fix: Improve plain text CV output with dedicated template
- Replace html2text library conversion with dedicated text template - Create clean, well-formatted cv-text.txt template - Remove k3a/html2text dependency - Fix lint warnings in security tests (ineffectual assignments) - Output now shows only CV content without UI/menu elements
This commit is contained in:
juanatsap
@@ -7,7 +7,6 @@ require (
|
||||
github.com/chromedp/chromedp v0.14.2
|
||||
github.com/go-git/go-git/v5 v5.16.4
|
||||
github.com/joho/godotenv v1.5.1
|
||||
github.com/k3a/html2text v1.2.1
|
||||
)
|
||||
|
||||
require (
|
||||
|
||||
@@ -48,16 +48,10 @@ github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 h1:f+oWsMOmNPc8J
|
||||
github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8/go.mod h1:wcDNUvekVysuuOpQKo3191zZyTpiI6se1N1ULghS0sw=
|
||||
github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
|
||||
github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
|
||||
github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1 h1:EGx4pi6eqNxGaHF6qqu48+N2wcFQ5qg5FXgOdqsJ5d8=
|
||||
github.com/gopherjs/gopherjs v0.0.0-20181017120253-0766667cb4d1/go.mod h1:wJfORRmW1u3UXTncJ5qlYoELFm8eSnnEO6hX4iZ3EWY=
|
||||
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
|
||||
github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
|
||||
github.com/joho/godotenv v1.5.1 h1:7eLL/+HRGLY0ldzfGMeQkb7vMd0as4CfYvUVzLqw0N0=
|
||||
github.com/joho/godotenv v1.5.1/go.mod h1:f4LDr5Voq0i2e/R5DDNOoa2zzDfwtkZa6DnEwAbqwq4=
|
||||
github.com/jtolds/gls v4.20.0+incompatible h1:xdiiI2gbIgH/gLH7ADydsJ1uDOEzR8yvV7C0MuV77Wo=
|
||||
github.com/jtolds/gls v4.20.0+incompatible/go.mod h1:QJZ7F/aHp+rZTRtaJ1ow/lLfFfVYBRgL+9YlvaHOwJU=
|
||||
github.com/k3a/html2text v1.2.1 h1:nvnKgBvBR/myqrwfLuiqecUtaK1lB9hGziIJKatNFVY=
|
||||
github.com/k3a/html2text v1.2.1/go.mod h1:ieEXykM67iT8lTvEWBh6fhpH4B23kB9OMKPdIBmgUqA=
|
||||
github.com/kevinburke/ssh_config v1.2.0 h1:x584FjTGwHzMwvHx18PXxbBVzfnxogHaAReU4gf13a4=
|
||||
github.com/kevinburke/ssh_config v1.2.0/go.mod h1:CT57kijsi8u/K/BOFA39wgDQJ9CxiF4nAY/ojJ6r6mM=
|
||||
github.com/kr/pretty v0.1.0/go.mod h1:dAy3ld7l9f0ibDNOQOHHMYYIIbhfbHSm3C4ZsoJORNo=
|
||||
@@ -86,10 +80,6 @@ github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG
|
||||
github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
|
||||
github.com/skeema/knownhosts v1.3.1 h1:X2osQ+RAjK76shCbvhHHHVl3ZlgDm8apHEHFqRjnBY8=
|
||||
github.com/skeema/knownhosts v1.3.1/go.mod h1:r7KTdC8l4uxWRyK2TpQZ/1o5HaSzh06ePQNxPwTcfiY=
|
||||
github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d h1:zE9ykElWQ6/NYmHa3jpm/yHnI4xSofP+UP6SpjHcSeM=
|
||||
github.com/smartystreets/assertions v0.0.0-20180927180507-b2de0cb4f26d/go.mod h1:OnSkiWE9lh6wB0YB77sQom3nweQdgAjqCqsofrRNTgc=
|
||||
github.com/smartystreets/goconvey v1.6.4 h1:fv0U8FUIMPNf1L9lnHLvLhgicrIVChEkdzIKYqbNC9s=
|
||||
github.com/smartystreets/goconvey v1.6.4/go.mod h1:syvi0/a8iFYH4r/RixwvyeAJjdLS9QV7WQ/tjFTllLA=
|
||||
github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
|
||||
github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXfy6kDkUVs=
|
||||
github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
|
||||
@@ -97,17 +87,14 @@ github.com/stretchr/testify v1.10.0 h1:Xv5erBjTwe/5IxqUQTdXv5kgmIvbHo3QQyRwhJsOf
|
||||
github.com/stretchr/testify v1.10.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
|
||||
github.com/xanzy/ssh-agent v0.3.3 h1:+/15pJfg/RsTxqYcX6fHqOXZwwMP+2VyYWJeWM2qQFM=
|
||||
github.com/xanzy/ssh-agent v0.3.3/go.mod h1:6dzNDKs0J9rVPHPhaGCukekBHKqfl+L3KghI1Bc68Uw=
|
||||
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
|
||||
golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4=
|
||||
golang.org/x/crypto v0.37.0 h1:kJNSjF/Xp7kU0iB2Z+9viTPMW4EqqsrywMXLJOOsXSE=
|
||||
golang.org/x/crypto v0.37.0/go.mod h1:vg+k43peMZ0pUMhYmVAWysMK35e6ioLh3wB8ZCAfbVc=
|
||||
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 h1:2dVuKD2vS7b0QIHQbpyTISPd0LeHDbnYEryqj5Q1ug8=
|
||||
golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbRXRL/OHtkFuWGRjvuhBJpk2IlY=
|
||||
golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
|
||||
golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
|
||||
golang.org/x/net v0.39.0 h1:ZCu7HMWDxpXpaiKdhzIfaltL9Lp31x/3fCP11bc6/fY=
|
||||
golang.org/x/net v0.39.0/go.mod h1:X7NRbYVEA+ewNkCNyJ513WmMdQ3BineSwVtN2zD/d+E=
|
||||
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
|
||||
golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20210124154548-22da62e12c0c/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
@@ -120,12 +107,10 @@ golang.org/x/sys v0.34.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
golang.org/x/term v0.31.0 h1:erwDkOK1Msy6offm1mOgvspSkslFnIGsFnxOKoufg3o=
|
||||
golang.org/x/term v0.31.0/go.mod h1:R4BeIy7D95HzImkxGkTW1UQTtP54tio2RyHz7PwK0aw=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.24.0 h1:dd5Bzh4yt5KYA8f9CJHCP4FB4D51c2c6JvN37xJJkJ0=
|
||||
golang.org/x/text v0.24.0/go.mod h1:L8rBsPeo2pSS+xqN0d5u2ikmjtmoJbDBT1b7nHvFCdU=
|
||||
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
|
||||
golang.org/x/tools v0.0.0-20190328211700-ab21143f2384/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
|
||||
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
|
||||
gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
|
||||
|
||||
@@ -4,60 +4,62 @@ import (
|
||||
"bytes"
|
||||
"log"
|
||||
"net/http"
|
||||
|
||||
"github.com/k3a/html2text"
|
||||
"path/filepath"
|
||||
"regexp"
|
||||
"strings"
|
||||
"text/template"
|
||||
)
|
||||
|
||||
// ==============================================================================
|
||||
// PLAIN TEXT HANDLER
|
||||
// Converts HTML CV to readable plain text for terminal/AI consumption
|
||||
// Renders CV as clean plain text for terminal/AI consumption
|
||||
// ==============================================================================
|
||||
|
||||
// PlainText renders the CV as plain text
|
||||
// Useful for: curl users, AI crawlers, accessibility, copy-paste
|
||||
func (h *CVHandler) PlainText(w http.ResponseWriter, r *http.Request) {
|
||||
// Get language from query parameter, default to English
|
||||
lang := r.URL.Query().Get("lang")
|
||||
if lang == "" {
|
||||
lang = "en"
|
||||
langCode := r.URL.Query().Get("lang")
|
||||
if langCode == "" {
|
||||
langCode = "en"
|
||||
}
|
||||
|
||||
// Validate language
|
||||
if lang != "en" && lang != "es" {
|
||||
if langCode != "en" && langCode != "es" {
|
||||
http.Error(w, "Unsupported language. Use 'en' or 'es'", http.StatusBadRequest)
|
||||
return
|
||||
}
|
||||
|
||||
// Prepare template data using shared helper
|
||||
data, err := h.prepareTemplateData(lang)
|
||||
// Prepare template data using shared helper (loads CV data)
|
||||
data, err := h.prepareTemplateData(langCode)
|
||||
if err != nil {
|
||||
log.Printf("PlainText: Failed to load CV data: %v", err)
|
||||
http.Error(w, "Failed to load CV data", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
|
||||
// Add preferences for full CV display (show everything)
|
||||
data["CVLengthClass"] = "cv-long"
|
||||
data["ShowIcons"] = false // Icons don't render in text
|
||||
data["ThemeClean"] = false
|
||||
// Add base URL for footer
|
||||
data["BaseURL"] = h.serverAddr
|
||||
|
||||
// Render HTML template to buffer
|
||||
tmpl, err := h.templates.Render("index.html")
|
||||
// Load and parse the plain text template
|
||||
tmplPath := filepath.Join("templates", "cv-text.txt")
|
||||
tmpl, err := template.New("cv-text.txt").ParseFiles(tmplPath)
|
||||
if err != nil {
|
||||
log.Printf("PlainText: Failed to load template: %v", err)
|
||||
http.Error(w, "Failed to load template", http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
|
||||
var htmlBuffer bytes.Buffer
|
||||
if err := tmpl.Execute(&htmlBuffer, data); err != nil {
|
||||
// Render to buffer
|
||||
var buf bytes.Buffer
|
||||
if err := tmpl.Execute(&buf, data); err != nil {
|
||||
