v0.31.8
This commit is contained in:
Mateusz Gruszczyński committed
1 parent
427d23cb6e
commit
68ada6680d
28 files changed
-8669
No files matched your search
@@ -1,452 +0,0 @@
|
||||
use super::*;
|
||||
use super::fastcgi::{
|
||||
fastcgi_body_stream, fastcgi_params, parse_cgi_headers, read_fcgi_record, write_fcgi_record,
|
||||
FCGI_END_REQUEST, FCGI_PARAMS, FCGI_STDIN, FCGI_STDOUT,
|
||||
};
|
||||
use axum::{body::Body, response::Response};
|
||||
use bytes::Bytes;
|
||||
use futures_util::StreamExt;
|
||||
use http::{
|
||||
header::{
|
||||
ACCEPT_RANGES, ALLOW, CACHE_CONTROL, CONTENT_DISPOSITION, CONTENT_ENCODING, CONTENT_LENGTH,
|
||||
CONTENT_RANGE, CONTENT_TYPE, ETAG, IF_MODIFIED_SINCE, IF_NONE_MATCH, IF_RANGE,
|
||||
LAST_MODIFIED, LOCATION, RANGE, VARY,
|
||||
},
|
||||
HeaderMap, HeaderValue, Method, StatusCode, Uri, Version,
|
||||
};
|
||||
use http_body_util::BodyExt;
|
||||
use std::{collections::BTreeMap, path::Path, time::Duration};
|
||||
use tempfile::TempDir;
|
||||
use tokio::{io::AsyncWriteExt, sync::mpsc, time::Instant};
|
||||
|
||||
fn service(root: &Path, listing: bool) -> CompiledService {
|
||||
Service {
|
||||
id: "site".into(),
|
||||
name: "Site".into(),
|
||||
document_root: root.to_path_buf(),
|
||||
index: vec!["index.html".into(), "index.htm".into()],
|
||||
directory_listing: listing,
|
||||
..Default::default()
|
||||
}
|
||||
.compile()
|
||||
.unwrap()
|
||||
}
|
||||
|
||||
fn request(method: Method, uri: &str) -> http::Request<()> {
|
||||
http::Request::builder()
|
||||
.method(method)
|
||||
.uri(uri)
|
||||
.body(())
|
||||
.unwrap()
|
||||
}
|
||||
|
||||
async fn serve_request(
|
||||
service: &CompiledService,
|
||||
request: &http::Request<()>,
|
||||
path: &str,
|
||||
) -> Response {
|
||||
serve_body_request(service, request, path, Body::empty()).await
|
||||
}
|
||||
|
||||
async fn serve_body_request(
|
||||
service: &CompiledService,
|
||||
request: &http::Request<()>,
|
||||
path: &str,
|
||||
body: Body,
|
||||
) -> Response {
|
||||
serve(
|
||||
service,
|
||||
request.method().clone(),
|
||||
request.headers().clone(),
|
||||
request.uri().clone(),
|
||||
path,
|
||||
body,
|
||||
RequestContext {
|
||||
client_ip: "127.0.0.1".parse().unwrap(),
|
||||
client_port: Some(12345),
|
||||
server_name: "example.test".into(),
|
||||
server_port: 80,
|
||||
tls: false,
|
||||
version: Version::HTTP_11,
|
||||
},
|
||||
)
|
||||
.await
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn get_head_index_and_directory_redirect_work() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::create_dir(tmp.path().join("dir")).unwrap();
|
||||
std::fs::write(tmp.path().join("index.html"), b"root").unwrap();
|
||||
std::fs::write(tmp.path().join("dir/index.html"), b"nested").unwrap();
|
||||
let service = service(tmp.path(), false);
|
||||
|
||||
let response = serve_request(&service, &request(Method::GET, "/"), "/").await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
assert_eq!(response.headers()[CONTENT_TYPE], "text/html; charset=utf-8");
|
||||
assert_eq!(response.into_body().collect().await.unwrap().to_bytes(), "root");
|
||||
|
||||
let response = serve_request(&service, &request(Method::HEAD, "/"), "/").await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
assert_eq!(response.headers()[CONTENT_LENGTH], "4");
|
||||
assert!(response.into_body().collect().await.unwrap().to_bytes().is_empty());
|
||||
|
||||
let response = serve_request(&service, &request(Method::GET, "/dir?x=1"), "/dir").await;
|
||||
assert_eq!(response.status(), StatusCode::MOVED_PERMANENTLY);
|
||||
assert_eq!(response.headers()[LOCATION], "/dir/?x=1");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn missing_files_and_disabled_directory_listing_return_normal_errors() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::create_dir(tmp.path().join("empty")).unwrap();
|
||||
let service = service(tmp.path(), false);
|
||||
|
||||
let missing = serve_request(&service, &request(Method::GET, "/missing.txt"), "/missing.txt").await;
|
||||
assert_eq!(missing.status(), StatusCode::NOT_FOUND);
|
||||
|
||||
let directory = serve_request(&service, &request(Method::GET, "/empty/"), "/empty/").await;
|
||||
assert_eq!(directory.status(), StatusCode::FORBIDDEN);
|
||||
assert_eq!(directory.headers()[CONTENT_TYPE], "text/html; charset=utf-8");
|
||||
let directory_body = directory.into_body().collect().await.unwrap().to_bytes();
|
||||
let directory_body = std::str::from_utf8(&directory_body).unwrap();
|
||||
assert!(directory_body.contains("403"));
|
||||
assert!(!directory_body.contains("directory listing is disabled"));
|
||||
|
||||
let directory_head = serve_request(&service, &request(Method::HEAD, "/empty/"), "/empty/").await;
|
||||
assert_eq!(directory_head.status(), StatusCode::FORBIDDEN);
|
||||
assert!(directory_head.into_body().collect().await.unwrap().to_bytes().is_empty());
|
||||
|
||||
let method = serve_request(&service, &request(Method::POST, "/missing.txt"), "/missing.txt").await;
|
||||
assert_eq!(method.status(), StatusCode::METHOD_NOT_ALLOWED);
|
||||
assert_eq!(method.headers()[ALLOW], "GET, HEAD");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn last_modified_condition_returns_304() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("file.txt"), b"validator").unwrap();
|
||||
let service = service(tmp.path(), false);
|
||||
let first = serve_request(&service, &request(Method::GET, "/file.txt"), "/file.txt").await;
|
||||
let last_modified = first.headers()[LAST_MODIFIED].clone();
|
||||
assert_eq!(first.headers()[CONTENT_TYPE], "text/plain; charset=utf-8");
|
||||
assert_eq!(first.headers()[CONTENT_LENGTH], "9");
|
||||
|
||||
let mut conditional = request(Method::GET, "/file.txt");
|
||||
conditional
|
||||
.headers_mut()
|
||||
.insert(IF_MODIFIED_SINCE, last_modified);
|
||||
let response = serve_request(&service, &conditional, "/file.txt").await;
|
||||
assert_eq!(response.status(), StatusCode::NOT_MODIFIED);
|
||||
assert!(response.headers().contains_key(LAST_MODIFIED));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn validators_and_single_ranges_work() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("file.txt"), b"0123456789").unwrap();
|
||||
let service = service(tmp.path(), false);
|
||||
let first = serve_request(&service, &request(Method::GET, "/file.txt"), "/file.txt").await;
|
||||
let etag = first.headers()[ETAG].clone();
|
||||
assert_eq!(first.headers()[ACCEPT_RANGES], "bytes");
|
||||
|
||||
let mut conditional = request(Method::GET, "/file.txt");
|
||||
conditional.headers_mut().insert(IF_NONE_MATCH, etag);
|
||||
assert_eq!(
|
||||
serve_request(&service, &conditional, "/file.txt").await.status(),
|
||||
StatusCode::NOT_MODIFIED
|
||||
);
|
||||
|
||||
let mut ranged = request(Method::GET, "/file.txt");
|
||||
