUN_RELEASE_URL", value)
+			if _, err := runReleasePlatformURL(); err == nil || !strings.Contains(err.Error(), "absolute http or https URL") {
+				t.Fatalf("expected invalid Run release URL %q to be rejected, got %v", value, err)
+			}
+		})
+	}
+}
+
+func TestCoreServiceRejectsLoopbackRunReleaseURLBeforeGeneration(t *testing.T) {
+	t.Setenv("PLATFORM_RUN_RELEASE_URL", "http://127.0.0.1:18080")
+	svc, session, instance := newDistributionTestFixture(t)
+
+	_, err := svc.GenerateRunDistributionForSession(session, domain.RunDistributionGenerateRequest{
+		ServerInstanceID: instance.ID,
+		TargetOS:         "windows",
+		TargetArch:       "amd64",
+		IdempotencyKey:   "loopback-release-url",
+	})
+	if err == nil || !strings.Contains(err.Error(), "reachable from the target server") {
+		t.Fatalf("expected loopback Run release URL to fail generation, got %v", err)
+	}
+	distributions, err := svc.store.RunDistributions().List(domain.RunDistributionFilter{ServerInstanceID: instance.ID})
+	if err != nil || len(distributions) != 0 {
+		t.Fatalf("invalid release URL must not create distributions, distributions=%+v err=%v", distributions, err)
+	}
+	keys, err := svc.store.EncryptedComponentKeys().List(domain.EncryptedComponentKeyFilter{ServerInstanceID: instance.ID, ComponentKind: domain.DistributionComponentRun})
+	if err != nil || len(keys) != 0 {
+		t.Fatalf("invalid release URL must not create component keys, keys=%+v err=%v", keys, err)
+	}
+	jobs, err := svc.store.Jobs().List(domain.JobFilter{ServerInstanceID: instance.ID})
+	if err != nil || len(jobs) != 0 {
+		t.Fatalf("invalid release URL must not create build jobs, jobs=%+v err=%v", jobs, err)
+	}
+}
+
 func TestCoreServiceGeneratesRunDistributionWithEncryptedSingletonKey(t *testing.T) {
 	svc, session, instance := newDistributionTestFixture(t)