Core Rule Set: Ghost's remaining fields pass with words that name commands (closes #359)
check / check (push) Waiting to run
check / check (push) Waiting to run
Ghost 6.76.0 was sent the fields the Ghost unit had not recorded with python3, powershell, ls -la and .htaccess. Fixes in ghost.conf: - the rules of plain text, now eight with 932235, for staff profiles, setup, invitations, tiers, offers, recommendations, integrations, webhooks, feature image captions, members' comments, the CSV import's labels, ActivityPub, and the analytics' query fields; - 932235 for the existing plain-text fields too, so "powershell & python3" passes there; - filter skips six more command rules, for the post picker's title:~'powershell & python3'; - staff invitation addresses, email_segment and a tag's code injection. Model: opus-5-5
This commit is contained in:
clawbot authored and sneak committed
1 parent
0cb6dded98
commit
4228f0ac9f
5 files changed
+577
-33
No files matched your search
@@ -28,6 +28,16 @@ const (
|
||||
ghostUser = "/ghost/api/admin/users/6af4570fd281b00001a59891/"
|
||||
ghostMember = "/members/api/member/"
|
||||
ghostMagicLink = "/members/api/send-magic-link/"
|
||||
ghostInvites = "/ghost/api/admin/invites/"
|
||||
ghostInvitation = "/ghost/api/admin/authentication/invitation/"
|
||||
ghostTiers = "/ghost/api/admin/tiers/6af45710d281b00001a598a3/"
|
||||
ghostOffers = "/ghost/api/admin/offers/"
|
||||
ghostRecommended = "/ghost/api/admin/recommendations/"
|
||||
ghostTags = "/ghost/api/admin/tags/"
|
||||
ghostImport = "/ghost/api/admin/members/upload/"
|
||||
ghostComments = "/members/api/comments/"
|
||||
ghostNote = "/.ghost/activitypub/v1/actions/note"
|
||||
ghostAccount = "/.ghost/activitypub/v1/account"
|
||||
)
|
||||
|
||||
func TestGhostFixesApplyOnlyToAHostnameThatServesGhost(t *testing.T) {
|
||||
@@ -64,7 +74,7 @@ func (f ghostField) with(t *testing.T, value string) string {
|
||||
)
|
||||
}
|
||||
|
||||
// ghostTextFields hold plain text and skip the rules of 900353 and 900359.
|
||||
// ghostTextFields hold plain text and skip the eight rules of plain text.
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var ghostTextFields = []ghostField{
|
||||
@@ -116,8 +126,103 @@ var ghostTextFields = []ghostField{
|
||||
`{"snippets":[{"name":"VALUE"}]}`,
|
||||
},
|
||||
{http.MethodPut, ghostMember, ghostMemberName},
|
||||
|
||||
// A staff user's profile, the first staff user, an invitation accepted.
|
||||
{http.MethodPut, ghostUser, `{"users":[{"name":"VALUE"}]}`},
|
||||
{http.MethodPut, ghostUser, `{"users":[{"slug":"VALUE"}]}`},
|
||||
{http.MethodPut, ghostUser, `{"users":[{"bio":"VALUE"}]}`},
|
||||
{http.MethodPut, ghostUser, `{"users":[{"location":"VALUE"}]}`},
|
||||
{http.MethodPut, ghostUser, `{"users":[{"website":"VALUE"}]}`},
|
||||
{http.MethodPost, ghostSetup, `{"setup":[{"blogTitle":"VALUE"}]}`},
|
||||
{http.MethodPost, ghostSetup, `{"setup":[{"name":"VALUE"}]}`},
|
||||
{http.MethodPost, ghostInvitation, `{"invitation":[{"name":"VALUE"}]}`},
|
||||
|
||||
// Tiers, offers, recommendations, integrations and webhooks.
