mirror of
https://github.com/MengMengCode/VoCat.git
synced 2026-08-21 23:33:42 +08:00
MengMengCode
07e47d012d
- Add eSIM notification management in `esim_notifications.go` with functions to retrieve, list, and remove notifications. - Implement parsing logic for pending notifications and notification metadata. - Create tests for eSIM notification parsing and request handling in `esim_notifications_test.go`. - Introduce email message construction in `email_message.go` to securely format and send emails. - Add tests for email message encoding and validation in `email_message_test.go`. - Enhance the CardPolicyAPN component to manage APN configurations, including adding, editing, and deleting custom APNs. - Implement UI for displaying and managing APN settings with appropriate validation and user feedback.
45 lines
1.4 KiB
Go
45 lines
1.4 KiB
Go
package server
|
|
|
|
import (
|
|
"bytes"
|
|
"encoding/base64"
|
|
"net/mail"
|
|
"strings"
|
|
"testing"
|
|
)
|
|
|
|
func TestWritePlainTextMailEncodesUntrustedContent(t *testing.T) {
|
|
from, err := parseMailAddress("VoCat Alerts <[email protected]>")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
recipient, err := parseMailAddress("Admin <[email protected]>")
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
body := "message\r\nBcc: [email protected]\r\n<script>alert(1)</script>"
|
|
var output bytes.Buffer
|
|
if err := writePlainTextMail(&output, from, []*mail.Address{recipient}, "new SMS", body); err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
message := output.String()
|
|
if strings.Contains(message, body) || strings.Contains(message, "\r\nBcc: [email protected]") {
|
|
t.Fatalf("unencoded body reached message: %q", message)
|
|
}
|
|
if !strings.Contains(message, "Content-Transfer-Encoding: base64") {
|
|
t.Fatalf("base64 transfer encoding missing: %q", message)
|
|
}
|
|
encoded := base64.StdEncoding.EncodeToString([]byte(body))
|
|
if !strings.Contains(strings.ReplaceAll(message, "\r\n", ""), encoded) {
|
|
t.Fatalf("encoded body missing: %q", message)
|
|
}
|
|
}
|
|
|
|
func TestWritePlainTextMailRejectsInjectedSubject(t *testing.T) {
|
|
from := &mail.Address{Address: "[email protected]"}
|
|
recipients := []*mail.Address{{Address: "[email protected]"}}
|
|
if err := writePlainTextMail(&bytes.Buffer{}, from, recipients, "hello\r\nBcc: [email protected]", "body"); err == nil {
|
|
t.Fatal("injected subject was accepted")
|
|
}
|
|
}
|