You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
60 lines
1.9 KiB
60 lines
1.9 KiB
2 days ago
|
#!/usr/bin/env bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
BASE_URL="${BASE_URL:-https://wx.sstbc.com}"
|
||
|
|
CURL_TIMEOUT="${CURL_TIMEOUT:-20}"
|
||
|
|
CURL_RESOLVE="${CURL_RESOLVE:-}"
|
||
|
|
TMP_DIR="$(mktemp -d)"
|
||
|
|
trap 'rm -rf "$TMP_DIR"' EXIT
|
||
|
|
|
||
|
|
CURL_ARGS=(-sS -L --max-time "$CURL_TIMEOUT")
|
||
|
|
if [[ "${CURL_INSECURE:-0}" == "1" ]]; then CURL_ARGS+=(-k); fi
|
||
|
|
if [[ -n "$CURL_RESOLVE" ]]; then CURL_ARGS+=(--resolve "$CURL_RESOLVE"); fi
|
||
|
|
|
||
|
|
request() {
|
||
|
|
local name="$1"
|
||
|
|
local method="$2"
|
||
|
|
local path="$3"
|
||
|
|
local payload="${4:-{\"mobile\":\"13800138000\",\"code\":\"1234\",\"challenge_id\":\"not-a-uuid\"}}"
|
||
|
|
local body="$TMP_DIR/$name.json"
|
||
|
|
local status
|
||
|
|
|
||
|
|
if ! status="$(curl "${CURL_ARGS[@]}" -X "$method" -H 'Accept: application/json' -H 'Content-Type: application/json' \
|
||
|
|
-d "$payload" \
|
||
|
|
-o "$body" -w '%{http_code}' "$BASE_URL$path")"; then
|
||
|
|
status="000"
|
||
|
|
fi
|
||
|
|
printf '%-32s HTTP %s\n' "$name" "$status"
|
||
|
|
printf '%s\n' "$body"
|
||
|
|
printf '%s' "$status" > "$TMP_DIR/$name.status"
|
||
|
|
}
|
||
|
|
|
||
|
|
request legacy-login GET /api/admin/auth/sms-login
|
||
|
|
request legacy-send GET /api/admin/auth/send-sms
|
||
|
|
request invalid-login POST /api/admin/auth/sms-login
|
||
|
|
request invalid-send POST /api/admin/auth/send-sms '{"mobile":"invalid"}'
|
||
|
|
|
||
|
|
if [[ "$(cat "$TMP_DIR/legacy-login.status")" != "405" || "$(cat "$TMP_DIR/legacy-send.status")" != "405" ]]; then
|
||
|
|
printf 'LEGACY_GET_CLOSED FAIL\n'
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
printf 'LEGACY_GET_CLOSED PASS\n'
|
||
|
|
|
||
|
|
if ! grep -Eq '"errcode"[[:space:]]*:[[:space:]]*30001' "$TMP_DIR/invalid-login.json"; then
|
||
|
|
printf 'LOGIN_VALIDATION FAIL\n'
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
if grep -Eiq 'access_token|token' "$TMP_DIR/invalid-login.json"; then
|
||
|
|
printf 'LOGIN_TOKEN_LEAK FAIL\n'
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
printf 'LOGIN_VALIDATION PASS\n'
|
||
|
|
|
||
|
|
if ! grep -Eq '"errcode"[[:space:]]*:[[:space:]]*30001' "$TMP_DIR/invalid-send.json"; then
|
||
|
|
printf 'SEND_VALIDATION FAIL\n'
|
||
|
|
exit 1
|
||
|
|
fi
|
||
|
|
printf 'SEND_VALIDATION PASS\n'
|
||
|
|
|
||
|
|
printf 'VULN03_ENDPOINT_REGRESSION PASS\n'
|