diff --git a/SECURITY_TODO.md b/SECURITY_TODO.md index 3b28ca6..02d7f52 100644 --- a/SECURITY_TODO.md +++ b/SECURITY_TODO.md @@ -1,6 +1,7 @@ # 安全修复 TODO 基于 2026-08-19 的安全审计（源码 + haibara.ai 线上验证）整理。 +2026-08-27 复审新增 #18–#25（标题标注"复审新发现"）。 按优先级排序，完成后勾选并标注日期。 --- @@ -42,6 +43,24 @@ - [x] 认证成功后先 `session.Clear()` 再写入 `user_id`/`username` 并 Save；保留 lang 与 csrf_token（避免多标签页已渲染表单失效） - **验证**: ✅ 登录前后 cookie 值不同，旧 cookie 无法访问受保护路由（`TestLoginRotatesSession`） +### [x] 18. SQLite 数据库文件可被公开下载（全库泄露）（2026-08-27 复审新发现）✅ 2026-08-27 +- **位置**: `main.go:72`（`router.Static("/uploads", cfg.Path)` 把存储根整体挂载为静态目录）、`models/db.go:36`（`blog.db` 就放在该目录下） +- **问题**: 未认证即可 `GET /uploads/blog.db` 下载整库——含 bcrypt 密码哈希、用户邮箱、评论者 IP/邮箱、私密评论（IsPrivate）、浏览记录等。 +- **修复**（采用方案 B，白名单挂载）: + - [x] `main.go` 新增 `registerUploadRoutes`：只挂载 `attachments/`、`avatars/`、`logos/` 及当前配置的附件存储目录，存储根不再整体暴露 + - [x] 自定义 `serveUploadDir` handler：禁用目录列表（目录/`..`/`\` 一律 404），只服务具体文件 + - [x] `safeStorageDir`：storage_dir 含穿越/绝对路径/反斜杠时回退 `attachments`（为 #22 提供纵深防御） + - [ ] （可选加固）方案 A：将数据库文件移出存储根，需迁移存量 blog.db，暂缓 +- **验证**: ✅ `main_test.go` 4 用例（blog.db 404 / 无目录列表 / 穿越失败 / 三目录正常服务、自定义 storage_dir、不安全回退、重名去重） + +### [x] 19. GORM 字符串条件 SQL 注入（admin 用户管理 3 处）（2026-08-27 复审新发现）✅ 2026-08-27 +- **位置**: `handlers/admin_user.go:253、289、362`（`db.First(&user, id)`，id 为 `c.Param("id")` 字符串） +- **问题**: GORM 对 `First(dest, s)`：s 为非数字字符串且无附加参数时按原始 SQL 条件拼入 WHERE（v1.31.1 `statement.go:293-303` 已核实）。`GET /admin/users/1 OR 1=1/edit` 即可注入；UserEditPage 为 GET 无 CSRF 拦截，可诱导已登录管理员点击链接触发盲注。 +- **修复**: + - [x] UserEditPage / UserUpdate / UserDelete 三处：先 `uintFormID` 解析为数值，非数值（0）直接 302 回列表页；查询一律走主键参数化 + - [x] 表单 Action URL 由解析后的数值 ID 构造，不再回拼原始路由参数 +- **验证**: ✅ `TestAdminUserRoutesRejectNonNumericIDs`（5 组注入串 × GET/POST/DELETE 均被拒、数据零变更、合法 ID 不受影响）；变异测试确认旧代码下注入用例失败（"1 OR 1=1" 返回 200） + --- ## P1 — 近期修复 @@ -76,6 +95,22 @@ - [x] goroutine 启动前同步提取 userID / ip / UA 为局部变量，`recordArticleView` 不再触碰 gin.Context 与 session - **验证**: ✅ `go test -race ./...` 全绿 +### [ ] 20. 被禁用/锁定/删除用户的会话不失效（2026-08-27 复审新发现） +- **位置**: `middleware/auth.go:16-27`（AuthRequired 只看 session 是否有 user_id，不回库校验） +- **问题**: 登录时的状态检查（`handlers/auth.go:50`）只在登录瞬间生效。管理员禁用/锁定/软删用户后，其已持有的 cookie 在最长 24h 内仍完全可用：发评论自动 Approved、写文章、传附件；`SetUserContext` 对已软删用户仍置 `is_logged_in=true`。 +- **修复**: + - [ ] AuthRequired 回库校验 `Status == StatusNormal` 且未软删，失败则清 session 并跳转 /login + - [ ] SetUserContext：用户查询失败时 `is_logged_in` 置 false +- **验证**: 禁用用户后用旧 cookie 访问 `/my/articles` → 302 `/login`；其新评论不再自动通过 + +### [ ] 21. 头像上传缺类别校验 + 可添加任意扩展名 → 存储型 XSS 链（2026-08-27 复审新发现） +- **位置**: `handlers/profile.go:196-208`（UploadAvatar 未限制 image 类别）、`handlers/profile.go:223-226`（processAvatar 失败回退存原始字节）、`handlers/profile.go:96-107`（UpdateProfile 头像分支同样无类别校验、原样落盘）、`handlers/settings.go:269-290`（addUploadFileType 无危险扩展黑名单） +- **问题**: logo/favicon 上传要求 `Category == image`（settings.go:113/153），但头像上传只查扩展名白名单且解码失败仍存原始文件；管理员又可在上传设置里添加任意扩展名（含 `.html`/`.svg`）。组合链：添加 `.html` 类型 → 任意登录用户以头像名义上传 HTML → 落在 `/uploads/avatars/` 同源可执行（CSP `script-src 'self' 'unsafe-inline'` 放行）。 +- **修复**: + - [ ] UploadAvatar / UpdateProfile 头像分支强制 `check.Type.Category == models.CategoryImage`，解码失败直接拒绝（不回退存原始字节） + - [ ] addUploadFileType 增加危险扩展黑名单（.html/.htm/.svg/.xhtml/.xml 等），拒绝添加 +- **验证**: 上传 `.html` 头像 → 拒绝；后台添加 `.html` 类型 → 拒绝；正常图片仍成功 + --- ## P2 — 计划修复 @@ -110,6 +145,27 @@ - **位置**: `install_linux.sh:80` - **修复**: `chmod 660` + `chown root:blog_go`（反向代理进程加入同组），避免本机任意用户绕过 Cloudflare 直连 +### [ ] 22. storage_dir 路径穿越（2026-08-27 复审新发现） +- **位置**: `handlers/settings.go:262-264`（任意 storage_dir 直接入库）、`handlers/attachment.go:21-27`（`filepath.Join` 不清洗 `../`） +- **问题**: 管理员把 storage_dir 设为 `../../tmp` 类值后，附件上传/删除将发生在存储根之外（越界读写）。 +- **修复**: + - [ ] 校验 storage_dir 为单个安全路径段（如 `^[A-Za-z0-9_-]+$`），否则拒绝保存 +- **验证**: 提交 `../evil` → 拒绝；`attachments` → 正常 + +### [ ] 23. 密码策略缺失（改密/管理员建号无最小长度）（2026-08-27 复审新发现） +- **位置**: `handlers/profile.go:146-159`（UpdateProfile 改密）、`handlers/admin_user.go` UserCreate/UserUpdate（建号/重置密码） +- **问题**: 注册要求密码 ≥6 位，但个人改密与管理员建号/重置密码均可设 1 位弱密码。 +- **修复**: + - [ ] 抽公共 `validatePassword`，三处统一调用（最小长度与注册口径一致） +- **验证**: 改密为 1 位 → 拒绝 + +### [ ] 24. 邮箱字段不校验格式（2026-08-27 复审新发现） +- **位置**: `handlers/auth.go:130`（注册）、`handlers/profile.go:81-83`（改邮箱）、`handlers/admin_user.go`（建号/编辑） +- **问题**: 仅评论处调用 `mail.ParseAddress`；注册/改资料/管理员建号均可写入非法邮箱（脏数据 + Gravatar 哈希异常）。 +- **修复**: + - [ ] 抽公共 `validateEmail`，各处统一调用 +- **验证**: 注册/改邮箱提交 `abc` → 拒绝 + --- ## P3 — 低优先级 / 观察项 @@ -132,11 +188,19 @@ - **位置**: `models/user.go:41`（DefaultCost=10） - **修复**: 提升到 12；已有哈希在用户下次改密时自然升级 +### [ ] 25. 登录计时侧信道（用户名枚举）（2026-08-27 复审新发现） +- **位置**: `handlers/auth.go:39-47` +- **问题**: 用户不存在时立即返回、不执行 bcrypt；密码错误时执行 bcrypt（~100ms）。响应时间差可用于枚举有效用户名，与未修复的 #10（无速率限制）叠加放大。 +- **修复**: + - [ ] 用户不存在时也执行一次 dummy bcrypt 比较（对固定哑哈希），抹平时间差 + - [ ] 与 #10 的速率限制一并实施 +- **验证**: 大样本计时统计：两分支无显著差异 + --- -## 不需要修复（已确认安全） +## 不需要修复（已确认安全，2026-08-27 复审复核仍成立） -- SQL 注入：全参数化查询（GORM） +- SQL 注入：全参数化查询（GORM）——唯一例外见 #19（admin_user.go 3 处字符串条件） - XSS：html/template 自动转义 + 评论双防御（服务端 strip + DOMPurify） - 密码哈希：bcrypt - 附件路径穿越：SHA-256 内容寻址文件名 @@ -147,8 +211,11 @@ ## 建议执行顺序 -1. **#1 → #4 → #5**（一次提交：会话安全三件套，改动小、风险低） -2. **#3**（附件越权，纯 handler 层校验） -3. **#2**（CSRF，涉及全站表单，改动面最大，单独一个 PR 充分回归） -4. **#7 → #8 → #6**（IP/竞态/响应头） -5. P2/P3 按迭代排入 +P0/P1 原有 8 项及 P0 新发现 #18/#19 均已完成。剩余： + +1. **#20**（会话失效校验，middleware 单点改动） +2. **#21**（头像/XSS 链：类别校验 + 扩展名黑名单） +3. **#22 → #23 → #24**（校验类小改动，可合并一个 PR） +4. **#9 → #10 → #25**（CDN 本地化、登录限速 + 计时抹平，同一主题） +5. 其余 P2/P3（#11 配置权限、#12 首启弱凭据、#13 socket 权限、#14 magic bytes、#17 bcrypt cost）按迭代排入 +6. （可选）#18 方案 A：数据库文件移出存储根 diff --git a/handlers/admin_user.go b/handlers/admin_user.go index 48e175d..f0137e9 100644 --- a/handlers/admin_user.go +++ b/handlers/admin_user.go @@ -1,6 +1,7 @@ package handlers import ( + "fmt" "net/http" "strconv" "strings" @@ -248,7 +249,15 @@ func UserCreate(db *gorm.DB) gin.HandlerFunc { func UserEditPage(db *gorm.DB) gin.HandlerFunc { return func(c *gin.Context) { tr := getTr(c) - id := c.Param("id") + // SECURITY (#19): the route param must be parsed to a numeric id + // before touching GORM — a raw string passed as the single cond to + // First() is interpolated as a SQL WHERE clause. + id := uintFormID(c.Param("id")) + if id == 0 { + c.Redirect(http.StatusFound, "/admin/users") + return + } + var user models.User if err := db.First(&user, id).Error; err != nil { c.Redirect(http.StatusFound, "/admin/users") @@ -268,7 +277,7 @@ func UserEditPage(db *gorm.DB) gin.HandlerFunc { Role: