Merge pull request #105 from drduh/04aug26

wall metadata, pin tls 1.3

Author: drduh

README.md

@@ -183,21 +183,13 @@ Get [random values](https://github.com/drduh/gone/blob/main/util/random.go) of c
 
 ```bash
 curl 127.0.0.1:8080/random/
-
 curl 127.0.0.1:8080/random/coin
-
 curl 127.0.0.1:8080/random/hex
-
 curl 127.0.0.1:8080/random/id
-
 curl 127.0.0.1:8080/random/mask
-
 curl 127.0.0.1:8080/random/name
-
 curl 127.0.0.1:8080/random/nato
-
 curl 127.0.0.1:8080/random/number
-
 curl 127.0.0.1:8080/random/pass
 ```
 
@@ -244,11 +236,8 @@ Tests and lint are validated with a [workflow](https://github.com/drduh/gone/blo
 
 ```bash
 make lint
-
 make test
-
 make test-verbose
-
 make test-race
 ```
 
@@ -266,14 +255,12 @@ On macOS, using [apple/container](https://github.com/apple/container):
 
 ```bash
 make build-container
-
 make run-container
 ```
 
 Get the server IP address:
 
 ```bash
 container ls | grep gone | grep --color --text -Eo "([0-9]{1,3}\.){3}[0-9]{1,3}"
-
 curl 192.168.64.3:8080
 ```

assets/style.css

@@ -91,11 +91,20 @@ form {
 }
 
 .itemMeta::selection,
-.itemName::selection {
+.itemName::selection,
+.wallMeta::selection {
   background-color: var(--fg-light);
   color: var(--bg-dark);
 }
 
+.wallMeta {
+  color: var(--fg-norm);
+  cursor: pointer;
+  font-family: ui-monospace, monospace;
+  font-size: 0.6em;
+  margin: 0;
+}
+
 footer {
   flex-shrink: 0;
   color: var(--fg-norm);

handlers/auth.go

@@ -93,7 +93,7 @@ func isAuthenticated(app *config.App, r *http.Request) bool {
 		app.Upload:       app.Require.Upload,
 		app.UserInfo:     app.Require.UserInfo,
 		app.UserRemask:   app.Require.UserRemask,
-		app.Wall:         app.Require.Wall,
+		app.WallModify:   app.Require.Wall,
 	}
 
 	path := strings.TrimSuffix(r.Pattern, "{$}")

handlers/config.go

@@ -4,6 +4,7 @@ package handlers
 
 const (
 	formFieldClear     = "clear"
+	formFieldDownload  = "download"
 	formFieldDownloads = "downloads"
 	formFieldDuration  = "duration"
 	formFieldMessage   = "message"

handlers/form.go

@@ -11,6 +11,16 @@ import (
 
 // parseFormInt reads an integer form value or returns the default.
 func parseFormInt(r *http.Request, field string, def, maximum int) int {
+	if maximum <= 0 {
+		return 0
+	}
+	if def < 0 {
+		def = 0
+	}
+	if def > maximum {
+		def = maximum
+	}
+
 	input := strings.TrimSpace(r.FormValue(field))
 	if input == "" {
 		return def

handlers/form_test.go

@@ -16,31 +16,36 @@ func TestParseFormInt(t *testing.T) {
 	maximum := 100
 
 	cases := []struct {
-		name    string
-		query   string
-		field   string
-		def     int
-		want    int
-		maximum int
+		name  string
+		query string
+		want  int
 	}{
-		{"valid", "/?downloads=5", "downloads",
-			def, 5, maximum},
-		{"space", "/?downloads= 5  ", "downloads",
-			def, 5, maximum},
-		{"missing", "/", "downloads",
-			def, 1, maximum},
-		{"invalid", "/?downloads=none", "downloads",
-			def, 1, maximum},
-		{"zero", "/?downloads=0", "downloads",
-			def, def, maximum},
-		{"negative", "/?downloads=-1", "downloads",
-			def, def, maximum},
-		{"fraction", "/?downloads=3.5", "downloads",
-			def, def, maximum},
-		{"large", "/?downloads=101", "downloads",
-			def, maximum, maximum},
+		{"valid", "/?downloads=5", 5},
+		{"space", "/?downloads= 5  ", 5},
+		{"unencoded", "/?downloads=+5", 5},
+		{"encoded", "/?downloads=%2B5", 5},
+		{"leading-zeros", "/?downloads=005", 5},
+		{"padded", "/?downloads=%C2%A05%C2%A0", 5},
+		{"missing", "/", def},
+		{"invalid", "/?downloads=none", def},
+		{"empty", "/?downloads=", def},
+		{"zero", "/?downloads=0", def},
+		{"negative", "/?downloads=-1", def},
+		{"fraction", "/?downloads=3.5", def},
+		{"hex", "/?downloads=0x5", def},
+		{"trailing", "/?downloads=5abc", def},
+		{"leading", "/?downloads=abc5", def},
+		{"non-ascii", "/?downloads=%EF%BC%95", def},
+		{"exceed max", "/?downloads=1000", maximum},
+		{"underscore", "/?downloads=1_000", def},
+		{"with-space", "/?downloads=1 000", def},
+		{"only-spaces", "/?downloads=   ", def},
+		{"empty-duplicate", "/?downloads=&downloads=5", def},
+		{"valid-duplicate", "/?downloads=5&downloads=10", 5},
+		{"upper-case", "/?Downloads=5", def},
+		{"multiple", "/?duration=5m&downloads=10", 10},
 		{"xlarge", "/?downloads=999999999999999999999",
-			"downloads", def, def, maximum}, // overflows int64
+			def}, // overflows int64
 	}
 
