bzr 0.4.4

A CLI for Bugzilla, inspired by gh
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157

#![expect(clippy::unwrap_used)]

use super::*;

#[test]
fn build_tls_client_default_succeeds() {
    let client = build_tls_client(&TlsConfig::default());
    assert!(client.is_ok());
}

#[test]
fn build_tls_client_insecure_succeeds() {
    let config = TlsConfig {
        insecure: true,
        ..Default::default()
    };
    assert!(build_tls_client(&config).is_ok());
}

#[test]
fn build_tls_client_pinned_succeeds() {
    let config = TlsConfig {
        pin_sha256: Some(crate::tls::fingerprint::compute_fingerprint(b"test")),
        server_name: Some("test".into()),
        ..Default::default()
    };
    assert!(build_tls_client(&config).is_ok());
}

#[test]
fn build_tls_client_bad_pin_fails() {
    let config = TlsConfig {
        pin_sha256: Some("not-a-valid-pin".into()),
        ..Default::default()
    };
    assert!(build_tls_client(&config).is_err());
}

#[test]
fn build_tls_client_missing_ca_cert_fails() {
    let config = TlsConfig {
        ca_cert_path: Some("/nonexistent/ca.pem".into()),
        ..Default::default()
    };
    let err = build_tls_client(&config).unwrap_err();
    assert!(
        err.to_string().contains("failed to read"),
        "should report missing file: {err}"
    );
}

/// Stand up two loopback mock servers where `origin` issues a `301` to a
/// different host (`127.0.0.1` vs `localhost`) so a followed redirect is
/// genuinely cross-host. Returns `(origin, target)`; `target` records every
/// request that reaches it.
async fn cross_host_redirect_pair() -> (wiremock::MockServer, wiremock::MockServer) {
    use wiremock::matchers::any;
    use wiremock::{Mock, MockServer, ResponseTemplate};

    let target = MockServer::start().await;
    Mock::given(any())
        .respond_with(ResponseTemplate::new(200))
        .mount(&target)
        .await;
    let target_port = target.address().port();

    let origin = MockServer::start().await;
    let location = format!("http://localhost:{target_port}/landed");
    Mock::given(any())
        .respond_with(ResponseTemplate::new(301).insert_header("location", location.as_str()))
        .mount(&origin)
        .await;

    (origin, target)
}

#[tokio::test]
async fn api_key_header_not_forwarded_across_cross_host_redirect() {
    let (origin, target) = cross_host_redirect_pair().await;
    let client = build_tls_client(&TlsConfig::default()).unwrap();

    // Mirror the real client's header-auth attach (http::apply_auth_to_request).
    let _ = client
        .get(format!("{}/start", origin.uri()))
        .header(crate::http::AUTH_HEADER_NAME, "SECRET-API-KEY")
        .send()
        .await;

    let leaked = target
        .received_requests()
        .await
        .unwrap()
        .iter()
        .any(|r| r.headers.contains_key(crate::http::AUTH_HEADER_NAME));
    assert!(
        !leaked,
        "API key header must not be forwarded to a different host across a redirect"
    );
}

#[tokio::test]
async fn api_key_query_param_not_forwarded_across_cross_host_redirect() {
    let (origin, target) = cross_host_redirect_pair().await;
    let client = build_tls_client(&TlsConfig::default()).unwrap();

    let _ = client
        .get(format!("{}/start", origin.uri()))
        .query(&[(crate::http::AUTH_QUERY_PARAM, "SECRET-QP-KEY")])
        .send()
        .await;

    let leaked = target.received_requests().await.unwrap().iter().any(|r| {
        r.url
            .query()
            .is_some_and(|q| q.contains(crate::http::AUTH_QUERY_PARAM))
    });
    assert!(
        !leaked,
        "API key query param must not be forwarded to a different host across a redirect"
    );
}

#[tokio::test]
async fn same_host_redirect_is_followed_with_credentials() {
    use wiremock::matchers::{any, path};
    use wiremock::{Mock, MockServer, ResponseTemplate};

    // A single server that 301s /start -> /landed on itself: a genuinely
    // same-host (same host AND port) redirect, which the policy must follow
    // and over which the credential is legitimately retained.
    let server = MockServer::start().await;
    Mock::given(path("/start"))
        .respond_with(ResponseTemplate::new(301).insert_header("location", "/landed"))
        .mount(&server)
        .await;
    Mock::given(any())
        .respond_with(ResponseTemplate::new(200))
        .mount(&server)
        .await;

    let client = build_tls_client(&TlsConfig::default()).unwrap();
    let resp = client
        .get(format!("{}/start", server.uri()))
        .header(crate::http::AUTH_HEADER_NAME, "SECRET-API-KEY")
        .send()
        .await
        .unwrap();
    assert_eq!(resp.status(), 200, "same-host redirect should be followed");

    let landed_with_key = server.received_requests().await.unwrap().iter().any(|r| {
        r.url.path() == "/landed" && r.headers.contains_key(crate::http::AUTH_HEADER_NAME)
    });
    assert!(
        landed_with_key,
        "same-host redirect should reach /landed carrying the API key header"
    );
}