Function TestValidateWebhookURL

internal/webhooks/validate_test.go:8–66

(t *testing.T)

)

func TestValidateWebhookURL(t *testing.T) {
	tests := []struct {
		name    string
		url     string
		wantErr bool
	}{
		// Valid URLs
		{"valid https", "https://example.com/webhook", false},
		{"valid http", "http://example.com/callback", false},
		{"valid with port", "https://example.com:8080/hook", false},
		{"valid with path", "https://example.com/api/v1/webhook", false},

		// Invalid schemes
		{"ftp scheme", "ftp://example.com/hook", true},
		{"javascript scheme", "javascript:alert(1)", true},
		{"file scheme", "file:///etc/passwd", true},
		{"no scheme", "example.com/hook", true},

		// Embedded credentials
		{"with credentials", "https://user:pass@example.com/hook", true},

		// Private IPs
		{"loopback IPv4", "http://127.0.0.1/hook", true},
		{"loopback IPv6", "http://[::1]/hook", true},
		{"private 10.x", "http://10.0.0.1/hook", true},
		{"private 172.16.x", "http://172.16.0.1/hook", true},
		{"private 192.168.x", "http://192.168.1.1/hook", true},
		{"cloud metadata", "http://169.254.169.254/latest/meta-data/", true},
		{"link-local", "http://169.254.1.1/hook", true},
		{"unspecified", "http://0.0.0.0/hook", true},

		// Widened reserved ranges
		{"cgnat 100.64.x", "http://100.64.1.2/hook", true},
		{"ietf protocol 192.0.0.x", "http://192.0.0.8/hook", true},
		{"benchmarking 198.18.x", "http://198.19.0.1/hook", true},
		{"reserved class E 240.x", "http://240.0.0.1/hook", true},
		{"broadcast", "http://255.255.255.255/hook", true},

		// Public addresses just outside the widened ranges must still pass
		{"public above cgnat", "http://100.128.0.1/hook", false},
		{"public above 198.18/15", "http://198.20.0.1/hook", false},

		// Hostnames resolving to private IPs
		{"localhost", "http://localhost/hook", true},

		// Empty/invalid
		{"empty url", "", true},
		{"no host", "http:///path", true},
	}

	for _, tt := range tests {
		t.Run(tt.name, func(t *testing.T) {
			err := ValidateWebhookURL(tt.url)
			if (err != nil) != tt.wantErr {
				t.Errorf("ValidateWebhookURL(%q) error = %v, wantErr = %v", tt.url, err, tt.wantErr)
			}
		})
	}