jay/go-roots-ws
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security: ensure injected strings are properly escaped

Browse Source 
Uses  over  for JSON compatibility.
This commit is contained in:
Jay
2026-08-10 09:46:15 -04:00
parent 622f66e376
commit 6ac95d732f
2 changed files with 79 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
enclose_test.go
+45
View File
@@ -50,6 +50,13 @@ func TestEncloseOK(t *testing.T) {
message: "Event accepted",
want: []byte(`["OK","abc123",true,"Event accepted"]`),
},
{
name: "escapes quotes",
eventID: `"abc123"`,
status: true,
message: `"Event accepted"`,
want: []byte(`["OK","\"abc123\"",true,"\"Event accepted\""]`),
},
{
name: "rejected event",
eventID: "xyz789",
@@ -98,6 +105,12 @@ func TestEncloseReq(t *testing.T) {
filters: [][]byte{},
want: []byte(`["REQ","sub3"]`),
},
{
name: "escapes quotes",
subID: `"sub3"`,
filters: [][]byte{},
want: []byte(`["REQ","\"sub3\""]`),
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
@@ -126,6 +139,12 @@ func TestEncloseSubscriptionEvent(t *testing.T) {
event: []byte(`{}`),
want: []byte(`["EVENT","sub2",{}]`),
},
{
name: "escapes quotes",
subID: `"sub2"`,
event: []byte(`{}`),
want: []byte(`["EVENT","\"sub2\"",{}]`),
},
}
for _, tc := range cases {
t.Run(tc.name, func(t *testing.T) {
@@ -146,6 +165,11 @@ func TestEncloseEOSE(t *testing.T) {
subID: "sub1",
want: []byte(`["EOSE","sub1"]`),
},
{
name: "escapes quotes",
subID: `"sub1"`,
want: []byte(`["EOSE","\"sub1\""]`),
},
{
name: "empty subscription ID",
subID: "",
@@ -171,6 +195,11 @@ func TestEncloseClose(t *testing.T) {
subID: "sub1",
want: []byte(`["CLOSE","sub1"]`),
},
{
name: "escapes quotes",
subID: `"sub1"`,
want: []byte(`["CLOSE","\"sub1\""]`),
},
{
name: "empty subscription ID",
subID: "",
@@ -198,6 +227,12 @@ func TestEncloseClosed(t *testing.T) {
message: "Subscription complete",
want: []byte(`["CLOSED","sub1","Subscription complete"]`),
},
{
name: "escapes quotes",
subID: `"sub1"`,
message: `"Subscription complete"`,
want: []byte(`["CLOSED","\"sub1\"","\"Subscription complete\""]`),
},
{
name: "empty message",
subID: "sub2",
@@ -224,6 +259,11 @@ func TestEncloseNotice(t *testing.T) {
message: "This is a notice",
want: []byte(`["NOTICE","This is a notice"]`),
},
{
name: "escapes quotes",
message: `"This is a notice"`,
want: []byte(`["NOTICE","\"This is a notice\""]`),
},
{
name: "empty message",
message: "",
@@ -249,6 +289,11 @@ func TestEncloseAuthChallenge(t *testing.T) {
challenge: "random-challenge-string",
want: []byte(`["AUTH","random-challenge-string"]`),
},
{
name: "escapes quotes",
challenge: `"random-challenge-string"`,
want: []byte(`["AUTH","\"random-challenge-string\""]`),
},
{
name: "empty challenge",
challenge: "",