Core Rule Set reads request bodies up to SWWAF_WAF_BODY_LIMIT (closes #116)

SWWAF_WAF_BODY_LIMIT (default off) has the Core Rule Set read form data
and multipart up to the limit, the rest streaming on, and JSON and XML
no larger than it; other bodies pass uninspected. The part read is held
and sent to the app first. A size or time limit met while it is read
ends the request before it reaches the app. Content-Encoding is refused
again on those four kinds. Rule 900300 moves to phase 2, to count form
and JSON fields past Coraza's 1000 too.

Judgement call: Content-Encoding is refused on a JSON or XML body too
large to be read, which SPEC.md allows.

Model: opus-5-5

internal/waf/waf_test.go

@@ -4,7 +4,9 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"net/netip"
+	"net/url"
 	"reflect"
+	"strconv"
 	"strings"
 	"testing"
 
@@ -48,12 +50,28 @@ func get(target string, headers ...string) request {
 func inspect(t *testing.T, crs *waf.CoreRuleSet, r request) waf.Result {
 	t.Helper()
 
+	result, _ := inspectBody(t, crs, r, "")
+
+	return result
+}
+
+// inspectBody is inspect for r with body, which is announced with its
+// Content-Length unless it is "", and returns what crs read of body too.
+func inspectBody(
+	t *testing.T, crs *waf.CoreRuleSet, r request, body string,
+) (waf.Result, string) {
+	t.Helper()
+
 	req := httptest.NewRequestWithContext(t.Context(), r.method,
-		"http://git.example"+r.target, http.NoBody)
+		"http://git.example"+r.target, strings.NewReader(body))
 	req.Header.Set("User-Agent", "Mozilla/5.0 (X11; Linux x86_64; rv:131.0) "+
 		"Gecko/20100101 Firefox/131.0")
 	req.Header.Set("Accept", "text/html")
 
+	if body != "" {
+		req.Header.Set("Content-Length", strconv.Itoa(len(body)))
+	}
+
 	for _, header := range r.headers {
 		// Go's server keeps Host and Transfer-Encoding out of the headers.
 		name, value, _ := strings.Cut(header, ": ")
@@ -67,7 +85,12 @@ func inspect(t *testing.T, crs *waf.CoreRuleSet, r request) waf.Result {
 		}
 	}
 
-	return crs.Inspect(req, netip.MustParseAddr("203.0.113.9"))
+	result, read, err := crs.Inspect(req, netip.MustParseAddr("203.0.113.9"), req.Body)
+	if err != nil {
+		t.Fatalf("read the body: %v", err)
+	}
+
+	return result, string(read)
 }
 
 // wantResult checks what crs finds in r.
@@ -174,7 +197,7 @@ func TestTransferEncodingIsRead(t *testing.T) {
 		waf.Result{})
 }
 
-func TestMoreQueryParametersThanCorazaKeepsIsAMatch(t *testing.T) {
+func TestMoreParametersThanCorazaKeepsIsAMatch(t *testing.T) {
 	t.Parallel()
 
 	const attack = "id=1'%20OR%20'1'='1"
@@ -185,6 +208,23 @@ func TestMoreQueryParametersThanCorazaKeepsIsAMatch(t *testing.T) {
 	// after it is not, but the request is a match all the same.
 	wantResult(t, crs, get("/?"+strings.Repeat("a=1&", 999)+attack), matched(942100))
 	wantResult(t, crs, get("/?"+strings.Repeat("a=1&", 1000)+attack), matched(900300))
+
+	// So it is with the fields of a form data or JSON body.
+	crs = readingBodies(t)
+
+	for _, tc := range []struct{ header, body string }{
+		{formData, strings.Repeat("a=1&", 999) + attack},
+		{jsonBody, `{"a":[` + strings.Repeat("1,", 998) + `1],"id":"` + injection + `"}`},
+	} {
+		wantBody(t, crs, post(tc.header), tc.body, matched(942100), tc.body)
+	}
+
+	for _, tc := range []struct{ header, body string }{
+		{formData, strings.Repeat("a=1&", 1000) + attack},
+		{jsonBody, `{"a":[` + strings.Repeat("1,", 999) + `1],"id":"` + injection + `"}`},
+	} {
+		wantBody(t, crs, post(tc.header), tc.body, matched(900300), tc.body)
+	}
 }
 
