ms2k/remora
SHA256
Watch
0
Code Releases Activity

Permit private IPv6 while redacting responses

Browse source
This commit is contained in:
ms2k 2026-07-17 03:45:13 +09:00
commit 5cbb0364d2
2 changed files with 47 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

5
crates/remora-outbound/tests/policy.rs
View file

@ -158,11 +158,14 @@ async fn allowlists_never_override_metadata_denial() {
let policy = OutboundPolicyBuilder::new()
.allow_non_global("10.0.0.0/8".parse::<IpNet>().expect("network"))
.allow_non_global("169.254.0.0/16".parse::<IpNet>().expect("network"))
.allow_non_global("fd00::/8".parse::<IpNet>().expect("network"))
.allow_non_global("fc00::/7".parse::<IpNet>().expect("network"))
.build();
authorize_literal(&policy, "10.1.2.3")
.await
.expect("allowlisted private address");
authorize_literal(&policy, "fd12:3456:789a::1")
.await
.expect("allowlisted ULA address");
for address in [
"169.254.169.254",
"169.254.170.2",

28
crates/remora-outbound/tests/transport.rs
View file

@ -251,6 +251,34 @@ fn request_debug_redacts_url_and_credential_values() {
assert!(!debug.contains("synthetic-api-key"));
}
#[tokio::test]
async fn response_debug_redacts_url_and_response_headers() {
let (port, _, server) = serve_http(1, |_| {
response(
"200 OK",
&[("Set-Cookie", "session=synthetic-secret")],
"ok",
)
})
.await;
let resolver = ScriptedResolver::new([("source.test", vec![vec![ip("127.0.0.1")]])]);
let client = OutboundClient::builder(resolver, local_policy(port, 5)).build();
let result = client
.execute(
OutboundRequest::get(&format!(
"http://source.test:{port}/sensitive?token=synthetic"
))
.expect("request"),
)
.await
.expect("response");
let debug = format!("{result:?}");
assert!(debug.contains("200"));
assert!(!debug.contains("sensitive"));
assert!(!debug.contains("synthetic-secret"));
server.await.expect("server");
}
#[tokio::test]
async fn denied_redirect_is_rejected_before_dial() {
let (port, _, server) = serve_http(1, |request| {