|
||||
{http.MethodPut, ghostTiers, `{"tiers":[{"name":"VALUE"}]}`},
|
||||
{http.MethodPut, ghostTiers, `{"tiers":[{"description":"VALUE"}]}`},
|
||||
{
|
||||
http.MethodPut,
|
||||
ghostTiers,
|
||||
`{"tiers":[{"benefits":["Tips","VALUE"]}]}`,
|
||||
},
|
||||
{http.MethodPost, ghostOffers, `{"offers":[{"name":"VALUE"}]}`},
|
||||
{http.MethodPost, ghostOffers, `{"offers":[{"code":"VALUE"}]}`},
|
||||
{http.MethodPost, ghostOffers, `{"offers":[{"display_title":"VALUE"}]}`},
|
||||
{
|
||||
http.MethodPost,
|
||||
ghostOffers,
|
||||
`{"offers":[{"display_description":"VALUE"}]}`,
|
||||
},
|
||||
{
|
||||
http.MethodPost,
|
||||
ghostRecommended,
|
||||
`{"recommendations":[{"title":"VALUE"}]}`,
|
||||
},
|
||||
{
|
||||
http.MethodPost,
|
||||
ghostRecommended,
|
||||
`{"recommendations":[{"description":"VALUE"}]}`,
|
||||
},
|
||||
{
|
||||
http.MethodPost,
|
||||
ghostRecommended,
|
||||
`{"recommendations":[{"excerpt":"VALUE"}]}`,
|
||||
},
|
||||
{
|
||||
http.MethodPost,
|
||||
"/ghost/api/admin/integrations/",
|
||||
`{"integrations":[{"name":"VALUE","description":"VALUE"}]}`,
|
||||
},
|
||||
{
|
||||
http.MethodPost,
|
||||
"/ghost/api/admin/webhooks/",
|
||||
`{"webhooks":[{"event":"post.published","name":"VALUE"}]}`,
|
||||
},
|
||||
|
||||
// A feature image's alt text and caption.
|
||||
{http.MethodPut, ghostPost, `{"posts":[{"feature_image_alt":"VALUE"}]}`},
|
||||
{
|
||||
http.MethodPut,
|
||||
ghostPost,
|
||||
`{"posts":[{"feature_image_caption":` +
|
||||
`"Photo: <a href=\"https://example.com/\">VALUE</a>"}]}`,
|
||||
},
|
||||
{http.MethodPut, ghostPage, `{"pages":[{"feature_image_alt":"VALUE"}]}`},
|
||||
|
||||
// A member's comment, written and edited.
|
||||
ghostNewComment,
|
||||
{
|
||||
http.MethodPut,
|
||||
ghostComments + "6af5426ae56ecb0001938894/",
|
||||
`{"comments":[{"id":"6af5426ae56ecb0001938894","html":"<p>VALUE</p>"}]}`,
|
||||
},
|
||||
|
||||
// ActivityPub: a note, a reply and the account.
|
||||
{http.MethodPost, ghostNote, `{"content":"VALUE"}`},
|
||||
{http.MethodPost, ghostReply, `{"content":"VALUE"}`},
|
||||
{http.MethodPut, ghostAccount, `{"name":"VALUE","username":"alice"}`},
|
||||
{http.MethodPut, ghostAccount, `{"username":"VALUE"}`},
|
||||
{http.MethodPut, ghostAccount, `{"bio":"VALUE"}`},
|
||||
}
|
||||
|
||||
// ghostNewComment is a member's comment on a post, with VALUE in a paragraph.