ranged.headers_mut().insert(RANGE, "bytes=2-5".parse().unwrap());
|
||||
let response = serve_request(&service, &ranged, "/file.txt").await;
|
||||
assert_eq!(response.status(), StatusCode::PARTIAL_CONTENT);
|
||||
assert_eq!(response.headers()[CONTENT_RANGE], "bytes 2-5/10");
|
||||
assert_eq!(response.headers()[CONTENT_LENGTH], "4");
|
||||
assert_eq!(response.into_body().collect().await.unwrap().to_bytes(), "2345");
|
||||
|
||||
let mut invalid = request(Method::GET, "/file.txt");
|
||||
invalid.headers_mut().insert(RANGE, "bytes=99-100".parse().unwrap());
|
||||
let response = serve_request(&service, &invalid, "/file.txt").await;
|
||||
assert_eq!(response.status(), StatusCode::RANGE_NOT_SATISFIABLE);
|
||||
assert_eq!(response.headers()[CONTENT_RANGE], "bytes */10");
|
||||
|
||||
let mut if_range_match = request(Method::GET, "/file.txt");
|
||||
if_range_match.headers_mut().insert(RANGE, "bytes=0-1".parse().unwrap());
|
||||
if_range_match.headers_mut().insert(IF_RANGE, first.headers()[ETAG].clone());
|
||||
assert_eq!(serve_request(&service, &if_range_match, "/file.txt").await.status(), StatusCode::PARTIAL_CONTENT);
|
||||
|
||||
let mut if_range_miss = request(Method::GET, "/file.txt");
|
||||
if_range_miss.headers_mut().insert(RANGE, "bytes=0-1".parse().unwrap());
|
||||
if_range_miss.headers_mut().insert(IF_RANGE, "\"different\"".parse().unwrap());
|
||||
let response = serve_request(&service, &if_range_miss, "/file.txt").await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
assert_eq!(response.headers()[CONTENT_LENGTH], "10");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn multipart_byte_ranges_stream_each_requested_part() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("file.txt"), b"0123456789").unwrap();
|
||||
let service = service(tmp.path(), false);
|
||||
let mut ranged = request(Method::GET, "/file.txt");
|
||||
ranged
|
||||
.headers_mut()
|
||||
.insert(RANGE, "bytes=0-1,6-8".parse().unwrap());
|
||||
let response = serve_request(&service, &ranged, "/file.txt").await;
|
||||
assert_eq!(response.status(), StatusCode::PARTIAL_CONTENT);
|
||||
let content_type = response.headers()[CONTENT_TYPE].to_str().unwrap().to_owned();
|
||||
assert!(content_type.starts_with("multipart/byteranges; boundary="));
|
||||
assert!(!response.headers().contains_key(CONTENT_RANGE));
|
||||
let body = response.into_body().collect().await.unwrap().to_bytes();
|
||||
let body = String::from_utf8(body.to_vec()).unwrap();
|
||||
assert!(body.contains("Content-Range: bytes 0-1/10"));
|
||||
assert!(body.contains("Content-Range: bytes 6-8/10"));
|
||||
assert!(body.contains("\r\n01\r\n"));
|
||||
assert!(body.contains("\r\n678\r\n"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn too_many_byte_ranges_are_rejected() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("file.txt"), b"0123456789").unwrap();
|
||||
let service = service(tmp.path(), false);
|
||||
let ranges = std::iter::repeat("0-0").take(17).collect::<Vec<_>>().join(",");
|
||||
let mut ranged = request(Method::GET, "/file.txt");
|
||||
ranged
|
||||
.headers_mut()
|
||||
.insert(RANGE, format!("bytes={ranges}").parse().unwrap());
|
||||
let response = serve_request(&service, &ranged, "/file.txt").await;
|
||||
assert_eq!(response.status(), StatusCode::RANGE_NOT_SATISFIABLE);
|
||||
assert_eq!(response.headers()[CONTENT_RANGE], "bytes */10");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn listing_escapes_html_and_encodes_urls() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("a & b.txt"), b"x").unwrap();
|
||||
let service = service(tmp.path(), true);
|
||||
let response = serve_request(&service, &request(Method::GET, "/"), "/").await;
|
||||
let body = response.into_body().collect().await.unwrap().to_bytes();
|
||||
let body = std::str::from_utf8(&body).unwrap();
|
||||
assert!(body.contains("a & b.txt"));
|
||||
assert!(body.contains("a%20%26%20b.txt"));
|
||||
assert!(!body.contains(tmp.path().to_string_lossy().as_ref()));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn root_directory_listing_is_repeatable_across_refreshes() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("first.txt"), b"one").unwrap();
|
||||
std::fs::write(tmp.path().join("second.txt"), b"two").unwrap();
|
||||
let mut configured = Service {
|
||||
id: "repeat-listing".into(),
|
||||
name: "Repeat listing".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
index: Vec::new(),
|
||||
directory_listing: true,
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
|
||||
for _ in 0..2 {
|
||||
let response = serve_request(&service, &request(Method::GET, "/"), "/").await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
assert_eq!(response.headers()[CACHE_CONTROL], "no-store");
|
||||
let body = response.into_body().collect().await.unwrap().to_bytes();
|
||||
let body = std::str::from_utf8(&body).unwrap();
|
||||
assert!(body.contains("first.txt"));
|
||||
assert!(body.contains("second.txt"));
|
||||
}
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn index_precedes_listing_and_missing_index_falls_back_to_listing_per_directory() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::create_dir(tmp.path().join("with-index")).unwrap();
|
||||
std::fs::create_dir(tmp.path().join("without-index")).unwrap();
|
||||
std::fs::write(tmp.path().join("with-index/index.html"), b"INDEX-WINS").unwrap();
|
||||
std::fs::write(tmp.path().join("with-index/other.txt"), b"hidden by index").unwrap();
|
||||
std::fs::write(tmp.path().join("without-index/listed.txt"), b"listed").unwrap();
|
||||
let service = service(tmp.path(), true);
|
||||
|
||||
let indexed = serve_request(
|
||||
&service,
|
||||
&request(Method::GET, "/with-index/"),
|
||||
"/with-index/",
|
||||
)
|
||||
.await;
|
||||
assert_eq!(indexed.status(), StatusCode::OK);
|
||||
assert_eq!(
|
||||
indexed.into_body().collect().await.unwrap().to_bytes(),
|
||||
"INDEX-WINS"
|
||||
);
|
||||
|
||||
let listed = serve_request(
|
||||
&service,
|
||||
&request(Method::GET, "/without-index/"),
|
||||
"/without-index/",
|
||||
)
|
||||
.await;
|
||||
assert_eq!(listed.status(), StatusCode::OK);
|
||||
let body = listed.into_body().collect().await.unwrap().to_bytes();
|
||||
let body = std::str::from_utf8(&body).unwrap();
|
||||
assert!(body.contains("listed.txt"));
|
||||
assert!(body.contains("DIRECTORY LISTING"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn mime_overrides_default_mime_and_cache_control_are_applied_to_files() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("asset.foo"), b"foo").unwrap();
|
||||
std::fs::write(tmp.path().join("asset.unknown"), b"unknown").unwrap();
|
||||
let mut configured = Service {
|
||||
id: "mime".into(),
|
||||
name: "MIME".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
mime_types: BTreeMap::from([(".FOO".into(), "application/x-foo".into())]),
|
||||
