Function TestStaticDirectoryHandlerAndRouterInconsistentEscaping

echo_test.go:362–476

(t *testing.T)

}

func TestStaticDirectoryHandlerAndRouterInconsistentEscaping(t *testing.T) {
	var testCases = []struct {
		name                                 string
		givenEnablePathUnescapingStaticFiles bool
		givenRouterUnescapePathParamValues   bool
		givenRouterUseEscapedPathForMatching bool
		whenURL                              string
		expectBody                           string
		expectStatus                         int
	}{
		{
			name:                                 "ok, file is served from not-forbidden path",
			givenEnablePathUnescapingStaticFiles: false,
			whenURL:                              "/test.txt",
			expectBody:                           "test.txt contents",
			expectStatus:                         http.StatusOK,
		},
		{
			name:                                 "ok, forbidden path is matched by route wildcard and forbidden by that",
			givenEnablePathUnescapingStaticFiles: false,
			whenURL:                              "/admin/private.txt",
			expectBody:                           "{\"message\":\"Forbidden\"}",
			expectStatus:                         http.StatusForbidden,
		},
		{
			name:                                 "ok, escaped filename from forbidden path is routed to guarded route",
			givenEnablePathUnescapingStaticFiles: false,
			givenRouterUnescapePathParamValues:   false,
			givenRouterUseEscapedPathForMatching: true, // Router uses escaped path (req.URL.RawPath) for matching
			whenURL:                              "/admin%2fprivate.txt",
			expectBody:                           "{\"message\":\"Forbidden\"}",
			expectStatus:                         http.StatusForbidden,
		},
		{
			name:                                 "ok, escaped filename from forbidden path is not unescaped and results 404",
			givenEnablePathUnescapingStaticFiles: false, // router path escaping and StaticDirectoryHandler is consistent
			whenURL:                              "/admin%2fprivate.txt",
			expectBody:                           "{\"message\":\"Not Found\"}",
			expectStatus:                         http.StatusNotFound,
		},
		{
			name:                                 "nok, escaped filename from forbidden path is unescaped and returns file contents (handler unescapes)",
			givenEnablePathUnescapingStaticFiles: true, // router path escaping and StaticDirectoryHandler is NOT consistent
			givenRouterUnescapePathParamValues:   false,
			whenURL:                              "/admin%2fprivate.txt",
			expectBody:                           "public/admin/private.txt - private file",
			expectStatus:                         http.StatusOK,
		},
		{
			name:                                 "nok, escaped filename from forbidden path is unescaped and returns file contents (router unescapes)",
			givenEnablePathUnescapingStaticFiles: false,
			givenRouterUnescapePathParamValues:   true, // router path escaping and StaticDirectoryHandler is NOT consistent
			whenURL:                              "/admin%2fprivate.txt",
			expectBody:                           "public/admin/private.txt - private file",
			expectStatus:                         http.StatusOK,
		},
		{
			name:                                 "nok, unescaped filename from forbidden path is escaped and returns file contents (router unescapes and method unescapes)",