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a struct
|
||||
var ghostNewComment = ghostField{
|
||||
http.MethodPost,
|
||||
ghostComments,
|
||||
`{"comments":[{"post_id":"6af458a5d281b00001a59969","html":"<p>VALUE</p>"}]}`,
|
||||
}
|
||||
|
||||
// ghostComment is the HTML of an ordinary comment, with a link.
|
||||
const ghostComment = `Try <strong>python3</strong>, then ` +
|
||||
`<a href="https://example.com/ls-la" rel="ugc">ls -la</a>.`
|
||||
|
||||
// ghostReply is the path that posts a reply to a note in ActivityPub.
|
||||
const ghostReply = "/.ghost/activitypub/v1/actions/reply/" +
|
||||
"https%3A%2F%2Fexample.com%2F.ghost%2Factivitypub%2Fnote%2F" +
|
||||
"0d6e3b4c-2a1f-4b5e-9c8d-7e6f5a4b3c2d"
|
||||
|
||||
// ghostMemberName is the body that saves a member's name at /members/api/.
|
||||
const ghostMemberName = `{"name":"VALUE"}`
|
||||
|
||||
@@ -135,6 +240,8 @@ var ghostAddressFields = []ghostField{
|
||||
{http.MethodPost, ghostMembers, `{"members":[{"email":"VALUE"}]}`},
|
||||
{http.MethodPost, ghostSession, `{"username":"VALUE"}`},
|
||||
{http.MethodPost, ghostSetup, `{"setup":[{"email":"VALUE"}]}`},
|
||||
{http.MethodPost, ghostInvites, `{"invites":[{"email":"VALUE"}]}`},
|
||||
{http.MethodPost, ghostInvitation, `{"invitation":[{"email":"VALUE"}]}`},
|
||||
{
|
||||
http.MethodPost,
|
||||
ghostPasswordReset,
|
||||
@@ -168,7 +275,7 @@ var ghostArticleFields = []ghostField{
|
||||
}
|
||||
|
||||
// ghostCodeFields hold code injection or a setting and skip the rules of
|
||||
// 900356.
|
||||
// 900356 and 900378.
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var ghostCodeFields = []ghostField{
|
||||
@@ -187,6 +294,16 @@ var ghostCodeFields = []ghostField{
|
||||
`{"settings":[{"key":"title","value":"Blog"},` +
|
||||
`{"key":"codeinjection_head","value":"VALUE"}]}`,
|
||||
},
|
||||
{
|
||||
http.MethodPost,
|
||||
ghostTags,
|
||||
`{"tags":[{"codeinjection_head":"VALUE"}]}`,
|
||||
},
|
||||
{
|
||||
http.MethodPut,
|
||||
ghostTags + "6af45d4ed281b00001a599a8/",
|
||||
`{"tags":[{"codeinjection_foot":"VALUE"}]}`,
|
||||
},
|
||||
}
|
||||
|
||||
// The query fields that skip some rules, each ending in "=".
|
||||
@@ -195,6 +312,13 @@ const (
|
||||
ghostContentFilter = "/ghost/api/content/posts/?key=c695aa1f5cdfa62f7b677c3c83&filter="
|
||||
ghostSearch = ghostMembers + "?limit=100&search="
|
||||
ghostEmbed = "/ghost/api/admin/oembed/?type=bookmark&url="
|
||||
ghostStats = "/ghost/api/admin/stats/top-content/?date_from=2026-10-13"
|
||||
ghostPathname = ghostStats + "&pathname="
|
||||
ghostSource = ghostStats + "&source="
|
||||
ghostCampaign = ghostStats + "&utm_campaign="
|
||||
ghostSegment = ghostPost + "?newsletter=default-newsletter&email_segment="
|
||||
ghostAccountSearch = "/.ghost/activitypub/v1/actions/search?query="
|
||||
ghostInvitedEmail = ghostInvitation + "?email="
|
||||
)
|
||||
|
||||
// ghostQueryFields are the query fields that skip some rules.
|
||||
@@ -202,8 +326,13 @@ const (
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var ghostQueryFields = []string{
|
||||
ghostAdminFilter, ghostContentFilter, ghostSearch, ghostEmbed,
|
||||
ghostPathname, ghostSource, ghostCampaign, ghostSegment,
|
||||
ghostAccountSearch, ghostInvitedEmail,
|
||||
}
|
||||
|
||||
// ghostCommandNames joins two command names, as an ordinary title can.
|
||||
const ghostCommandNames = "powershell & python3"
|
||||
|
||||
// ghostURLs are addresses 930120 and 932120 refused in url.
