feat(server): adds minimum keepalive and headroom, chore: updates packages to fix vulnerabilities

2026-07-29 13:18:19 +02:00
parent 94bf0b554b
commit 3ae9123597
12 changed files with 181 additions and 22 deletions
@@ -0,0 +1,35 @@
+using Ngino.Client;
+using Xunit;
+
+namespace Ngino.Client.Tests;
+
+public sealed class UpstreamRequestTests
+{
+    private static readonly Uri Upstream = new("http://localhost:11434");
+
+    [Theory]
+    [InlineData("/api/tags", "http://localhost:11434/api/tags")]
+    [InlineData("/api/tags?model=llama3.1", "http://localhost:11434/api/tags?model=llama3.1")]
+    [InlineData("/api//tags", "http://localhost:11434/api//tags")]
+    public void BuildUpstreamUri_AcceptsOriginFormPaths(string pathAndQuery, string expected)
+    {
+        var uri = UpstreamRequest.BuildUpstreamUri(Upstream, pathAndQuery);
+
+        Assert.Equal(expected, uri.AbsoluteUri);
+    }
+
+    [Theory]
+    [InlineData("//169.254.169.254/latest")]
+    [InlineData("http://169.254.169.254/latest")]
+    [InlineData("https://localhost:11434/api/tags")]
+    [InlineData(@"\\169.254.169.254\latest")]
+    [InlineData(@"/\169.254.169.254/latest")]
+    [InlineData("api/tags")]
+    public void BuildUpstreamUri_RejectsPathsThatCanEscapeTheUpstreamOrigin(string pathAndQuery)
+    {
+        var exception = Assert.Throws<InvalidOperationException>(
+            () => UpstreamRequest.BuildUpstreamUri(Upstream, pathAndQuery));
+
+        Assert.Contains("origin-form path", exception.Message);
+    }
+}