🧪 test: Enhance CSRF tests to address unsafe header value issue (#2045) #3485
Conversation
WalkthroughThe CSRF middleware test Changes
Sequence Diagram(s)sequenceDiagram
participant Tester as Test
participant Server as CSRF Middleware
Tester->>Server: GET request with CSRF cookie
Server-->>Tester: CSRF token in response
Tester->>Server: POST request with CSRF token in header and cookie
Server-->>Tester: Validates CSRF, returns response
Assessment against linked issues
Possibly related PRs
Suggested labels
Suggested reviewers
Poem
📜 Recent review detailsConfiguration used: CodeRabbit UI 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
⏰ Context from checks skipped due to timeout of 90000ms (4)
✨ Finishing Touches
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. 🪧 TipsChatThere are 3 ways to chat with CodeRabbit:
SupportNeed help? Create a ticket on our support page for assistance with any issues or questions. Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments. CodeRabbit Commands (Invoked using PR comments)
Other keywords and placeholders
CodeRabbit Configuration File (
|
There was a problem hiding this comment.
Pull Request Overview
This PR improves the CSRF test suite by enabling and extending the unsafe header value test to better simulate real-world scenarios with cookies.
- Imported
net/httpand added cookie setup to CSRF unsafe header test - Removed the skip to run the new
Test_CSRF_UnsafeHeaderValueand clarified its comment - Added cookie injection for both GET and POST requests
Comments suppressed due to low confidence (1)
middleware/csrf/csrf_test.go:1350
- This test currently only checks status codes. To fully cover the unsafe-header scenario, inject a header with CRLF or other unsafe characters and assert that the middleware rejects it.
func Test_CSRF_UnsafeHeaderValue(t *testing.T) {
Codecov ReportAll modified and coverable lines are covered by tests ✅
Additional details and impacted files@@ Coverage Diff @@
## main #3485 +/- ##
=======================================
Coverage 83.76% 83.76%
=======================================
Files 120 120
Lines 12254 12254
=======================================
Hits 10265 10265
Misses 1564 1564
Partials 425 425
Flags with carried forward coverage won't be shown. Click here to find out more. ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
Co-authored-by: Copilot <[email protected]>
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
This comment was marked as outdated.
This comment was marked as outdated.
Sorry, something went wrong.
Improved the CSRF tests to ensure that the unsafe header value bug is reproducible and properly tested. This includes adding necessary cookies to the requests to simulate real-world scenarios and validate the middleware's behavior against the identified issue.
Fixes #2045