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
@@ -327,6 +456,8 @@ func TestGhostOrdinaryValuesPassInTheExcludedFields(t *testing.T) {
|
||||
wantGhostField(t, f, ghostCodeInjection, false)
|
||||
}
|
||||
|
||||
wantGhostField(t, ghostNewComment, ghostComment, false)
|
||||
|
||||
wantGhostQuery(t, "/ghost/api/admin/posts/?filter="+
|
||||
url.QueryEscape(
|
||||
"tag:powershell+status:[draft,scheduled,published,sent]",
|
||||
@@ -358,13 +489,17 @@ func TestGhostAttacksAreRefusedInTheExcludedFields(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// A command after a separator stays refused wherever its rules do not
|
||||
// misfire: in the query fields, the plain text and the addresses.
|
||||
for _, f := range slices.Concat(ghostTextFields, ghostAddressFields) {
|
||||
// A command after a separator stays refused wherever 932235 does not
|
||||
// misfire: in the addresses, search, url, email_segment and email. The
|
||||
// plain text, filter and the analytics' fields skip 932235, which
|
||||
// refuses "powershell & python3" as it refuses this.
|
||||
for _, f := range ghostAddressFields {
|
||||
wantGhostField(t, f, commandAfterASeparator, true)
|
||||
}
|
||||
|
||||
for _, target := range ghostQueryFields {
|
||||
for _, target := range []string{
|
||||
ghostSearch, ghostEmbed, ghostSegment, ghostInvitedEmail,
|
||||
} {
|
||||
wantGhostQuery(
|
||||
t,
|
||||
target+url.QueryEscape(commandAfterASeparator),
|
||||
@@ -372,6 +507,15 @@ func TestGhostAttacksAreRefusedInTheExcludedFields(t *testing.T) {
|
||||
)
|
||||
}
|
||||
|
||||
// A comment keeps the rules for scripts and HTML.
|
||||
wantGhostField(t, ghostNewComment, `<img src=x onerror=alert(1)>`, true)
|
||||
wantGhostField(
|
||||
t,
|
||||
ghostNewComment,
|
||||
`<a href="javascript:alert(1)">x</a>`,
|
||||
true,
|
||||
)
|
||||
|
||||
// The articles and code injection carry HTML on purpose, but a script
|
||||
// element and a javascript: link are still refused there.
|
||||
for _, f := range slices.Concat(ghostArticleFields, ghostCodeFields) {
|
||||
@@ -385,6 +529,108 @@ func TestGhostAttacksAreRefusedInTheExcludedFields(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
func TestGhostTwoCommandNamesPass(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
for _, f := range ghostTextFields {
|
||||
wantGhostField(t, f, ghostCommandNames, false)
|
||||
}
|
||||
|
||||
// filter as the admin's post picker writes it, after a person types a
|
||||
// title that joins two command names.
|
||||
for _, typed := range []string{
|
||||
ghostCommandNames, "python3 & powershell", "powershell & ls -la",
|
||||
"ls -la & python3",
|
||||
} {
|
||||
filter := "status:published+title:~'" + typed + "'"
|
||||
wantGhostQuery(t, ghostAdminFilter+url.QueryEscape(filter), false)
|
||||
}
|
||||
}
|
||||
|
||||
// TestGhostOrdinaryQueriesPass checks the query fields of the analytics
|
||||
// pages, email_segment, the search of ActivityPub and the check of an
|
||||
// invitation.
