diff --git a/src/services/headers/index.js b/src/services/headers/index.js index a92912a..439baf0 100644 --- a/src/services/headers/index.js +++ b/src/services/headers/index.js @@ -8,7 +8,6 @@ export default async function routes (fastify, options) { schema, handler: async (request, reply) => { const response = { ...request.headers } - delete response.host await logAccess(response, fastify.mongo.db.collection('access-log')) await sleep(request.query.delay) // nosemgrep: javascript.express.security.audit.xss.direct-response-write.direct-response-write diff --git a/src/services/ping/index.js b/src/services/ping/index.js index 58aa2f9..8ac6a0d 100644 --- a/src/services/ping/index.js +++ b/src/services/ping/index.js @@ -16,6 +16,7 @@ export default async function routes (fastify, options) { }) fastify.get('/:response', { + schema, handler: async (request, reply) => { const response = { ping: request.params.response } await logAccess(response, fastify.mongo.db.collection('access-log')) diff --git a/test/headers.test.js b/test/headers.test.js index a393d08..58fc74c 100644 --- a/test/headers.test.js +++ b/test/headers.test.js @@ -15,18 +15,21 @@ afterEach(async (t) => { test('GET `/api/headers` route', async t => { const expectedHeaders = { - 'user-agent': 'lightMyRequest' + 'user-agent': 'lightMyRequest', + host: 'host' } const res = await t.app.inject({ method: 'GET', - url: '/api/headers' + url: '/api/headers', + headers: { + host: 'host' + } }) assert.equal(res.headers['content-type'], 'application/json; charset=utf-8') assert.equal(res.statusCode, 200) const headers = res.json() - delete headers.host assert.deepEqual(headers, expectedHeaders) assert.deepEqual(await lastLogItem(t.app.mongo.db), expectedHeaders) }) @@ -34,37 +37,43 @@ test('GET `/api/headers` route', async t => { test('GET `/api/headers` route additional headers', async t => { const expectedHeaders = { 'x-my-header': '42', - 'user-agent': 'lightMyRequest' + 'user-agent': 'lightMyRequest', + host: 'host' } const res = await t.app.inject({ method: 'GET', url: '/api/headers', - headers: { 'x-my-header': '42' } + headers: { + 'x-my-header': '42', + host: 'host' + } }) assert.equal(res.headers['content-type'], 'application/json; charset=utf-8') assert.equal(res.statusCode, 200) const headers = res.json() - delete headers.host assert.deepEqual(headers, expectedHeaders) assert.deepEqual(await lastLogItem(t.app.mongo.db), expectedHeaders) }) test('GET `/api/headers?delay=1` route', async t => { const expectedHeaders = { - 'user-agent': 'lightMyRequest' + 'user-agent': 'lightMyRequest', + host: 'host' } const res = await t.app.inject({ method: 'GET', - url: '/api/headers' + url: '/api/headers', + headers: { + host: 'host' + } }) assert.equal(res.headers['content-type'], 'application/json; charset=utf-8') assert.equal(res.statusCode, 200) const headers = res.json() - delete headers.host assert.deepEqual(headers, expectedHeaders) assert.deepEqual(await lastLogItem(t.app.mongo.db), expectedHeaders) })