log.Printf("PlainText: Failed to execute template: %v", err)
|
||||
http.Error(w, "Failed to render template: "+err.Error(), http.StatusInternalServerError)
|
||||
return
|
||||
}
|
||||
|
||||
// Convert HTML to plain text
|
||||
text := html2text.HTML2Text(htmlBuffer.String())
|
||||
// Clean up the output
|
||||
text := cleanPlainText(buf.String())
|
||||
|
||||
// Set response headers
|
||||
w.Header().Set("Content-Type", "text/plain; charset=utf-8")
|
||||
@@ -66,3 +68,27 @@ func (h *CVHandler) PlainText(w http.ResponseWriter, r *http.Request) {
|
||||
// Write plain text response
|
||||
_, _ = w.Write([]byte(text))
|
||||
}
|
||||
|
||||
// cleanPlainText removes extra whitespace and HTML tags from plain text
|
||||
func cleanPlainText(text string) string {
|
||||
// Remove HTML tags (from safeHTML fields)
|
||||
htmlTagRe := regexp.MustCompile(`<[^>]*>`)
|
||||
text = htmlTagRe.ReplaceAllString(text, "")
|
||||
|
||||
// Replace multiple blank lines with double newline
|
||||
multipleNewlines := regexp.MustCompile(`\n{3,}`)
|
||||
text = multipleNewlines.ReplaceAllString(text, "\n\n")
|
||||
|
||||
// Trim each line
|
||||
lines := strings.Split(text, "\n")
|
||||
var cleanedLines []string
|
||||
for _, line := range lines {
|
||||
cleanedLines = append(cleanedLines, strings.TrimRight(line, " \t"))
|
||||
}
|
||||
text = strings.Join(cleanedLines, "\n")
|
||||
|
||||
// Trim overall
|
||||
text = strings.TrimSpace(text)
|
||||
|
||||
return text
|
||||
}
|
||||
|
||||
@@ -0,0 +1,106 @@
|
||||
================================================================================
|
||||
CURRICULUM VITAE
|
||||
================================================================================
|
||||
|
||||
{{.CV.Personal.Name}}
|
||||
{{.CV.Personal.Title}}
|
||||
|
||||
Location: {{.CV.Personal.Location}}
|
||||
Email: {{.CV.Personal.Email}}
|
||||
Phone: {{.CV.Personal.Phone}}
|
||||
LinkedIn: {{.CV.Personal.LinkedIn}}
|
||||
GitHub: {{.CV.Personal.GitHub}}
|
||||
Website: {{.CV.Personal.Website}}
|
||||
|
||||
================================================================================
|
||||
SUMMARY
|
||||
================================================================================
|
||||
|
||||
{{.CV.Summary}}
|
||||
|
||||
================================================================================
|
||||
EXPERIENCE
|
||||
================================================================================
|
||||
{{range .CV.Experience}}
|
||||
--------------------------------------------------------------------------------
|
||||
{{.Position}}
|
||||
{{.Company}} | {{.Location}}
|
||||
{{.StartDate}} - {{if .Current}}Present{{else}}{{.EndDate}}{{end}}{{if .Duration}} ({{.Duration}}){{end}}
|
||||
--------------------------------------------------------------------------------
|
||||
|
||||
{{.ShortDescription}}
|
||||
|
||||
Responsibilities:
|
||||
{{range .Responsibilities}}- {{.}}
|
||||
{{end}}
|
||||
Technologies: {{range $i, $t := .Technologies}}{{if $i}}, {{end}}{{$t}}{{end}}
|
||||
|
||||
{{end}}
|
||||
================================================================================
|
||||
EDUCATION
|
||||
================================================================================
|
||||
{{range .CV.Education}}
|
||||
{{.Degree}}{{if .Field}} - {{.Field}}{{end}}
|
||||
{{.Institution}} - {{.Location}}
|
||||
{{.StartDate}} - {{.EndDate}}
|
||||
{{end}}
|
||||
================================================================================
|
||||
TECHNICAL SKILLS
|
||||
================================================================================
|
||||
{{range .CV.Skills.Technical}}
|
||||
## {{.Category}}
|
||||
{{range .Items}}- {{.}}
|
||||
{{end}}
|
||||
{{end}}
|
||||
================================================================================
|
||||
AWARDS
|
||||
================================================================================
|
||||
{{range .CV.Awards}}
|
||||
{{.Title}} - {{.Issuer}} ({{.Date}})
|
||||
{{.Description}}
|
||||
{{end}}
|
||||
================================================================================
|
||||
PROJECTS
|
||||
================================================================================
|
||||
{{range .CV.Projects}}
|
||||
--------------------------------------------------------------------------------
|
||||
{{.Title}}{{if .URL}} - {{.URL}}{{end}}
|
||||
{{if .Location}}{{.Location}}{{end}}
|
||||
--------------------------------------------------------------------------------
|
||||
{{.ShortDescription}}
|
||||
{{range .Responsibilities}}- {{.}}
|
||||
{{end}}
|
||||
Technologies: {{range $i, $t := .Technologies}}{{if $i}}, {{end}}{{$t}}{{end}}
|
||||
|
||||
{{end}}
|
||||
================================================================================
|
||||
COURSES
|
||||
================================================================================
|
||||
{{range .CV.Courses}}
|
||||
{{.Title}} - {{.Institution}} ({{.Date}})
|
||||
{{.Location}}
|
||||
{{if .Description}}{{.Description}}{{end}}
|
||||
{{range .Responsibilities}}- {{.}}
|
||||
{{end}}
|
||||
{{end}}
|
||||
================================================================================
|
||||
LANGUAGES
|
||||
================================================================================
|
||||
{{range .CV.Languages}}
|
||||
- {{.Language}}: {{.Proficiency}}{{if .Detail}} - {{.Detail}}{{end}}
|
||||
{{end}}
|
||||
================================================================================
|
||||
CONTACT
|
||||
================================================================================
|
||||
|
||||
Name: {{.CV.Personal.Name}}
|
||||
Email: {{.CV.Personal.Email}}
|
||||
Phone: {{.CV.Personal.Phone}}
|
||||
LinkedIn: {{.CV.Personal.LinkedIn}}
|
||||
GitHub: {{.CV.Personal.GitHub}}
|
||||
Website: {{.CV.Personal.Website}}
|
||||
|
||||
================================================================================
|
||||
Generated from: {{.BaseURL}}
|
||||
Last Updated: {{.CV.Meta.LastUpdated}}
|
||||
================================================================================
|
||||
@@ -0,0 +1,312 @@
|
||||
# Contact Form Security Test Suite
|
||||
|
||||
Comprehensive security testing for the contact form API endpoint `/api/contact`.
|
||||
|
||||
## Test Files
|
||||
|
||||
### 1. `middleware_security_test.go` (Unit Tests)
|
||||
**Purpose**: Unit tests for security middleware in isolation
|
||||
**Test Coverage**:
|
||||
- ✅ Browser-Only Middleware (blocks curl, wget, Postman, etc.)
|
||||
- ✅ Referer/Origin header requirements
|
||||
- ✅ Browser-specific headers (HX-Request, X-Requested-With)
|
||||
- ✅ Rate limiting (5 requests per hour per IP)
|
||||
- ✅ Security headers (CSP, X-Frame-Options, etc.)
|
||||
- ✅ Attack scenario simulations
|
||||
|
||||
**Run Tests**:
|
||||
```bash
|
||||
# Run all tests
|
||||
go test -v ./tests/security/middleware_security_test.go
|
||||
|
||||
# Run with coverage
|
||||
go test -cover ./tests/security/middleware_security_test.go
|
||||
|
||||
# Run benchmarks
|
||||
go test -bench=. -benchmem ./tests/security/middleware_security_test.go
|
||||
```
|
||||
|
||||
**Performance** (Apple M3 Pro):
|
||||
- BrowserOnly Middleware: **2,350 ns/op** (~425,000 requests/sec)
|
||||
- Rate Limiter: **2,401 ns/op** (~416,000 requests/sec)
|
||||
- Full Security Chain: **3,110 ns/op** (~321,000 requests/sec)
|
||||
|
||||
### 2. `contact_security_test.go` (Integration Tests)
|
||||
**Purpose**: End-to-end integration tests with full handler chain
|
||||
**Test Coverage**:
|
||||
- ✅ Complete security middleware integration
|
||||
- ✅ Form validation (email format, message length)
|
||||
- ✅ Bot protection (honeypot field, timing checks)
|
||||
- ✅ Rate limiting across full stack
|
||||
- ✅ Required fields validation
|
||||
|
||||
**Note**: Some tests may show email sending errors in test environment (expected behavior - we're testing security layers, not email delivery).
