288 lines
11 KiB
Rust
288 lines
11 KiB
Rust
#[test]
|
|
fn fastcgi_never_forwards_proxy_header_as_http_proxy() {
|
|
let tmp = TempDir::new().unwrap();
|
|
let mut configured = Service {
|
|
id: "fastcgi-params".into(),
|
|
name: "FastCGI params".into(),
|
|
document_root: tmp.path().to_path_buf(),
|
|
php: Php { enabled: true, endpoint: "tcp:127.0.0.1:9000".into(), ..Default::default() },
|
|
..Default::default()
|
|
};
|
|
configured.validate().unwrap();
|
|
let service = configured.compile().unwrap();
|
|
let php = service.php.as_ref().unwrap();
|
|
let mut headers = HeaderMap::new();
|
|
headers.insert("proxy", HeaderValue::from_static("http://attacker.invalid:8080"));
|
|
headers.insert("user-agent", HeaderValue::from_static("security-test"));
|
|
let uri: Uri = "/index.php?q=1".parse().unwrap();
|
|
let encoded = fastcgi_params(
|
|
&service,
|
|
php,
|
|
&Method::GET,
|
|
&headers,
|
|
&uri,
|
|
"/index.php",
|
|
None,
|
|
Some("q=1"),
|
|
&RequestContext {
|
|
client_ip: "127.0.0.1".parse().unwrap(),
|
|
client_port: Some(12345),
|
|
server_name: "example.test".into(),
|
|
server_port: 80,
|
|
tls: false,
|
|
version: Version::HTTP_11,
|
|
},
|
|
)
|
|
.unwrap();
|
|
assert!(!encoded.windows(b"HTTP_PROXY".len()).any(|window| window == b"HTTP_PROXY"));
|
|
assert!(encoded.windows(b"HTTP_USER_AGENT".len()).any(|window| window == b"HTTP_USER_AGENT"));
|
|
}
|
|
|
|
#[test]
|
|
fn php_custom_fastcgi_params_and_php_values_are_validated() {
|
|
let tmp = TempDir::new().unwrap();
|
|
let mut configured = Service {
|
|
id: "php-custom".into(),
|
|
name: "PHP custom".into(),
|
|
document_root: tmp.path().to_path_buf(),
|
|
php: Php {
|
|
enabled: true,
|
|
endpoint: "tcp:127.0.0.1:9000".into(),
|
|
pass_authorization: false,
|
|
custom_params: BTreeMap::from([("app_env".into(), "production".into())]),
|
|
php_values: BTreeMap::from([("memory_limit".into(), "256M".into())]),
|
|
..Default::default()
|
|
},
|
|
..Default::default()
|
|
};
|
|
configured.validate().unwrap();
|
|
assert!(configured.php.custom_params.contains_key("APP_ENV"));
|
|
let service = configured.compile().unwrap();
|
|
let php = service.php.as_ref().unwrap();
|
|
let mut headers = HeaderMap::new();
|
|
headers.insert("authorization", HeaderValue::from_static("Bearer secret"));
|
|
let uri: Uri = "/index.php".parse().unwrap();
|
|
let encoded = fastcgi_params(
|
|
&service,
|
|
php,
|
|
&Method::GET,
|
|
&headers,
|
|
&uri,
|
|
"/index.php",
|
|
None,
|
|
None,
|
|
&RequestContext {
|
|
client_ip: "127.0.0.1".parse().unwrap(),
|
|
client_port: None,
|
|
server_name: "example.test".into(),
|
|
server_port: 443,
|
|
tls: true,
|
|
version: Version::HTTP_2,
|
|
},
|
|
)
|
|
.unwrap();
|
|
assert!(encoded.windows(b"APP_ENV".len()).any(|window| window == b"APP_ENV"));
|
|
assert!(encoded.windows(b"production".len()).any(|window| window == b"production"));
|
|
assert!(encoded.windows(b"PHP_VALUE".len()).any(|window| window == b"PHP_VALUE"));
|
|
assert!(encoded.windows(b"memory_limit=256M".len()).any(|window| window == b"memory_limit=256M"));
|
|
assert!(!encoded.windows(b"HTTP_AUTHORIZATION".len()).any(|window| window == b"HTTP_AUTHORIZATION"));
|
|
}
|
|
|
|
#[test]
|
|
fn fastcgi_path_info_keeps_script_filename_separate() {
|
|
let tmp = TempDir::new().unwrap();
|
|
let mut configured = Service {
|
|
id: "php-path-info".into(),
|
|
name: "PHP PATH_INFO".into(),
|
|
document_root: tmp.path().to_path_buf(),
|
|
php: Php {
|
|
enabled: true,
|
|
path_info: true,
|
|
endpoint: "tcp:127.0.0.1:9000".into(),
|
|
..Default::default()
|
|
},
|
|
..Default::default()
|
|
};
|
|
configured.validate().unwrap();
|
|
