Function TestProxyHandler_RejectsNonHTTPSTarget

sidecar/server-demo/handler_test.go:281–308

TestProxyHandler_RejectsNonHTTPSTarget verifies end-to-end that a compromised sandbox holding a valid PROXY_KEY cannot coerce the sidecar into forwarding real tokens over cleartext HTTP or to an unexpected path. The check must fire before HMAC verification so that the request is rejected even when t

(t *testing.T)

// The check must fire before HMAC verification so that the request is
// rejected even when the signature is technically valid.
func TestProxyHandler_RejectsNonHTTPSTarget(t *testing.T) {
	key := []byte("test-key")
	h := newTestHandler(key)

	cases := []struct {
		name   string
		target string
	}{
		{"http downgrade", "http://open.feishu.cn"},
		{"bare hostname", "open.feishu.cn"},
		{"ftp scheme", "ftp://open.feishu.cn"},
		{"target with path", "https://open.feishu.cn/open-apis/evil"},
		{"target with query", "https://open.feishu.cn?steal=1"},
		{"target with userinfo", "https://attacker:pw@open.feishu.cn"},
	}
	for _, tc := range cases {
		t.Run(tc.name, func(t *testing.T) {
			// Sign with a valid key against the malicious target — proves the
			// scheme/shape check is not bypassed by signature legitimacy.
			req := signedReq(t, key, "GET", tc.target, "/open-apis/im/v1/chats", nil)
			w := httptest.NewRecorder()
			h.ServeHTTP(w, req)
			if w.Code != http.StatusForbidden {
				t.Errorf("expected 403 for target %q, got %d (body: %s)", tc.target, w.Code, w.Body.String())
			}
		})
	}
}

// TestProxyHandler_RejectsIdentityReplay locks in C1 end-to-end: a captured
// bot-signed request whose identity header is flipped to user (or vice versa)