Merge pull request #1329 from dyc3/disable-indexing

add `--disable-indexing` cli flag to completely disable directory indexing

2 files changed, 63 insertions, 0 deletions

diff --git a/tests/archive.rs b/tests/archive.rs
index b8def22..e6d0263 100644
--- a/tests/archive.rs
+++ b/tests/archive.rs
@@ -56,3 +56,31 @@ fn test_tar_archives(#[with(&["-g"])] server: TestServer) -> Result<(), Error> {
 
     Ok(())
 }
+
+#[rstest]
+#[case(server(&["--disable-indexing", "--enable-tar-gz", "--enable-tar", "--enable-zip"]))]
+fn archives_are_disabled_when_indexing_disabled(#[case] server: TestServer) -> Result<(), Error> {
+    // Ensure the links to the archives are not present
+    let body = reqwest::blocking::get(server.url())?;
+    let parsed = Document::from_read(body)?;
+    assert!(parsed
+        .find(Text)
+        .all(|x| x.text() != "Download .tar.gz" && x.text() != "Download .tar"));
+
+    // Try to download anyway, ensure it's forbidden
+    // We assert for not found to make sure we aren't leaking information about directories that do exist.
+    assert_eq!(
+        reqwest::blocking::get(server.url().join("?download=tar_gz")?)?.status(),
+        StatusCode::NOT_FOUND
+    );
+    assert_eq!(
+        reqwest::blocking::get(server.url().join("?download=tar")?)?.status(),
+        StatusCode::NOT_FOUND
+    );
+    assert_eq!(
+        reqwest::blocking::get(server.url().join("?download=zip")?)?.status(),
+        StatusCode::NOT_FOUND
+    );
+
+    Ok(())
+}
diff --git a/tests/serve_request.rs b/tests/serve_request.rs
index ac4360e..b7359c3 100644
--- a/tests/serve_request.rs
+++ b/tests/serve_request.rs
@@ -321,3 +321,38 @@ fn serves_requests_static_file_check(
 
     Ok(())
 }
+
+#[rstest]
+#[case(server(&["--disable-indexing"]))]
+fn serves_no_directory_if_indexing_disabled(#[case] server: TestServer) -> Result<(), Error> {
+    let body = reqwest::blocking::get(server.url())?;
+    assert_eq!(body.status(), StatusCode::NOT_FOUND);
+    let parsed = Document::from_read(body)?;
+
+    assert!(parsed
+        .find(|x: &Node| x.text() == FILES[0])
+        .next()
+        .is_none());
+    assert!(parsed
+        .find(|x: &Node| x.text() == DIRECTORIES[0])
+        .next()
+        .is_none());
+    assert!(parsed
+        .find(|x: &Node| x.text() == "404 Not Found")
+        .next()
+        .is_some());
+    assert!(parsed
+        .find(|x: &Node| x.text() == "File not found.")
+        .next()
+        .is_some());
+
+    Ok(())
+}
+
+#[rstest]
+#[case(server(&["--disable-indexing"]))]
+fn serves_file_requests_when_indexing_disabled(#[case] server: TestServer) -> Result<(), Error> {
+    reqwest::blocking::get(format!("{}{}", server.url(), FILES[0]))?.error_for_status()?;
+
+    Ok(())
+}