let service = configured.compile().unwrap();
|
|
assert!(service.php.as_ref().unwrap().path_info);
|
|
let uri: Uri = "/index.php/foo/bar?q=1".parse().unwrap();
|
|
let encoded = fastcgi_params(
|
|
&service,
|
|
service.php.as_ref().unwrap(),
|
|
&Method::GET,
|
|
&HeaderMap::new(),
|
|
&uri,
|
|
"/index.php",
|
|
Some("/foo/bar"),
|
|
Some("q=1"),
|
|
&RequestContext {
|
|
client_ip: "127.0.0.1".parse().unwrap(),
|
|
client_port: Some(12345),
|
|
server_name: "example.test".into(),
|
|
server_port: 80,
|
|
tls: false,
|
|
version: Version::HTTP_11,
|
|
},
|
|
)
|
|
.unwrap();
|
|
assert!(encoded.windows(b"PATH_INFO".len()).any(|window| window == b"PATH_INFO"));
|
|
assert!(encoded.windows(b"/foo/bar".len()).any(|window| window == b"/foo/bar"));
|
|
assert!(encoded.windows(b"SCRIPT_FILENAME".len()).any(|window| window == b"SCRIPT_FILENAME"));
|
|
}
|
|
|
|
#[test]
|
|
fn php_custom_fastcgi_params_cannot_override_core_or_php_admin_values() {
|
|
let tmp = TempDir::new().unwrap();
|
|
for name in ["SCRIPT_FILENAME", "HTTP_HOST", "PHP_VALUE", "PHP_ADMIN_VALUE"] {
|
|
let mut configured = Service {
|
|
id: "php-reserved".into(),
|
|
name: "PHP reserved".into(),
|
|
document_root: tmp.path().to_path_buf(),
|
|
php: Php {
|
|
custom_params: BTreeMap::from([(name.into(), "bad".into())]),
|
|
..Default::default()
|
|
},
|
|
..Default::default()
|
|
};
|
|
assert!(configured.validate().unwrap_err().to_string().contains("reserved name"));
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn php_custom_fastcgi_data_has_a_combined_bound() {
|
|
let tmp = TempDir::new().unwrap();
|
|
let custom_params = (0..17)
|
|
.map(|index| (format!("APP_{index}"), "x".repeat(8192)))
|
|
.collect();
|
|
let mut configured = Service {
|
|
id: "php-custom-bound".into(),
|
|
name: "PHP custom bound".into(),
|
|
document_root: tmp.path().to_path_buf(),
|
|
php: Php { custom_params, ..Default::default() },
|
|
..Default::default()
|
|
};
|
|
assert!(configured
|
|
.validate()
|
|
.unwrap_err()
|
|
.to_string()
|
|
.contains("at most 128 KiB"));
|
|
}
|
|
|
|
#[test]
|
|
fn fastcgi_response_cannot_control_downstream_framing_or_hop_headers() {
|
|
let (_, headers) = parse_cgi_headers(
|
|
b"Content-Type: text/plain\r\nContent-Length: 999999\r\nTransfer-Encoding: chunked\r\nConnection: keep-alive\r\nTE: trailers\r\nTrailer: X-Test\r\nProxy-Authenticate: Basic realm=x\r\nProxy-Authorization: secret\r\nX-App: ok\r\n",
|
|
)
|
|
.unwrap();
|
|
assert_eq!(headers.get("x-app").unwrap(), "ok");
|
|
for name in [
|
|
"content-length",
|
|
"transfer-encoding",
|
|
"connection",
|
|
"te",
|
|
"trailer",
|
|
"proxy-authenticate",
|
|
"proxy-authorization",
|
|
] {
|
|
assert!(!headers.contains_key(name), "unexpected FastCGI framing header: {name}");
|
|
}
|
|
}
|
|
|
|
#[test]
|
|
fn fastcgi_response_rejects_informational_status_codes() {
|
|
let error = parse_cgi_headers(b"Status: 101 Switching Protocols\r\nContent-Type: text/plain\r\n")
|
|
.unwrap_err()
|
|
.to_string();
|
|
assert!(error.contains("unsupported informational/invalid status"));
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn hardening_blocks_common_probe_paths_and_trace() {
|
|
let tmp = TempDir::new().unwrap();
|
|
std::fs::write(tmp.path().join("index.html"), b"ok").unwrap();
|
|
std::fs::write(tmp.path().join(".env"), b"secret").unwrap();
|
|
std::fs::write(tmp.path().join("backup.sql"), b"secret").unwrap();
|
|
std::fs::write(tmp.path().join("public.txt"), b"public").unwrap();
|
|
let mut configured = Service {
|
|
id: "hardened".into(),
|
|
name: "hardened".into(),
|
|
document_root: tmp.path().to_path_buf(),
|
|
index: vec![],
|
|
directory_listing: true,
|
|