default_mime_type: "application/x-fallback".into(),
|
||||
cache_control: Some("public, max-age=3600".into()),
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
assert!(configured.mime_types.contains_key("foo"));
|
||||
let service = configured.compile().unwrap();
|
||||
|
||||
let custom = serve_request(&service, &request(Method::GET, "/asset.foo"), "/asset.foo").await;
|
||||
assert_eq!(custom.headers()[CONTENT_TYPE], "application/x-foo");
|
||||
assert_eq!(custom.headers()[CACHE_CONTROL], "public, max-age=3600");
|
||||
|
||||
let fallback = serve_request(
|
||||
&service,
|
||||
&request(Method::GET, "/asset.unknown"),
|
||||
"/asset.unknown",
|
||||
)
|
||||
.await;
|
||||
assert_eq!(fallback.headers()[CONTENT_TYPE], "application/x-fallback");
|
||||
assert_eq!(fallback.headers()[CACHE_CONTROL], "public, max-age=3600");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn try_files_rewrites_cache_rules_headers_and_downloads_work() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("index.html"), b"SPA").unwrap();
|
||||
std::fs::write(tmp.path().join("style.css"), b"css").unwrap();
|
||||
std::fs::write(tmp.path().join("archive.zip"), b"zip").unwrap();
|
||||
let mut configured = Service {
|
||||
id: "routing".into(),
|
||||
name: "Routing".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
try_files: vec!["$uri".into(), "/index.html?$query_string".into()],
|
||||
rewrites: vec![
|
||||
RewriteRule {
|
||||
pattern: "^/internal$".into(),
|
||||
replacement: "/style.css".into(),
|
||||
status: None,
|
||||
},
|
||||
RewriteRule {
|
||||
pattern: "^/old/(.*)$".into(),
|
||||
replacement: "/new/$1".into(),
|
||||
status: Some(301),
|
||||
},
|
||||
],
|
||||
cache_control: Some("no-cache".into()),
|
||||
cache_rules: vec![CacheRule {
|
||||
matcher: "ext:css".into(),
|
||||
cache_control: "public, max-age=3600".into(),
|
||||
}],
|
||||
response_headers: BTreeMap::from([("x-static-service".into(), "yes".into())]),
|
||||
download_extensions: vec!["zip".into()],
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
|
||||
let spa = serve_request(
|
||||
&service,
|
||||
&request(Method::GET, "/missing?x=1"),
|
||||
"/missing",
|
||||
)
|
||||
.await;
|
||||
assert_eq!(spa.status(), StatusCode::OK);
|
||||
assert_eq!(spa.headers()[CACHE_CONTROL], "no-cache");
|
||||
assert_eq!(spa.headers()["x-static-service"], "yes");
|
||||
assert_eq!(spa.into_body().collect().await.unwrap().to_bytes(), "SPA");
|
||||
|
||||
let internal = serve_request(
|
||||
&service,
|
||||
&request(Method::GET, "/internal"),
|
||||
"/internal",
|
||||
)
|
||||
.await;
|
||||
assert_eq!(internal.status(), StatusCode::OK);
|
||||
assert_eq!(internal.headers()[CONTENT_TYPE], "text/css; charset=utf-8");
|
||||
assert_eq!(internal.headers()[CACHE_CONTROL], "public, max-age=3600");
|
||||
|
||||
let redirect = serve_request(
|
||||
&service,
|
||||
&request(Method::GET, "/old/path"),
|
||||
"/old/path",
|
||||
)
|
||||
.await;
|
||||
assert_eq!(redirect.status(), StatusCode::MOVED_PERMANENTLY);
|
||||
assert_eq!(redirect.headers()[LOCATION], "/new/path");
|
||||
|
||||
let download = serve_request(
|
||||
&service,
|
||||
&request(Method::GET, "/archive.zip"),
|
||||
"/archive.zip",
|
||||
)
|
||||
.await;
|
||||
assert!(download.headers()[CONTENT_DISPOSITION]
|
||||
.to_str()
|
||||
.unwrap()
|
||||
.starts_with("attachment;"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn precompressed_sidecars_keep_mime_validators_and_range_semantics() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("app.js"), b"ORIGINAL").unwrap();
|
||||
std::fs::write(tmp.path().join("app.js.br"), b"BROTLI").unwrap();
|
||||
let mut configured = Service {
|
||||
id: "compressed".into(),
|
||||
name: "Compressed".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
precompressed: Precompressed {
|
||||
enabled: true,
|
||||
brotli: true,
|
||||
gzip: false,
|
||||
},
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
|
||||
let mut accepted = request(Method::GET, "/app.js");
|
||||
accepted
|
||||
.headers_mut()
|
||||
.insert(http::header::ACCEPT_ENCODING, "br".parse().unwrap());
|
||||
let response = serve_request(&service, &accepted, "/app.js").await;
|
||||
assert_eq!(response.headers()[CONTENT_ENCODING], "br");
|
||||
assert_eq!(response.headers()[CONTENT_TYPE], "text/javascript; charset=utf-8");
|
||||
assert_eq!(response.headers()[VARY], "Accept-Encoding");
|
||||
assert_eq!(response.into_body().collect().await.unwrap().to_bytes(), "BROTLI");
|
||||
|
||||
let mut ranged = request(Method::GET, "/app.js");
|
||||
ranged
|
||||
.headers_mut()
|
||||
.insert(http::header::ACCEPT_ENCODING, "br".parse().unwrap());
|
||||
ranged
|
||||
.headers_mut()
|
||||
.insert(RANGE, "bytes=0-2".parse().unwrap());
|
||||
let response = serve_request(&service, &ranged, "/app.js").await;
|
||||
assert_eq!(response.status(), StatusCode::PARTIAL_CONTENT);
|
||||
assert_eq!(response.headers()[CONTENT_RANGE], "bytes 0-2/6");
|
||||
assert_eq!(response.into_body().collect().await.unwrap().to_bytes(), "BRO");
|
||||
|
||||
let plain = serve_request(&service, &request(Method::GET, "/app.js"), "/app.js").await;
|
||||
assert!(!plain.headers().contains_key(CONTENT_ENCODING));
|
||||
assert_eq!(plain.into_body().collect().await.unwrap().to_bytes(), "ORIGINAL");
|
||||
}
|
||||
@@ -1,454 +0,0 @@
|
||||
async fn fastcgi_fixture(response_body: &'static [u8]) -> std::net::SocketAddr {
|
||||
let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
|
||||
let address = listener.local_addr().unwrap();
|
||||
tokio::spawn(async move {
|
||||
let (mut stream, _) = listener.accept().await.unwrap();
|
||||
let deadline = Instant::now() + Duration::from_secs(5);
|
||||
loop {
|
||||
let (kind, content) = read_fcgi_record(&mut stream, deadline).await.unwrap();
|
||||
if kind == FCGI_STDIN && content.is_empty() {
|
||||
break;
|
||||
}
|
||||
}
|
||||
let mut stdout = b"Status: 200 OK\r\nContent-Type: text/plain; charset=utf-8\r\nX-PHP-FPM: fixture\r\n\r\n".to_vec();
|
||||
stdout.extend_from_slice(response_body);
|
||||
write_fcgi_record(&mut stream, FCGI_STDOUT, &stdout).await.unwrap();
|
||||
write_fcgi_record(&mut stream, FCGI_STDOUT, &[]).await.unwrap();
|
||||
write_fcgi_record(&mut stream, FCGI_END_REQUEST, &[0u8; 8]).await.unwrap();
|
||||
stream.flush().await.unwrap();
|
||||
});
|
||||
address
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn fastcgi_stream_can_be_polled_repeatedly_after_eof() {
|
||||
let (tx, rx) = mpsc::channel(1);
|
||||
tx.send(Ok(Bytes::from_static(b"data"))).await.unwrap();
|
||||
drop(tx);
|
||||
let mut body = Box::pin(fastcgi_body_stream(rx));
|
||||
assert_eq!(body.next().await.unwrap().unwrap(), Bytes::from_static(b"data"));
|
||||
assert!(body.next().await.is_none());
|
||||
// Without `fuse` this panics inside futures-util::stream::unfold.