|
||||
func TestGhostOrdinaryQueriesPass(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
for _, encoded := range hardValues {
|
||||
value, _ := url.QueryUnescape(encoded)
|
||||
text := url.QueryEscape("Notes on " + value + " & tidy files")
|
||||
|
||||
wantGhostQuery(
|
||||
t,
|
||||
ghostPathname+url.QueryEscape("/"+value+"/"),
|
||||
false,
|
||||
)
|
||||
wantGhostQuery(t, ghostSource+encoded, false)
|
||||
wantGhostQuery(t, ghostCampaign+text, false)
|
||||
wantGhostQuery(t, ghostAccountSearch+text, false)
|
||||
}
|
||||
|
||||
wantGhostQuery(
|
||||
t,
|
||||
ghostCampaign+url.QueryEscape(ghostCommandNames),
|
||||
false,
|
||||
)
|
||||
wantGhostQuery(
|
||||
t,
|
||||
ghostAccountSearch+"%40powershell%40example.com",
|
||||
false,
|
||||
)
|
||||
|
||||
for _, segment := range []string{
|
||||
"label:powershell-users", "label:python3", "label:ls-la",
|
||||
"label:htaccess", "status:free,tier:powershell-club",
|
||||
} {
|
||||
wantGhostQuery(t, ghostSegment+url.QueryEscape(segment), false)
|
||||
}
|
||||
|
||||
for _, address := range ghostAddresses {
|
||||
wantGhostQuery(t, ghostInvitedEmail+url.QueryEscape(address), false)
|
||||
}
|
||||
}
|
||||
|
||||
// wantGhostImportLabel checks that the Core Rule Set, reading bodies,
|
||||
// refuses label, sent as labels in a CSV import to target, or lets it
|
||||
// through.
|
||||
func wantGhostImportLabel(
|
||||
t *testing.T, target, label string, refused bool,
|
||||
) {
|
||||
t.Helper()
|
||||
|
||||
r := request{http.MethodPost, target, []string{multipart}}
|
||||
body := field("labels", label) + field("mapping[email]", "email") + end
|
||||
|
||||
got, _ := inspectBody(t, readingBodies(t), r, body)
|
||||
if refused && got.Score < ghostThreshold {
|
||||
t.Errorf("labels=%q at %s let through: %+v", label, target, got)
|
||||
}
|
||||
|
||||
if !refused && got.Score >= ghostThreshold {
|
||||
t.Errorf("labels=%q at %s refused: %+v", label, target, got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestGhostImportLabelsPass(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
for _, encoded := range hardValues {
|
||||
value, _ := url.QueryUnescape(encoded)
|
||||
wantGhostImportLabel(t, ghostImport, value+" import", false)
|
||||
}
|
||||
|
||||
wantGhostImportLabel(t, ghostImport, ghostCommandNames, false)
|
||||
|
||||
for _, attack := range ghostAttacks {
|
||||
wantGhostImportLabel(t, ghostImport, attack, true)
|
||||
}
|
||||
|
||||
// labels keeps its rules on other paths, and when the query has a field
|
||||
// of the same name.
|
||||
wantGhostImportLabel(t, ghostMembers, "python3 import", true)
|
||||
wantGhostImportLabel(t, ghostImport+"?labels=x", "python3 import", true)
|
||||
}
|
||||
|
||||
func TestGhostExclusionsAreNarrow(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
@@ -420,7 +666,6 @@ func TestGhostExclusionsAreNarrow(t *testing.T) {
|
||||
`{"settings":[{"value":"<meta name=x content=y>"}]}`,
|
||||
},
|
||||
{"/ghost/api/admin/members/", `{"members":[{"geolocation":"python3"}]}`},
|
||||
{"/ghost/api/admin/invites/", `{"invites":[{"email":"python3.dev@example.com"}]}`},
|
||||
{ghostPosts, email},
|
||||
{ghostMembers, email},
|
||||
{ghostMember, `{"members":[{"email":"python3.dev@example.com"}]}`},
|
||||
@@ -464,7 +709,8 @@ func TestGhostQueryExclusionsAreNarrow(t *testing.T) {
|
||||
|
||||
// The query fields keep their rules off Ghost's paths, and in other
|
||||
// query fields there. search skips its rules only on the Admin API, and
|
||||
// url only on the editor's lookup of embeds.
