81 lines
3.1 KiB
Swift
81 lines
3.1 KiB
Swift
//
|
|
// HTTPSDowngradeGuardTests.swift
|
|
//
|
|
// Copyright 2026 Brendan Szymanski <hello@bscubed.dev>
|
|
//
|
|
// This program is free software: you can redistribute it and/or modify
|
|
// it under the terms of the GNU General Public License as published by
|
|
// the Free Software Foundation, either version 3 of the License, or
|
|
// (at your option) any later version.
|
|
//
|
|
// This program is distributed in the hope that it will be useful,
|
|
// but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
// GNU General Public License for more details.
|
|
//
|
|
// You should have received a copy of the GNU General Public License
|
|
// along with this program. If not, see <https://www.gnu.org/licenses/>.
|
|
//
|
|
// SPDX-License-Identifier: GPL-3.0-or-later
|
|
//
|
|
|
|
import Foundation
|
|
import Testing
|
|
|
|
@testable import LuminateServices
|
|
|
|
#if canImport(FoundationNetworking)
|
|
import FoundationNetworking
|
|
#endif
|
|
|
|
/// Covers the redirect policy that stops an HTTPS probe from being silently downgraded.
|
|
@Suite struct HTTPSDowngradeGuardTests {
|
|
/// Invokes the guard synchronously and captures whatever request it decides to follow.
|
|
///
|
|
/// - Parameters:
|
|
/// - responseURL: The URL of the response that requested the redirect.
|
|
/// - requestURL: The URL of the proposed redirected request.
|
|
/// - Returns: The request the guard passed to its completion handler, or `nil` if rejected.
|
|
private func redirect(from responseURL: URL, to requestURL: URL) -> URLRequest? {
|
|
let guardian = HTTPSDowngradeGuard()
|
|
let response = HTTPURLResponse(
|
|
url: responseURL, statusCode: 302, httpVersion: nil, headerFields: nil)!
|
|
let request = URLRequest(url: requestURL)
|
|
let task = URLSession.shared.dataTask(with: URLRequest(url: responseURL))
|
|
var captured: URLRequest?!
|
|
guardian.urlSession(
|
|
.shared, task: task, willPerformHTTPRedirection: response, newRequest: request
|
|
) { result in
|
|
captured = result
|
|
}
|
|
return captured
|
|
}
|
|
|
|
@Test("An HTTPS to HTTP redirect is rejected")
|
|
func httpsToHTTPRejected() {
|
|
let result = redirect(
|
|
from: URL(string: "https://host/a")!, to: URL(string: "http://host/b")!)
|
|
#expect(result == nil)
|
|
}
|
|
|
|
@Test("An HTTPS to HTTPS redirect passes through unchanged")
|
|
func httpsToHTTPSPassesThrough() {
|
|
let requestURL = URL(string: "https://host/b")!
|
|
let result = redirect(from: URL(string: "https://host/a")!, to: requestURL)
|
|
#expect(result?.url == requestURL)
|
|
}
|
|
|
|
@Test("An HTTP to HTTP redirect passes through")
|
|
func httpToHTTPPassesThrough() {
|
|
let requestURL = URL(string: "http://host/b")!
|
|
let result = redirect(from: URL(string: "http://host/a")!, to: requestURL)
|
|
#expect(result?.url == requestURL)
|
|
}
|
|
|
|
@Test("Uppercase scheme spellings still trigger the downgrade check")
|
|
func uppercaseSchemesNormalized() {
|
|
let result = redirect(
|
|
from: URL(string: "HTTPS://host/a")!, to: URL(string: "HTTP://host/b")!)
|
|
#expect(result == nil)
|
|
}
|
|
}
|