mirror of
https://github.com/Wei-Shaw/sub2api.git
synced 2026-10-15 23:22:59 +08:00
对 #4814 的审计跟进修复: - 域名尾随点绕过:user@gmail.com. 的域名不在 gmail 家族名单内,点号折叠与 googlemail 归一被整体跳过,别名刷号原样可复现。归一化入口统一去掉 FQDN 根点。 - 误拒合法用户:剥 "+后缀" 缺空串守卫,+alice@ 与 +bob@ 都折叠成 @domain, 该域后续 "+x@" 注册会永久 EMAIL_EXISTS 且无自助恢复。改为仅当 "+" 不在首位时剥离。 - 无界不可索引全表扫描:原实现按 LOWER(email) LIKE '%@domain' 把整域邮箱读进内存, 且挂在公开未鉴权的 send-verify-code 上。改为按去点邮箱 REPLACE(LOWER(TRIM(email)), '.', '') 做等值 + "local+%@domain" 前缀探针并带 LIMIT, 新增同表达式的部分索引(migrations/190)。TRIM 口径与既有精确匹配一致, 历史带首尾空白的行同样命中;LIKE 元字符转义,% 与 _ 不会扩大匹配面。 - 并发竞态:注册改走 CreateWithEmailAliasGuard,在邮箱唯一性锁上追加收件箱身份锁并在 锁内复查,避免同一收件箱的多个别名变体同时通过服务层前置查重。管理员建号仍走 Create,不受别名限制。 - 能力断言静默 fail-open:别名查重方法上提到 UserRepository 端口(编译期强制), 移除可选接口类型断言与静默降级分支。 - OAuth 邮箱注册的两条建号路径(同样发放注册赠额)纳入同一查重口径;邮箱换绑/绑定 不纳入,否则用户把邮箱改成自己收件箱的别名会被误拒。
165 lines
5.5 KiB
Go
165 lines
5.5 KiB
Go
//go:build unit
|
|
|
|
package service
|
|
|
|
import (
|
|
"context"
|
|
"errors"
|
|
"testing"
|
|
|
|
"github.com/stretchr/testify/require"
|
|
)
|
|
|
|
func TestNormalizeEmailForAliasDedup(t *testing.T) {
|
|
cases := []struct {
|
|
name string
|
|
email string
|
|
want string
|
|
}{
|
|
{"plain", "user@example.com", "user@example.com"},
|
|
{"uppercase and spaces", " User@Example.COM ", "user@example.com"},
|
|
{"plus alias stripped", "user+tag@example.com", "user@example.com"},
|
|
{"gmail plus alias", "someone+bulk294@gmail.com", "someone@gmail.com"},
|
|
{"gmail dots removed", "some.one@gmail.com", "someone@gmail.com"},
|
|
{"gmail dots and plus", "s.o.m.e+x@gmail.com", "some@gmail.com"},
|
|
{"googlemail folded to gmail", "user@googlemail.com", "user@gmail.com"},
|
|
{"non-gmail keeps dots", "first.last@qq.com", "first.last@qq.com"},
|
|
{"fqdn root dot dropped", "d.axis.2026@gmail.com.", "daxis2026@gmail.com"},
|
|
{"fqdn root dot on other domain", "first.last@qq.com.", "first.last@qq.com"},
|
|
{"leading plus keeps local part", "+alice@gmail.com", "+alice@gmail.com"},
|
|
{"dot-only local part kept", "...@gmail.com", "...@gmail.com"},
|
|
{"invalid keeps lowered raw", "not-an-email", "not-an-email"},
|
|
}
|
|
for _, tc := range cases {
|
|
t.Run(tc.name, func(t *testing.T) {
|
|
require.Equal(t, tc.want, NormalizeEmailForAliasDedup(tc.email))
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestNormalizeEmailForAliasDedupKeepsDistinctInboxes(t *testing.T) {
|
|
// 剥离 "+后缀" 不能把同域下不同用户折叠成同一身份。
|
|
require.NotEqual(t,
|
|
NormalizeEmailForAliasDedup("+alice@gmail.com"),
|
|
NormalizeEmailForAliasDedup("+bob@gmail.com"),
|
|
)
|
|
require.NotEqual(t,
|
|
NormalizeEmailForAliasDedup("alice@gmail.com"),
|
|
NormalizeEmailForAliasDedup("bob@gmail.com"),
|
|
)
|
|
}
|
|
|
|
func TestEmailAliasDedupProbes(t *testing.T) {
|
|
require.ElementsMatch(t,
|
|
[]EmailAliasProbe{{Local: "someone", Domain: "gmailcom"}, {Local: "someone", Domain: "googlemailcom"}},
|
|
EmailAliasDedupProbes("Some.One+tag@gmail.com"),
|
|
)
|
|
require.ElementsMatch(t,
|
|
[]EmailAliasProbe{{Local: "daxis2026", Domain: "gmailcom"}, {Local: "daxis2026", Domain: "googlemailcom"}},
|
|
EmailAliasDedupProbes("d.axis.2026@googlemail.com."),
|
|
)
|
|
require.Equal(t,
|
|
[]EmailAliasProbe{{Local: "firstlast", Domain: "qqcom"}},
|
|
EmailAliasDedupProbes("first.last+tag@qq.com"),
|
|
)
|
|
require.Nil(t, EmailAliasDedupProbes("not-an-email"))
|
|
require.Nil(t, EmailAliasDedupProbes("...@gmail.com"))
|
|
}
|
|
|
|
// aliasDedupRepoStub implements only the methods alias dedup uses; other
|
|
// UserRepository methods come from the embedded nil interface (a wrong call
|
|
// would panic, failing the test).
