| 1 | package sheets |
| 2 | |
| 3 | import ( |
| 4 | "fmt" |
| 5 | "net/http" |
| 6 | "net/http/httptest" |
| 7 | "strings" |
| 8 | "testing" |
| 9 | ) |
| 10 | |
| 11 | // r.FormValue swallows the error from ParseForm — including the one |
| 12 | // MaxBytesReader raises on an oversized body — and Go still populates |
| 13 | // r.Form from the URL QUERY. So a form post whose body is refused can |
| 14 | // have its patch read from the query instead, and the write lands. |
| 15 | // |
| 16 | // sizeFromForm checks ParseForm explicitly; formatFromForm did not, so |
| 17 | // the two decoders disagreed about what a malformed form is. Found by |
| 18 | // an independent review (Codex, 2026-09-05). |
| 19 | func TestAnOversizedFormBodyIsRefusedNotReadFromTheQuery(t *testing.T) { |
| 20 | app, cookies := signIn(t) |
| 21 | s, _ := newSheet(t, app, cookies, "Budget") |
| 22 | |
| 23 | path := fmt.Sprintf( |
| 24 | "/api/sheets/%d/tabs/%d/format?r1=0&c1=0&r2=0&c2=0&bold=set&page=1", |
| 25 | s.ID, s.TabID) |
| 26 | // Well past the handler's 8 KiB cap, so ParseForm fails on the body. |
| 27 | req := httptest.NewRequest(http.MethodPost, path, strings.NewReader("pad="+strings.Repeat("x", 32<<10))) |
| 28 | req.Header.Set("Content-Type", "application/x-www-form-urlencoded") |
| 29 | rec := do(t, app, as(req, cookies)) |
| 30 | |
| 31 | if rec.Code == http.StatusSeeOther || rec.Code == http.StatusOK { |
| 32 | t.Fatalf("an oversized form body was accepted (%d); the patch came from the query", rec.Code) |
| 33 | } |
| 34 | } |
| 35 | |
amadan