55 lines
1.9 KiB
C#
55 lines
1.9 KiB
C#
using System;
|
|
using Paca.Browser.Extensions;
|
|
using Xunit;
|
|
|
|
namespace Paca.Tests.Browser;
|
|
|
|
/// <summary>
|
|
/// RED TEAM ATTACK SUITE: DeclarativeNetRequest Trie 컴파일러 적대적 공격 테스트
|
|
/// 1. 서브도메인 위장 공격(Subdomain Spoofing): evil-youtube.com != youtube.com
|
|
/// 2. 거대 URL 주입(Large Payload Stress / DoS 방어)
|
|
/// 3. 악의적 와일드카드 조합 및 경로 조작 공격
|
|
/// </summary>
|
|
public class DeclarativeNetRequestAdversarialTests
|
|
{
|
|
[Fact]
|
|
public void RedTeam_SubdomainSpoofing_MustNotMatch()
|
|
{
|
|
var trie = new DnrUrlTrie();
|
|
trie.InsertDomain("youtube.com", 100);
|
|
|
|
// 정당한 서브도메인 및 도메인
|
|
Assert.Contains(100, trie.FindMatches("https://youtube.com/watch?v=123"));
|
|
Assert.Contains(100, trie.FindMatches("https://music.youtube.com/"));
|
|
Assert.Contains(100, trie.FindMatches("https://www.youtube.com/feed"));
|
|
|
|
// 악의적 서브도메인 위장(Spoofing) 시도
|
|
Assert.DoesNotContain(100, trie.FindMatches("https://evil-youtube.com/"));
|
|
Assert.DoesNotContain(100, trie.FindMatches("https://notyoutube.com/watch"));
|
|
Assert.DoesNotContain(100, trie.FindMatches("https://youtube.com.attacker.com/"));
|
|
}
|
|
|
|
[Fact]
|
|
public void RedTeam_MassiveUrl_NoCrash_Resilience()
|
|
{
|
|
var trie = new DnrUrlTrie();
|
|
trie.InsertDomain("tracker.ad", 1);
|
|
|
|
// 50,000자 거대 쿼리스트링 URL 주입
|
|
var massiveUrl = "https://example.com/api?data=" + new string('A', 50000);
|
|
var matches = trie.FindMatches(massiveUrl);
|
|
|
|
Assert.Empty(matches);
|
|
}
|
|
|
|
[Fact]
|
|
public void RedTeam_NullAndMalformedUrl_SafeFallback()
|
|
{
|
|
var trie = new DnrUrlTrie();
|
|
trie.InsertDomain("ads.com", 1);
|
|
|
|
Assert.Empty(trie.FindMatches(""));
|
|
Assert.Empty(trie.FindMatches(" "));
|
|
Assert.Empty(trie.FindMatches("not-a-valid-uri::::://"));
|
|
}
|
|
}
|