owenandClaude Sonnet 5
789bf91eed
Security: - New internal/netguard package: podcast feed/enclosure fetching now refuses to dial non-public IPs (loopback/RFC1918/link-local/cloud metadata/CGNAT), validated per-connection including across redirects, closing an SSRF gap where a malicious or compromised feed URL could probe the server's internal network. Configurable via VIBESONIC_PODCASTS_ALLOW_PRIVATE_NETWORKS for intentional LAN feeds. - Podcast episode downloads capped at 4GB (was unbounded, disk-exhaustion risk) - Cover art decoding now rejects images above a 40-megapixel budget before full decode (decompression-bomb guard) - HTTP server sets ReadHeaderTimeout (slowloris hardening) - Admin folder-scan redirect now validated as same-site instead of trusting the raw Referer header (open-redirect fix) - Legacy Subsonic token/salt auth now uses a constant-time comparison Web UI completion: - Persistent player: shuffle and repeat (off/all/one) controls, wired into queue advance/prev logic and persisted like other player state - Admin user-permissions form: adminRole toggle (with a guard against demoting the last remaining admin) and per-user music-folder access checkboxes, backed by existing schema/enforcement that was previously unreachable from the UI - Playlist M3U8 import/export Docs: added docs/client-compatibility.md (honest tracking template — no client testing has been performed), docs/deployment.md, docs/security.md, docs/backup.md; refreshed README and cross-links; added a footnote in docs/subsonic-compatibility.md distinguishing spec-standard from VibeSonic-original OpenSubsonic extensions. Also added Go fuzz tests for the external-auth CIDR/IP parser and the LRC lyrics parser. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_014r98AtcBbevpscWLsfwVvv
87 lines
2.6 KiB
Go
87 lines
2.6 KiB
Go
package subsonic
|
|
|
|
import (
|
|
"database/sql"
|
|
"io"
|
|
"log/slog"
|
|
"net/http/httptest"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
vsauth "git.noroutes.net/NoRoutes/vibetunes/internal/auth"
|
|
"git.noroutes.net/NoRoutes/vibetunes/internal/config"
|
|
"git.noroutes.net/NoRoutes/vibetunes/internal/coverart"
|
|
"git.noroutes.net/NoRoutes/vibetunes/internal/database"
|
|
"git.noroutes.net/NoRoutes/vibetunes/internal/jukebox"
|
|
"git.noroutes.net/NoRoutes/vibetunes/internal/metadata"
|
|
"git.noroutes.net/NoRoutes/vibetunes/internal/podcasts"
|
|
"git.noroutes.net/NoRoutes/vibetunes/internal/scanner"
|
|
"git.noroutes.net/NoRoutes/vibetunes/internal/transcoding"
|
|
)
|
|
|
|
func newTestServer(t *testing.T) (*Server, *sql.DB) {
|
|
t.Helper()
|
|
db, err := database.Open(filepath.Join(t.TempDir(), "test.db"))
|
|
if err != nil {
|
|
t.Fatalf("database.Open: %v", err)
|
|
}
|
|
t.Cleanup(func() { db.Close() })
|
|
|
|
key, err := vsauth.EncryptionKey(db, "test-secret")
|
|
if err != nil {
|
|
t.Fatalf("EncryptionKey: %v", err)
|
|
}
|
|
|
|
log := slog.New(slog.NewTextHandler(io.Discard, nil))
|
|
s := &Server{
|
|
DB: db,
|
|
Config: config.Config{DataDir: t.TempDir()},
|
|
EncryptionKey: key,
|
|
Scanner: scanner.New(db, &metadata.Prober{}, log),
|
|
CoverArt: coverart.New(t.TempDir(), ""),
|
|
Transcoder: transcoding.NewManager(""),
|
|
Podcasts: podcasts.NewManager(db, t.TempDir(), "", log, true),
|
|
Jukebox: jukebox.New(""),
|
|
Log: log,
|
|
}
|
|
t.Cleanup(s.Jukebox.Close)
|
|
return s, db
|
|
}
|
|
|
|
// createTestUser creates a user with the given password (via
|
|
// auth.SetUserPassword, so both the Argon2id hash and the encrypted
|
|
// Subsonic-token-auth secret are populated, matching production).
|
|
func createTestUser(t *testing.T, s *Server, username, password string, isAdmin bool) *database.User {
|
|
t.Helper()
|
|
u, err := database.CreateUser(s.DB, username, "", "", isAdmin)
|
|
if err != nil {
|
|
t.Fatalf("CreateUser: %v", err)
|
|
}
|
|
if err := vsauth.SetUserPassword(s.DB, s.EncryptionKey, u.ID, password); err != nil {
|
|
t.Fatalf("SetUserPassword: %v", err)
|
|
}
|
|
u, err = database.GetUserByID(s.DB, u.ID)
|
|
if err != nil {
|
|
t.Fatalf("GetUserByID: %v", err)
|
|
}
|
|
return u
|
|
}
|
|
|
|
func newTestRecorderServer(t *testing.T) (*Server, *httptest.Server) {
|
|
t.Helper()
|
|
s, _ := newTestServer(t)
|
|
srv := httptest.NewServer(s.Router())
|
|
t.Cleanup(srv.Close)
|
|
return s, srv
|
|
}
|
|
|
|
// newSubsonicTestServer starts an HTTP server for an already-constructed
|
|
// Server (as opposed to newTestRecorderServer, which builds its own) —
|
|
// for tests that need to seed the database before the server matters.
|
|
func newSubsonicTestServer(t *testing.T, s *Server) string {
|
|
t.Helper()
|
|
srv := httptest.NewServer(s.Router())
|
|
t.Cleanup(srv.Close)
|
|
return srv.URL
|
|
}
|