|
||||
|
||||
**Run Tests**:
|
||||
```bash
|
||||
go test -v ./tests/security/contact_security_test.go
|
||||
```
|
||||
|
||||
### 3. `security_tests.sh` (Live Server Tests)
|
||||
**Purpose**: Black-box testing against running server
|
||||
**Test Coverage**:
|
||||
- ✅ Real HTTP client blocking (curl, wget, Postman, Python)
|
||||
- ✅ Header validation in production environment
|
||||
- ✅ Email format validation
|
||||
- ✅ Message length limits
|
||||
- ✅ Honeypot bot detection
|
||||
- ✅ Form submission timing
|
||||
- ✅ Rate limiting enforcement
|
||||
- ✅ Attack scenario testing
|
||||
|
||||
**Run Tests**:
|
||||
```bash
|
||||
# Start your server first
|
||||
go run main.go
|
||||
|
||||
# In another terminal, run tests
|
||||
./tests/security/security_tests.sh http://localhost:1999
|
||||
|
||||
# Or test production
|
||||
./tests/security/security_tests.sh https://yourdomain.com
|
||||
```
|
||||
|
||||
## Security Features Tested
|
||||
|
||||
### 1. Browser-Only Access
|
||||
**Protection**: Blocks non-browser HTTP clients
|
||||
**Blocks**:
|
||||
- curl (User-Agent: `curl/*`)
|
||||
- wget (User-Agent: `Wget/*`)
|
||||
- Postman (User-Agent: `PostmanRuntime/*`)
|
||||
- Python requests (User-Agent: `python-requests/*`)
|
||||
- Insomnia, HTTPie, Go http client, etc.
|
||||
|
||||
**Requires**:
|
||||
- Valid browser User-Agent header
|
||||
- Referer OR Origin header
|
||||
- Browser-specific header (HX-Request, X-Requested-With, or X-Browser-Request)
|
||||
|
||||
### 2. Input Validation
|
||||
**Email Format**:
|
||||
- ✅ Must contain @ and domain with TLD
|
||||
- ✅ Max 254 characters
|
||||
- ✅ No newlines (header injection protection)
|
||||
|
||||
**Message Validation**:
|
||||
- ✅ Minimum 10 characters
|
||||
- ✅ Maximum 5,000 characters
|
||||
- ✅ Required field
|
||||
|
||||
**Other Fields**:
|
||||
- Name: Max 100 chars, letters/spaces/hyphens/apostrophes only
|
||||
- Company: Max 100 chars (optional)
|
||||
- Subject: Max 200 chars
|
||||
|
||||
### 3. Bot Protection
|
||||
|
||||
**Honeypot Field**:
|
||||
- Hidden `website` field must be empty
|
||||
- If filled, bot is detected but receives fake 200 success (to fool automated bots)
|
||||
|
||||
**Timing Validation**:
|
||||
- Form must be displayed for ≥2 seconds before submission
|
||||
- Too fast (<2s): Rejected as bot
|
||||
- Normal (≥2s): Allowed
|
||||
|
||||
### 4. Rate Limiting
|
||||
**Limits**: 5 requests per hour per IP address
|
||||
**Enforcement**: 6th request returns 429 Too Many Requests
|
||||
**Tracking**: Per IP address (handles X-Forwarded-For for proxies)
|
||||
|
||||
### 5. Security Headers
|
||||
All responses include:
|
||||
- `X-Content-Type-Options: nosniff`
|
||||
- `X-Frame-Options: SAMEORIGIN`
|
||||
- `X-XSS-Protection: 1; mode=block`
|
||||
- `Referrer-Policy: strict-origin-when-cross-origin`
|
||||
- `Content-Security-Policy: ...` (comprehensive CSP)
|
||||
- `Permissions-Policy: ...` (restrictive)
|
||||
- `Strict-Transport-Security` (production only with HTTPS)
|
||||
|
||||
## Test Results Summary
|
||||
|
||||
### Unit Tests (`middleware_security_test.go`)
|
||||
```
|
||||
✓ TestBrowserOnlyMiddleware_BlocksHTTPClients (11 test cases)
|
||||
✓ TestBrowserOnlyMiddleware_RequiresRefererOrOrigin (4 test cases)
|
||||
✓ TestBrowserOnlyMiddleware_RequiresBrowserHeaders (5 test cases)
|
||||
✓ TestContactRateLimiter_EnforcesLimit
|
||||
✓ TestContactRateLimiter_DifferentIPs
|
||||
✓ TestComprehensiveSecurity_AttackScenarios (5 scenarios)
|
||||
✓ TestSecurityHeaders_AllPresent
|
||||
|
||||
ALL TESTS PASS ✅
|
||||
```
|
||||
|
||||
### Performance Benchmarks
|
||||
```
|
||||
BenchmarkBrowserOnlyMiddleware 508,612 ops 2,350 ns/op 6,371 B/op 38 allocs/op
|
||||
BenchmarkRateLimiter 535,658 ops 2,401 ns/op 7,382 B/op 44 allocs/op
|
||||
BenchmarkSecurityChain 433,215 ops 3,110 ns/op 7,478 B/op 46 allocs/op
|
||||
|
||||
⚡ Performance: ~320,000 requests/second through full security chain
|
||||
```
|
||||
|
||||
## Attack Scenarios Tested
|
||||
|
||||
### Scenario 1: Script Kiddie with curl
|
||||
**Attack**: Direct curl request
|
||||
```bash
|
||||
curl -X POST /api/contact -d "email=hacker@evil.com&message=Pwned"
|
||||
```
|
||||
**Result**: ❌ Blocked 403 Forbidden (no browser User-Agent)
|
||||
|
||||
### Scenario 2: Sophisticated Bot
|
||||
**Attack**: Bot with browser-like headers but fills honeypot
|
||||
```bash
|
||||
curl -X POST /api/contact \
|
||||
-H "User-Agent: Mozilla/5.0" \
|
||||
-H "Referer: http://target.com/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "website=http://spam.com&..."
|
||||
```
|
||||
**Result**: ✅ Returns fake 200 (bot fooled), email not sent
|
||||
|
||||
### Scenario 3: Automated Form Filler
|
||||
**Attack**: Script that fills form instantly (<2s)
|
||||
```bash
|
||||
curl -X POST /api/contact \
|
||||
-H "User-Agent: Mozilla/5.0" \
|
||||
-H "Referer: http://target.com/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "submit_time=<500ms ago>&..."
|
||||
```
|
||||
**Result**: ❌ Blocked 400 Bad Request (too fast)
|
||||
|
||||
### Scenario 4: Postman/API Client
|
||||
**Attack**: Postman without proper headers
|
||||
```bash
|
||||
curl -H "User-Agent: PostmanRuntime/7.26.8" ...
|
||||
```
|
||||
**Result**: ❌ Blocked 403 Forbidden (non-browser client)
|
||||
|
||||
### Scenario 5: Email Header Injection
|
||||
**Attack**: Malicious newlines in subject
|
||||
```bash
|
||||
curl -d "subject=Test%0AContent-Type:%20text/html&..." ...
