1 files changed, 166 insertions, 0 deletions
diff --git a/config/security/securityonfig_test.go b/config/security/securityonfig_test.go
new file mode 100644
index 000000000..d0416a20d
--- /dev/null
+++ b/config/security/securityonfig_test.go
@@ -0,0 +1,166 @@
+// Copyright 2018 The Hugo Authors. All rights reserved.
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+// http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package security
+
+import (
+	"testing"
+
+	qt "github.com/frankban/quicktest"
+	"github.com/gohugoio/hugo/config"
+)
+
+func TestDecodeConfigFromTOML(t *testing.T) {
+	c := qt.New(t)
+
+	c.Run("Slice whitelist", func(c *qt.C) {
+		c.Parallel()
+		tomlConfig := `
+
+
+someOtherValue = "bar"
+
+[security]
+enableInlineShortcodes=true
+[security.exec]
+allow=["a", "b"]
+osEnv=["a", "b", "c"]
+[security.funcs]
+getEnv=["a", "b"]
+
+`
+
+		cfg, err := config.FromConfigString(tomlConfig, "toml")
+		c.Assert(err, qt.IsNil)
+
+		pc, err := DecodeConfig(cfg)
+		c.Assert(err, qt.IsNil)
+		c.Assert(pc, qt.Not(qt.IsNil))
+		c.Assert(pc.EnableInlineShortcodes, qt.IsTrue)
+		c.Assert(pc.Exec.Allow.Accept("a"), qt.IsTrue)
+		c.Assert(pc.Exec.Allow.Accept("d"), qt.IsFalse)
+		c.Assert(pc.Exec.OsEnv.Accept("a"), qt.IsTrue)
+		c.Assert(pc.Exec.OsEnv.Accept("e"), qt.IsFalse)
+		c.Assert(pc.Funcs.Getenv.Accept("a"), qt.IsTrue)
+		c.Assert(pc.Funcs.Getenv.Accept("c"), qt.IsFalse)
+
+	})
+
+	c.Run("String whitelist", func(c *qt.C) {
+		c.Parallel()
+		tomlConfig := `
+
+
+someOtherValue = "bar"
+
+[security]
+[security.exec]
+allow="a"
+osEnv="b"
+
+`
+
+		cfg, err := config.FromConfigString(tomlConfig, "toml")
+		c.Assert(err, qt.IsNil)
+
+		pc, err := DecodeConfig(cfg)
+		c.Assert(err, qt.IsNil)
+		c.Assert(pc, qt.Not(qt.IsNil))
+		c.Assert(pc.Exec.Allow.Accept("a"), qt.IsTrue)
+		c.Assert(pc.Exec.Allow.Accept("d"), qt.IsFalse)
+		c.Assert(pc.Exec.OsEnv.Accept("b"), qt.IsTrue)
+		c.Assert(pc.Exec.OsEnv.Accept("e"), qt.IsFalse)
+
+	})
+
+	c.Run("Default exec.osEnv", func(c *qt.C) {
+		c.Parallel()
+		tomlConfig := `
+
+
+someOtherValue = "bar"
+
+[security]
+[security.exec]
+allow="a"
+
+`
+
+		cfg, err := config.FromConfigString(tomlConfig, "toml")
+		c.Assert(err, qt.IsNil)
+
+		pc, err := DecodeConfig(cfg)
+		c.Assert(err, qt.IsNil)
+		c.Assert(pc, qt.Not(qt.IsNil))
+		c.Assert(pc.Exec.Allow.Accept("a"), qt.IsTrue)
+		c.Assert(pc.Exec.OsEnv.Accept("PATH"), qt.IsTrue)
+		c.Assert(pc.Exec.OsEnv.Accept("e"), qt.IsFalse)
+
+	})
+
+	c.Run("Enable inline shortcodes, legacy", func(c *qt.C) {
+		c.Parallel()
+		tomlConfig := `
+
+
+someOtherValue = "bar"
+enableInlineShortcodes=true
+
+[security]
+[security.exec]
+allow="a"
+osEnv="b"
+
+`
+
+		cfg, err := config.FromConfigString(tomlConfig, "toml")
+		c.Assert(err, qt.IsNil)
+
+		pc, err := DecodeConfig(cfg)
+		c.Assert(err, qt.IsNil)
+		c.Assert(pc.EnableInlineShortcodes, qt.IsTrue)
+
+	})
+
+}
+
+func TestToTOML(t *testing.T) {
+	c := qt.New(t)
+
+	got := DefaultConfig.ToTOML()
+
+	c.Assert(got, qt.Equals,
+		"[security]\n  enableInlineShortcodes = false\n  [security.exec]\n    allow = ['^dart-sass-embedded$', '^go$', '^npx$', '^postcss$']\n    osEnv = ['(?i)^(PATH|PATHEXT|APPDATA|TMP|TEMP|TERM)$']\n\n  [security.funcs]\n    getenv = ['^HUGO_']\n\n  [security.http]\n    methods = ['(?i)GET|POST']\n    urls = ['.*']",
+	)
+}
+
+func TestDecodeConfigDefault(t *testing.T) {
+	t.Parallel()
+	c := qt.New(t)
+
+	pc, err := DecodeConfig(config.New())
+	c.Assert(err, qt.IsNil)
+	c.Assert(pc, qt.Not(qt.IsNil))
+	c.Assert(pc.Exec.Allow.Accept("a"), qt.IsFalse)
+	c.Assert(pc.Exec.Allow.Accept("npx"), qt.IsTrue)
+	c.Assert(pc.Exec.Allow.Accept("Npx"), qt.IsFalse)
+	c.Assert(pc.Exec.OsEnv.Accept("a"), qt.IsFalse)
+	c.Assert(pc.Exec.OsEnv.Accept("PATH"), qt.IsTrue)
+	c.Assert(pc.Exec.OsEnv.Accept("e"), qt.IsFalse)
+
+	c.Assert(pc.HTTP.URLs.Accept("https://example.org"), qt.IsTrue)
+	c.Assert(pc.HTTP.Methods.Accept("POST"), qt.IsTrue)
+	c.Assert(pc.HTTP.Methods.Accept("GET"), qt.IsTrue)
+	c.Assert(pc.HTTP.Methods.Accept("get"), qt.IsTrue)
+	c.Assert(pc.HTTP.Methods.Accept("DELETE"), qt.IsFalse)
+}