|
||||
assert!(body.next().await.is_none());
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn php_fpm_gzip_response_finishes_after_fastcgi_eof() {
|
||||
use std::io::Read;
|
||||
|
||||
let expected = b"FastCGI compressed response regression: 0123456789 0123456789 0123456789";
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("index.php"), b"<?php echo 'placeholder';").unwrap();
|
||||
let address = fastcgi_fixture(expected).await;
|
||||
let mut configured = Service {
|
||||
id: "php-compression-regression".into(),
|
||||
name: "PHP compression regression".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
index: vec!["index.php".into()],
|
||||
php: Php {
|
||||
enabled: true,
|
||||
endpoint: format!("tcp:{address}"),
|
||||
connect_timeout_ms: 500,
|
||||
request_timeout_ms: 5_000,
|
||||
max_concurrent_requests: 1,
|
||||
..Default::default()
|
||||
},
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
let response = serve_request(&service, &request(Method::GET, "/"), "/").await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
|
||||
let mut accept = HeaderMap::new();
|
||||
accept.insert("accept-encoding", "gzip".parse().unwrap());
|
||||
let settings = crate::compression::Settings {
|
||||
gzip: true,
|
||||
br: false,
|
||||
zstd: false,
|
||||
deflate: false,
|
||||
min_bytes: 32,
|
||||
};
|
||||
let response = crate::compression::encode(response, &accept, &Method::GET, &settings).await;
|
||||
assert_eq!(response.headers()[CONTENT_ENCODING], "gzip");
|
||||
|
||||
let compressed = response.into_body().collect().await.unwrap().to_bytes();
|
||||
let mut decoded = Vec::new();
|
||||
flate2::read::GzDecoder::new(compressed.as_ref())
|
||||
.read_to_end(&mut decoded)
|
||||
.unwrap();
|
||||
assert_eq!(decoded.as_slice(), expected);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn php_fpm_executes_index_and_try_files_front_controller_without_source_disclosure() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("index.php"), b"<?php echo 'SOURCE';").unwrap();
|
||||
let address = fastcgi_fixture(b"PHP-OK").await;
|
||||
let mut configured = Service {
|
||||
id: "php".into(),
|
||||
name: "PHP".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
index: vec!["index.php".into()],
|
||||
try_files: vec!["$uri".into(), "/index.php?$query_string".into()],
|
||||
php: Php {
|
||||
enabled: true,
|
||||
endpoint: format!("tcp:{address}"),
|
||||
connect_timeout_ms: 500,
|
||||
request_timeout_ms: 5_000,
|
||||
max_concurrent_requests: 4,
|
||||
..Default::default()
|
||||
},
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
let response = serve_body_request(
|
||||
&service,
|
||||
&request(Method::POST, "/missing?name=test"),
|
||||
"/missing",
|
||||
Body::from("payload"),
|
||||
)
|
||||
.await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
assert_eq!(response.headers()["x-php-fpm"], "fixture");
|
||||
let body = response.into_body().collect().await.unwrap().to_bytes();
|
||||
assert_eq!(body, "PHP-OK");
|
||||
assert!(!std::str::from_utf8(&body).unwrap().contains("SOURCE"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn php_fpm_executes_configured_directory_index() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("index.php"), b"<?php echo 'INDEX-SOURCE';").unwrap();
|
||||
let address = fastcgi_fixture(b"PHP-INDEX").await;
|
||||
let mut configured = Service {
|
||||
id: "php-index".into(),
|
||||
name: "PHP index".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
index: vec!["index.php".into()],
|
||||
php: Php {
|
||||
enabled: true,
|
||||
endpoint: format!("tcp:{address}"),
|
||||
connect_timeout_ms: 500,
|
||||
request_timeout_ms: 5_000,
|
||||
max_concurrent_requests: 4,
|
||||
..Default::default()
|
||||
},
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
let response = serve_request(&service, &request(Method::GET, "/"), "/").await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
let body = response.into_body().collect().await.unwrap().to_bytes();
|
||||
assert_eq!(body, "PHP-INDEX");
|
||||
assert!(!String::from_utf8_lossy(&body).contains("INDEX-SOURCE"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn php_request_body_limit_returns_413_before_fastcgi_connect() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("index.php"), b"<?php echo 'secret';").unwrap();
|
||||
let mut configured = Service {
|
||||
id: "php-body-limit".into(),
|
||||
name: "PHP body limit".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
php: Php {
|
||||
enabled: true,
|
||||
endpoint: "tcp:127.0.0.1:9".into(),
|
||||
max_request_body_bytes: 5,
|
||||
..Default::default()
|
||||
},
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
let mut req = request(Method::POST, "/index.php");
|
||||
req.headers_mut().insert(CONTENT_LENGTH, HeaderValue::from_static("10"));
|
||||
let response = serve_body_request(&service, &req, "/index.php", Body::from("0123456789")).await;
|
||||
assert_eq!(response.status(), StatusCode::PAYLOAD_TOO_LARGE);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn php_fpm_failure_returns_gateway_error_instead_of_php_source() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("index.php"), b"SECRET-PHP-SOURCE").unwrap();
|
||||
let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
|
||||
let address = listener.local_addr().unwrap();
|
||||
drop(listener);
|
||||
let mut configured = Service {
|
||||
id: "php-fail".into(),
|
||||
name: "PHP fail".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
php: Php {
|
||||
enabled: true,
|
||||
endpoint: format!("tcp:{address}"),
|
||||
connect_timeout_ms: 100,
|
||||
request_timeout_ms: 500,
|
||||
max_concurrent_requests: 1,
|
||||
..Default::default()
|
||||
},
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
let response = serve_request(
|
||||
&service,
|
||||
&request(Method::GET, "/index.php"),
|
||||
"/index.php",
|
||||
)
|
||||
.await;
|
||||
assert!(matches!(response.status(), StatusCode::BAD_GATEWAY | StatusCode::GATEWAY_TIMEOUT));
|
||||
let body = response.into_body().collect().await.unwrap().to_bytes();
|
||||
assert!(!String::from_utf8_lossy(&body).contains("SECRET-PHP-SOURCE"));
|
||||
}
|
||||
|
||||
#[cfg(target_os = "linux")]
|
||||
#[tokio::test]
|
||||
async fn inside_root_symlink_policy_allows_only_targets_beneath_root() {
|
||||
use std::os::unix::fs::symlink;
|
||||
let tmp = TempDir::new().unwrap();
|
||||
let outside = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("inside.txt"), b"inside").unwrap();
|
||||
std::fs::write(outside.path().join("outside.txt"), b"outside").unwrap();
|
||||
symlink(tmp.path().join("inside.txt"), tmp.path().join("inside-link.txt")).unwrap();
|
||||
symlink(outside.path().join("outside.txt"), tmp.path().join("outside-link.txt")).unwrap();
|
||||
let mut configured = Service {
|
||||
id: "links".into(),
|
||||
name: "Links".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
symlink_policy: SymlinkPolicy::InsideRoot,
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
|
||||
let inside = serve_request(
|
||||
&service,
|
||||
&request(Method::GET, "/inside-link.txt"),
|
||||
"/inside-link.txt",
|
||||
)
|
||||
.await;
|
||||
assert_eq!(inside.status(), StatusCode::OK);
|
||||
assert_eq!(inside.into_body().collect().await.unwrap().to_bytes(), "inside");
|
||||
|
||||
let outside = serve_request(
|
||||
&service,
|
||||
&request(Method::GET, "/outside-link.txt"),
|
||||
"/outside-link.txt",
