Merge pull request #30 from ashum9/security-pr-s1-strict-json

harden location ingest JSON parsing

Author: aaronbrethorst

handlers.go

@@ -4,6 +4,7 @@ import (
 	"context"
 	"encoding/json"
 	"fmt"
+	"io"
 	"log"
 	"net/http"
 	"time"
@@ -53,7 +54,16 @@ func handlePostLocation(store LocationSaver, tracker *Tracker) http.HandlerFunc
 		r.Body = http.MaxBytesReader(w, r.Body, 1<<20) // 1MB
 
 		var loc LocationReport
-		if err := json.NewDecoder(r.Body).Decode(&loc); err != nil {
+		decoder := json.NewDecoder(r.Body)
+		decoder.DisallowUnknownFields()
+		if err := decoder.Decode(&loc); err != nil {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON: " + err.Error()})
+			return
+		}
+		if err := decoder.Decode(new(json.RawMessage)); err == nil {
+			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON: request body must contain a single JSON object and no trailing data"})
+			return
+		} else if err != io.EOF {
 			writeJSON(w, http.StatusBadRequest, map[string]string{"error": "invalid JSON: " + err.Error()})
 			return
 		}

handlers_test.go

@@ -26,6 +26,16 @@ func postLocation(handler http.HandlerFunc, loc LocationReport) *httptest.Respon
 	return w
 }
 
+func postLocationWithBody(handler http.HandlerFunc, body []byte, contentType string) *httptest.ResponseRecorder {
+	req := httptest.NewRequest("POST", "/api/v1/locations", bytes.NewReader(body))
+	if contentType != "" {
+		req.Header.Set("Content-Type", contentType)
+	}
+	w := httptest.NewRecorder()
+	handler(w, req)
+	return w
+}
+
 func getFeed(handler http.HandlerFunc, query string) *httptest.ResponseRecorder {
 	url := "/gtfs-rt/vehicle-positions"
 	if query != "" {
@@ -267,3 +277,71 @@ func TestHandlePostLocation_InvalidJSON(t *testing.T) {
 	require.NoError(t, err)
 	assert.Contains(t, resp["error"], "invalid JSON")
 }
+
+func TestHandlePostLocation_UnknownFieldRejected(t *testing.T) {
+	tracker := NewTracker(5 * time.Minute)
+	handler := handlePostLocation(nil, tracker)
+
+	body := []byte(`{"vehicle_id":"bus-1","latitude":1,"longitude":2,"timestamp":100,"extra":"x"}`)
+	w := postLocationWithBody(handler, body, "application/json")
+
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+	var resp map[string]string
+	err := json.NewDecoder(w.Body).Decode(&resp)
+	require.NoError(t, err)
+	assert.Contains(t, resp["error"], "unknown field")
+}
+
+func TestHandlePostLocation_TrailingJSONRejected(t *testing.T) {
+	tracker := NewTracker(5 * time.Minute)
+	handler := handlePostLocation(nil, tracker)
+
+	body := []byte(`{"vehicle_id":"bus-1","latitude":1,"longitude":2,"timestamp":100}{"x":1}`)
+	w := postLocationWithBody(handler, body, "application/json")
+
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+	var resp map[string]string
+	err := json.NewDecoder(w.Body).Decode(&resp)
+	require.NoError(t, err)
+	assert.Contains(t, resp["error"], "single JSON object")
+}
+
+func TestHandlePostLocation_TrailingEmptyJSONObjectRejected(t *testing.T) {
+	tracker := NewTracker(5 * time.Minute)
+	handler := handlePostLocation(nil, tracker)
+
+	body := []byte(`{"vehicle_id":"bus-1","latitude":1,"longitude":2,"timestamp":100}{}`)
+	w := postLocationWithBody(handler, body, "application/json")
+
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+	var resp map[string]string
+	err := json.NewDecoder(w.Body).Decode(&resp)
+	require.NoError(t, err)
+	assert.Contains(t, resp["error"], "single JSON object")
+}
+
+func TestHandlePostLocation_TrailingGarbageRejected(t *testing.T) {
+	tracker := NewTracker(5 * time.Minute)
+	handler := handlePostLocation(nil, tracker)
+
+	body := []byte(`{"vehicle_id":"bus-1","latitude":1,"longitude":2,"timestamp":100}GARBAGE`)
+	w := postLocationWithBody(handler, body, "application/json")
+
+	assert.Equal(t, http.StatusBadRequest, w.Code)
+	var resp map[string]string
+	err := json.NewDecoder(w.Body).Decode(&resp)
+	require.NoError(t, err)
+	assert.Contains(t, resp["error"], "invalid JSON:")
+}
+
+func TestHandlePostLocation_TrailingWhitespaceAccepted(t *testing.T) {
+	tracker := NewTracker(5 * time.Minute)
+	mStore := &mockStore{}
+	handler := handlePostLocation(mStore, tracker)
+
+	body := []byte("{\"vehicle_id\":\"bus-1\",\"latitude\":1,\"longitude\":2,\"timestamp\":100}   \n")
+	w := postLocationWithBody(handler, body, "application/json")
+
+	assert.Equal(t, http.StatusCreated, w.Code)
+	assert.True(t, mStore.saved, "location should be saved when only trailing whitespace exists")
+}