From 1ad05475e84014f6a848cc6090a76dc12aac6f38 Mon Sep 17 00:00:00 2001 From: root Date: Fri, 17 Jul 2026 01:41:33 +0000 Subject: [PATCH] Require live HTTP security probes --- site/tests/cli_runner.uce | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/site/tests/cli_runner.uce b/site/tests/cli_runner.uce index 915539a..67ac1ef 100644 --- a/site/tests/cli_runner.uce +++ b/site/tests/cli_runner.uce @@ -327,10 +327,10 @@ void cli_run_site_suite(bool skip_local_service_pages = false) void cli_run_security_smoke() { CliHttpResponse dotdot = cli_direct_http("/../site/demo/hello.uce"); - cli_test_case("uce_security_smoke:direct HTTP rejects dot-dot script traversal", dotdot.status != 200 && !cli_contains(dotdot.body, "hello world"), "direct HTTP dot-dot traversal returned HTTP " + std::to_string(dotdot.status)); + cli_test_case("uce_security_smoke:direct HTTP rejects dot-dot script traversal", dotdot.status == 404 && !cli_contains(dotdot.body, "hello world"), "direct HTTP dot-dot traversal returned HTTP " + std::to_string(dotdot.status)); CliHttpResponse spoof = cli_direct_http("/no-such-script.uce", "Script-Filename: /Code/uce.openfu.com/uce/site/demo/hello.uce\r\n"); - cli_test_case("uce_security_smoke:direct HTTP ignores Script-Filename header", spoof.status != 200 && !cli_contains(spoof.body, "hello world"), "direct HTTP Script-Filename override returned HTTP " + std::to_string(spoof.status)); + cli_test_case("uce_security_smoke:direct HTTP ignores Script-Filename header", spoof.status == 404 && !cli_contains(spoof.body, "hello world"), "direct HTTP Script-Filename override returned HTTP " + std::to_string(spoof.status)); CliHttpResponse sanitizer = cli_frontend("/tests/security_headers.uce"); String headers_lower = to_lower(sanitizer.headers);