v0.25.1
This commit is contained in:
Mateusz Gruszczyński committed
1 parent
87e571c170
commit
fa7abc9e53
308 files changed
+49746
-50237
No files matched your search
@@ -0,0 +1,211 @@
|
||||
#[test]
|
||||
fn fastcgi_never_forwards_proxy_header_as_http_proxy() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
let mut configured = Service {
|
||||
id: "fastcgi-params".into(),
|
||||
name: "FastCGI params".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
php: Php { enabled: true, endpoint: "tcp:127.0.0.1:9000".into(), ..Default::default() },
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
let php = service.php.as_ref().unwrap();
|
||||
let mut headers = HeaderMap::new();
|
||||
headers.insert("proxy", HeaderValue::from_static("http://attacker.invalid:8080"));
|
||||
headers.insert("user-agent", HeaderValue::from_static("security-test"));
|
||||
let uri: Uri = "/index.php?q=1".parse().unwrap();
|
||||
let encoded = fastcgi_params(
|
||||
&service,
|
||||
php,
|
||||
&Method::GET,
|
||||
&headers,
|
||||
&uri,
|
||||
"/index.php",
|
||||
Some("q=1"),
|
||||
&RequestContext {
|
||||
client_ip: "127.0.0.1".parse().unwrap(),
|
||||
client_port: Some(12345),
|
||||
server_name: "example.test".into(),
|
||||
server_port: 80,
|
||||
tls: false,
|
||||
version: Version::HTTP_11,
|
||||
},
|
||||
)
|
||||
.unwrap();
|
||||
assert!(!encoded.windows(b"HTTP_PROXY".len()).any(|window| window == b"HTTP_PROXY"));
|
||||
assert!(encoded.windows(b"HTTP_USER_AGENT".len()).any(|window| window == b"HTTP_USER_AGENT"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn php_custom_fastcgi_params_and_php_values_are_validated() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
let mut configured = Service {
|
||||
id: "php-custom".into(),
|
||||
name: "PHP custom".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
php: Php {
|
||||
enabled: true,
|
||||
endpoint: "tcp:127.0.0.1:9000".into(),
|
||||
pass_authorization: false,
|
||||
custom_params: BTreeMap::from([("app_env".into(), "production".into())]),
|
||||
php_values: BTreeMap::from([("memory_limit".into(), "256M".into())]),
|
||||
..Default::default()
|
||||
},
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
assert!(configured.php.custom_params.contains_key("APP_ENV"));
|
||||
let service = configured.compile().unwrap();
|
||||
let php = service.php.as_ref().unwrap();
|
||||
let mut headers = HeaderMap::new();
|
||||
headers.insert("authorization", HeaderValue::from_static("Bearer secret"));
|
||||
let uri: Uri = "/index.php".parse().unwrap();
|
||||
let encoded = fastcgi_params(
|
||||
&service,
|
||||
php,
|
||||
&Method::GET,
|
||||
&headers,
|
||||
&uri,
|
||||
"/index.php",
|
||||
None,
|
||||
&RequestContext {
|
||||
client_ip: "127.0.0.1".parse().unwrap(),
|
||||
client_port: None,
|
||||
server_name: "example.test".into(),
|
||||
server_port: 443,
|
||||
tls: true,
|
||||
version: Version::HTTP_2,
|
||||
},
|
||||
)
|
||||
.unwrap();
|
||||
assert!(encoded.windows(b"APP_ENV".len()).any(|window| window == b"APP_ENV"));
|
||||
assert!(encoded.windows(b"production".len()).any(|window| window == b"production"));
|
||||
assert!(encoded.windows(b"PHP_VALUE".len()).any(|window| window == b"PHP_VALUE"));
|
||||
assert!(encoded.windows(b"memory_limit=256M".len()).any(|window| window == b"memory_limit=256M"));
|
||||
assert!(!encoded.windows(b"HTTP_AUTHORIZATION".len()).any(|window| window == b"HTTP_AUTHORIZATION"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn php_custom_fastcgi_params_cannot_override_core_or_php_admin_values() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
for name in ["SCRIPT_FILENAME", "HTTP_HOST", "PHP_VALUE", "PHP_ADMIN_VALUE"] {
|
||||
let mut configured = Service {
|
||||
id: "php-reserved".into(),
|
||||
name: "PHP reserved".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
php: Php {
|
||||
custom_params: BTreeMap::from([(name.into(), "bad".into())]),
|
||||
..Default::default()
|
||||
},
|
||||
..Default::default()
|
||||
};
|
||||
assert!(configured.validate().unwrap_err().to_string().contains("reserved name"));
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn php_custom_fastcgi_data_has_a_combined_bound() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
let custom_params = (0..17)
|
||||
.map(|index| (format!("APP_{index}"), "x".repeat(8192)))
|
||||
.collect();
|
