Function TestURLSource_Read_RejectsLocalAddresses

pkg/config/sources_test.go:564–594

(t *testing.T)

}

func TestURLSource_Read_RejectsLocalAddresses(t *testing.T) {
	t.Parallel()

	// Hosts whose only resolution is a non-public IP must be refused at
	// dial time. We test the SSRF dialer via the HTTPS code path even
	// though the TLS handshake will never complete, because the dial is
	// aborted before any bytes are sent.
	tests := []string{
		"https://127.0.0.1/agent.yaml",       // loopback
		"https://[::1]/agent.yaml",           // IPv6 loopback
		"https://10.0.0.1/agent.yaml",        // RFC1918
		"https://192.168.1.1/agent.yaml",     // RFC1918
		"https://169.254.169.254/agent.yaml", // AWS/GCP/Azure metadata
		"https://0.0.0.0/agent.yaml",         // unspecified
	}
	for _, rawURL := range tests {
		t.Run(rawURL, func(t *testing.T) {
			t.Parallel()

			// Clear any cached content so the dial is actually attempted.
			urlCacheDir := getURLCacheDir()
			urlHash := hashURL(rawURL)
			_ = os.Remove(filepath.Join(urlCacheDir, urlHash))
			_ = os.Remove(filepath.Join(urlCacheDir, urlHash+".etag"))

			_, err := NewURLSource(rawURL, nil).Read(t.Context())
			require.Error(t, err)
			assert.Contains(t, err.Error(), "non-public address")
		})
	}
}

func TestURLSource_Read_RejectsHTTPRedirect(t *testing.T) {
	t.Parallel()