|
||||
)
|
||||
.await;
|
||||
assert_eq!(outside.status(), StatusCode::FORBIDDEN);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn empty_index_can_go_directly_to_directory_listing() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("file.txt"), b"x").unwrap();
|
||||
let mut configured = Service {
|
||||
id: "listing-only".into(),
|
||||
name: "Listing only".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
index: Vec::new(),
|
||||
directory_listing: true,
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
let response = serve_request(&service, &request(Method::GET, "/"), "/").await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
let body = response.into_body().collect().await.unwrap().to_bytes();
|
||||
let body = std::str::from_utf8(&body).unwrap();
|
||||
assert!(body.contains("file.txt"));
|
||||
assert!(body.contains("DIRECTORY LISTING"));
|
||||
assert!(body.contains(&format!("RustProxy <b>{}</b>", env!("CARGO_PKG_VERSION"))));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn traversal_and_symlink_escape_are_not_served() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("ok.txt"), b"ok").unwrap();
|
||||
let service = service(tmp.path(), false);
|
||||
assert_eq!(
|
||||
serve_request(&service, &request(Method::GET, "/../secret"), "/../secret")
|
||||
.await
|
||||
.status(),
|
||||
StatusCode::BAD_REQUEST
|
||||
);
|
||||
|
||||
#[cfg(unix)]
|
||||
{
|
||||
use std::os::unix::fs::symlink;
|
||||
let outside = TempDir::new().unwrap();
|
||||
std::fs::write(outside.path().join("secret.txt"), b"secret").unwrap();
|
||||
symlink(outside.path().join("secret.txt"), tmp.path().join("escape.txt")).unwrap();
|
||||
let response = serve_request(
|
||||
&service,
|
||||
&request(Method::GET, "/escape.txt"),
|
||||
"/escape.txt",
|
||||
)
|
||||
.await;
|
||||
assert_ne!(response.status(), StatusCode::OK);
|
||||
}
|
||||
}
|
||||
#[tokio::test]
|
||||
async fn htaccess_wordpress_style_front_controller_and_protected_files_work() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("index.html"), b"front-controller").unwrap();
|
||||
std::fs::write(tmp.path().join("existing.txt"), b"existing").unwrap();
|
||||
std::fs::write(
|
||||
tmp.path().join(".htaccess"),
|
||||
br#"<IfModule mod_rewrite.c>
|
||||
RewriteEngine On
|
||||
RewriteCond %{REQUEST_FILENAME} !-f
|
||||
RewriteCond %{REQUEST_FILENAME} !-d
|
||||
RewriteRule . /index.html [L]
|
||||
</IfModule>
|
||||
"#,
|
||||
)
|
||||
.unwrap();
|
||||
let mut configured = Service {
|
||||
id: "htaccess-rewrite".into(),
|
||||
name: "htaccess rewrite".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
htaccess: htaccess::Config { enabled: true, ..Default::default() },
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
|
||||
let rewritten = serve_request(&service, &request(Method::GET, "/missing"), "/missing").await;
|
||||
assert_eq!(rewritten.status(), StatusCode::OK);
|
||||
assert_eq!(rewritten.into_body().collect().await.unwrap().to_bytes(), "front-controller");
|
||||
|
||||
let existing = serve_request(&service, &request(Method::GET, "/existing.txt"), "/existing.txt").await;
|
||||
assert_eq!(existing.status(), StatusCode::OK);
|
||||
assert_eq!(existing.into_body().collect().await.unwrap().to_bytes(), "existing");
|
||||
|
||||
let protected = serve_request(&service, &request(Method::GET, "/.htaccess"), "/.htaccess").await;
|
||||
assert_eq!(protected.status(), StatusCode::FORBIDDEN);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn htaccess_directory_index_mime_headers_expires_and_nested_scope_work() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::create_dir(tmp.path().join("docs")).unwrap();
|
||||
std::fs::write(tmp.path().join("docs/home.foo"), b"nested").unwrap();
|
||||
std::fs::write(
|
||||
tmp.path().join("docs/.htaccess"),
|
||||
br#"DirectoryIndex home.foo
|
||||
Options -Indexes
|
||||
AddType text/x-foo .foo
|
||||
Header always set X-Htaccess yes
|
||||
ExpiresActive On
|
||||
ExpiresByType text/x-foo "access plus 1 hour"
|
||||
"#,
|
||||
)
|
||||
.unwrap();
|
||||
let mut configured = Service {
|
||||
id: "htaccess-nested".into(),
|
||||
name: "htaccess nested".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
index: vec!["index.html".into()],
|
||||
directory_listing: true,
|
||||
htaccess: htaccess::Config { enabled: true, ..Default::default() },
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
let response = serve_request(&service, &request(Method::GET, "/docs/"), "/docs/").await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
assert_eq!(response.headers()[CONTENT_TYPE], "text/x-foo");
|
||||
assert_eq!(response.headers()["x-htaccess"], "yes");
|
||||
assert_eq!(response.headers()[CACHE_CONTROL], "public, max-age=3600");
|
||||
assert!(response.headers().contains_key(http::header::EXPIRES));
|
||||
assert_eq!(response.into_body().collect().await.unwrap().to_bytes(), "nested");
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn php_source_extensions_are_not_served_without_php_fpm() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("index.php"), b"<?php echo 'secret';").unwrap();
|
||||
let service = service(tmp.path(), false);
|
||||
let response = serve_request(&service, &request(Method::GET, "/index.php"), "/index.php").await;
|
||||
assert_eq!(response.status(), StatusCode::FORBIDDEN);
|
||||
let body = response.into_body().collect().await.unwrap().to_bytes();
|
||||
assert!(!String::from_utf8_lossy(&body).contains("secret"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn htaccess_php_addhandler_requires_php_fpm() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("index.phtml"), b"secret").unwrap();
|
||||
std::fs::write(tmp.path().join(".htaccess"), b"AddHandler application/x-httpd-php .phtml\n").unwrap();
|
||||
let mut configured = Service {
|
||||
id: "htaccess-handler".into(),
|
||||
name: "htaccess handler".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
htaccess: htaccess::Config { enabled: true, ..Default::default() },
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
assert!(configured.compile().unwrap_err().to_string().contains("requires PHP-FPM"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn htaccess_security_sensitive_unsupported_directives_fail_closed() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("index.php"), b"secret").unwrap();
|
||||
std::fs::write(
|
||||
tmp.path().join(".htaccess"),
|
||||
br#"<FilesMatch "\.php$">
|
||||
SetHandler application/x-httpd-php
|
||||
</FilesMatch>
|
||||
"#,
|
||||
)
|
||||
.unwrap();
|
||||
let mut configured = Service {
|
||||
id: "htaccess-filesmatch".into(),
|
||||
name: "htaccess filesmatch".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
htaccess: htaccess::Config { enabled: true, strict: false, ..Default::default() },
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let error = configured.compile().unwrap_err().to_string();
|
||||
assert!(error.contains("Files/FilesMatch"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn htaccess_strict_mode_rejects_unsupported_directives() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("index.html"), b"ok").unwrap();
|
||||
std::fs::write(tmp.path().join(".htaccess"), b"ErrorDocument 404 /404.html\n").unwrap();
|
||||
let mut configured = Service {
|
||||
id: "htaccess-strict".into(),
|
||||
name: "htaccess strict".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
