yellow

~ opinionated web scanning pipeline for pentesters in a hurry
git clone https://github.com/djnnvx/yellow.git
net_test.go (2348B)
      1 package helper
      2 
      3 import (
      4 	"bytes"
      5 	"testing"
      6 )
      7 
      8 func TestReadCappedBodyTruncatesOversizedBody(t *testing.T) {
      9 	body, truncated, err := ReadCappedBody(bytes.NewReader(make([]byte, MaxBodySize+1<<20)))
     10 	if err != nil {
     11 		t.Fatalf("ReadCappedBody returned %v", err)
     12 	}
     13 	if !truncated {
     14 		t.Error("oversized body not reported as truncated")
     15 	}
     16 	if len(body) != MaxBodySize {
     17 		t.Errorf("read %d bytes, want the %d byte cap", len(body), MaxBodySize)
     18 	}
     19 }
     20 
     21 func TestReadCappedBodyKeepsExactCapIntact(t *testing.T) {
     22 	body, truncated, err := ReadCappedBody(bytes.NewReader(make([]byte, MaxBodySize)))
     23 	if err != nil {
     24 		t.Fatalf("ReadCappedBody returned %v", err)
     25 	}
     26 	if truncated {
     27 		t.Error("body of exactly MaxBodySize reported as truncated")
     28 	}
     29 	if len(body) != MaxBodySize {
     30 		t.Errorf("read %d bytes, want %d", len(body), MaxBodySize)
     31 	}
     32 }
     33 
     34 func TestResolveWebTargetFallsBackToHTTP(t *testing.T) {
     35 	probed := []string{}
     36 	unavailable := func(url string) bool {
     37 		probed = append(probed, url)
     38 		return url != "http://example.com"
     39 	}
     40 
     41 	got, ok := resolveWebTarget("example.com", false, unavailable)
     42 	if !ok {
     43 		t.Fatalf("host serving plaintext was skipped; probed %v", probed)
     44 	}
     45 	if got != "http://example.com" {
     46 		t.Errorf("got %q, want http://example.com", got)
     47 	}
     48 	if len(probed) != 2 || probed[0] != "https://example.com" {
     49 		t.Errorf("want https probed first then http, got %v", probed)
     50 	}
     51 }
     52 
     53 func TestResolveWebTargetPrefersHTTPS(t *testing.T) {
     54 	unavailable := func(string) bool { return false }
     55 
     56 	got, ok := resolveWebTarget("example.com", false, unavailable)
     57 	if !ok || got != "https://example.com" {
     58 		t.Errorf("got %q (ok=%v), want https://example.com", got, ok)
     59 	}
     60 }
     61 
     62 func TestResolveWebTargetForceInsecureSkipsHTTPS(t *testing.T) {
     63 	probed := []string{}
     64 	unavailable := func(url string) bool {
     65 		probed = append(probed, url)
     66 		return false
     67 	}
     68 
     69 	got, ok := resolveWebTarget("example.com", true, unavailable)
     70 	if !ok || got != "http://example.com" {
     71 		t.Errorf("got %q (ok=%v), want http://example.com", got, ok)
     72 	}
     73 	if len(probed) != 1 {
     74 		t.Errorf("force-insecure must not probe https, got %v", probed)
     75 	}
     76 }
     77 
     78 func TestResolveWebTargetDeadHost(t *testing.T) {
     79 	unavailable := func(string) bool { return true }
     80 
     81 	if got, ok := resolveWebTarget("example.com", false, unavailable); ok {
     82 		t.Errorf("dead host reported alive as %q", got)
     83 	}
     84 }