(t *testing.T)
| 226 | } |
| 227 | |
| 228 | func TestValidate_TamperedContent(t *testing.T) { |
| 229 | t.Parallel() |
| 230 | |
| 231 | chain := newTestCertChain(t) |
| 232 | |
| 233 | // Build a valid PKCS7 envelope. |
| 234 | original := []byte(`{"vmId":"tamper-test-vm"}`) |
| 235 | signed := chain.createSignedPKCS7(t, original) |
| 236 | |
| 237 | // Decode, tamper with the content, re-encode. |
| 238 | raw, err := base64.StdEncoding.DecodeString(signed) |
| 239 | require.NoError(t, err) |
| 240 | tampered := bytes.Replace(raw, []byte("tamper-test-vm"), []byte("tampered!!!!!!"), 1) |
| 241 | require.NotEqual(t, raw, tampered, "payload should have changed") |
| 242 | tamperedB64 := base64.StdEncoding.EncodeToString(tampered) |
| 243 | |
| 244 | opts := chain.validationOptions() |
| 245 | _, err = azureidentity.Validate(context.Background(), tamperedB64, opts) |
| 246 | require.Error(t, err, "tampered content must not pass validation") |
| 247 | } |
| 248 | |
| 249 | func TestValidate_UntrustedCertWithValidSignature(t *testing.T) { |
| 250 | t.Parallel() |
nothing calls this directly
no test coverage detected