htaccess: htaccess::Config { enabled: true, strict: true, ..Default::default() },
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
assert!(configured.compile().unwrap_err().to_string().contains("ErrorDocument"));
|
||||
}
|
||||
|
||||
#[cfg(unix)]
|
||||
#[test]
|
||||
fn htaccess_configuration_file_cannot_be_a_symlink() {
|
||||
use std::os::unix::fs::symlink;
|
||||
let tmp = TempDir::new().unwrap();
|
||||
let outside = TempDir::new().unwrap();
|
||||
std::fs::write(outside.path().join("outside.conf"), b"RewriteEngine On\n").unwrap();
|
||||
symlink(outside.path().join("outside.conf"), tmp.path().join(".htaccess")).unwrap();
|
||||
let mut configured = Service {
|
||||
id: "htaccess-symlink".into(),
|
||||
name: "htaccess symlink".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
htaccess: htaccess::Config { enabled: true, ..Default::default() },
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let error = configured.compile().unwrap_err().to_string();
|
||||
assert!(error.contains("must not be a symlink"));
|
||||
}
|
||||
@@ -1,361 +0,0 @@
|
||||
#[test]
|
||||
fn fastcgi_never_forwards_proxy_header_as_http_proxy() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
let mut configured = Service {
|
||||
id: "fastcgi-params".into(),
|
||||
name: "FastCGI params".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
php: Php { enabled: true, endpoint: "tcp:127.0.0.1:9000".into(), ..Default::default() },
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
let php = service.php.as_ref().unwrap();
|
||||
let mut headers = HeaderMap::new();
|
||||
headers.insert("proxy", HeaderValue::from_static("http://attacker.invalid:8080"));
|
||||
headers.insert("user-agent", HeaderValue::from_static("security-test"));
|
||||
let uri: Uri = "/index.php?q=1".parse().unwrap();
|
||||
let encoded = fastcgi_params(
|
||||
&service,
|
||||
php,
|
||||
&Method::GET,
|
||||
&headers,
|
||||
&uri,
|
||||
"/index.php",
|
||||
None,
|
||||
Some("q=1"),
|
||||
&RequestContext {
|
||||
client_ip: "127.0.0.1".parse().unwrap(),
|
||||
client_port: Some(12345),
|
||||
server_name: "example.test".into(),
|
||||
server_port: 80,
|
||||
tls: false,
|
||||
version: Version::HTTP_11,
|
||||
},
|
||||
)
|
||||
.unwrap();
|
||||
assert!(!encoded.windows(b"HTTP_PROXY".len()).any(|window| window == b"HTTP_PROXY"));
|
||||
assert!(encoded.windows(b"HTTP_USER_AGENT".len()).any(|window| window == b"HTTP_USER_AGENT"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn php_custom_fastcgi_params_and_php_values_are_validated() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
let mut configured = Service {
|
||||
id: "php-custom".into(),
|
||||
name: "PHP custom".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
php: Php {
|
||||
enabled: true,
|
||||
endpoint: "tcp:127.0.0.1:9000".into(),
|
||||
pass_authorization: false,
|
||||
custom_params: BTreeMap::from([("app_env".into(), "production".into())]),
|
||||
php_values: BTreeMap::from([("memory_limit".into(), "256M".into())]),
|
||||
..Default::default()
|
||||
},
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
assert!(configured.php.custom_params.contains_key("APP_ENV"));
|
||||
let service = configured.compile().unwrap();
|
||||
let php = service.php.as_ref().unwrap();
|
||||
let mut headers = HeaderMap::new();
|
||||
headers.insert("authorization", HeaderValue::from_static("Bearer secret"));
|
||||
let uri: Uri = "/index.php".parse().unwrap();
|
||||
let encoded = fastcgi_params(
|
||||
&service,
|
||||
php,
|
||||
&Method::GET,
|
||||
&headers,
|
||||
&uri,
|
||||
"/index.php",
|
||||
None,
|
||||
None,
|
||||
&RequestContext {
|
||||
client_ip: "127.0.0.1".parse().unwrap(),
|
||||
client_port: None,
|
||||
server_name: "example.test".into(),
|
||||
server_port: 443,
|
||||
tls: true,
|
||||
version: Version::HTTP_2,
|
||||
},
|
||||
)
|
||||
.unwrap();
|
||||
assert!(encoded.windows(b"APP_ENV".len()).any(|window| window == b"APP_ENV"));
|
||||
assert!(encoded.windows(b"production".len()).any(|window| window == b"production"));
|
||||
assert!(encoded.windows(b"PHP_VALUE".len()).any(|window| window == b"PHP_VALUE"));
|
||||
assert!(encoded.windows(b"memory_limit=256M".len()).any(|window| window == b"memory_limit=256M"));
|
||||
assert!(!encoded.windows(b"HTTP_AUTHORIZATION".len()).any(|window| window == b"HTTP_AUTHORIZATION"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn fastcgi_path_info_keeps_script_filename_separate() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
let mut configured = Service {
|
||||
id: "php-path-info".into(),
|
||||
name: "PHP PATH_INFO".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
php: Php {
|
||||
enabled: true,
|
||||
path_info: true,
|
||||
endpoint: "tcp:127.0.0.1:9000".into(),
|
||||
..Default::default()
|
||||
},
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
assert!(service.php.as_ref().unwrap().path_info);
|
||||
let uri: Uri = "/index.php/foo/bar?q=1".parse().unwrap();
|
||||
let encoded = fastcgi_params(
|
||||
&service,
|
||||
service.php.as_ref().unwrap(),
|
||||
&Method::GET,
|
||||
&HeaderMap::new(),
|
||||
&uri,
|
||||
"/index.php",
|
||||
Some("/foo/bar"),
|
||||
Some("q=1"),
|
||||
&RequestContext {
|
||||
client_ip: "127.0.0.1".parse().unwrap(),
|
||||
client_port: Some(12345),
|
||||
server_name: "example.test".into(),
|
||||
server_port: 80,
|
||||
tls: false,
|
||||
version: Version::HTTP_11,
|
||||
},
|
||||
)
|
||||
.unwrap();
|
||||
assert!(encoded.windows(b"PATH_INFO".len()).any(|window| window == b"PATH_INFO"));
|
||||
assert!(encoded.windows(b"/foo/bar".len()).any(|window| window == b"/foo/bar"));
|
||||
assert!(encoded.windows(b"SCRIPT_FILENAME".len()).any(|window| window == b"SCRIPT_FILENAME"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn php_custom_fastcgi_params_cannot_override_core_or_php_admin_values() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
for name in ["SCRIPT_FILENAME", "HTTP_HOST", "PHP_VALUE", "PHP_ADMIN_VALUE"] {
|
||||
let mut configured = Service {
|
||||
id: "php-reserved".into(),
|
||||
name: "PHP reserved".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
php: Php {
|
||||
custom_params: BTreeMap::from([(name.into(), "bad".into())]),
|
||||
..Default::default()
|
||||
},
|
||||
..Default::default()
|
||||
};
|
||||
assert!(configured.validate().unwrap_err().to_string().contains("reserved name"));
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn php_custom_fastcgi_data_has_a_combined_bound() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
let custom_params = (0..17)
|
||||
.map(|index| (format!("APP_{index}"), "x".repeat(8192)))
|
||||
.collect();
|
||||
let mut configured = Service {
|
||||
id: "php-custom-bound".into(),
|
||||
name: "PHP custom bound".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
php: Php { custom_params, ..Default::default() },
|
||||
..Default::default()
|
||||
};
|
||||
assert!(configured
|
||||
.validate()
|
||||
.unwrap_err()
|
||||
.to_string()
|
||||
.contains("at most 128 KiB"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn fastcgi_response_cannot_control_downstream_framing_or_hop_headers() {
|
||||
let (_, headers) = parse_cgi_headers(
|
||||
b"Content-Type: text/plain\r\nContent-Length: 999999\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nTE: trailers\r\nTrailer: X-Test\r\nProxy-Authenticate: Basic realm=x\r\nProxy-Authorization: secret\r\nX-App: ok\r\n",
|
||||
)
|
||||