|
||||
// url only on the editor's lookup of embeds. pathname, email_segment,
|
||||
// query and email skip theirs only on their own paths.
|
||||
for _, target := range []string{
|
||||
"/api/posts/?filter=powershell",
|
||||
"/ghost/posts/?filter=powershell",
|
||||
@@ -473,11 +719,61 @@ func TestGhostQueryExclusionsAreNarrow(t *testing.T) {
|
||||
"/members/api/member/?search=python3",
|
||||
"/ghost/api/admin/posts/?url=powershell",
|
||||
"/oembed/?url=powershell",
|
||||
"/ghost/api/admin/posts/?pathname=%2Fpowershell%2F",
|
||||
"/ghost/api/admin/stats/top-content/?order=powershell",
|
||||
"/ghost/api/admin/pages/?email_segment=label%3Apowershell-users",
|
||||
"/ghost/api/admin/posts/?query=python3",
|
||||
"/.ghost/activitypub/v1/actions/note?query=python3",
|
||||
"/ghost/api/admin/invites/?email=python3.dev%40example.com",
|
||||
} {
|
||||
wantGhostQuery(t, target, true)
|
||||
}
|
||||
}
|
||||
|
||||
// TestGhostStaffCommentAndActivityPubExclusionsAreNarrow checks the body
|
||||
// fields that 900370 to 900378 name, as TestGhostExclusionsAreNarrow checks
|
||||
// the others: each keeps its rules on another path, and when the query has
|
||||
// a field of the same name.
|
||||
func TestGhostStaffCommentAndActivityPubExclusionsAreNarrow(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
const (
|
||||
bio = `{"users":[{"bio":"python3"}]}`
|
||||
comment = `{"comments":[{"html":"<p>Notes on .htaccess</p>"}]}`
|
||||
content = `{"content":"python3"}`
|
||||
accountBio = `{"bio":"python3"}`
|
||||
invited = `{"invites":[{"email":"python3.dev@example.com"}]}`
|
||||
accepted = `{"invitation":[{"email":"python3.dev@example.com"}]}`
|
||||
tagCode = `{"tags":[{"codeinjection_head":"<meta name=x content=y>"}]}`
|
||||
)
|
||||
|
||||
for _, refused := range []struct{ target, body string }{
|
||||
{"/api/users/1/", bio},
|
||||
{ghostMember, bio},
|
||||
{ghostUser + "?json.users.0.bio=x", bio},
|
||||
{ghostPosts, comment},
|
||||
{ghostComments + "?json.comments.0.html=x", comment},
|
||||
{ghostAccount, content},
|
||||
{ghostNote + "?json.content=x", content},
|
||||
{ghostNote, accountBio},
|
||||
{ghostAccount + "?json.bio=x", accountBio},
|
||||
{ghostPosts, invited},
|
||||
{ghostInvites + "?json.invites.0.email=x", invited},
|
||||
{ghostInvites, accepted},
|
||||
{ghostInvitation + "?json.invitation.0.email=x", accepted},
|
||||
{ghostPosts, tagCode},
|
||||
{ghostTags + "?json.tags.0.codeinjection_head=x", tagCode},
|
||||
} {
|
||||
r := request{http.MethodPut, refused.target, []string{jsonBody}}
|
||||
|
||||
got, _ := inspectBody(t, readingBodies(t), r, refused.body)
|
||||
if got.Score < ghostThreshold {
|
||||
t.Errorf("PUT %s %s let through: %+v", refused.target,
|
||||
refused.body, got)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestGhostPasswordsPass(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
|
||||
Reference in new issue
Block a user