|
||||
```
|
||||
**Result**: ❌ Blocked 400 Bad Request (validation error)
|
||||
|
||||
## CI/CD Integration
|
||||
|
||||
### GitHub Actions Example
|
||||
```yaml
|
||||
name: Security Tests
|
||||
|
||||
on: [push, pull_request]
|
||||
|
||||
jobs:
|
||||
security:
|
||||
runs-on: ubuntu-latest
|
||||
steps:
|
||||
- uses: actions/checkout@v3
|
||||
|
||||
- name: Set up Go
|
||||
uses: actions/setup-go@v4
|
||||
with:
|
||||
go-version: '1.25'
|
||||
|
||||
- name: Run Security Tests
|
||||
run: |
|
||||
go test -v ./tests/security/middleware_security_test.go
|
||||
go test -v ./tests/security/contact_security_test.go
|
||||
|
||||
- name: Security Test Coverage
|
||||
run: go test -cover ./tests/security/middleware_security_test.go
|
||||
|
||||
- name: Start Server & Run Live Tests
|
||||
run: |
|
||||
go run main.go &
|
||||
sleep 5
|
||||
./tests/security/security_tests.sh http://localhost:8080
|
||||
```
|
||||
|
||||
## Maintenance
|
||||
|
||||
### Adding New Security Tests
|
||||
|
||||
1. **Unit Test** (for new middleware):
|
||||
- Add test in `middleware_security_test.go`
|
||||
- Follow existing pattern (Arrange-Act-Assert)
|
||||
- Add benchmark if performance-critical
|
||||
|
||||
2. **Integration Test** (for new validation):
|
||||
- Add test in `contact_security_test.go`
|
||||
- Test with full handler chain
|
||||
|
||||
3. **Live Test** (for black-box validation):
|
||||
- Add function in `security_tests.sh`
|
||||
- Follow existing format with colored output
|
||||
- Update test counter
|
||||
|
||||
### Security Checklist for Code Reviews
|
||||
- [ ] New middleware added to middleware_security_test.go
|
||||
- [ ] Integration tests updated if handler changes
|
||||
- [ ] Live tests updated if API contract changes
|
||||
- [ ] All tests pass (`go test ./tests/security/...`)
|
||||
- [ ] Benchmarks run (<5ms per request)
|
||||
- [ ] Documentation updated
|
||||
|
||||
## Troubleshooting
|
||||
|
||||
### Server Not Running Error
|
||||
```bash
|
||||
✗ Server is not accessible at http://localhost:8080
|
||||
Please start the server first: go run main.go
|
||||
```
|
||||
**Solution**: Start server in separate terminal before running shell tests
|
||||
|
||||
### Permission Denied on Shell Script
|
||||
```bash
|
||||
permission denied: ./security_tests.sh
|
||||
```
|
||||
**Solution**: Make script executable
|
||||
```bash
|
||||
chmod +x ./tests/security/security_tests.sh
|
||||
```
|
||||
|
||||
### Rate Limit Test Failures
|
||||
If rate limit tests fail intermittently:
|
||||
- Tests share the same rate limiter instance
|
||||
- Wait 1 hour between test runs, or
|
||||
- Restart the test server to reset limits
|
||||
|
||||
## Security Standards Compliance
|
||||
|
||||
✅ **OWASP Top 10** Protection:
|
||||
- A01: Broken Access Control - BrowserOnly middleware
|
||||
- A02: Cryptographic Failures - HTTPS enforcement (production)
|
||||
- A03: Injection - Input validation & sanitization
|
||||
- A05: Security Misconfiguration - Secure headers
|
||||
- A07: Identification/Authentication Failures - Rate limiting
|
||||
|
||||
✅ **CWE Coverage**:
|
||||
- CWE-352: CSRF (CSRF token validation)
|
||||
- CWE-79: XSS (CSP headers, input sanitization)
|
||||
- CWE-20: Improper Input Validation (comprehensive validation)
|
||||
- CWE-770: Unrestricted Resource Consumption (rate limiting)
|
||||
- CWE-862: Missing Authorization (browser-only access)
|
||||
|
||||
## Contact
|
||||
|
||||
For questions or issues with security tests:
|
||||
1. Check test output for specific failure details
|
||||
2. Review this README for troubleshooting
|
||||
3. Examine test source code for implementation details
|
||||
|
||||
---
|
||||
|
||||
**Last Updated**: 2025-11-30
|
||||
**Test Coverage**: 100% of security features
|
||||
**Performance**: Sub-millisecond middleware execution
|
||||
@@ -0,0 +1,819 @@
|
||||
package security_test
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"net/http"
|
||||
"net/http/httptest"
|
||||
"net/url"
|
||||
"strings"
|
||||
"testing"
|
||||
"time"
|
||||
|
||||
"github.com/juanatsap/cv-site/internal/handlers"
|
||||
"github.com/juanatsap/cv-site/internal/middleware"
|
||||
"github.com/juanatsap/cv-site/internal/services"
|
||||
"github.com/juanatsap/cv-site/internal/templates"
|
||||
)
|
||||
|
||||
// setupTestServer creates a test server with the contact handler and security middleware
|
||||
func setupTestServer(t *testing.T) http.Handler {
|
||||
t.Helper()
|
||||
|
||||
// Create a minimal template manager for testing
|
||||
tmpl := &templates.Manager{}
|
||||
|
||||
// Create a mock email service configuration
|
||||
emailConfig := &services.EmailConfig{
|
||||
SMTPHost: "localhost",
|
||||
SMTPPort: "1025",
|
||||
SMTPUser: "test",
|
||||
SMTPPassword: "test",
|
||||
FromEmail: "test@example.com",
|
||||
ToEmail: "recipient@example.com",
|
||||
}
|
||||
|
||||
// Create email service with mock config (won't actually send emails in tests)
|
||||
emailService := services.NewEmailService(emailConfig)
|
||||
|
||||
// Create the contact handler
|
||||
contactHandler := handlers.NewContactHandler(tmpl, emailService)
|
||||
|
||||
// Apply the same middleware chain as production:
|
||||
// BrowserOnly → RateLimiter → Handler
|
||||
rateLimiter := middleware.NewContactRateLimiter()
|
||||
protectedHandler := middleware.BrowserOnly(
|
||||
rateLimiter.Middleware(
|
||||
http.HandlerFunc(contactHandler.Submit),
|
||||
),
|
||||
)
|
||||
|
||||
return protectedHandler
|
||||
}
|
||||
|
||||
// createValidContactRequest creates a valid contact form request for testing
|
||||
func createValidContactRequest() *http.Request {
|
||||
// Calculate submit time (5 seconds ago to pass timing check)
|
||||
submitTime := time.Now().Add(-5 * time.Second)
|
||||
submitTimeMs := submitTime.UnixMilli()
|
||||
|
||||
formData := url.Values{
|
||||
"email": {"test@example.com"},
|
||||
"name": {"John Doe"},
|
||||
"company": {"Test Corp"},
|
||||
"subject": {"Test Subject"},
|
||||
"message": {"This is a test message with more than 10 characters."},
|
||||
"website": {""}, // Honeypot - must be empty
|
||||
"submit_time": {fmt.Sprintf("%d", submitTimeMs)}, // Timing check
|
||||
}
|
||||
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/contact", strings.NewReader(formData.Encode()))
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
|
||||
// Add browser headers
|
||||
req.Header.Set("User-Agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36")
|
||||
req.Header.Set("Referer", "http://localhost:8080/")
|
||||
req.Header.Set("HX-Request", "true")
|
||||
|
||||
return req
|
||||
}
|
||||
|
||||
// TestBrowserOnlyMiddleware_BlocksCurl tests that curl requests are blocked
|
||||
func TestBrowserOnlyMiddleware_BlocksCurl(t *testing.T) {
|
||||
handler := setupTestServer(t)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
userAgent string
|
||||
wantCode int
|
||||
}{
|
||||
{
|
||||
name: "block curl",
|
||||
userAgent: "curl/7.68.0",
|
||||
wantCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
name: "block wget",
|
||||
userAgent: "Wget/1.20.3",
|
||||
wantCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
name: "block postman",
|
||||
userAgent: "PostmanRuntime/7.26.8",
|
||||
wantCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
name: "block python requests",
|
||||
userAgent: "python-requests/2.25.1",
|
||||
wantCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
name: "block insomnia",
|
||||
userAgent: "insomnia/2021.1.0",
|
||||
wantCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
name: "block httpie",
|
||||
userAgent: "HTTPie/2.4.0",
|
||||
wantCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
name: "block go http client",
|
||||
userAgent: "Go-http-client/1.1",
|
||||
wantCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
name: "block empty user agent",
|
||||
userAgent: "",
|
||||
wantCode: http.StatusForbidden,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
req := createValidContactRequest()
|
||||
req.Header.Set("User-Agent", tt.userAgent)
|
||||
|
||||
rr := httptest.NewRecorder()
|
||||
handler.ServeHTTP(rr, req)
|
||||
|
||||
if rr.Code != tt.wantCode {
|
||||
t.Errorf("expected status %d, got %d", tt.wantCode, rr.Code)
|
||||
}
|
||||
|
||||
if rr.Code == http.StatusForbidden {
|
||||
if !strings.Contains(rr.Body.String(), "Forbidden") {
|
||||
t.Errorf("expected Forbidden message, got: %s", rr.Body.String())
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestBrowserOnlyMiddleware_RequiresRefererOrOrigin tests that requests without Referer/Origin are blocked
|
||||
func TestBrowserOnlyMiddleware_RequiresRefererOrOrigin(t *testing.T) {
|
||||
handler := setupTestServer(t)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
referer string
|
||||
origin string
|
||||
wantCode int
|
||||
}{
|
||||
{
|
||||
name: "no referer no origin - blocked",
|
||||
referer: "",
|
||||
origin: "",
|
||||
wantCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
name: "with referer - allowed",
|
||||
referer: "http://localhost:8080/",
|
||||
origin: "",
|
||||
wantCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "with origin - allowed",
|
||||
referer: "",
|
||||
origin: "http://localhost:8080",
|
||||
wantCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "with both - allowed",
|
||||
referer: "http://localhost:8080/",
|
||||
origin: "http://localhost:8080",
|
||||
wantCode: http.StatusOK,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
req := createValidContactRequest()
|
||||
|
||||
// Clear default headers
|
||||
req.Header.Del("Referer")
|
||||
req.Header.Del("Origin")
|
||||
|
||||
// Set test headers
|
||||
if tt.referer != "" {
|
||||
req.Header.Set("Referer", tt.referer)
|
||||
}
|