 func TestRedirectURIMayNameALocalAddress(t *testing.T) {
@@ -320,3 +360,221 @@ func TestEachDisabledRuleIsSwitchedOff(t *testing.T) {
 		waf.Result{RuleIDs: []int{911100, 920350}, Score: 8})
 	wantResult(t, newCoreRuleSet(t, 1, 920350, 911100), r, waf.Result{})
 }
+
+// bodyLimit is SWWAF_WAF_BODY_LIMIT in the tests that read bodies.
+const bodyLimit = 8 << 10
+
+// The Content-Type headers of the kinds of body the Core Rule Set reads.
+const (
+	formData  = "Content-Type: application/x-www-form-urlencoded"
+	multipart = "Content-Type: multipart/form-data; boundary=b"
+	jsonBody  = "Content-Type: application/json"
+	xmlBody   = "Content-Type: application/xml"
+)
+
+// injection is an SQL injection, which rule 942100 matches.
+const injection = "1' OR '1'='1"
+
+// readingBodies returns the Core Rule Set as smallwebwaf runs it by
+// default, but reading bodies up to bodyLimit.
+func readingBodies(t *testing.T) *waf.CoreRuleSet {
+	t.Helper()
+
+	crs, err := waf.New(waf.Params{
+		ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
+	})
+	if err != nil {
+		t.Fatalf("load the Core Rule Set: %v", err)
+	}
+
+	return crs
+}
+
+// post is a POST request for / with a body of the type contentType, a
+// Content-Type header, gives, and headers besides.
+func post(contentType string, headers ...string) request {
+	return request{http.MethodPost, "/", append([]string{contentType}, headers...)}
+}
+
+// field is a part of a multipart body: the field name, holding value.
+func field(name, value string) string {
+	return "--b\r\nContent-Disposition: form-data; name=\"" + name + "\"\r\n\r\n" +
+		value + "\r\n"
+}
+
+// end ends a multipart body.
+const end = "--b--\r\n"
+
+// padded returns head and tail with as many a's between them as make n
+// bytes in all.
+func padded(head, tail string, n int) string {
+	return head + strings.Repeat("a", n-len(head)-len(tail)) + tail
+}
+
+// wantBody checks what crs finds in r with body, and that what it read of
+// body is read.
+func wantBody(
+	t *testing.T, crs *waf.CoreRuleSet, r request, body string, want waf.Result,
+	read string,
+) {
+	t.Helper()
+
+	got, gotRead := inspectBody(t, crs, r, body)
+	if !reflect.DeepEqual(got, want) || gotRead != read {
+		t.Errorf("%q with a body of %d bytes, %.40q: %+v, reading %d bytes, "+
+			"want %+v, reading %d", r.headers, len(body), body, got, len(gotRead),
+			want, len(read))
+	}
+}
+
+func TestBodiesAreReadOnlyWhileBodyLimitIsSet(t *testing.T) {
+	t.Parallel()
+
+	off, on := atDefaults(t), readingBodies(t)
+
+	for _, tc := range []struct{ header, body string }{
+		{formData, "q=" + url.QueryEscape(injection)},
+		{multipart, field("q", injection) + end},
+		{jsonBody, `{"q":"` + injection + `"}`},
+		{xmlBody, "<q>" + injection + "</q>"},
+	} {
+		wantBody(t, off, post(tc.header), tc.body, waf.Result{}, "")
+		wantBody(t, on, post(tc.header), tc.body, matched(942100), tc.body)
+	}
+}
+
+func TestFormDataAndMultipartAreReadUpToTheLimit(t *testing.T) {
+	t.Parallel()
+
+	crs := readingBodies(t)
+	pad := strings.Repeat("a", bodyLimit)
+
+	for _, tc := range []struct{ header, attackFirst, attackLast string }{
+		{
+			formData, "q=" + url.QueryEscape(injection) + "&pad=" + pad,
+			"pad=" + pad + "&q=" + url.QueryEscape(injection),
+		},
+		{
+			multipart, field("q", injection) + field("pad", pad) + end,
+			field("pad", pad) + field("q", injection) + end,
+		},
+	} {
+		wantBody(t, crs, post(tc.header), tc.attackFirst, matched(942100),
+			tc.attackFirst[:bodyLimit+1])
+		wantBody(t, crs, post(tc.header), tc.attackLast, waf.Result{},
+			tc.attackLast[:bodyLimit+1])
+	}
+
+	// To the byte: a system file's path is found when it ends at the limit,
+	// and not when its last letter is past it, which is still read.