.unwrap();
|
||||
assert_eq!(headers.get("x-app").unwrap(), "ok");
|
||||
for name in [
|
||||
"content-length",
|
||||
"transfer-encoding",
|
||||
"connection",
|
||||
"te",
|
||||
"trailer",
|
||||
"proxy-authenticate",
|
||||
"proxy-authorization",
|
||||
] {
|
||||
assert!(!headers.contains_key(name), "unexpected FastCGI framing header: {name}");
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn fastcgi_response_rejects_informational_status_codes() {
|
||||
let error = parse_cgi_headers(b"Status: 101 Switching Protocols\r\nContent-Type: text/plain\r\n")
|
||||
.unwrap_err()
|
||||
.to_string();
|
||||
assert!(error.contains("unsupported informational/invalid status"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn hardening_blocks_common_probe_paths_and_trace() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("index.html"), b"ok").unwrap();
|
||||
std::fs::write(tmp.path().join(".env"), b"secret").unwrap();
|
||||
std::fs::write(tmp.path().join("backup.sql"), b"secret").unwrap();
|
||||
std::fs::write(tmp.path().join("public.txt"), b"public").unwrap();
|
||||
let mut configured = Service {
|
||||
id: "hardened".into(),
|
||||
name: "hardened".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
index: vec![],
|
||||
directory_listing: true,
|
||||
hardening: Hardening { block_common_attacks: true, strip_unnecessary_headers: false },
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
for path in ["/.env", "/wp-config.php", "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/backup.sql"] {
|
||||
let response = serve_request(&service, &request(Method::GET, path), path).await;
|
||||
assert_eq!(response.status(), StatusCode::FORBIDDEN, "{path}");
|
||||
}
|
||||
let trace = serve_request(&service, &request(Method::TRACE, "/"), "/").await;
|
||||
assert_eq!(trace.status(), StatusCode::FORBIDDEN);
|
||||
let listing = serve_request(&service, &request(Method::GET, "/"), "/").await;
|
||||
let listing = String::from_utf8_lossy(&listing.into_body().collect().await.unwrap().to_bytes()).to_string();
|
||||
assert!(listing.contains("public.txt"));
|
||||
assert!(!listing.contains(".env"));
|
||||
assert!(!listing.contains("backup.sql"));
|
||||
let well_known = serve_request(&service, &request(Method::GET, "/.well-known/missing"), "/.well-known/missing").await;
|
||||
assert_eq!(well_known.status(), StatusCode::NOT_FOUND);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn hardening_strips_fingerprint_headers_after_source_rules() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("index.html"), b"ok").unwrap();
|
||||
let mut configured = Service {
|
||||
id: "headers".into(),
|
||||
name: "headers".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
response_headers: BTreeMap::from([
|
||||
("server".into(), "Example/1.0".into()),
|
||||
("x-powered-by".into(), "PHP/8.4".into()),
|
||||
("x-custom".into(), "kept".into()),
|
||||
]),
|
||||
hardening: Hardening { block_common_attacks: false, strip_unnecessary_headers: true },
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
let response = serve_request(&service, &request(Method::GET, "/index.html"), "/index.html").await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
assert!(!response.headers().contains_key("server"));
|
||||
assert!(!response.headers().contains_key("x-powered-by"));
|
||||
assert_eq!(response.headers()["x-custom"], "kept");
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn php_admin_values_are_operator_only_and_serialized() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
let mut configured = Service {
|
||||
id: "php-admin".into(), name: "PHP admin".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
php: Php {
|
||||
enabled: true, endpoint: "tcp:127.0.0.1:9000".into(),
|
||||
php_admin_values: BTreeMap::from([("open_basedir".into(), "/var/www/webmail/:/tmp/".into())]),
|
||||
..Default::default()
|
||||
}, ..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
let encoded = fastcgi_params(
|
||||
&service, service.php.as_ref().unwrap(), &Method::GET, &HeaderMap::new(),
|
||||
&"/index.php".parse().unwrap(), "/index.php", None, None,
|
||||
&RequestContext { client_ip: "127.0.0.1".parse().unwrap(), client_port: None,
|
||||
server_name: "webmail.example.test".into(), server_port: 8589, tls: false,
|
||||
version: Version::HTTP_11 },
|
||||
).unwrap();
|
||||
assert!(encoded.windows(b"PHP_ADMIN_VALUE".len()).any(|w| w == b"PHP_ADMIN_VALUE"));
|
||||
assert!(encoded.windows(b"open_basedir=/var/www/webmail/:/tmp/".len())
|
||||
.any(|w| w == b"open_basedir=/var/www/webmail/:/tmp/"));
|
||||
configured.php.php_values.insert("open_basedir".into(), "/".into());
|
||||
assert!(configured.validate().is_err());
|
||||
configured.php.php_values.clear();
|
||||
configured.php.php_admin_values.insert("unsafe".into(), "value\nother=1".into());
|
||||
assert!(configured.validate().is_err());
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn fastcgi_always_sets_http_host_for_http2_http3_wordpress_requests() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
let mut configured = Service {
|
||||
id: "host-fallback".into(),
|
||||
name: "Host fallback".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
php: Php { enabled: true, endpoint: "tcp:127.0.0.1:9000".into(), ..Default::default() },
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
let php = service.php.as_ref().unwrap();
|
||||
let uri: Uri = "/wp-admin/index.php".parse().unwrap();
|
||||
for version in [Version::HTTP_2, Version::HTTP_3] {
|
||||
let encoded = fastcgi_params(
|
||||
&service,
|
||||
php,
|
||||
&Method::GET,
|
||||
&HeaderMap::new(),
|
||||
&uri,
|
||||
"/wp-admin/index.php",
|
||||
None,
|
||||
None,
|
||||
&RequestContext {
|
||||
client_ip: "127.0.0.1".parse().unwrap(),
|
||||
client_port: Some(12345),
|
||||
server_name: "example.test".into(),
|
||||
server_port: 443,
|
||||
tls: true,
|
||||
version,
|
||||
},
|
||||
).unwrap();
|
||||
assert!(encoded.windows(b"HTTP_HOST".len()).any(|w| w == b"HTTP_HOST"));
|
||||
assert!(encoded.windows(b"example.test".len()).any(|w| w == b"example.test"));
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn fastcgi_http_host_keeps_explicit_host_and_port() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
let mut configured = Service {
|
||||
id: "host-port".into(),
|
||||
name: "Host port".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
php: Php { enabled: true, endpoint: "tcp:127.0.0.1:9000".into(), ..Default::default() },
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
let mut headers = HeaderMap::new();
|
||||
headers.insert(http::header::HOST, HeaderValue::from_static("example.test:8443"));
|
||||
let encoded = fastcgi_params(
|
||||
&service,
|
||||
service.php.as_ref().unwrap(),
|
||||
&Method::GET,
|
||||
&headers,
|
||||
&"/index.php".parse().unwrap(),
|
||||
"/index.php",
|
||||
None,
|
||||
None,
|
||||
&RequestContext {
|
||||
client_ip: "127.0.0.1".parse().unwrap(),
|
||||
client_port: None,
|
||||
server_name: "example.test".into(),
|
||||
server_port: 443,
|
||||
tls: true,
|
||||
version: Version::HTTP_11,
|
||||
},
|
||||
).unwrap();
|
||||
assert!(encoded.windows(b"HTTP_HOST".len()).any(|w| w == b"HTTP_HOST"));
|
||||
assert!(encoded.windows(b"example.test:8443".len()).any(|w| w == b"example.test:8443"));
|
||||
}
|
||||
@@ -1,126 +0,0 @@
|
||||
// Decode the actual FastCGI PARAMS records received by a mock PHP-FPM peer.
