Function TestCheckResponse_LargeBodyTruncated

github/github_test.go:3893–3919

TestCheckResponse_LargeBodyTruncated verifies that CheckResponse reads at most maxErrorBodySize bytes from an error response body, so that a malicious or buggy server cannot cause the client to allocate unbounded memory.

(t *testing.T)

// malicious or buggy server cannot cause the client to allocate unbounded
// memory.
func TestCheckResponse_LargeBodyTruncated(t *testing.T) {
	t.Parallel()
	// Build a body that is one byte larger than the cap.
	body := strings.Repeat("x", maxErrorBodySize+1)
	res := &http.Response{
		Request:    &http.Request{},
		StatusCode: http.StatusBadRequest,
		Body:       io.NopCloser(strings.NewReader(body)),
	}

	// CheckResponse should not return an error from the read itself; the HTTP
	// error status is the expected error.
	if err := CheckResponse(res); err == nil {
		t.Fatal("Expected error from CheckResponse, got nil")
	}

	// After CheckResponse, the body is restored with the (truncated) bytes that
	// were actually read.  Verify the restored body is exactly maxErrorBodySize
	// bytes — not the full maxErrorBodySize+1 that the server sent.
	restored, err := io.ReadAll(res.Body)
	if err != nil {
		t.Fatalf("io.ReadAll on restored body: %v", err)
	}
	if got, want := len(restored), maxErrorBodySize; got != want {
		t.Errorf("restored body length = %v, want %v (maxErrorBodySize)", got, want)
	}
}

func TestParseBooleanResponse_true(t *testing.T) {
	t.Parallel()