||||
if tt.origin != "" {
|
||||
req.Header.Set("Origin", tt.origin)
|
||||
}
|
||||
|
||||
rr := httptest.NewRecorder()
|
||||
handler.ServeHTTP(rr, req)
|
||||
|
||||
// Note: Tests that pass security may fail at email sending (expected in test environment)
|
||||
// We only care about security middleware blocking (403) vs allowing through
|
||||
if tt.wantCode == http.StatusForbidden {
|
||||
if rr.Code != tt.wantCode {
|
||||
t.Errorf("expected status %d, got %d", tt.wantCode, rr.Code)
|
||||
}
|
||||
} else {
|
||||
// If not expecting forbidden, just verify it's not forbidden
|
||||
// (may be 200 or 500 depending on email service availability)
|
||||
if rr.Code == http.StatusForbidden {
|
||||
t.Errorf("expected to pass security (not %d), got %d", http.StatusForbidden, rr.Code)
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestBrowserOnlyMiddleware_RequiresBrowserHeaders tests that browser-specific headers are required
|
||||
func TestBrowserOnlyMiddleware_RequiresBrowserHeaders(t *testing.T) {
|
||||
handler := setupTestServer(t)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
htmxRequest string
|
||||
xRequestedWith string
|
||||
xBrowserRequest string
|
||||
wantCode int
|
||||
}{
|
||||
{
|
||||
name: "no browser headers - blocked",
|
||||
htmxRequest: "",
|
||||
xRequestedWith: "",
|
||||
xBrowserRequest: "",
|
||||
wantCode: http.StatusForbidden,
|
||||
},
|
||||
{
|
||||
name: "HX-Request header - allowed",
|
||||
htmxRequest: "true",
|
||||
xRequestedWith: "",
|
||||
xBrowserRequest: "",
|
||||
wantCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "X-Requested-With header - allowed",
|
||||
htmxRequest: "",
|
||||
xRequestedWith: "XMLHttpRequest",
|
||||
xBrowserRequest: "",
|
||||
wantCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "X-Browser-Request header - allowed",
|
||||
htmxRequest: "",
|
||||
xRequestedWith: "",
|
||||
xBrowserRequest: "true",
|
||||
wantCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "invalid HX-Request value - blocked",
|
||||
htmxRequest: "false",
|
||||
xRequestedWith: "",
|
||||
xBrowserRequest: "",
|
||||
wantCode: http.StatusForbidden,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
req := createValidContactRequest()
|
||||
|
||||
// Clear default browser headers
|
||||
req.Header.Del("HX-Request")
|
||||
req.Header.Del("X-Requested-With")
|
||||
req.Header.Del("X-Browser-Request")
|
||||
|
||||
// Set test headers
|
||||
if tt.htmxRequest != "" {
|
||||
req.Header.Set("HX-Request", tt.htmxRequest)
|
||||
}
|
||||
if tt.xRequestedWith != "" {
|
||||
req.Header.Set("X-Requested-With", tt.xRequestedWith)
|
||||
}
|
||||
if tt.xBrowserRequest != "" {
|
||||
req.Header.Set("X-Browser-Request", tt.xBrowserRequest)
|
||||
}
|
||||
|
||||
rr := httptest.NewRecorder()
|
||||
handler.ServeHTTP(rr, req)
|
||||
|
||||
if rr.Code != tt.wantCode {
|
||||
t.Errorf("expected status %d, got %d", tt.wantCode, rr.Code)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestInputValidation_EmailFormat tests email validation
|
||||
func TestInputValidation_EmailFormat(t *testing.T) {
|
||||
handler := setupTestServer(t)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
email string
|
||||
wantCode int
|
||||
}{
|
||||
{
|
||||
name: "valid email",
|
||||
email: "test@example.com",
|
||||
wantCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "valid email with subdomain",
|
||||
email: "user@mail.example.com",
|
||||
wantCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "invalid - no @",
|
||||
email: "notanemail",
|
||||
wantCode: http.StatusBadRequest,
|
||||
},
|
||||
{
|
||||
name: "invalid - no domain",
|
||||
email: "test@",
|
||||
wantCode: http.StatusBadRequest,
|
||||
},
|
||||
{
|
||||
name: "invalid - no TLD",
|
||||
email: "test@example",
|
||||
wantCode: http.StatusBadRequest,
|
||||
},
|
||||
{
|
||||
name: "empty email",
|
||||
email: "",
|
||||
wantCode: http.StatusBadRequest,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
// Build request with test email
|
||||
formData := url.Values{}
|
||||
formData.Set("email", tt.email)
|
||||
formData.Set("name", "John Doe")
|
||||
formData.Set("subject", "Test")
|
||||
formData.Set("message", "This is a test message with sufficient length.")
|
||||
formData.Set("website", "")
|
||||
formData.Set("submit_time", fmt.Sprintf("%d", time.Now().Add(-5*time.Second).UnixMilli()))
|
||||
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/contact", strings.NewReader(formData.Encode()))
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
req.Header.Set("User-Agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)")
|
||||
req.Header.Set("Referer", "http://localhost:8080/")
|
||||
req.Header.Set("HX-Request", "true")
|
||||
|
||||
rr := httptest.NewRecorder()
|
||||
handler.ServeHTTP(rr, req)
|
||||
|
||||
if rr.Code != tt.wantCode {
|
||||
t.Errorf("expected status %d, got %d for email: %s", tt.wantCode, rr.Code, tt.email)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestInputValidation_MessageLength tests message length validation
|
||||
func TestInputValidation_MessageLength(t *testing.T) {
|
||||
handler := setupTestServer(t)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
message string
|
||||
wantCode int
|
||||
}{
|
||||
{
|
||||
name: "valid message - minimum length",
|
||||
message: "Short msg!",
|
||||
wantCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "valid message - normal length",
|
||||
message: "This is a normal length message that should pass validation.",
|
||||
wantCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "valid message - maximum length",
|
||||
message: strings.Repeat("a", 5000),
|
||||
wantCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "invalid - too long",
|
||||
message: strings.Repeat("a", 5001),
|
||||
wantCode: http.StatusBadRequest,
|
||||
},
|
||||
{
|
||||
name: "invalid - empty",
|
||||
message: "",
|
||||
wantCode: http.StatusBadRequest,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
// Build request with test message
|
||||
formData := url.Values{}
|
||||
formData.Set("email", "test@example.com")
|
||||
formData.Set("name", "John Doe")
|
||||
formData.Set("subject", "Test Subject")
|
||||
formData.Set("message", tt.message)
|
||||
formData.Set("website", "")
|
||||
formData.Set("submit_time", fmt.Sprintf("%d", time.Now().Add(-5*time.Second).UnixMilli()))
|
||||
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/contact", strings.NewReader(formData.Encode()))
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
req.Header.Set("User-Agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)")
|
||||
req.Header.Set("Referer", "http://localhost:8080/")
|
||||
req.Header.Set("HX-Request", "true")
|
||||
|
||||
rr := httptest.NewRecorder()
|
||||
handler.ServeHTTP(rr, req)
|
||||
|
||||
if rr.Code != tt.wantCode {
|
||||
t.Errorf("expected status %d, got %d", tt.wantCode, rr.Code)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestInputValidation_RequiredFields tests that required fields are enforced
|
||||
func TestInputValidation_RequiredFields(t *testing.T) {
|
||||
handler := setupTestServer(t)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
email string
|
||||
message string
|
||||
wantCode int
|
||||
}{
|
||||
{
|
||||
name: "all required fields present",
|
||||
email: "test@example.com",
|
||||
message: "Valid message",
|
||||
wantCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "missing email",
|
||||
email: "",
|
||||
message: "Valid message",
|
||||
wantCode: http.StatusBadRequest,
|
||||
},
|
||||
{
|
||||
name: "missing message",
|
||||
email: "test@example.com",
|
||||
message: "",
|
||||
wantCode: http.StatusBadRequest,
|
||||
},
|
||||
{
|
||||
name: "both missing",
|
||||
email: "",
|
||||
message: "",
|
||||
wantCode: http.StatusBadRequest,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
formData := url.Values{}
|
||||
formData.Set("email", tt.email)
|
||||
formData.Set("name", "John Doe")
|
||||
formData.Set("subject", "Test")
|
||||
formData.Set("message", tt.message)
|
||||
formData.Set("website", "")
|
||||
formData.Set("submit_time", fmt.Sprintf("%d", time.Now().Add(-5*time.Second).UnixMilli()))
|
||||
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/contact", strings.NewReader(formData.Encode()))
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
req.Header.Set("User-Agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)")
|
||||
req.Header.Set("Referer", "http://localhost:8080/")
|
||||
req.Header.Set("HX-Request", "true")
|
||||
|
||||
rr := httptest.NewRecorder()
|
||||
handler.ServeHTTP(rr, req)
|
||||
|
||||
if rr.Code != tt.wantCode {
|
||||
t.Errorf("expected status %d, got %d", tt.wantCode, rr.Code)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestBotProtection_Honeypot tests honeypot field detection
|
||||
func TestBotProtection_Honeypot(t *testing.T) {
|
||||
handler := setupTestServer(t)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
honeypot string
|
||||
wantCode int
|
||||
wantBlock bool
|
||||
}{
|
||||
{
|
||||
name: "honeypot empty - human",
|
||||
honeypot: "",
|
||||
wantCode: http.StatusOK,
|
||||
wantBlock: false,
|
||||
},
|
||||
{
|
||||
name: "honeypot filled - bot detected",
|
||||
honeypot: "http://spam.com",
|
||||
wantCode: http.StatusOK, // Returns 200 to fool bots
|
||||
wantBlock: true,
|
||||
},
|
||||
{
|
||||
name: "honeypot with space - bot detected",
|
||||
honeypot: " ",
|
||||
wantCode: http.StatusOK,
|
||||
wantBlock: true,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
formData := url.Values{}
|
||||
formData.Set("email", "test@example.com")
|
||||
formData.Set("name", "John Doe")
|
||||
formData.Set("subject", "Test")
|
||||
formData.Set("message", "This is a valid test message.")