|
||||
// This tests the Web Service dispatch and parameter generation together.
|
||||
fn decode_fastcgi_params(mut bytes: &[u8]) -> BTreeMap<String, String> {
|
||||
fn read_len(bytes: &mut &[u8]) -> usize {
|
||||
let prefix = bytes[0];
|
||||
if prefix & 0x80 == 0 {
|
||||
*bytes = &bytes[1..];
|
||||
prefix as usize
|
||||
} else {
|
||||
let value = u32::from_be_bytes(bytes[..4].try_into().unwrap()) & 0x7fff_ffff;
|
||||
*bytes = &bytes[4..];
|
||||
value as usize
|
||||
}
|
||||
}
|
||||
let mut result = BTreeMap::new();
|
||||
while !bytes.is_empty() {
|
||||
let name_len = read_len(&mut bytes);
|
||||
let value_len = read_len(&mut bytes);
|
||||
let name = std::str::from_utf8(&bytes[..name_len]).unwrap().to_owned();
|
||||
let value = std::str::from_utf8(&bytes[name_len..name_len + value_len]).unwrap().to_owned();
|
||||
bytes = &bytes[name_len + value_len..];
|
||||
result.insert(name, value);
|
||||
}
|
||||
result
|
||||
}
|
||||
|
||||
async fn fastcgi_fixture_record_params() -> (
|
||||
std::net::SocketAddr,
|
||||
tokio::sync::oneshot::Receiver<BTreeMap<String, String>>,
|
||||
) {
|
||||
let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
|
||||
let address = listener.local_addr().unwrap();
|
||||
let (tx, rx) = tokio::sync::oneshot::channel();
|
||||
tokio::spawn(async move {
|
||||
let (mut stream, _) = listener.accept().await.unwrap();
|
||||
let deadline = Instant::now() + Duration::from_secs(5);
|
||||
let mut params = Vec::new();
|
||||
loop {
|
||||
let (kind, content) = read_fcgi_record(&mut stream, deadline).await.unwrap();
|
||||
if kind == FCGI_PARAMS {
|
||||
params.extend_from_slice(&content);
|
||||
}
|
||||
if kind == FCGI_STDIN && content.is_empty() {
|
||||
break;
|
||||
}
|
||||
}
|
||||
let _ = tx.send(decode_fastcgi_params(¶ms));
|
||||
write_fcgi_record(&mut stream, FCGI_STDOUT,
|
||||
b"Status: 200 OK\r\nContent-Type: text/css\r\n\r\nPHP-STATIC-OK").await.unwrap();
|
||||
write_fcgi_record(&mut stream, FCGI_STDOUT, &[]).await.unwrap();
|
||||
write_fcgi_record(&mut stream, FCGI_END_REQUEST, &[0u8; 8]).await.unwrap();
|
||||
stream.flush().await.unwrap();
|
||||
});
|
||||
(address, rx)
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn roundcube_static_php_path_info_runs_before_front_controller_try_files() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("static.php"), b"<?php // static asset handler").unwrap();
|
||||
std::fs::write(tmp.path().join("index.php"), b"<?php // front controller").unwrap();
|
||||
// This is the Roundcube v1.7 URL layout; /static.php/skins/... is
|
||||
// virtual PATH_INFO, not a readable directory on disk.
|
||||
let uri = "/static.php/skins/elastic/images/favicon.ico?s=1783249197";
|
||||
let (address, received) = fastcgi_fixture_record_params().await;
|
||||
let mut configured = Service {
|
||||
id: "roundcube".into(),
|
||||
name: "Roundcube".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
index: vec!["index.php".into()],
|
||||
try_files: vec!["$uri".into(), "$uri/".into(), "/index.php?$query_string".into()],
|
||||
php: Php {
|
||||
enabled: true,
|
||||
path_info: true,
|
||||
endpoint: format!("tcp:{address}"),
|
||||
..Default::default()
|
||||
},
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
let response = serve_request(&service, &request(Method::GET, uri),
|
||||
"/static.php/skins/elastic/images/favicon.ico").await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
assert_eq!(response.headers()[CONTENT_TYPE], "text/css");
|
||||
assert_eq!(response.into_body().collect().await.unwrap().to_bytes(), "PHP-STATIC-OK");
|
||||
let params = received.await.unwrap();
|
||||
assert_eq!(params["SCRIPT_FILENAME"].as_str(), tmp.path().join("static.php").to_string_lossy().as_ref());
|
||||
assert_eq!(params["SCRIPT_NAME"], "/static.php");
|
||||
assert_eq!(params["PATH_INFO"], "/skins/elastic/images/favicon.ico");
|
||||
assert_eq!(params["QUERY_STRING"], "s=1783249197");
|
||||
assert_eq!(params["REQUEST_URI"], uri);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn without_php_path_info_try_files_keeps_legacy_front_controller_fallback() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("static.php"), b"<?php // static asset handler").unwrap();
|
||||
std::fs::write(tmp.path().join("index.php"), b"<?php // front controller").unwrap();
|
||||
let (address, received) = fastcgi_fixture_record_params().await;
|
||||
let mut configured = Service {
|
||||
id: "roundcube-no-path-info".into(),
|
||||
name: "Roundcube without PATH_INFO".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
try_files: vec!["$uri".into(), "/index.php?$query_string".into()],
|
||||
php: Php {
|
||||
enabled: true,
|
||||
path_info: false,
|
||||
endpoint: format!("tcp:{address}"),
|
||||
..Default::default()
|
||||
},
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
let uri = "/static.php/plugins/zipdownload/zipdownload.min.js?s=1783249197";
|
||||
let response = serve_request(&service, &request(Method::GET, uri),
|
||||
"/static.php/plugins/zipdownload/zipdownload.min.js").await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
let _ = response.into_body().collect().await.unwrap().to_bytes();
|
||||
let params = received.await.unwrap();
|
||||
assert_eq!(params["SCRIPT_FILENAME"].as_str(), tmp.path().join("index.php").to_string_lossy().as_ref());
|
||||
assert_eq!(params["SCRIPT_NAME"], "/index.php");
|
||||
assert!(!params.contains_key("PATH_INFO"));
|
||||
}
|
||||
|
||||
Reference in new issue
Block a user