#!/bin/bash
# test.sh - curl tests for all badtests.py endpoints
# Usage: ./test.sh [host:port]
# Output is capped at 8KB per endpoint to prevent multi-GB files

HOST="${1:-localhost:60666}"
SEP="--------------------------------------------"
MAX_OUTPUT=8192  # max bytes of curl output to capture per endpoint

test_endpoint() {
    local path="$1"
    local title="$2"
    local extra_flags="$3"
    echo "$SEP"
    echo "ENDPOINT: $path"
    echo "TITLE:    $title"
    echo ""
    local cmd="curl -sv --max-time 5 ${extra_flags} http://${HOST}${path}"
    echo "COMMAND:  $cmd"
    echo ""
    eval "$cmd" 2>&1 | head -c "$MAX_OUTPUT"
    echo ""
    echo ""
}

# --- Content-Length Abuses ---
test_endpoint "/cl-word"         "Content-Length: banana"
test_endpoint "/cl-empty"        "Content-Length: (empty)"
test_endpoint "/cl-negative"     "Content-Length: -99999999999999999"
test_endpoint "/cl-huge"         "Content-Length: 99999999999999999" "--max-time 2"
test_endpoint "/cl-zero"         "Content-Length: 0 (body sent)"
test_endpoint "/cl-float"        "Content-Length: 3.14159"
test_endpoint "/cl-hex"          "Content-Length: 0xDEAD"
test_endpoint "/cl-null"         "Content-Length: 5\\x00"
test_endpoint "/cl-negative-one" "Content-Length: -1"
test_endpoint "/cl-nan"          "Content-Length: NaN"
test_endpoint "/cl-inf"          "Content-Length: Infinity"
test_endpoint "/cl-mismatch"     "Content-Length: 1 (body is 30 bytes)"

# --- Content-Type Abuses ---
test_endpoint "/ct-garbage"      "Content-Type: 200 random chars"
test_endpoint "/ct-multi"        "Content-Type: 5 MIME types"
test_endpoint "/ct-empty"        "Content-Type: (empty)"
test_endpoint "/ct-null"         "Content-Type: text/\\x00html"
test_endpoint "/ct-emoji"        "Content-Type: emoji"
test_endpoint "/ct-mega"         "Content-Type: 10KB long"
test_endpoint "/ct-crlf"         "Content-Type with CRLF injection"
test_endpoint "/ct-semicolon"    "Content-Type with 50 charset params"

# --- Status Code Abuses ---
test_endpoint "/status-neg"      "Status: -1"
test_endpoint "/status-zero"     "Status: 0"
test_endpoint "/status-999"      "Status: 999"
test_endpoint "/status-huge"     "Status: 99999"
test_endpoint "/status-word"     "Status: BANANA"

# --- Header Abuses ---
test_endpoint "/hdr-mega-name"   "Header name: 64KB of As"
test_endpoint "/hdr-mega-val"    "Header value: 1MB of Bs"
test_endpoint "/hdr-1000"        "1000 headers"
test_endpoint "/hdr-empty-name"  "Header: : empty_name"
test_endpoint "/hdr-no-colon"    "Header without colon"
test_endpoint "/hdr-dup-cl"      "Duplicate Content-Length: 5 and 999"
test_endpoint "/hdr-null"        "Header with null bytes"
test_endpoint "/hdr-newline"     "Header with bare \\n"

# --- Body Abuses ---
test_endpoint "/body-endless"    "Infinite body stream" "--max-time 2"
test_endpoint "/body-none"       "Content-Length: 5, no body" "--max-time 2"
test_endpoint "/body-binary"     "4KB binary as text/html"

# --- Transfer-Encoding Abuses ---
test_endpoint "/te-invalid"      "Transfer-Encoding: banana"
test_endpoint "/te-double"       "Content-Length + Transfer-Encoding"
test_endpoint "/te-bad-chunk"    "Chunked with ZZZ chunk size"

# --- Protocol Abuses ---
test_endpoint "/proto-garbage"       "512 random bytes (no HTTP)"
test_endpoint "/proto-empty"         "Empty response (0 bytes)"
test_endpoint "/proto-half"          "HTTP/9.9 version"
test_endpoint "/proto-no-headers"    "Status line + body, no headers"
test_endpoint "/proto-just-newlines" "Response is just CRLF"

# --- Encoding Abuses ---
test_endpoint "/enc-utf16"       "Body is UTF-16, header says UTF-8"
test_endpoint "/enc-gzip-lie"    "Content-Encoding: gzip (plaintext body)"

# --- Redirect Abuses ---
test_endpoint "/redir-self"      "301 redirect loop"
test_endpoint "/redir-garbage"   "301 garbage Location URL"
test_endpoint "/redir-chain"     "302 infinite unique redirect chain" "-L --max-redirs 5"

# --- Timing Abuses ---
test_endpoint "/slow-headers"    "Slowloris: 1 byte per 0.5s headers" "--max-time 2"
test_endpoint "/slow-body"       "Body: 1 byte per second (a-z)" "--max-time 2"

# --- HTML/Content Abuses ---
test_endpoint "/html-utf16"           "Full HTML page encoded as UTF-16LE"
test_endpoint "/html-long-title"      "HTML title is 1000 characters"
test_endpoint "/html-multiline-title" "HTML title with embedded newlines"
test_endpoint "/html-irc-title"       "Title with CRLF IRC injection"
test_endpoint "/html-unicode"         "Random unicode title and body"
test_endpoint "/html-meta-refresh"    "Meta refresh loop (0 second)"

# --- Terminal Abuses ---
echo "$SEP"
echo "ENDPOINT: /ansi-chaos"
echo "TITLE:    ANSI escape code nightmare"
echo ""
echo "COMMAND:  curl -s --max-time 5 http://${HOST}/ansi-chaos | cat -v"
echo ""
curl -s --max-time 5 "http://${HOST}/ansi-chaos" | cat -v | head -c "$MAX_OUTPUT"
echo ""
echo ""

# --- Network Abuses ---
test_endpoint "/net-gzip-bomb"   "Gzip bomb (~10KB to 10MB)" "-o /dev/null"
test_endpoint "/net-event-flood" "SSE event flood (infinite)" "--max-time 1"
test_endpoint "/net-mime-sniff"  "MIME type confusion (JS as image/jpeg)"
test_endpoint "/net-cache-poison" "Contradicting cache headers"
test_endpoint "/net-hsts-bomb"   "HSTS with insane max-age"

# --- Miscellaneous ---
test_endpoint "/misc-ipv4"       "Shows your connecting IPv4 address" "-4"
test_endpoint "/misc-ipv6"       "Shows your connecting IPv6 address" "-6"

echo "$SEP"
echo "ALL TESTS COMPLETE"
echo "$SEP"