Function TestDecompress_ZipBomb

middleware/decompress_test.go:323–351

(t *testing.T)

}

func TestDecompress_ZipBomb(t *testing.T) {
	e := echo.New()
	// Create highly compressed data that expands to 2MB
	// but limit is 1MB
	largeBody := bytes.Repeat([]byte("A"), 2*1024*1024) // 2MB
	var buf bytes.Buffer
	gzWriter := gzip.NewWriter(&buf)
	gzWriter.Write(largeBody)
	gzWriter.Close()

	req := httptest.NewRequest(http.MethodPost, "/", &buf)
	req.Header.Set(echo.HeaderContentEncoding, GZIPEncoding)
	rec := httptest.NewRecorder()
	c := e.NewContext(req, rec)

	h, err := DecompressConfig{MaxDecompressedSize: 1 * MB}.ToMiddleware()
	assert.NoError(t, err)

	err = h(func(c *echo.Context) error {
		_, readErr := io.ReadAll(c.Request().Body)
		return readErr
	})(c)

	// Should return 413 error
	assert.Error(t, err)
	he, ok := err.(echo.HTTPStatusCoder)
	assert.True(t, ok)
	assert.Equal(t, http.StatusRequestEntityTooLarge, he.StatusCode())
}

func TestDecompress_UnlimitedExplicit(t *testing.T) {
	e := echo.New()