sneak
c6ab946c86
check / check (push) Waiting to run
Every setting of waf and rproxy is read through viper, in place of the os.LookupEnv function Main passed down. NewViper turns AutomaticEnv and AllowEmptyEnv on, so a setting that is set but empty reads as set. A setting may also be given as a file, the _FILE form, which rproxy's settings now have too; rproxy still writes nothing to disk. The settings are renamed: waf's take the prefix SWW_WAF_, rproxy's take SWW_RPROXY_, and the shared SWW_COMMAND keeps SWW_. The Core Rule Set's settings take SWW_WAF_CORE_RULE_SET_ rather than SWW_WAF_WAF_. Model: deepseek-v4-pro (first version); opus-5-5 (rework)
79 lines
2.3 KiB
Go
79 lines
2.3 KiB
Go
package coreruleset_test
|
|
|
|
import (
|
|
"net/http"
|
|
"slices"
|
|
"testing"
|
|
)
|
|
|
|
// forgejoSearches are Forgejo's searches whose q skips some rules: the
|
|
// wiki's, from the fifteenth change, and the searches for a name, from the
|
|
// eighth.
|
|
//
|
|
//nolint:gochecknoglobals // a constant cannot be a list
|
|
var forgejoSearches = []string{
|
|
"/alice/tools/wiki/search",
|
|
"/explore/repos",
|
|
"/explore/users",
|
|
"/alice/tools/branches",
|
|
"/alice/-/packages",
|
|
"/api/v1/packages/alice",
|
|
"/alice",
|
|
}
|
|
|
|
// forgejoAttacks are an SQL injection, a path traversal, a script injection
|
|
// and a shell command after a ";", as query values.
|
|
//
|
|
//nolint:gochecknoglobals // a constant cannot be a list
|
|
var forgejoAttacks = []string{
|
|
sqlInjection, "..%2Fcustom%2Fconf%2Fapp.ini", scriptInjection, commandInjection,
|
|
}
|
|
|
|
func TestForgejoAttacksAreRefusedInItsSearches(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
|
|
|
|
defaults, bodies := atDefaults(t), readingBodies(t)
|
|
|
|
for _, path := range forgejoSearches {
|
|
for _, attack := range forgejoAttacks {
|
|
if got := inspect(t, defaults, get(path+"?q="+attack)); got.Score < threshold {
|
|
t.Errorf("GET %s?q=%s let through: %+v", path, attack, got)
|
|
}
|
|
|
|
// The same field in a form data body.
|
|
r := request{http.MethodPost, path, []string{formData}}
|
|
if got, _ := inspectBody(t, bodies, r, "q="+attack); got.Score < threshold {
|
|
t.Errorf("POST %s q=%s let through: %+v", path, attack, got)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestForgejoExclusionsAreNarrow(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const threshold = 5 // SWW_WAF_CORE_RULE_SET_ANOMALY_THRESHOLD's default
|
|
|
|
crs := atDefaults(t)
|
|
|
|
// /bin/sh and the hard values, which q lets through on the wiki's
|
|
// search, stay refused in q on paths near it and in another field on it.
|
|
// /alice/wiki/search would be the code search of a repository named
|
|
// wiki, where the eighth change lets q through. Forgejo has no owner
|
|
// named api, so /api/wiki/search is not one.
|
|
for _, target := range []string{
|
|
"/alice/tools/wiki/Home?q=",
|
|
"/alice/tools/wiki/search/x?q=",
|
|
"/api/wiki/search?q=",
|
|
"/alice/tools/wiki/search?other=",
|
|
} {
|
|
for _, value := range slices.Concat([]string{"%2Fbin%2Fsh"}, hardValues) {
|
|
if got := inspect(t, crs, get(target+value)); got.Score < threshold {
|
|
t.Errorf("%s%s let through: %+v", target, value, got)
|
|
}
|
|
}
|
|
}
|
|
}
|