jen/epusdt
1
0
Fork 0
mirror of https://github.com/GMWalletApp/epusdt.git synced 2026-07-07 18:26:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: reject private callback and rate API URLs

Browse Source
This commit is contained in:
line-6000
2026-05-26 20:54:41 +08:00
parent 0d97237c71
commit 8bf2adad89
7 changed files with 267 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/route/admin_router_test.go
+45 -4
View File
@@ -1035,12 +1035,53 @@ func TestAdminSettings_DeleteNonExistent(t *testing.T) {
}
}
func TestAdminSettings_RejectsPrivateRateAPIURL(t *testing.T) {
e, token := setupAdminTestEnv(t)
rec := doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
"items": []map[string]interface{}{
{"group": "rate", "key": mdb.SettingKeyRateApiUrl, "value": "http://127.0.0.1:8080/", "type": "string"},
},
}, token)
resp := assertOK(t, rec)
results, ok := resp["data"].([]interface{})
if !ok || len(results) != 1 {
t.Fatalf("expected one result, got %T %v", resp["data"], resp["data"])
}
result, _ := results[0].(map[string]interface{})
if result["ok"] != false {
t.Fatalf("private rate.api_url result = %v, want ok=false", result)
}
if got, _ := result["error"].(string); !strings.Contains(got, "rate.api_url invalid") {
t.Fatalf("private rate.api_url error = %q", got)
}
}
func TestAdminSettings_AllowsPublicRateAPIURL(t *testing.T) {
e, token := setupAdminTestEnv(t)
rec := doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
"items": []map[string]interface{}{
{"group": "rate", "key": mdb.SettingKeyRateApiUrl, "value": "https://93.184.216.34/rate", "type": "string"},
},
}, token)
resp := assertOK(t, rec)
results, ok := resp["data"].([]interface{})
if !ok || len(results) != 1 {
t.Fatalf("expected one result, got %T %v", resp["data"], resp["data"])
}
result, _ := results[0].(map[string]interface{})
if result["ok"] != true {
t.Fatalf("public rate.api_url result = %v, want ok=true", result)
}
}
func TestAdminSettings_DeleteThenReupsertRestoresSetting(t *testing.T) {
e, token := setupAdminTestEnv(t)
rec := doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
"items": []map[string]interface{}{
{"group": "rate", "key": mdb.SettingKeyRateApiUrl, "value": "https://rate.old.example", "type": "string"},
{"group": "rate", "key": mdb.SettingKeyRateApiUrl, "value": "https://93.184.216.34/rate-old", "type": "string"},
},
}, token)
assertOK(t, rec)
@@ -1053,7 +1094,7 @@ func TestAdminSettings_DeleteThenReupsertRestoresSetting(t *testing.T) {
rec = doPutAdmin(e, "/admin/api/v1/settings", map[string]interface{}{
"items": []map[string]interface{}{
{"group": "rate", "key": mdb.SettingKeyRateApiUrl, "value": "https://rate.new.example", "type": "string"},
{"group": "rate", "key": mdb.SettingKeyRateApiUrl, "value": "https://93.184.216.34/rate-new", "type": "string"},
},
}, token)
assertOK(t, rec)
@@ -1069,7 +1110,7 @@ func TestAdminSettings_DeleteThenReupsertRestoresSetting(t *testing.T) {
item, _ := row.(map[string]interface{})
if item["key"] == mdb.SettingKeyRateApiUrl {
found = true
if item["value"] != "https://rate.new.example" {
if item["value"] != "https://93.184.216.34/rate-new" {
t.Fatalf("rate.api_url value = %v, want new value", item["value"])
}
}
@@ -1350,7 +1391,7 @@ func TestAdminOrders_ListWithSubExcludesSubOrdersFromTopLevel(t *testing.T) {
"currency": "CNY",
"token": "USDT",
"network": "tron",
"notify_url": "https://merchant.example/callback",
"notify_url": "https://93.184.216.34/callback",
"redirect_url": "https://merchant.example/redirect",
})
rec := doPost(e, "/payments/gmpay/v1/order/create-transaction", parentBody)
src/route/router_test.go
+29 -11
View File
@@ -240,7 +240,7 @@ func TestCreateOrderGmpayV1Solana(t *testing.T) {
"token": "usdt",
"currency": "cny",
"network": "solana",
"notify_url": "http://localhost/notify",
"notify_url": "https://93.184.216.34/notify",
})
rec := doPost(e, "/payments/gmpay/v1/order/create-transaction", body)
@@ -269,6 +269,24 @@ func TestCreateOrderGmpayV1Solana(t *testing.T) {
t.Logf("Order created: trade_id=%v address=%v amount=%v", data["trade_id"], data["receive_address"], data["actual_amount"])
}
func TestCreateOrderGmpayRejectsPrivateNotifyURL(t *testing.T) {
e := setupTestEnv(t)
body := signBody(map[string]interface{}{
"order_id": "test-private-notify-001",
"amount": 1.00,
"token": "usdt",
"currency": "cny",
"network": "solana",
"notify_url": "http://127.0.0.1/notify",
})
rec := doPost(e, "/payments/gmpay/v1/order/create-transaction", body)
if rec.Code != http.StatusBadRequest {
t.Fatalf("expected 400, got %d: %s", rec.Code, rec.Body.String())
}
}
// TestCreateOrderGmpayV1SolNative tests creating an order for native SOL token.