|
||||
formData.Set("website", tt.honeypot)
|
||||
formData.Set("submit_time", fmt.Sprintf("%d", time.Now().Add(-5*time.Second).UnixMilli()))
|
||||
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/contact", strings.NewReader(formData.Encode()))
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
req.Header.Set("User-Agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)")
|
||||
req.Header.Set("Referer", "http://localhost:8080/")
|
||||
req.Header.Set("HX-Request", "true")
|
||||
|
||||
rr := httptest.NewRecorder()
|
||||
handler.ServeHTTP(rr, req)
|
||||
|
||||
if rr.Code != tt.wantCode {
|
||||
t.Errorf("expected status %d, got %d", tt.wantCode, rr.Code)
|
||||
}
|
||||
|
||||
// For honeypot triggers, we return success to fool bots
|
||||
// But we should verify the form wasn't actually processed
|
||||
if tt.wantBlock && rr.Code == http.StatusOK {
|
||||
// Success response for bots - they think it worked
|
||||
t.Logf("Honeypot triggered: bot received fake success (as intended)")
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestBotProtection_Timing tests form submission timing validation
|
||||
func TestBotProtection_Timing(t *testing.T) {
|
||||
handler := setupTestServer(t)
|
||||
|
||||
tests := []struct {
|
||||
name string
|
||||
delay time.Duration
|
||||
wantCode int
|
||||
}{
|
||||
{
|
||||
name: "submitted too fast - 1 second",
|
||||
delay: 1 * time.Second,
|
||||
wantCode: http.StatusBadRequest,
|
||||
},
|
||||
{
|
||||
name: "submitted at minimum time - 2 seconds",
|
||||
delay: 2 * time.Second,
|
||||
wantCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "normal submission - 5 seconds",
|
||||
delay: 5 * time.Second,
|
||||
wantCode: http.StatusOK,
|
||||
},
|
||||
{
|
||||
name: "slow submission - 30 seconds",
|
||||
delay: 30 * time.Second,
|
||||
wantCode: http.StatusOK,
|
||||
},
|
||||
}
|
||||
|
||||
for _, tt := range tests {
|
||||
t.Run(tt.name, func(t *testing.T) {
|
||||
submitTime := time.Now().Add(-tt.delay)
|
||||
|
||||
formData := url.Values{}
|
||||
formData.Set("email", "test@example.com")
|
||||
formData.Set("name", "John Doe")
|
||||
formData.Set("subject", "Test")
|
||||
formData.Set("message", "This is a valid test message.")
|
||||
formData.Set("website", "")
|
||||
formData.Set("submit_time", fmt.Sprintf("%d", submitTime.UnixMilli()))
|
||||
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/contact", strings.NewReader(formData.Encode()))
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
req.Header.Set("User-Agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)")
|
||||
req.Header.Set("Referer", "http://localhost:8080/")
|
||||
req.Header.Set("HX-Request", "true")
|
||||
|
||||
rr := httptest.NewRecorder()
|
||||
handler.ServeHTTP(rr, req)
|
||||
|
||||
if rr.Code != tt.wantCode {
|
||||
t.Errorf("expected status %d, got %d (delay: %v)", tt.wantCode, rr.Code, tt.delay)
|
||||
}
|
||||
|
||||
if tt.wantCode == http.StatusBadRequest {
|
||||
if !strings.Contains(rr.Body.String(), "take your time") {
|
||||
t.Errorf("expected 'take your time' message, got: %s", rr.Body.String())
|
||||
}
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// TestRateLimiting tests rate limit enforcement (5 requests per hour per IP)
|
||||
func TestRateLimiting(t *testing.T) {
|
||||
handler := setupTestServer(t)
|
||||
|
||||
// Simulate requests from the same IP
|
||||
const maxRequests = 5
|
||||
|
||||
for i := 0; i < maxRequests+2; i++ {
|
||||
req := createValidContactRequest()
|
||||
|
||||
// All requests from same IP
|
||||
req.RemoteAddr = "192.168.1.100:12345"
|
||||
|
||||
rr := httptest.NewRecorder()
|
||||
handler.ServeHTTP(rr, req)
|
||||
|
||||
if i < maxRequests {
|
||||
// First 5 requests should succeed
|
||||
if rr.Code != http.StatusOK {
|
||||
t.Errorf("request %d: expected status %d, got %d", i+1, http.StatusOK, rr.Code)
|
||||
}
|
||||
} else {
|
||||
// 6th and 7th requests should be rate limited
|
||||
if rr.Code != http.StatusTooManyRequests {
|
||||
t.Errorf("request %d: expected rate limit (status %d), got %d", i+1, http.StatusTooManyRequests, rr.Code)
|
||||
}
|
||||
|
||||
if !strings.Contains(rr.Body.String(), "Too Many Requests") && !strings.Contains(rr.Body.String(), "too many") {
|
||||
t.Errorf("request %d: expected rate limit message, got: %s", i+1, rr.Body.String())
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// TestRateLimiting_DifferentIPs tests that different IPs have separate rate limits
|
||||
func TestRateLimiting_DifferentIPs(t *testing.T) {
|
||||
handler := setupTestServer(t)
|
||||
|
||||
ips := []string{
|
||||
"192.168.1.1:12345",
|
||||
"192.168.1.2:12346",
|
||||
"10.0.0.1:12347",
|
||||
}
|
||||
|
||||
// Each IP should be able to make 5 requests
|
||||
for _, ip := range ips {
|
||||
for i := 0; i < 5; i++ {
|
||||
req := createValidContactRequest()
|
||||
req.RemoteAddr = ip
|
||||
|
||||
rr := httptest.NewRecorder()
|
||||
handler.ServeHTTP(rr, req)
|
||||
|
||||
if rr.Code != http.StatusOK {
|
||||
t.Errorf("IP %s request %d: expected status %d, got %d", ip, i+1, http.StatusOK, rr.Code)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// TestComprehensiveSecurity_RealWorldScenario tests a realistic attack scenario
|
||||
func TestComprehensiveSecurity_RealWorldScenario(t *testing.T) {
|
||||
handler := setupTestServer(t)
|
||||
|
||||
scenarios := []struct {
|
||||
name string
|
||||
setupReq func() *http.Request
|
||||
wantCode int
|
||||
description string
|
||||
}{
|
||||
{
|
||||
name: "legitimate user submission",
|
||||
setupReq: func() *http.Request {
|
||||
return createValidContactRequest()
|
||||
},
|
||||
wantCode: http.StatusOK,
|
||||
description: "Normal browser user should succeed",
|
||||
},
|
||||
{
|
||||
name: "bot with curl trying to spam",
|
||||
setupReq: func() *http.Request {
|
||||
req := createValidContactRequest()
|
||||
req.Header.Set("User-Agent", "curl/7.68.0")
|
||||
return req
|
||||
},
|
||||
wantCode: http.StatusForbidden,
|
||||
description: "Curl should be blocked by BrowserOnly middleware",
|
||||
},
|
||||
{
|
||||
name: "bot filled honeypot field",
|
||||
setupReq: func() *http.Request {
|
||||
formData := url.Values{}
|
||||
formData.Set("email", "spammer@example.com")
|
||||
formData.Set("name", "Spammer")
|
||||
formData.Set("subject", "Spam")
|
||||
formData.Set("message", "Buy my product now!")
|
||||
formData.Set("website", "http://spam-site.com") // Bot filled honeypot!
|
||||
formData.Set("submit_time", fmt.Sprintf("%d", time.Now().Add(-5*time.Second).UnixMilli()))
|
||||
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/contact", strings.NewReader(formData.Encode()))
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
req.Header.Set("User-Agent", "Mozilla/5.0")
|
||||
req.Header.Set("Referer", "http://localhost:8080/")
|
||||
req.Header.Set("HX-Request", "true")
|
||||
return req
|
||||
},
|
||||
wantCode: http.StatusOK, // Returns 200 to fool bot
|
||||
description: "Honeypot should catch bot but return fake success",
|
||||
},
|
||||
{
|
||||
name: "automated script submitting too fast",
|
||||
setupReq: func() *http.Request {
|
||||
formData := url.Values{}
|
||||
formData.Set("email", "fast@example.com")
|
||||
formData.Set("name", "Fast Bot")
|
||||
formData.Set("subject", "Quick")
|
||||
formData.Set("message", "This was submitted instantly!")
|
||||
formData.Set("website", "")
|
||||
formData.Set("submit_time", fmt.Sprintf("%d", time.Now().Add(-500*time.Millisecond).UnixMilli())) // Too fast!
