Function TestServerURLInjection

pkg/codegen/server_urls_test.go:90–132

TestServerURLInjection checks that attacker-controlled spec text (server description, URL, and variable default), which flows into generated Go line comments and string literals, cannot break out into an executable top-level declaration.

(t *testing.T)

// comments and string literals, cannot break out into an executable top-level
// declaration.
func TestServerURLInjection(t *testing.T) {
	// commentBreakout escapes a `//` comment, declares the sentinel, then
	// re-opens a comment so the surrounding template text stays valid.
	commentBreakout := "benign\nvar " + injectSentinel + " = 1\n//"
	// literalBreakout escapes a `"…"` string literal, declares the
	// sentinel, then re-opens a literal to swallow the template's closing
	// quote.
	literalBreakout := `https://api.example.com"; var ` + injectSentinel + ` = 1; var _ = "`

	t.Run("newline in description cannot escape the doc comment", func(t *testing.T) {
		out := renderServerURLs(t, &openapi3.T{Servers: openapi3.Servers{
			{URL: "https://api.example.com", Description: commentBreakout},
		}})
		assertSentinelNotDeclared(t, out)
	})

	t.Run("description in the function (variable-bearing) form cannot escape", func(t *testing.T) {
		out := renderServerURLs(t, &openapi3.T{Servers: openapi3.Servers{
			{URL: "https://api.example.com/{tenant}", Description: commentBreakout},
		}})
		assertSentinelNotDeclared(t, out)
	})

	t.Run("quote in URL cannot escape the const string literal", func(t *testing.T) {
		out := renderServerURLs(t, &openapi3.T{Servers: openapi3.Servers{
			{URL: literalBreakout},
		}})
		assertSentinelNotDeclared(t, out)
	})

	t.Run("quote in a variable default cannot escape the const string literal", func(t *testing.T) {
		out := renderServerURLs(t, &openapi3.T{Servers: openapi3.Servers{
			{
				URL: "https://api.example.com/{base}",
				Variables: map[string]*openapi3.ServerVariable{
					// non-enum, used → emits `const …BaseVariableDefault = "<default>"`
					"base": {Default: `v2"; var ` + injectSentinel + ` = 1; var _ = "`},
				},
			},
		}})
		assertSentinelNotDeclared(t, out)
	})
}

// assertSentinelNotDeclared parses the generated output as a package body
// and fails if it is not valid Go or if injectSentinel appears as a