||||
let mut configured = Service {
|
||||
id: "php-custom-bound".into(),
|
||||
name: "PHP custom bound".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
php: Php { custom_params, ..Default::default() },
|
||||
..Default::default()
|
||||
};
|
||||
assert!(configured
|
||||
.validate()
|
||||
.unwrap_err()
|
||||
.to_string()
|
||||
.contains("at most 128 KiB"));
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn fastcgi_response_cannot_control_downstream_framing_or_hop_headers() {
|
||||
let (_, headers) = parse_cgi_headers(
|
||||
b"Content-Type: text/plain\r\nContent-Length: 999999\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nTE: trailers\r\nTrailer: X-Test\r\nProxy-Authenticate: Basic realm=x\r\nProxy-Authorization: secret\r\nX-App: ok\r\n",
|
||||
)
|
||||
.unwrap();
|
||||
assert_eq!(headers.get("x-app").unwrap(), "ok");
|
||||
for name in [
|
||||
"content-length",
|
||||
"transfer-encoding",
|
||||
"connection",
|
||||
"te",
|
||||
"trailer",
|
||||
"proxy-authenticate",
|
||||
"proxy-authorization",
|
||||
] {
|
||||
assert!(!headers.contains_key(name), "unexpected FastCGI framing header: {name}");
|
||||
}
|
||||
}
|
||||
|
||||
#[test]
|
||||
fn fastcgi_response_rejects_informational_status_codes() {
|
||||
let error = parse_cgi_headers(b"Status: 101 Switching Protocols\r\nContent-Type: text/plain\r\n")
|
||||
.unwrap_err()
|
||||
.to_string();
|
||||
assert!(error.contains("unsupported informational/invalid status"));
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn hardening_blocks_common_probe_paths_and_trace() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("index.html"), b"ok").unwrap();
|
||||
std::fs::write(tmp.path().join(".env"), b"secret").unwrap();
|
||||
std::fs::write(tmp.path().join("backup.sql"), b"secret").unwrap();
|
||||
std::fs::write(tmp.path().join("public.txt"), b"public").unwrap();
|
||||
let mut configured = Service {
|
||||
id: "hardened".into(),
|
||||
name: "hardened".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
index: vec![],
|
||||
directory_listing: true,
|
||||
hardening: Hardening { block_common_attacks: true, strip_unnecessary_headers: false },
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
for path in ["/.env", "/wp-config.php", "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/backup.sql"] {
|
||||
let response = serve_request(&service, &request(Method::GET, path), path).await;
|
||||
assert_eq!(response.status(), StatusCode::FORBIDDEN, "{path}");
|
||||
}
|
||||
let trace = serve_request(&service, &request(Method::TRACE, "/"), "/").await;
|
||||
assert_eq!(trace.status(), StatusCode::FORBIDDEN);
|
||||
let listing = serve_request(&service, &request(Method::GET, "/"), "/").await;
|
||||
let listing = String::from_utf8_lossy(&listing.into_body().collect().await.unwrap().to_bytes()).to_string();
|
||||
assert!(listing.contains("public.txt"));
|
||||
assert!(!listing.contains(".env"));
|
||||
assert!(!listing.contains("backup.sql"));
|
||||
let well_known = serve_request(&service, &request(Method::GET, "/.well-known/missing"), "/.well-known/missing").await;
|
||||
assert_eq!(well_known.status(), StatusCode::NOT_FOUND);
|
||||
}
|
||||
|
||||
#[tokio::test]
|
||||
async fn hardening_strips_fingerprint_headers_after_source_rules() {
|
||||
let tmp = TempDir::new().unwrap();
|
||||
std::fs::write(tmp.path().join("index.html"), b"ok").unwrap();
|
||||
let mut configured = Service {
|
||||
id: "headers".into(),
|
||||
name: "headers".into(),
|
||||
document_root: tmp.path().to_path_buf(),
|
||||
response_headers: BTreeMap::from([
|
||||
("server".into(), "Example/1.0".into()),
|
||||
("x-powered-by".into(), "PHP/8.4".into()),
|
||||
("x-custom".into(), "kept".into()),
|
||||
]),
|
||||
hardening: Hardening { block_common_attacks: false, strip_unnecessary_headers: true },
|
||||
..Default::default()
|
||||
};
|
||||
configured.validate().unwrap();
|
||||
let service = configured.compile().unwrap();
|
||||
let response = serve_request(&service, &request(Method::GET, "/index.html"), "/index.html").await;
|
||||
assert_eq!(response.status(), StatusCode::OK);
|
||||
assert!(!response.headers().contains_key("server"));
|
||||
assert!(!response.headers().contains_key("x-powered-by"));
|
||||
assert_eq!(response.headers()["x-custom"], "kept");
|
||||
}
|
||||
Reference in new issue
Block a user