user.Role, Status: user.Status, IsEdit: true, - Action: "/admin/users/" + id + "/edit", + Action: fmt.Sprintf("/admin/users/%d/edit", user.ID), TitleText: tr["user_edit_title"], }, "") } @@ -278,15 +287,19 @@ func UserEditPage(db *gorm.DB) gin.HandlerFunc { func UserUpdate(db *gorm.DB) gin.HandlerFunc { return func(c *gin.Context) { tr := getTr(c) - id := c.Param("id") f := parseUserForm(c) - f.ID = uintFormID(id) + // SECURITY (#19): reject non-numeric ids before touching GORM (see + // UserEditPage). + if f.ID == 0 { + c.Redirect(http.StatusFound, "/admin/users") + return + } f.IsEdit = true - f.Action = "/admin/users/" + id + "/edit" + f.Action = fmt.Sprintf("/admin/users/%d/edit", f.ID) f.TitleText = tr["user_edit_title"] var user models.User - if err := db.First(&user, id).Error; err != nil { + if err := db.First(&user, f.ID).Error; err != nil { c.Redirect(http.StatusFound, "/admin/users") return } @@ -354,12 +367,17 @@ func UserUpdate(db *gorm.DB) gin.HandlerFunc { // UserDelete soft-deletes a user, with self-protection and last-admin guards. func UserDelete(db *gorm.DB) gin.HandlerFunc { return func(c *gin.Context) { - id := c.Param("id") - targetID := uintFormID(id) + // SECURITY (#19): reject non-numeric ids before touching GORM (see + // UserEditPage). + targetID := uintFormID(c.Param("id")) + if targetID == 0 { + c.Redirect(http.StatusFound, "/admin/users") + return + } currentID := userIDFromSession(c) var user models.User - if err := db.First(&user, id).Error; err != nil { + if err := db.First(&user, targetID).Error; err != nil { c.Redirect(http.StatusFound, "/admin/users") return } diff --git a/handlers/security_test.go b/handlers/security_test.go index 492c5d8..a5d34e7 100644 --- a/handlers/security_test.go +++ b/handlers/security_test.go @@ -92,6 +92,14 @@ func newSecurityTestEnv(t *testing.T) *securityTestEnv { }) } + // Admin user-management routes (SQL-injection regression coverage, #19). + admin := r.Group("/admin", middleware.AuthRequired(), middleware.AdminRequired(db)) + { + admin.GET("/users/:id/edit", UserEditPage(db)) + admin.POST("/users/:id/edit", UserUpdate(db)) + admin.POST("/users/:id/delete", UserDelete(db)) + } + return &securityTestEnv{router: r, db: db, storageDir: storageDir} } @@ -370,6 +378,80 @@ func TestAttachmentAdminOverride(t *testing.T) { } } +func TestAdminUserRoutesRejectNonNumericIDs(t *testing.T) { + e := newSecurityTestEnv(t) + admin := e.login(t, "admin") + token := e.csrfTokenFor(t, admin) + + var alice models.User + if err := e.db.Where("username = ?", "alice").First(&alice).Error; err != nil { + t.Fatalf("alice not found: %v", err) + } + + // Malicious :id values. Before the #19 fix, GORM interpolated a + // non-numeric single string cond into the WHERE clause raw + // (e.g. WHERE 1 OR 1=1). + ids := []string{ + "1 OR 1=1", + "1;--", + "1) OR (1=1", + "1 UNION SELECT 1", + "alice", + } + + for _, id := range ids { + // GET edit page must redirect instead of rendering a matched row. + w := e.do(http.MethodGet, "/admin/users/"+url.PathEscape(id)+"/edit", admin, nil, "") + if w.Code != http.StatusFound { + t.Fatalf("GET edit with id %q: status = %d, want 302", id, w.Code) + } + if loc := w.Header().Get("Location"); loc != "/admin/users" { + t.Fatalf("GET