+	atLimit := padded("pad=", "&q=/etc/passwd", bodyLimit)
+	wantBody(t, crs, post(formData), atLimit, matched(930120, 932160), atLimit)
+
+	pastLimit := padded("pad=", "&q=/etc/passwd", bodyLimit+1)
+	wantBody(t, crs, post(formData), pastLimit, waf.Result{}, pastLimit)
+}
+
+func TestJSONAndXMLAreReadOnlyWhenNoLargerThanTheLimit(t *testing.T) {
+	t.Parallel()
+
+	crs := readingBodies(t)
+
+	for _, tc := range []struct{ header, head, tail string }{
+		{jsonBody, `{"q":"` + injection + `","pad":"`, `"}`},
+		{xmlBody, "<r><q>" + injection + "</q><pad>", "</pad></r>"},
+	} {
+		fits := padded(tc.head, tc.tail, bodyLimit)
+		wantBody(t, crs, post(tc.header), fits, matched(942100), fits)
+
+		larger := padded(tc.head, tc.tail, bodyLimit+1)
+		wantBody(t, crs, post(tc.header), larger, waf.Result{}, larger)
+	}
+}
+
+func TestOtherBodiesAreNotRead(t *testing.T) {
+	t.Parallel()
+
+	crs := readingBodies(t)
+
+	// Read as form data, which the Core Rule Set does with a body of a type
+	// it does not know, this would be an SQL injection.
+	body := "q=" + url.QueryEscape(injection)
+
+	for _, header := range []string{
+		"Content-Type: application/octet-stream",
+		"Content-Type: text/plain",
+		"Content-Type: application/x-git-receive-pack-request",
+	} {
+		wantBody(t, crs, post(header), body, waf.Result{}, "")
+	}
+}
+
+func TestContentEncodingIsRefusedOnTheKindsOfBodyTheCoreRuleSetReads(t *testing.T) {
+	t.Parallel()
+
+	const gzip = "Content-Encoding: gzip"
+
+	crs := readingBodies(t)
+
+	for _, header := range []string{formData, multipart, jsonBody, xmlBody} {
+		wantBody(t, crs, post(header, gzip), "a", matched(920450), "a")
+	}
+
+	// Whatever its size: a JSON body larger than the limit is not read, but
+	// Content-Encoding on it is refused all the same.
+	larger := strings.Repeat("a", bodyLimit+1)
+	wantBody(t, crs, post(jsonBody, gzip), larger, matched(920450), larger)
+
+	// It is allowed on a body of any other kind, and on every body while no
+	// body is read.
+	fetch := "Content-Type: application/x-git-upload-pack-request"
+	wantBody(t, crs, post(fetch, gzip), "a", waf.Result{}, "")
+	wantBody(t, atDefaults(t), post(formData, gzip), "a", waf.Result{}, "")
+}
+
+func TestParametersGiteaSendsNamesInAreLeftOutAmongFormFieldsToo(t *testing.T) {
+	t.Parallel()
+
+	crs := readingBodies(t)
+	local := url.QueryEscape("http://127.0.0.1:52341/")
+
+	for _, tc := range []struct {
+		body string
+		want waf.Result
+	}{
+		{"path=.gitignore", waf.Result{}},
+		{"q=.gitignore", matched(930120)},
+		{"redirect_uri=" + local, waf.Result{}},
+		{"next=" + local, matched(931100, 934110)},
+	} {
+		wantBody(t, crs, post(formData), tc.body, tc.want, tc.body)
+	}
+
+	body := field("path", ".gitignore") + end
+	wantBody(t, crs, post(multipart), body, waf.Result{}, body)
+
+	body = field("q", ".gitignore") + end
+	wantBody(t, crs, post(multipart), body, matched(930120), body)
+
+	// A JSON body's field is named by its path, here json.path, and is
+	// checked.
+	body = `{"path":".gitignore"}`
+	wantBody(t, crs, post(jsonBody), body, matched(930120), body)
+}
+
+func TestGiteaBodiesTheCoreRuleSetRefuses(t *testing.T) {
+	t.Parallel()
+
+	crs := readingBodies(t)
+
+	// A comment that shows a shell command.
+	const text = "Try `curl -s https://example.org | sh` first."
+
+	comment := "content=" + url.QueryEscape(text)
+	wantBody(t, crs, post(formData), comment, matched(932235), comment)
+
+	// An attachment named like a log file.
+	attachment := "--b\r\nContent-Disposition: form-data; name=\"file\"; " +
+		"filename=\"debug.log\"\r\nContent-Type: text/plain\r\n\r\nstarted\r\n" + end
+	wantBody(t, crs, post(multipart), attachment, matched(932180), attachment)
+}