 	for _, tc := range cases {
@@ -52,7 +57,8 @@ func TestParseFormInt(t *testing.T) {
 			if err != nil {
 				t.Fatal(err)
 			}
-			got := parseFormInt(req, tc.field, tc.def, tc.maximum)
+			got := parseFormInt(
+				req, formFieldDownloads, def, maximum)
 			if got != tc.want {
 				t.Fatalf("parseFormInt(%q) = %d; want %d",
 					tc.query, got, tc.want)
@@ -69,37 +75,58 @@ func TestParseFormDuration(t *testing.T) {
 	maximum := 8 * 24 * time.Hour
 
 	cases := []struct {
-		name    string
-		query   string
-		field   string
-		def     time.Duration
-		want    time.Duration
-		maximum time.Duration
+		name  string
+		query string
+		want  time.Duration
 	}{
-		{"valid", "/?duration=1h30m", "duration",
-			def, 90 * time.Minute, maximum},
-		{"space", "/?duration= 15m ", "duration",
-			def, 15 * time.Minute, maximum},
-		{"missing", "/", "duration",
-			def, def, maximum},
-		{"invalid", "/?duration=none", "duration",
-			def, def, maximum},
-		{"zero", "/?duration=0s", "duration",
-			def, def, maximum},
-		{"negative", "/?duration=-1h", "duration",
-			def, def, maximum},
-		{"fraction", "/?duration=1.5h", "duration",
-			def, 90 * time.Minute, maximum},
-		{"no-unit", "/?duration=3333", "duration",
-			def, def, maximum},
-		{"bad-unit", "/duration=8h", "duration",
-			def, def, maximum},
-		{"large", "/?duration=9999h", "duration",
-			def, maximum, maximum},
-		{"xlarge", "/?duration=99999999999h", "duration",
-			def, def, maximum}, // overflows int64
-		{"encoded", "/?duration=%32%34%68", "duration",
-			def, 24 * time.Hour, maximum}, // "24h" encoded
+		{"valid", "/?duration=1h30m", 90 * time.Minute},
+		{"space", "/?duration= 15m ", 15 * time.Minute},
+		{"missing", "/", def},
+		{"invalid", "/?duration=none", def},
+		{"zero", "/?duration=0s", def},
+		{"negative", "/?duration=-1h", def},
+		{"fraction", "/?duration=1.5h", 90 * time.Minute},
+		{"no-unit", "/?duration=3333", def},
+		{"bad-unit", "/duration=8h", def},
+		{"large", "/?duration=9999h", maximum},
+		{"xlarge", "/?duration=99999999999h",
+			def}, // overflows int64
+		{"encoded", "/?duration=%32%34%68",
+			24 * time.Hour}, // "24h" encoded
+		{"encoded-plus",
+			"/?duration=1h%2B30m", def}, // "1h+30m"
+		{"unicode-microseconds",
+			"/?duration=1500%C2%B5s", def}, // below 1s min
+		{"microseconds",
+			"/?duration=1500us", def}, // below 1s min
+		{"leading-decimal",
+			"/?duration=.5s", def}, // below 1s min
+		{"overflow-boundary",
+			"/?duration=2562047h47m16.854775807s", maximum},
+		{"overflow-one-nanosecond",
+			"/?duration=2562047h47m16.854775808s", def},
+		{"tabs-and-newlines",
+			"/?duration=%09%0A15m%0D%0A", 15 * time.Minute},
+		{"plus-as-space",
+			"/?duration=+15m+", 15 * time.Minute},
+		{"duplicate-first-valid",
+			"/?duration=15m&duration=2h", 15 * time.Minute},
+		{"duplicate-first-invalid",
+			"/?duration=invalid&duration=15m", def},
+		{"compound-fraction",
+			"/?duration=1h0.5m", time.Hour + 30*time.Second},
+		{"minimum", "/?duration=1s", time.Second},
+		{"below-minimum", "/?duration=999ms", def},
+		{"subsecond", "/?duration=1ns", def},
+		{"at-maximum", "/?duration=192h", maximum},
+		{"case-sensitive-unit", "/?duration=15M", def},
+		{"just-over-maximum", "/?duration=192h1ns", maximum},
+		{"unsupported-days", "/?duration=1d", def},
+		{"plus-zero", "/?duration=+0s", def},
+		{"negative-zero", "/?duration=-0s", def},
+		{"mixed-sign", "/?duration=1h-30m", def},
+		{"embedded-nul", "/?duration=15m%00ignored", def},
+		{"html", "/?duration=%3Cscript%3Ealert(1)%3C%2Fscript%3E", def},
 	}
 