edit with id %q: location = %q, want /admin/users", id, loc) + } + + // POST update must not modify anything (attempt role escalation). + form := url.Values{} + form.Set("_csrf", token) + form.Set("role", models.RoleAdmin) + form.Set("status", "1") + form.Set("display_name", "hacked") + w = e.do(http.MethodPost, "/admin/users/"+url.PathEscape(id)+"/edit", admin, + strings.NewReader(form.Encode()), "application/x-www-form-urlencoded") + if w.Code != http.StatusFound || w.Header().Get("Location") != "/admin/users" { + t.Fatalf("POST edit with id %q: status = %d, location = %q", id, w.Code, w.Header().Get("Location")) + } + + // POST delete must not delete anything. + form = url.Values{} + form.Set("_csrf", token) + w = e.do(http.MethodPost, "/admin/users/"+url.PathEscape(id)+"/delete", admin, + strings.NewReader(form.Encode()), "application/x-www-form-urlencoded") + if w.Code != http.StatusFound { + t.Fatalf("POST delete with id %q: status = %d, want 302", id, w.Code) + } + } + + // No user was modified or removed by any of the payloads. + var count int64 + e.db.Model(&models.User{}).Count(&count) + if count != 3 { + t.Fatalf("user count = %d, want 3 (injection removed rows)", count) + } + var check models.User + if err := e.db.Where("username = ?", "alice").First(&check).Error; err != nil { + t.Fatalf("alice gone: %v", err) + } + if check.Role != models.RoleAuthor || check.DisplayName != "alice" { + t.Fatalf("alice modified via id injection: role=%q display=%q", check.Role, check.DisplayName) + } + + // Sanity: a valid numeric id still works. + w := e.do(http.MethodGet, fmt.Sprintf("/admin/users/%d/edit", alice.ID), admin, nil, "") + if w.Code != http.StatusOK { + t.Fatalf("GET edit with valid id: status = %d, want 200", w.Code) + } +} + func userIDByUsername(t *testing.T, db *gorm.DB, username string) uint { t.Helper() var u models.User diff --git a/main.go b/main.go index 22da3f1..753edaa 100644 --- a/main.go +++ b/main.go @@ -9,6 +9,9 @@ import ( "net" "net/http" "os" + "path" + "path/filepath" + "strings" "github.com/gin-contrib/sessions" "github.com/gin-contrib/sessions/cookie" @@ -45,8 +48,8 @@ func main() { store := cookie.NewStore([]byte(cfg.Secret)) store.Options(sessions.Options{ Path: "/", - MaxAge: 86400, // 24 hours - HttpOnly: true, // prevent XSS access + MaxAge: 86400, // 24 hours + HttpOnly: true, // prevent XSS access SameSite: http.SameSiteLaxMode, // CSRF defense-in-depth; token check is the primary control // Secure is set per request (over HTTPS only) in the middleware below. }) @@ -68,8 +71,11 @@ func main() { // 5. Load HTML templates. router.LoadHTMLGlob("templates/**/*.html") - // 6. Serve uploaded files (avatars etc.) from the storage path. - router.Static("/uploads", cfg.Path) + // 6. Serve uploaded files (avatars etc.) from the storage path. Only the + // known upload subdirectories are exposed — never the storage root + // itself, which also holds the SQLite database file: mounting the whole + // root would let anyone download /uploads/blog.db (SECURITY_TODO #18). + registerUploadRoutes(router.Group("/uploads"), cfg.Path, models.GetUploadConfig().StorageDir) // 6b. Serve bundled static assets (embedded into the binary). staticFS, err := fs.Sub(staticFiles, "static") @@ -253,3 +259,57 @@ func main() { // Block forever. select {} } + +// registerUploadRoutes exposes the public upload subdirectories under the +// /uploads group: avatars, logos, and the configured attachment storage +// directory (plus the default "attachments" for backward compatibility). +// The storage root itself is never mounted — it also contains the SQLite +// database file, which must not be downloadable (SECURITY_TODO #18). +// Directory listing is disabled: only concrete files resolve. +func registerUploadRoutes(g *gin.RouterGroup, storagePath, storageDir string) { + dirs := []string{"attachments", "avatars", "logos"} + if dir := safeStorageDir(storageDir); dir != "attachments" && dir != "avatars" && dir != "logos" { + dirs = append(dirs, dir) + } + for _, d := range dirs { + h := serveUploadDir(filepath.Join(storagePath, d)) + g.GET("/"+d+"/*file", h) + g.HEAD("/"+d+"/*file", h) + } +} + +// safeStorageDir clamps the configured attachment storage directory to a +// safe relative path: non-empty, not absolute, and free of ".." or "\". +// Anything unsafe falls back to the default "attachments" so a +// misconfigured storage_dir cannot escape the storage root (defense in +// depth for SECURITY_TODO #22). +func safeStorageDir(dir string) string { + const fallback = "attachments" + if dir == "" { + return fallback + } + cleaned := path.Clean(dir) + if path.IsAbs(cleaned) || cleaned == "." || + strings.Contains(cleaned, "..") || strings.Contains(cleaned, "\\") { + return fallback + } + return cleaned +} + +// serveUploadDir serves concrete files from one upload subdirectory. +// Directory listings and traversal attempts are rejected with 404. +func serveUploadDir(root string) gin.HandlerFunc { + return func(c *gin.Context) { + rel := c.Param("file") // always begins with "/" + if strings.Contains(rel, "..") || strings.ContainsRune(rel, '\\') { + c.Status(http.StatusNotFound) + return + } + full := filepath.Join(root, rel) + if st, err := os.Stat(full); err != nil || st.IsDir() { + c.Status(http.StatusNotFound) + return + } + c.File(full) + } +} diff --git a/main_test.go b/main_test.go new file mode 100644 index 0000000..928b755 --- /dev/null +++ b/main_test.go @@ -0,0 +1,129 @@ +package main + +import ( + "net/http" + "net/http/httptest" + "os" + "path/filepath" + "testing" + + "github.com/gin-gonic/gin" +) + +// newUploadsRouter builds a router with the production upload routes over a +// temp storage root that mirrors the real layout: the SQLite database file +// lives in the root itself, uploads live in subdirectories. +func newUploadsRouter(t *testing.T, storageDir string) (*gin.Engine, string) { + t.Helper() + gin.SetMode(gin.TestMode) + + root := t.TempDir() + if err := os.WriteFile(filepath.Join(root, "blog.db"), []byte("fake sqlite"), 0644); err != nil { + t.Fatalf("seed blog.db: %v", err) + } + + r := gin.New() + registerUploadRoutes(r.Group("/uploads"), root, storageDir) + return r, root +} + +func doGet(t *testing.T, r *gin.Engine, path string) *httptest.ResponseRecorder { + t.Helper() + w := httptest.NewRecorder() + r.ServeHTTP(w, httptest.NewRequest(http.MethodGet, path, nil)) + return w +} + +func seedUploadFile(t *testing.T, root, sub, name string) { + t.Helper() + dir := filepath.Join(root, sub) + if err := os.MkdirAll(dir, 0755); err != nil { + t.Fatalf("mkdir %s: %v", dir, err) + } + if err := os.WriteFile(filepath.Join(dir, name), []byte("content"), 0644); err != nil { + t.Fatalf("seed %s: %v", name, err) + } +} + +func TestUploadsWhitelistHidesStorageRoot(t *testing.T) { + r, root := newUploadsRouter(t, "") + for _, sub := range []string{"attachments", "avatars", "logos"} { + seedUploadFile(t, root, sub, "file.txt") + } + + // The database file in the storage root must not be downloadable. + if w := doGet(t, r, "/uploads/blog.db"); w.Code != http.StatusNotFound { + t.Fatalf("GET /uploads/blog.db = %d, want 404 (database leak)", w.Code) + } + + // No directory listing anywhere. + for _, p := range []string{ + "/uploads", "/uploads/", + "/uploads/attachments/", "/uploads/avatars/", "/uploads/logos/", + } { + if w := doGet(t, r, p); w.Code != http.StatusNotFound { + t.Fatalf("GET %s = %d, want 404 (no directory listing)", p, w.Code) + } + } + + // Traversal attempts must not escape the subdirectory. + for _, p := range []string{ + "/uploads/attachments/../blog.db", + "/uploads/attachments/..%2f..%2fblog.db", + "/uploads/attachments/%2e%2e/blog.db", + } { + if w := doGet(t, r, p); w.Code == http.StatusOK { + t.Fatalf("GET %s = %d, want non-200 (traversal)", p, w.Code) + } + } + + // Files in the whitelisted subdirectories are still served. + for _, p := range []string{ + "/uploads/attachments/file.txt", + "/uploads/avatars/file.txt", + "/uploads/logos/file.txt", + } { + if w := doGet(t, r, p); w.Code != http.StatusOK { + t.Fatalf("GET %s = %d, want 200", p, w.Code) + } + } +} + +func TestUploadsWhitelistCustomStorageDir(t *testing.T) { + r, root := newUploadsRouter(t, "files") + seedUploadFile(t, root, "files", "a.bin") + + if w := doGet(t, r, "/uploads/files/a.bin"); w.Code != http.StatusOK { + t.Fatalf("GET /uploads/files/a.bin = %d, want 200", w.Code) + } + // The default dir stays mounted for backward compatibility. + seedUploadFile(t, root, "attachments", "old.txt") + if w := doGet(t, r, "/uploads/attachments/old.txt"); w.Code != http.StatusOK { + t.Fatalf("GET /uploads/attachments/old.txt = %d, want 200", w.Code) + } + if w := doGet(t, r, "/uploads/blog.db"); w.Code != http.StatusNotFound { + t.Fatalf("GET /uploads/blog.db = %d, want 404", w.Code) + } +} + +func TestUploadsWhitelistUnsafeStorageDirFallsBack(t *testing.T) { + for _, dir := range []string{"../evil", "/etc", "..", "a/../../b", "."} { + r, root := newUploadsRouter(t, dir) + seedUploadFile(t, root, "attachments", "file.txt") + if w := doGet(t, r, "/uploads/attachments/file.txt"); w.Code != http.StatusOK { + t.Fatalf("storage dir %q: fallback mount broken: %d", dir, w.Code) + } + if w := doGet(t, r, "/uploads/blog.db"); w.Code != http.StatusNotFound { + t.Fatalf("storage dir %q: /uploads/blog.db = %d, want 404", dir, w.Code) + } + } +} + +func TestUploadsWhitelistStorageDirDedup(t *testing.T) { + // A storage dir equal to a known dir must not panic on duplicate routes. + r, root := newUploadsRouter(t, "avatars") + seedUploadFile(t, root, "avatars", "me.jpg") + if w := doGet(t, r, "/uploads/avatars/me.jpg"); w.Code != http.StatusOK { + t.Fatalf("GET /uploads/avatars/me.jpg = %d, want 200", w.Code) + } +}