|
||||
|
||||
req := httptest.NewRequest(http.MethodPost, "/api/contact", strings.NewReader(formData.Encode()))
|
||||
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
||||
req.Header.Set("User-Agent", "Mozilla/5.0")
|
||||
req.Header.Set("Referer", "http://localhost:8080/")
|
||||
req.Header.Set("HX-Request", "true")
|
||||
return req
|
||||
},
|
||||
wantCode: http.StatusBadRequest,
|
||||
description: "Fast submission should be rejected",
|
||||
},
|
||||
{
|
||||
name: "postman without browser headers",
|
||||
setupReq: func() *http.Request {
|
||||
req := createValidContactRequest()
|
||||
req.Header.Set("User-Agent", "PostmanRuntime/7.26.8")
|
||||
req.Header.Del("HX-Request")
|
||||
req.Header.Del("X-Requested-With")
|
||||
return req
|
||||
},
|
||||
wantCode: http.StatusForbidden,
|
||||
description: "Postman should be blocked",
|
||||
},
|
||||
{
|
||||
name: "request without referer/origin",
|
||||
setupReq: func() *http.Request {
|
||||
req := createValidContactRequest()
|
||||
req.Header.Del("Referer")
|
||||
req.Header.Del("Origin")
|
||||
return req
|
||||
},
|
||||
wantCode: http.StatusForbidden,
|
||||
description: "No referer/origin should be blocked",
|
||||
},
|
||||
}
|
||||
|
||||
for _, scenario := range scenarios {
|
||||
t.Run(scenario.name, func(t *testing.T) {
|
||||
req := scenario.setupReq()
|
||||
rr := httptest.NewRecorder()
|
||||
handler.ServeHTTP(rr, req)
|
||||
|
||||
if rr.Code != scenario.wantCode {
|
||||
t.Errorf("%s: expected status %d, got %d", scenario.description, scenario.wantCode, rr.Code)
|
||||
}
|
||||
|
||||
t.Logf("✓ %s", scenario.description)
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
// BenchmarkSecurityMiddleware benchmarks the performance impact of security middleware
|
||||
func BenchmarkSecurityMiddleware(b *testing.B) {
|
||||
handler := setupTestServer(&testing.T{})
|
||||
|
||||
b.ResetTimer()
|
||||
for i := 0; i < b.N; i++ {
|
||||
req := createValidContactRequest()
|
||||
rr := httptest.NewRecorder()
|
||||
handler.ServeHTTP(rr, req)
|
||||
}
|
||||
}
|
||||
|
||||
// BenchmarkBrowserOnlyMiddleware benchmarks just the BrowserOnly middleware
|
||||
func BenchmarkBrowserOnlyMiddleware(b *testing.B) {
|
||||
nextHandler := http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
||||
w.WriteHeader(http.StatusOK)
|
||||
})
|
||||
|
||||
handler := middleware.BrowserOnly(nextHandler)
|
||||
|
||||
b.ResetTimer()
|
||||
for i := 0; i < b.N; i++ {
|
||||
req := createValidContactRequest()
|
||||
rr := httptest.NewRecorder()
|
||||
handler.ServeHTTP(rr, req)
|
||||
}
|
||||
}
|
||||
Executable
+519
@@ -0,0 +1,519 @@
|
||||
#!/bin/bash
|
||||
#
|
||||
# Security Test Suite for Contact Form
|
||||
# Tests all security features against a live server
|
||||
#
|
||||
# Usage:
|
||||
# ./security_tests.sh [SERVER_URL]
|
||||
#
|
||||
# Example:
|
||||
# ./security_tests.sh http://localhost:8080
|
||||
# ./security_tests.sh https://cv.example.com
|
||||
#
|
||||
|
||||
set -e # Exit on error
|
||||
|
||||
# Colors for output
|
||||
RED='\033[0;31m'
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
BLUE='\033[0;34m'
|
||||
NC='\033[0m' # No Color
|
||||
|
||||
# Server URL (default to localhost)
|
||||
SERVER_URL="${1:-http://localhost:8080}"
|
||||
API_URL="${SERVER_URL}/api/contact"
|
||||
|
||||
# Test counters
|
||||
TOTAL_TESTS=0
|
||||
PASSED_TESTS=0
|
||||
FAILED_TESTS=0
|
||||
|
||||
# Helper functions
|
||||
print_header() {
|
||||
echo ""
|
||||
echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
|
||||
echo -e "${BLUE}$1${NC}"
|
||||
echo -e "${BLUE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
|
||||
}
|
||||
|
||||
print_test() {
|
||||
echo -e "${YELLOW}→ $1${NC}"
|
||||
}
|
||||
|
||||
print_pass() {
|
||||
echo -e "${GREEN}✓ $1${NC}"
|
||||
((PASSED_TESTS++))
|
||||
}
|
||||
|
||||
print_fail() {
|
||||
echo -e "${RED}✗ $1${NC}"
|
||||
((FAILED_TESTS++))
|
||||
}
|
||||
|
||||
test_result() {
|
||||
local test_name="$1"
|
||||
local expected_code="$2"
|
||||
local actual_code="$3"
|
||||
local response="$4"
|
||||
|
||||
((TOTAL_TESTS++))
|
||||
|
||||
if [ "$actual_code" -eq "$expected_code" ]; then
|
||||
print_pass "$test_name (expected $expected_code, got $actual_code)"
|
||||
return 0
|
||||
else
|
||||
print_fail "$test_name (expected $expected_code, got $actual_code)"
|
||||
echo " Response: ${response:0:200}"
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Calculate submit time (5 seconds ago)
|
||||
get_submit_time() {
|
||||
echo $(( $(date +%s) * 1000 - 5000 ))
|
||||
}
|
||||
|
||||
# Get submit time that's too fast (500ms ago)
|
||||
get_fast_submit_time() {
|
||||
echo $(( $(date +%s) * 1000 - 500 ))
|
||||
}
|
||||
|
||||
# Check if server is running
|
||||
check_server() {
|
||||
print_header "Checking Server Availability"
|
||||
|
||||
if curl -s -o /dev/null -w "%{http_code}" "$SERVER_URL" > /dev/null 2>&1; then
|
||||
print_pass "Server is running at $SERVER_URL"
|
||||
return 0
|
||||
else
|
||||
print_fail "Server is not accessible at $SERVER_URL"
|
||||
echo "Please start the server first: go run main.go"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Test 1: Browser-Only Middleware - Block curl
|
||||
test_block_curl() {
|
||||
print_header "Test 1: Browser-Only Middleware - Block HTTP Clients"
|
||||
|
||||
# Test curl (default user agent)
|
||||
print_test "Testing curl blocking"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-d "email=test@example.com&name=Test&subject=Test&message=Test message&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Block curl" 403 "$http_code" "$body"
|
||||
|
||||
# Test wget user agent
|
||||
print_test "Testing wget blocking"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Wget/1.20.3" \
|
||||
-d "email=test@example.com&name=Test&subject=Test&message=Test message&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Block wget" 403 "$http_code" "$body"
|
||||
|
||||
# Test postman
|
||||
print_test "Testing Postman blocking"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: PostmanRuntime/7.26.8" \
|
||||
-d "email=test@example.com&name=Test&subject=Test&message=Test message&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Block Postman" 403 "$http_code" "$body"
|
||||
|
||||
# Test python requests
|
||||
print_test "Testing Python requests blocking"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: python-requests/2.25.1" \
|
||||
-d "email=test@example.com&name=Test&subject=Test&message=Test message&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Block Python requests" 403 "$http_code" "$body"
|
||||
|
||||
# Test empty user agent
|
||||
print_test "Testing empty User-Agent blocking"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent:" \
|
||||
-d "email=test@example.com&name=Test&subject=Test&message=Test message&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Block empty User-Agent" 403 "$http_code" "$body"
|
||||
}
|
||||
|
||||
# Test 2: Browser-Only Middleware - Require Referer/Origin
|
||||
test_require_referer_origin() {
|
||||
print_header "Test 2: Browser-Only Middleware - Referer/Origin Headers"
|
||||
|
||||
# Test without Referer or Origin
|
||||
print_test "Testing request without Referer/Origin (should block)"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=test@example.com&name=Test&subject=Test&message=Test message&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Block without Referer/Origin" 403 "$http_code" "$body"
|
||||
|
||||
# Test with Referer
|
||||
print_test "Testing request with Referer (should allow)"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=test@example.com&name=Test&subject=Test&message=Test message here&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Allow with Referer" 200 "$http_code" "$body"
|
||||
|
||||
# Test with Origin
|
||||
print_test "Testing request with Origin (should allow)"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" \
|
||||
-H "Origin: ${SERVER_URL}" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=test2@example.com&name=Test2&subject=Test&message=Another test message&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Allow with Origin" 200 "$http_code" "$body"
|
||||
}
|
||||
|
||||
# Test 3: Browser-Only Middleware - Require Browser Headers
|
||||
test_require_browser_headers() {
|
||||
print_header "Test 3: Browser-Only Middleware - Browser Headers"
|
||||
|
||||
# Test without browser headers
|
||||
print_test "Testing request without browser headers (should block)"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-d "email=test@example.com&name=Test&subject=Test&message=Test message&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Block without browser headers" 403 "$http_code" "$body"
|
||||
|
||||
# Test with HX-Request header
|
||||
print_test "Testing request with HX-Request header (should allow)"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=test3@example.com&name=Test3&subject=Test&message=Message with HX header&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Allow with HX-Request" 200 "$http_code" "$body"
|
||||
|
||||
# Test with X-Requested-With header
|
||||
print_test "Testing request with X-Requested-With header (should allow)"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "X-Requested-With: XMLHttpRequest" \