 	for _, tc := range cases {
@@ -112,8 +139,8 @@ func TestParseFormDuration(t *testing.T) {
 				t.Fatal(err)
 			}
 
-			got := parseFormDuration(req, tc.field, tc.def,
-				settings.Duration{Duration: tc.maximum})
+			got := parseFormDuration(req, formFieldDuration, def,
+				settings.Duration{Duration: maximum})
 			if got != tc.want {
 				t.Fatalf("parseFormDuration(%q) = %v; want %v",
 					tc.query, got, tc.want)

handlers/message.go

@@ -60,7 +60,7 @@ func MessageAdd(app *config.App) http.HandlerFunc {
 
 		app.CountMessages()
 
-		msgLength := len(formContent)
+		msgLength := charCount(formContent)
 		if msgLength > app.MessageLimits.LengthChars {
 			writeJSON(w, http.StatusBadRequest,
 				errorJSON(app.MsgLength))

handlers/routes.go

@@ -31,7 +31,7 @@ func Routes(app *config.App) map[string]http.HandlerFunc {
 		app.MessageGet:   MessageGet(app),
 
 		// Wall
-		app.Wall: Wall(app),
+		app.WallModify: Wall(app),
 
 		// User request information
 		app.UserInfo:   UserInfo(app),

handlers/status.go

@@ -33,6 +33,7 @@ func Status(app *config.App) http.HandlerFunc {
 			Default:    app.Default,
 			Limit:      app.Limit,
 			Sizes:      app.Sizes,
+			WallMeta:   app.WallMeta,
 		}
 
 		app.Log.Info("serving status",

handlers/status_test.go

@@ -71,8 +71,8 @@ func TestStatus(t *testing.T) {
 
 			var gotAddr string
 			if err := json.Unmarshal(
-				response["addr"], &gotAddr); err != nil {
-				t.Fatalf("decode addr: %v", err)
+				response["serverAddr"], &gotAddr); err != nil {
+				t.Fatalf("addr unavailable: %v", err)
 			}
 			if gotAddr != app.ServerAddr {
 				t.Errorf("addr = %q; want %q",
@@ -81,8 +81,8 @@ func TestStatus(t *testing.T) {
 
 			var gotPort int
 			if err := json.Unmarshal(
-				response["port"], &gotPort); err != nil {
-				t.Fatalf("decode port: %v", err)
+				response["serverPort"], &gotPort); err != nil {
+				t.Fatalf("port unavailable: %v", err)
 			}
 			if gotPort != app.ServerPort {
 				t.Errorf("port = %d; want %d",
@@ -127,9 +127,16 @@ func TestStatus(t *testing.T) {
 				t.Errorf("numMessages = %d; want 2",
 					gotSizes.NumMessages)
 			}
-			if gotSizes.CharsWall != len(app.WallContent) {
-				t.Errorf("charsWall = %d; want %d",
-					gotSizes.CharsWall, len(app.WallContent))
+
+			var gotWall storage.WallMeta
+			if err := json.Unmarshal(
+				response["wallMeta"], &gotWall); err != nil {
+				t.Fatalf("decode wall meta: %v", err)
+			}
+
+			if gotWall.WallChars != len(app.WallContent) {
+				t.Errorf("wallChars = %d; want %d",
+					gotWall.WallChars, len(app.WallContent))
 			}
 		})
 	}