|
|
type aliasDedupRepoStub struct {
|
|
UserRepository
|
|
exists bool
|
|
existsErr error
|
|
stored []string
|
|
aliasErr error
|
|
aliasChecks []string
|
|
}
|
|
|
|
func (s *aliasDedupRepoStub) ExistsByEmail(context.Context, string) (bool, error) {
|
|
return s.exists, s.existsErr
|
|
}
|
|
|
|
func (s *aliasDedupRepoStub) ExistsByEmailAlias(_ context.Context, email string) (bool, error) {
|
|
s.aliasChecks = append(s.aliasChecks, email)
|
|
if s.aliasErr != nil {
|
|
return false, s.aliasErr
|
|
}
|
|
identity := NormalizeEmailForAliasDedup(email)
|
|
for _, candidate := range s.stored {
|
|
if NormalizeEmailForAliasDedup(candidate) == identity {
|
|
return true, nil
|
|
}
|
|
}
|
|
return false, nil
|
|
}
|
|
|
|
func TestExistsByEmailOrAlias(t *testing.T) {
|
|
ctx := context.Background()
|
|
|
|
t.Run("exact duplicate short-circuits", func(t *testing.T) {
|
|
repo := &aliasDedupRepoStub{exists: true}
|
|
svc := &AuthService{userRepo: repo}
|
|
got, err := svc.existsByEmailOrAlias(ctx, "user@gmail.com")
|
|
require.NoError(t, err)
|
|
require.True(t, got)
|
|
require.Empty(t, repo.aliasChecks, "no alias probe expected after exact hit")
|
|
})
|
|
|
|
t.Run("plus alias variant detected", func(t *testing.T) {
|
|
repo := &aliasDedupRepoStub{stored: []string{"someone+bulk294@gmail.com"}}
|
|
svc := &AuthService{userRepo: repo}
|
|
got, err := svc.existsByEmailOrAlias(ctx, "Someone@gmail.com")
|
|
require.NoError(t, err)
|
|
require.True(t, got)
|
|
})
|
|
|
|
t.Run("gmail dot variant detected", func(t *testing.T) {
|
|
repo := &aliasDedupRepoStub{stored: []string{"some.one@gmail.com"}}
|
|
svc := &AuthService{userRepo: repo}
|
|
got, err := svc.existsByEmailOrAlias(ctx, "someone@gmail.com")
|
|
require.NoError(t, err)
|
|
require.True(t, got)
|
|
})
|
|
|
|
t.Run("fqdn root dot variant detected", func(t *testing.T) {
|
|
repo := &aliasDedupRepoStub{stored: []string{"d.axis.2026@gmail.com"}}
|
|
svc := &AuthService{userRepo: repo}
|
|
got, err := svc.existsByEmailOrAlias(ctx, "da.xis.2026@gmail.com.")
|
|
require.NoError(t, err)
|
|
require.True(t, got)
|
|
})
|
|
|
|
t.Run("different inbox allowed", func(t *testing.T) {
|
|
repo := &aliasDedupRepoStub{stored: []string{"other@gmail.com"}}
|
|
svc := &AuthService{userRepo: repo}
|
|
got, err := svc.existsByEmailOrAlias(ctx, "user@gmail.com")
|
|
require.NoError(t, err)
|
|
require.False(t, got)
|
|
})
|
|
|
|
t.Run("distinct plus-prefixed locals allowed", func(t *testing.T) {
|
|
repo := &aliasDedupRepoStub{stored: []string{"+alice@gmail.com"}}
|
|
svc := &AuthService{userRepo: repo}
|
|
got, err := svc.existsByEmailOrAlias(ctx, "+bob@gmail.com")
|
|
require.NoError(t, err)
|
|
require.False(t, got)
|
|
})
|
|
|
|
t.Run("alias probe error fails closed", func(t *testing.T) {
|
|
repo := &aliasDedupRepoStub{aliasErr: errors.New("db down")}
|
|
svc := &AuthService{userRepo: repo}
|
|
_, err := svc.existsByEmailOrAlias(ctx, "user@gmail.com")
|
|
require.Error(t, err)
|
|
})
|
|
|
|
t.Run("exact check error propagates", func(t *testing.T) {
|
|
repo := &aliasDedupRepoStub{existsErr: errors.New("db down")}
|
|
svc := &AuthService{userRepo: repo}
|
|
_, err := svc.existsByEmailOrAlias(ctx, "user@gmail.com")
|
|
require.Error(t, err)
|
|
})
|
|
}
|