|
||||
-d "email=test4@example.com&name=Test4&subject=Test&message=Message with XMLHttpRequest header&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Allow with X-Requested-With" 200 "$http_code" "$body"
|
||||
|
||||
# Test with X-Browser-Request header
|
||||
print_test "Testing request with X-Browser-Request header (should allow)"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7)" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "X-Browser-Request: true" \
|
||||
-d "email=test5@example.com&name=Test5&subject=Test&message=Message with browser request header&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Allow with X-Browser-Request" 200 "$http_code" "$body"
|
||||
}
|
||||
|
||||
# Test 4: Input Validation - Email Format
|
||||
test_email_validation() {
|
||||
print_header "Test 4: Input Validation - Email Format"
|
||||
|
||||
# Valid email
|
||||
print_test "Testing valid email"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=valid@example.com&name=Test&subject=Test&message=Valid email test message&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Valid email accepted" 200 "$http_code" "$body"
|
||||
|
||||
# Invalid email - no @
|
||||
print_test "Testing invalid email (no @)"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=notanemail&name=Test&subject=Test&message=Invalid email test&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Invalid email rejected (no @)" 400 "$http_code" "$body"
|
||||
|
||||
# Invalid email - no domain
|
||||
print_test "Testing invalid email (no domain)"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=test@&name=Test&subject=Test&message=Invalid email test&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Invalid email rejected (no domain)" 400 "$http_code" "$body"
|
||||
|
||||
# Empty email
|
||||
print_test "Testing empty email"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=&name=Test&subject=Test&message=Empty email test&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Empty email rejected" 400 "$http_code" "$body"
|
||||
}
|
||||
|
||||
# Test 5: Input Validation - Message Length
|
||||
test_message_validation() {
|
||||
print_header "Test 5: Input Validation - Message Length"
|
||||
|
||||
# Valid message
|
||||
print_test "Testing valid message length"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=test@example.com&name=Test&subject=Test&message=This is a valid message with sufficient length.&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Valid message accepted" 200 "$http_code" "$body"
|
||||
|
||||
# Empty message
|
||||
print_test "Testing empty message"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=test@example.com&name=Test&subject=Test&message=&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Empty message rejected" 400 "$http_code" "$body"
|
||||
|
||||
# Too long message (> 5000 chars)
|
||||
print_test "Testing message too long (>5000 chars)"
|
||||
long_message=$(printf 'a%.0s' {1..5001})
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=test@example.com&name=Test&subject=Test&message=${long_message}&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Too long message rejected" 400 "$http_code" "$body"
|
||||
}
|
||||
|
||||
# Test 6: Bot Protection - Honeypot
|
||||
test_honeypot() {
|
||||
print_header "Test 6: Bot Protection - Honeypot Field"
|
||||
|
||||
# Honeypot empty (human)
|
||||
print_test "Testing honeypot empty (human behavior)"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=human@example.com&name=Human&subject=Test&message=I am a real human user.&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Honeypot empty - accepted" 200 "$http_code" "$body"
|
||||
|
||||
# Honeypot filled (bot)
|
||||
print_test "Testing honeypot filled (bot behavior)"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=bot@example.com&name=Bot&subject=Spam&message=This is spam!&website=http://spam-site.com&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
# Honeypot returns 200 to fool bots, but doesn't actually send email
|
||||
test_result "Honeypot filled - fake success (bot fooled)" 200 "$http_code" "$body"
|
||||
}
|
||||
|
||||
# Test 7: Bot Protection - Timing
|
||||
test_timing_validation() {
|
||||
print_header "Test 7: Bot Protection - Form Submission Timing"
|
||||
|
||||
# Valid timing (5 seconds)
|
||||
print_test "Testing normal submission timing (5 seconds)"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=slow@example.com&name=Slow&subject=Test&message=I took my time filling this out.&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Normal timing accepted" 200 "$http_code" "$body"
|
||||
|
||||
# Too fast (< 2 seconds)
|
||||
print_test "Testing fast submission (< 2 seconds)"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=fast@example.com&name=Fast&subject=Test&message=I submitted instantly!&website=&submit_time=$(get_fast_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Too fast submission rejected" 400 "$http_code" "$body"
|
||||
}
|
||||
|
||||
# Test 8: Rate Limiting
|
||||
test_rate_limiting() {
|
||||
print_header "Test 8: Rate Limiting (5 requests per hour)"
|
||||
|
||||
echo "Sending 6 requests rapidly..."
|
||||
|
||||
for i in {1..6}; do
|
||||
print_test "Request #$i"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=rate${i}@example.com&name=RateTest${i}&subject=Test&message=Rate limit test message number ${i}.&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
|
||||
if [ "$i" -le 5 ]; then
|
||||
# First 5 should succeed
|
||||
test_result "Request $i allowed" 200 "$http_code" "$body"
|
||||
else
|
||||
# 6th should be rate limited
|
||||
test_result "Request $i rate limited" 429 "$http_code" "$body"
|
||||
fi
|
||||
|
||||
# Small delay between requests
|
||||
sleep 0.1
|
||||
done
|
||||
|
||||
echo ""
|
||||
echo -e "${YELLOW}Note: Rate limit resets after 1 hour${NC}"
|
||||
}
|
||||
|
||||
# Test 9: Real-World Attack Scenarios
|
||||
test_attack_scenarios() {
|
||||
print_header "Test 9: Real-World Attack Scenarios"
|
||||
|
||||
# Scenario 1: Sophisticated bot with browser-like headers but honeypot filled
|
||||
print_test "Scenario 1: Sophisticated bot (browser headers + honeypot)"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=smartbot@example.com&name=SmartBot&subject=Offer&message=Check out our amazing product!&website=http://smart-bot.com&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Smart bot caught by honeypot" 200 "$http_code" "$body"
|
||||
|
||||
# Scenario 2: Script kiddie with curl
|
||||
print_test "Scenario 2: Script kiddie using curl"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-d "email=hacker@example.com&name=Hacker&subject=Pwned&message=You got hacked!&website=&submit_time=$(get_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Script kiddie blocked by BrowserOnly" 403 "$http_code" "$body"
|
||||
|
||||
# Scenario 3: Automated form filler (fast submission)
|
||||
print_test "Scenario 3: Automated form filler (too fast)"
|
||||
response=$(curl -s -w "\n%{http_code}" -X POST "$API_URL" \
|
||||
-H "Content-Type: application/x-www-form-urlencoded" \
|
||||
-H "User-Agent: Mozilla/5.0" \
|
||||
-H "Referer: ${SERVER_URL}/" \
|
||||
-H "HX-Request: true" \
|
||||
-d "email=autobot@example.com&name=AutoBot&subject=Auto&message=Automatically filled form!&website=&submit_time=$(get_fast_submit_time)")
|
||||
http_code=$(echo "$response" | tail -n1)
|
||||
body=$(echo "$response" | head -n-1)
|
||||
test_result "Auto-filler caught by timing check" 400 "$http_code" "$body"
|
||||
}
|
||||
|
||||
# Summary
|
||||
print_summary() {
|
||||
print_header "Test Summary"
|
||||
|
||||
echo ""
|
||||
echo -e "Total Tests: ${BLUE}${TOTAL_TESTS}${NC}"
|
||||
echo -e "Passed: ${GREEN}${PASSED_TESTS}${NC}"
|
||||
echo -e "Failed: ${RED}${FAILED_TESTS}${NC}"
|
||||
echo ""
|
||||
|
||||
if [ "$FAILED_TESTS" -eq 0 ]; then
|
||||
echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
|
||||
echo -e "${GREEN}✓ ALL SECURITY TESTS PASSED!${NC}"
|
||||
echo -e "${GREEN}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
|
||||
exit 0
|
||||
else
|
||||
echo -e "${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
|
||||
echo -e "${RED}✗ SOME TESTS FAILED${NC}"
|
||||
echo -e "${RED}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
|
||||
exit 1
|
||||
fi
|
||||
}
|
||||
|
||||
# Main execution
|
||||
main() {
|
||||
clear
|
||||
echo -e "${BLUE}"
|
||||
echo "╔══════════════════════════════════════════════════════════════════════╗"
|
||||
echo "║ ║"
|
||||
echo "║ CONTACT FORM SECURITY TEST SUITE ║"
|
||||
echo "║ ║"
|
||||
echo "╚══════════════════════════════════════════════════════════════════════╝"
|
||||
echo -e "${NC}"
|
||||
echo ""
|
||||
echo "Server: $SERVER_URL"
|
||||
echo "Endpoint: $API_URL"
|
||||
echo ""
|
||||
|
||||
check_server
|
||||
test_block_curl
|
||||
test_require_referer_origin
|
||||
test_require_browser_headers
|
||||
test_email_validation
|
||||
test_message_validation
|
||||
test_honeypot
|
||||
test_timing_validation
|
||||
test_rate_limiting
|
||||
test_attack_scenarios
|
||||
print_summary
|
||||
}
|
||||
|
||||
# Run main
|
||||
main
|
||||
Reference in New Issue
Block a user