hardening: Hardening { block_common_attacks: true, strip_unnecessary_headers: false },
|
|
..Default::default()
|
|
};
|
|
configured.validate().unwrap();
|
|
let service = configured.compile().unwrap();
|
|
for path in ["/.env", "/wp-config.php", "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", "/backup.sql"] {
|
|
let response = serve_request(&service, &request(Method::GET, path), path).await;
|
|
assert_eq!(response.status(), StatusCode::FORBIDDEN, "{path}");
|
|
}
|
|
let trace = serve_request(&service, &request(Method::TRACE, "/"), "/").await;
|
|
assert_eq!(trace.status(), StatusCode::FORBIDDEN);
|
|
let listing = serve_request(&service, &request(Method::GET, "/"), "/").await;
|
|
let listing = String::from_utf8_lossy(&listing.into_body().collect().await.unwrap().to_bytes()).to_string();
|
|
assert!(listing.contains("public.txt"));
|
|
assert!(!listing.contains(".env"));
|
|
assert!(!listing.contains("backup.sql"));
|
|
let well_known = serve_request(&service, &request(Method::GET, "/.well-known/missing"), "/.well-known/missing").await;
|
|
assert_eq!(well_known.status(), StatusCode::NOT_FOUND);
|
|
}
|
|
|
|
#[tokio::test]
|
|
async fn hardening_strips_fingerprint_headers_after_source_rules() {
|
|
let tmp = TempDir::new().unwrap();
|
|
std::fs::write(tmp.path().join("index.html"), b"ok").unwrap();
|
|
let mut configured = Service {
|
|
id: "headers".into(),
|
|
name: "headers".into(),
|
|
document_root: tmp.path().to_path_buf(),
|
|
response_headers: BTreeMap::from([
|
|
("server".into(), "Example/1.0".into()),
|
|
("x-powered-by".into(), "PHP/8.4".into()),
|
|
("x-custom".into(), "kept".into()),
|
|
]),
|
|
hardening: Hardening { block_common_attacks: false, strip_unnecessary_headers: true },
|
|
..Default::default()
|
|
};
|
|
configured.validate().unwrap();
|
|
let service = configured.compile().unwrap();
|
|
let response = serve_request(&service, &request(Method::GET, "/index.html"), "/index.html").await;
|
|
assert_eq!(response.status(), StatusCode::OK);
|
|
assert!(!response.headers().contains_key("server"));
|
|
assert!(!response.headers().contains_key("x-powered-by"));
|
|
assert_eq!(response.headers()["x-custom"], "kept");
|
|
}
|
|
|
|
#[test]
|
|
fn php_admin_values_are_operator_only_and_serialized() {
|
|
let tmp = TempDir::new().unwrap();
|
|
let mut configured = Service {
|
|
id: "php-admin".into(), name: "PHP admin".into(),
|
|
document_root: tmp.path().to_path_buf(),
|
|
php: Php {
|
|
enabled: true, endpoint: "tcp:127.0.0.1:9000".into(),
|
|
php_admin_values: BTreeMap::from([("open_basedir".into(), "/var/www/webmail/:/tmp/".into())]),
|
|
..Default::default()
|
|
}, ..Default::default()
|
|
};
|
|
configured.validate().unwrap();
|
|
let service = configured.compile().unwrap();
|
|
let encoded = fastcgi_params(
|
|
&service, service.php.as_ref().unwrap(), &Method::GET, &HeaderMap::new(),
|
|
&"/index.php".parse().unwrap(), "/index.php", None, None,
|
|
&RequestContext { client_ip: "127.0.0.1".parse().unwrap(), client_port: None,
|
|
server_name: "webmail.example.test".into(), server_port: 8589, tls: false,
|
|
version: Version::HTTP_11 },
|
|
).unwrap();
|
|
assert!(encoded.windows(b"PHP_ADMIN_VALUE".len()).any(|w| w == b"PHP_ADMIN_VALUE"));
|
|
assert!(encoded.windows(b"open_basedir=/var/www/webmail/:/tmp/".len())
|
|
.any(|w| w == b"open_basedir=/var/www/webmail/:/tmp/"));
|
|
configured.php.php_values.insert("open_basedir".into(), "/".into());
|
|
assert!(configured.validate().is_err());
|
|
configured.php.php_values.clear();
|
|
configured.php.php_admin_values.insert("unsafe".into(), "value\nother=1".into());
|
|
assert!(configured.validate().is_err());
|
|
}
|