TestDeepNestingBounded pins the adversarial DoS fix: a deeply nested multipart message must parse quickly (depth-capped), not blow up O(depth²).
(t *testing.T)
| 80 | // TestDeepNestingBounded pins the adversarial DoS fix: a deeply nested |
| 81 | // multipart message must parse quickly (depth-capped), not blow up O(depth²). |
| 82 | func TestDeepNestingBounded(t *testing.T) { |
| 83 | var sb strings.Builder |
| 84 | sb.WriteString("From: a@x.com\r\nContent-Type: multipart/mixed; boundary=b0\r\n\r\n") |
| 85 | for i := 0; i < 5000; i++ { |
| 86 | sb.WriteString("--b0\r\nContent-Type: multipart/mixed; boundary=b0\r\n\r\n") |
| 87 | } |
| 88 | sb.WriteString("--b0\r\nContent-Type: text/plain\r\n\r\ndeep\r\n") |
| 89 | done := make(chan struct{}) |
| 90 | go func() { _, _ = ParsedBody([]byte(sb.String()), 0); close(done) }() |
| 91 | select { |
| 92 | case <-done: |
| 93 | case <-time.After(3 * time.Second): |
| 94 | t.Fatal("ParsedBody did not return within 3s on deeply nested multipart (DoS guard missing)") |
| 95 | } |
| 96 | } |
| 97 | |
| 98 | // TestNestedMultipartRecoversInnerText: mixed wrapping alternative → inner plain. |
| 99 | func TestNestedMultipartRecoversInnerText(t *testing.T) { |
nothing calls this directly
no test coverage detected