Function TestSecretTokenAuth

drive/driveimpl/drive_test.go:205–228

TestSecretTokenAuth verifies that the fileserver running at localhost cannot be accessed directly without the correct secret token. This matters because if a victim can be induced to visit the localhost URL and access a malicious file on their own share, it could allow a Mark-of-the-Web bypass attac

(t *testing.T)

// if a victim can be induced to visit the localhost URL and access a malicious
// file on their own share, it could allow a Mark-of-the-Web bypass attack.
func TestSecretTokenAuth(t *testing.T) {
	s := newSystem(t)

	fileserverAddr := s.addRemote(remote1)
	s.addShare(remote1, share11, drive.PermissionReadWrite)
	s.writeFile("writing file to read/write remote should succeed", remote1, share11, file111, "hello world", true)

	client := &http.Client{
		Transport: &http.Transport{DisableKeepAlives: true},
	}
	addr := strings.Split(fileserverAddr, "|")[1]
	wrongSecret, err := generateSecretToken()
	if err != nil {
		t.Fatal(err)
	}
	u := fmt.Sprintf("http://%s/%s/%s", addr, wrongSecret, url.PathEscape(file111))
	resp, err := client.Get(u)
	if err != nil {
		t.Fatal(err)
	}
	if resp.StatusCode != http.StatusForbidden {
		t.Errorf("expected %d for incorrect secret token, but got %d", http.StatusForbidden, resp.StatusCode)
	}
}

func TestLOCK(t *testing.T) {
	s := newSystem(t)