sneak
c8c7b98645
check / check (push) Waiting to run
Forgejo 17.0.1's recorded requests are in testdata/forgejo-requests.txt, checked at the defaults. What Forgejo sends and gitea does not: - its flash cookie is named flash, which joins gitea_flash among the cookies left out; - its wiki search, whose q skips five rules in forgejo.conf, the fifteenth change. Gaps in gitea's fixes the recording showed: q on the name searches skips 932250 (ls -la), and the API's package search is one of them. User and organisation pages, any one-segment path, keep 932250. Model: opus-5-5
79 lines
2.3 KiB
Go
79 lines
2.3 KiB
Go
package coreruleset_test
|
|
|
|
import (
|
|
"net/http"
|
|
"slices"
|
|
"testing"
|
|
)
|
|
|
|
// forgejoSearches are Forgejo's searches whose q skips some rules: the
|
|
// wiki's, from the fifteenth change, and the searches for a name, from the
|
|
// eighth.
|
|
//
|
|
//nolint:gochecknoglobals // a constant cannot be a list
|
|
var forgejoSearches = []string{
|
|
"/alice/tools/wiki/search",
|
|
"/explore/repos",
|
|
"/explore/users",
|
|
"/alice/tools/branches",
|
|
"/alice/-/packages",
|
|
"/api/v1/packages/alice",
|
|
"/alice",
|
|
}
|
|
|
|
// forgejoAttacks are an SQL injection, a path traversal, a script injection
|
|
// and a shell command after a ";", as query values.
|
|
//
|
|
//nolint:gochecknoglobals // a constant cannot be a list
|
|
var forgejoAttacks = []string{
|
|
sqlInjection, "..%2Fcustom%2Fconf%2Fapp.ini", scriptInjection, commandInjection,
|
|
}
|
|
|
|
func TestForgejoAttacksAreRefusedInItsSearches(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
|
|
|
|
defaults, bodies := atDefaults(t), readingBodies(t)
|
|
|
|
for _, path := range forgejoSearches {
|
|
for _, attack := range forgejoAttacks {
|
|
if got := inspect(t, defaults, get(path+"?q="+attack)); got.Score < threshold {
|
|
t.Errorf("GET %s?q=%s let through: %+v", path, attack, got)
|
|
}
|
|
|
|
// The same field in a form data body.
|
|
r := request{http.MethodPost, path, []string{formData}}
|
|
if got, _ := inspectBody(t, bodies, r, "q="+attack); got.Score < threshold {
|
|
t.Errorf("POST %s q=%s let through: %+v", path, attack, got)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestForgejoExclusionsAreNarrow(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
|
|
|
|
crs := atDefaults(t)
|
|
|
|
// /bin/sh and the hard values, which q lets through on the wiki's
|
|
// search, stay refused in q on paths near it and in another field on it.
|
|
// /alice/wiki/search would be the code search of a repository named
|
|
// wiki, where the eighth change lets q through. Forgejo has no owner
|
|
// named api, so /api/wiki/search is not one.
|
|
for _, target := range []string{
|
|
"/alice/tools/wiki/Home?q=",
|
|
"/alice/tools/wiki/search/x?q=",
|
|
"/api/wiki/search?q=",
|
|
"/alice/tools/wiki/search?other=",
|
|
} {
|
|
for _, value := range slices.Concat([]string{"%2Fbin%2Fsh"}, hardValues) {
|
|
if got := inspect(t, crs, get(target+value)); got.Score < threshold {
|
|
t.Errorf("%s%s let through: %+v", target, value, got)
|
|
}
|
|
}
|
|
}
|
|
}
|