translations fixed to be safe

web/src/lib.rs

@@ -416,6 +416,72 @@ mod tests {
         }
     }
 
+    /// Every POST refuses a request another site made the browser send, and
+    /// refuses it *first*.
+    ///
+    /// The backend channel here points at a port nothing is listening on, so a
+    /// handler that loaded the page before checking would answer with the
+    /// failure of that call — a 502 or a redirect — instead of the refusal.
+    /// Only a handler that checks before it works can answer 403.
+    #[tokio::test]
+    async fn a_cross_site_post_is_refused_before_any_backend_call() {
+        for (path, body) in [
+            ("/login", "identifier=alice&password=secret"),
+            (
+                "/register",
+                "username=alice&email=a%40b.c&password=x&password_confirmation=x\
+                 &timezone=UTC&phone_country=SK",
+            ),
+            ("/logout", ""),
+            ("/api/catalog", "profile_name=billing"),
+            (
+                "/api/query",
+                "profile_name=billing&sql=select%201&chart_type=table",
+            ),
+            ("/permissions/roles/create", "name=sales&access=none"),
+            ("/permissions/roles/remove", "role=sales"),
+            ("/permissions/users/role", "username=alice&role=sales"),
+            (
+                "/permissions/users/password",
+                "username=alice&new_password=a&new_password_confirmation=a",
+            ),
+            (
+                "/permissions/grants/apply",
+                "role=sales&mode=grant&pair=data%3A*%7Cread",
+            ),
+            ("/admin/tables/delete", "profile=billing&table=invoice"),
+            ("/admin/profiles/copy", "profile=billing&table=invoice"),
+            ("/admin/tables/presentation", "profile=billing&table=invoice"),
+            ("/admin/tables/columns", "profile=billing&table=invoice"),
+            ("/admin/tables/builder", ""),
+            ("/admin/tables", ""),
+            ("/admin/logic", ""),
+            ("/admin/validation", ""),
+            ("/admin/validation/rules", ""),
+            ("/admin/validation/sets", ""),
+            ("/admin/import", ""),
+            ("/admin/export.csv", ""),
+        ] {
+            let response = test_router()
+                .oneshot(
+                    Request::builder()
+                        .method("POST")
+                        .uri(path)
+                        .header("content-type", "application/x-www-form-urlencoded")
+                        .header("sec-fetch-site", "cross-site")
+                        .body(Body::from(body))
+                        .unwrap(),
+                )
+                .await
+                .unwrap();
+            assert_eq!(
+                response.status(),
+                axum::http::StatusCode::FORBIDDEN,
+                "{path} served a cross-site POST"
+            );
+        }
+    }
+
     #[tokio::test]
     async fn stylesheet_is_served_once_for_every_page() {
         let (status, body) = get("/static/app.css").await;