v0.29.2

src/web_server/tests/part_03.rs

@@ -22,6 +22,7 @@ fn fastcgi_never_forwards_proxy_header_as_http_proxy() {
         &headers,
         &uri,
         "/index.php",
+        None,
         Some("q=1"),
         &RequestContext {
             client_ip: "127.0.0.1".parse().unwrap(),
@@ -69,6 +70,7 @@ fn php_custom_fastcgi_params_and_php_values_are_validated() {
         &uri,
         "/index.php",
         None,
+        None,
         &RequestContext {
             client_ip: "127.0.0.1".parse().unwrap(),
             client_port: None,
@@ -86,6 +88,49 @@ fn php_custom_fastcgi_params_and_php_values_are_validated() {
     assert!(!encoded.windows(b"HTTP_AUTHORIZATION".len()).any(|window| window == b"HTTP_AUTHORIZATION"));
 }
 
+#[test]
+fn fastcgi_path_info_keeps_script_filename_separate() {
+    let tmp = TempDir::new().unwrap();
+    let mut configured = Service {
+        id: "php-path-info".into(),
+        name: "PHP PATH_INFO".into(),
+        document_root: tmp.path().to_path_buf(),
+        php: Php {
+            enabled: true,
+            path_info: true,
+            endpoint: "tcp:127.0.0.1:9000".into(),
+            ..Default::default()
+        },
+        ..Default::default()
+    };
+    configured.validate().unwrap();
+    let service = configured.compile().unwrap();
+    assert!(service.php.as_ref().unwrap().path_info);
+    let uri: Uri = "/index.php/foo/bar?q=1".parse().unwrap();
+    let encoded = fastcgi_params(
+        &service,
+        service.php.as_ref().unwrap(),
+        &Method::GET,
+        &HeaderMap::new(),
+        &uri,
+        "/index.php",
+        Some("/foo/bar"),
+        Some("q=1"),
+        &RequestContext {
+            client_ip: "127.0.0.1".parse().unwrap(),
+            client_port: Some(12345),
+            server_name: "example.test".into(),
+            server_port: 80,
+            tls: false,
+            version: Version::HTTP_11,
+        },
+    )
+    .unwrap();
+    assert!(encoded.windows(b"PATH_INFO".len()).any(|window| window == b"PATH_INFO"));
+    assert!(encoded.windows(b"/foo/bar".len()).any(|window| window == b"/foo/bar"));
+    assert!(encoded.windows(b"SCRIPT_FILENAME".len()).any(|window| window == b"SCRIPT_FILENAME"));
+}
+
 #[test]
 fn php_custom_fastcgi_params_cannot_override_core_or_php_admin_values() {
     let tmp = TempDir::new().unwrap();
@@ -209,3 +254,34 @@ async fn hardening_strips_fingerprint_headers_after_source_rules() {
     assert!(!response.headers().contains_key("x-powered-by"));
     assert_eq!(response.headers()["x-custom"], "kept");
 }
+
+#[test]
+fn php_admin_values_are_operator_only_and_serialized() {
+    let tmp = TempDir::new().unwrap();
+    let mut configured = Service {
+        id: "php-admin".into(), name: "PHP admin".into(),
+        document_root: tmp.path().to_path_buf(),
+        php: Php {
+            enabled: true, endpoint: "tcp:127.0.0.1:9000".into(),
+            php_admin_values: BTreeMap::from([("open_basedir".into(), "/var/www/webmail/:/tmp/".into())]),
+            ..Default::default()
+        }, ..Default::default()
+    };
+    configured.validate().unwrap();
+    let service = configured.compile().unwrap();
+    let encoded = fastcgi_params(
+        &service, service.php.as_ref().unwrap(), &Method::GET, &HeaderMap::new(),
+        &"/index.php".parse().unwrap(), "/index.php", None, None,
+        &RequestContext { client_ip: "127.0.0.1".parse().unwrap(), client_port: None,
+            server_name: "webmail.example.test".into(), server_port: 8589, tls: false,
+            version: Version::HTTP_11 },
+    ).unwrap();
+    assert!(encoded.windows(b"PHP_ADMIN_VALUE".len()).any(|w| w == b"PHP_ADMIN_VALUE"));
+    assert!(encoded.windows(b"open_basedir=/var/www/webmail/:/tmp/".len())
+        .any(|w| w == b"open_basedir=/var/www/webmail/:/tmp/"));
+    configured.php.php_values.insert("open_basedir".into(), "/".into());
+    assert!(configured.validate().is_err());
+    configured.php.php_values.clear();
+    configured.php.php_admin_values.insert("unsafe".into(), "value\nother=1".into());
+    assert!(configured.validate().is_err());
+}