Merge pull request #14 from justincjohnson/justincjohnson/validate-status

fix: validate status codes

Author: lidel

redirects.go

@@ -154,9 +154,25 @@ func ParseString(s string) ([]Rule, error) {
 func parseStatus(s string) (code int, err error) {
 	if strings.HasSuffix(s, "!") {
 		// See https://docs.netlify.com/routing/redirects/rewrites-proxies/#shadowing
-		return -1, fmt.Errorf("forced redirects (or \"shadowing\") are not supported by IPFS gateways")
+		return 0, fmt.Errorf("forced redirects (or \"shadowing\") are not supported by IPFS gateways")
 	}
 
 	code, err = strconv.Atoi(s)
-	return code, err
+	if err != nil {
+		return 0, err
+	}
+
+	if !isValidStatusCode(code) {
+		return 0, fmt.Errorf("status code %d is not supported", code)
+	}
+
+	return code, nil
+}
+
+func isValidStatusCode(status int) bool {
+	switch status {
+	case 200, 301, 302, 303, 307, 308, 404, 410, 451:
+		return true
+	}
+	return false
 }

redirects_test.go

@@ -58,12 +58,22 @@ func TestRule_IsRewrite(t *testing.T) {
 	})
 }
 
-func TestParse(t *testing.T) {
+func Test_Parse(t *testing.T) {
 	t.Run("with illegal force", func(t *testing.T) {
 		_, err := Parse(strings.NewReader(`
 		/home / 301!
 		`))
 
-		assert.Error(t, err, "forced redirects should return an error")
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "forced redirects")
+	})
+
+	t.Run("with illegal code", func(t *testing.T) {
+		_, err := Parse(strings.NewReader(`
+		/home / 42
+		`))
+
+		assert.Error(t, err)
+		assert.Contains(t, err.Error(), "status code 42 is not supported")
 	})
 }