mirror of
https://github.com/git-pkgs/proxy.git
synced 2026-11-09 15:49:16 -05:00
29ecb20733
govulncheck reads vuln.go.dev directly, so on networks that only reach the proxy it cannot run. upstream.go_vulndb (default https://vuln.go.dev) is now served at /go/vulndb for `govulncheck -db`. Only the files the database API defines are passed on (index/db, index/modules, index/vulns and ID/{id}, as .json and .json.gz), with IDs limited to letters, digits, '-' and '_'. They are stored and served byte-for-byte; .json.gz files are gzip data without Content-Encoding. All files, entries included, follow the metadata TTL since entries change when their modified date does, and fall back to the cached copy when the database is unreachable. Non-JSON responses are refused so a block page does not replace the copy kept for an outage. HEAD is allowed under /vulndb/, because govulncheck checks a non-default database with HEAD on index/modules.json.gz.
39 lines
1.1 KiB
Go
39 lines
1.1 KiB
Go
package server
|
|
|
|
import (
|
|
"io"
|
|
"log/slog"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
|
|
"github.com/git-pkgs/proxy/internal/config"
|
|
"github.com/git-pkgs/proxy/internal/handler"
|
|
"github.com/go-chi/chi/v5"
|
|
)
|
|
|
|
func TestGoVulnDBReachesGoHandler(t *testing.T) {
|
|
const dbJSON = `{"modified":"2026-10-21T00:27:29Z"}`
|
|
upstream := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
if r.URL.Path != "/index/db.json" {
|
|
http.NotFound(w, r)
|
|
return
|
|
}
|
|
_, _ = io.WriteString(w, dbJSON)
|
|
}))
|
|
defer upstream.Close()
|
|
|
|
cfg := config.Default()
|
|
cfg.BaseURL = "https://proxy.example"
|
|
cfg.Upstream.GoVulnDB = upstream.URL
|
|
p := &handler.Proxy{HTTPClient: upstream.Client(), Logger: slog.New(slog.NewTextHandler(io.Discard, nil))}
|
|
s := &Server{cfg: cfg}
|
|
r := chi.NewRouter()
|
|
s.mountProtocolHandlers(r, p)
|
|
|
|
w := httptest.NewRecorder()
|
|
r.ServeHTTP(w, httptest.NewRequest(http.MethodGet, "/go/vulndb/index/db.json", nil))
|
|
if w.Code != http.StatusOK || w.Body.String() != dbJSON {
|
|
t.Errorf("status = %d, body = %q; want index/db.json from upstream.go_vulndb", w.Code, w.Body.String())
|
|
}
|
|
}
|