Harden scan robustness and tests

2026-09-24 20:21:52 +08:00 · 2026-06-14 22:23:48 +08:00
parent 5ad914a1bb
commit c49c23c7f0
100 changed files with 4483 additions and 412 deletions
@@ -3,7 +3,9 @@ package web
 import (
 	"context"
 	"net/http"
+	"strings"
 	"testing"
+	"unicode/utf8"

 	"github.com/shadow1ng/fscan/webscan/lib"
 )
@@ -12,6 +14,14 @@ type faviconRoundTripper struct {
 	called bool
 }

+func TestExtractTitleTruncatesByRune(t *testing.T) {
+	title := strings.Repeat("界", 105)
+	got := NewWebTitlePlugin().extractTitle("<html><title>" + title + "</title></html>")
+	if !utf8.ValidString(got) || len([]rune(got)) != 103 || !strings.HasSuffix(got, "...") {
+		t.Fatalf("extractTitle() = %q", got)
+	}
+}
+
 func (rt *faviconRoundTripper) RoundTrip(req *http.Request) (*http.Response, error) {
 	rt.called = true
 	<-req.Context().Done()
@@ -56,3 +66,38 @@ func TestWebTitleURLUsesJoinHostPort(t *testing.T) {
 		})
 	}
 }
+
+func TestWebTitleHTTPClientsFallbackWhenGlobalsNil(t *testing.T) {
+	previousClient, previousNoRedirect := lib.Client, lib.ClientNoRedirect
+	previousGM, previousNoRedirectGM := lib.ClientGM, lib.ClientNoRedirectGM
+	lib.Client, lib.ClientNoRedirect = nil, nil
+	lib.ClientGM, lib.ClientNoRedirectGM = nil, nil
+	defer func() {
+		lib.Client, lib.ClientNoRedirect = previousClient, previousNoRedirect
+		lib.ClientGM, lib.ClientNoRedirectGM = previousGM, previousNoRedirectGM
+	}()
+
+	clientNR, clientR := webTitleHTTPClients(false)
+	if clientNR == nil || clientR == nil {
+		t.Fatal("webTitleHTTPClients returned nil fallback client")
+	}
+
+	req, err := http.NewRequest(http.MethodGet, "http://example.com", nil)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if err := clientNR.CheckRedirect(req, []*http.Request{req}); err != http.ErrUseLastResponse {
+		t.Fatalf("no-redirect fallback error = %v, want http.ErrUseLastResponse", err)
+	}
+}
+
+func TestReadWebTitleBodyIsBounded(t *testing.T) {
+	body := strings.NewReader(strings.Repeat("a", maxWebTitleBodyBytes+1024))
+	got, err := readWebTitleBody(body)
+	if err != nil {
+		t.Fatalf("readWebTitleBody error = %v", err)
+	}
+	if len(got) != maxWebTitleBodyBytes {
+		t.Fatalf("body len = %d, want %d", len(got), maxWebTitleBodyBytes)
+	}
+}