func TestCreateOrderGmpayV1SolNative(t *testing.T) {
e := setupTestEnv(t)
@@ -279,7 +297,7 @@ func TestCreateOrderGmpayV1SolNative(t *testing.T) {
"token": "sol",
"currency": "usd",
"network": "solana",
"notify_url": "http://localhost/notify",
"notify_url": "https://93.184.216.34/notify",
})
rec := doPost(e, "/payments/gmpay/v1/order/create-transaction", body)
@@ -334,7 +352,7 @@ func TestCreateOrderGmpayV1FormData(t *testing.T) {
"token": {"usdt"},
"currency": {"cny"},
"network": {"solana"},
"notify_url": {"http://localhost/notify"},
"notify_url": {"https://93.184.216.34/notify"},
})
rec := doFormPost(e, "/payments/gmpay/v1/order/create-transaction", values)
@@ -688,7 +706,7 @@ func seedOkPayNotifyFixture(t *testing.T) *okPayNotifyFixture {
Token: "USDT",
Network: mdb.NetworkTron,
Status: mdb.StatusWaitPay,
NotifyUrl: "http://localhost/notify",
NotifyUrl: "https://93.184.216.34/notify",
PaymentType: mdb.PaymentTypeEpay,
PayProvider: mdb.PaymentProviderOnChain,
}
@@ -928,7 +946,7 @@ func TestCreateOrderNetworkIsolation(t *testing.T) {
"token": "usdt",
"currency": "cny",
"network": "solana",
"notify_url": "http://localhost/notify",
"notify_url": "https://93.184.216.34/notify",
})
rec := doPost(e, "/payments/gmpay/v1/order/create-transaction", body)
@@ -956,7 +974,7 @@ func TestEpaySubmitPhpGetCompatible(t *testing.T) {
"type": {"alipay"},
"money": {"1.00"},
"out_trade_no": {"epay-get-001"},
"notify_url": {"http://localhost/notify"},
"notify_url": {"https://93.184.216.34/notify"},
"return_url": {"http://localhost/return"},
})
@@ -981,7 +999,7 @@ func TestEpaySubmitPhpPostFormCompatible(t *testing.T) {
"type": {"alipay"},
"money": {"1.00"},
"out_trade_no": {"epay-post-001"},
"notify_url": {"http://localhost/notify"},
"notify_url": {"https://93.184.216.34/notify"},
"return_url": {"http://localhost/return"},
"sitename": {"example-shop"},
})
@@ -1162,7 +1180,7 @@ func createCheckoutCounterRespTestOrder(t *testing.T, e *echo.Echo, orderID stri
"token": "usdt",
"currency": "cny",
"network": "tron",
"notify_url": "http://localhost/notify",
"notify_url": "https://93.184.216.34/notify",
"redirect_url": "https://merchant.example/return",
})
rec := doPost(e, "/payments/gmpay/v1/order/create-transaction", body)
@@ -1252,7 +1270,7 @@ func TestSwitchNetwork_WithOrder(t *testing.T) {
"token": "usdt",
"currency": "cny",
"network": "solana",
"notify_url": "http://localhost/notify",
"notify_url": "https://93.184.216.34/notify",
})
createRec := doPost(e, "/payments/gmpay/v1/order/create-transaction", createBody)
if createRec.Code != http.StatusOK {
@@ -1344,7 +1362,7 @@ func TestSwitchNetwork_OkPayCreatesProviderSubOrder(t *testing.T) {
"token": "usdt",
"currency": "cny",
"network": "solana",
"notify_url": "http://localhost/notify",
"notify_url": "https://93.184.216.34/notify",
})
createRec := doPost(e, "/payments/gmpay/v1/order/create-transaction", createBody)
if createRec.Code != http.StatusOK {
@@ -1441,7 +1459,7 @@ func TestSwitchNetwork_OkPayIntegration(t *testing.T) {
"token": "usdt",
"currency": "cny",
"network": "solana",
"notify_url": "http://localhost/notify",
"notify_url": "https://93.184.216.34/notify",
})
createRec := doPost(e, "/payments/gmpay/v1/order/create-transaction", createBody)
if createRec.Code != http.StatusOK {