Joseph Doherty
513fa1aa16
Comment/XML-doc changes only: - add summaries to ~10k test methods, fixtures, fakes and helpers (+ <param> on theories, <returns> on async Task methods, <inheritdoc/> on interface implementations the checker can resolve) - strip ~2.6k project-tracking references (WP*, P*-*, row-NN, Task N, #NN, Component-0NN) from comments, keeping the explanatory text; reword false positives in comments only - real docs on fakes implementing BCL/library interfaces (IDisposable, ILogger, IOptionsMonitor, IAsyncLifetime) - reword the last 5 src/ false positives (CWE-1236, failures-1, year-0001, M365) Only non-comment edits: four one-line nested classes split across lines so members can carry docs. Build 0 errors / 0 warnings.
69 lines
3.6 KiB
C#
69 lines
3.6 KiB
C#
using System.Net;
|
|
using System.Text;
|
|
using Microsoft.AspNetCore.Builder;
|
|
using Microsoft.AspNetCore.Hosting;
|
|
using Microsoft.AspNetCore.Hosting.Server;
|
|
using Microsoft.AspNetCore.Hosting.Server.Features;
|
|
using Microsoft.AspNetCore.Http;
|
|
using Microsoft.AspNetCore.Server.Kestrel.Core;
|
|
using Microsoft.Extensions.DependencyInjection;
|
|
using NSubstitute;
|
|
using ZB.MOM.WW.ScadaBridge.AuditLog.Configuration;
|
|
using ZB.MOM.WW.ScadaBridge.Commons.Interfaces.Services;
|
|
using ZB.MOM.WW.ScadaBridge.InboundAPI;
|
|
using ZB.MOM.WW.ScadaBridge.InboundAPI.Middleware;
|
|
|
|
namespace ZB.MOM.WW.ScadaBridge.Host.Tests;
|
|
|
|
public class InboundBodyLimitKestrelTests
|
|
{
|
|
/// <summary>Verifies that an over-limit request body is rejected by the Kestrel cap regardless of audit body-capture settings.</summary>
|
|
/// <param name="http2">Whether the request uses HTTP/2 instead of HTTP/1.1.</param>
|
|
/// <param name="skipCapture">Whether the audit per-target override skips body capture.</param>
|
|
/// <param name="declared">Whether the request declares its content length.</param>
|
|
/// <returns>A task that represents the asynchronous operation.</returns>
|
|
[Theory]
|
|
[InlineData(false, false, false)]
|
|
[InlineData(false, true, false)]
|
|
[InlineData(true, false, false)]
|
|
[InlineData(true, true, false)]
|
|
[InlineData(false, false, true)]
|
|
public async Task EI10_OverLimitBody_AuditCannotDisableKestrelCap(bool http2, bool skipCapture, bool declared)
|
|
{
|
|
var builder = WebApplication.CreateBuilder();
|
|
builder.WebHost.ConfigureKestrel(o => o.Listen(IPAddress.Loopback, 0, l => l.Protocols = http2 ? HttpProtocols.Http2 : HttpProtocols.Http1));
|
|
builder.Services.Configure<InboundApiOptions>(o => o.MaxRequestBodyBytes = 128);
|
|
builder.Services.Configure<AuditLogOptions>(o => o.PerTargetOverrides["echo"] = new PerTargetRedactionOverride { SkipBodyCapture = skipCapture });
|
|
builder.Services.AddSingleton(Substitute.For<ICentralAuditWriter>());
|
|
await using var app = builder.Build();
|
|
app.UseRouting();
|
|
app.UseAuditWriteMiddleware();
|
|
var dispatched = 0;
|
|
app.MapPost("/api/{methodName}", async (HttpContext context) =>
|
|
{
|
|
await context.Request.Body.CopyToAsync(Stream.Null);
|
|
Interlocked.Increment(ref dispatched);
|
|
return Results.Ok();
|
|
}).AddEndpointFilter<InboundApiEndpointFilter>();
|
|
await app.StartAsync();
|
|
var address = app.Services.GetRequiredService<IServer>().Features.Get<IServerAddressesFeature>()!.Addresses.Single();
|
|
using var client = new HttpClient();
|
|
using var request = new HttpRequestMessage(HttpMethod.Post, address + "/api/echo")
|
|
{ Version = http2 ? HttpVersion.Version20 : HttpVersion.Version11, VersionPolicy = HttpVersionPolicy.RequestVersionExact };
|
|
var bytes = Encoding.UTF8.GetBytes("{\"value\":\"" + new string('x', 1000) + "\"}");
|
|
request.Content = declared ? new ByteArrayContent(bytes) : new UnknownLengthContent(bytes);
|
|
request.Content.Headers.ContentType = new("application/json");
|
|
using var response = await client.SendAsync(request);
|
|
Assert.Equal(HttpStatusCode.RequestEntityTooLarge, response.StatusCode);
|
|
Assert.Equal(0, dispatched);
|
|
}
|
|
|
|
private sealed class UnknownLengthContent(byte[] bytes) : HttpContent
|
|
{
|
|
/// <inheritdoc />
|
|
protected override Task SerializeToStreamAsync(Stream stream, TransportContext? context) => stream.WriteAsync(bytes).AsTask();
|
|
/// <inheritdoc />
|
|
protected override bool TryComputeLength(out long length) { length = 0; return false; }
|
|
}
|
|
}
|