sneak
ed54adbc98
check / check (push) Waiting to run
Each app's fixes are one .conf file and one entry in apps. They apply only while Inspect has set the app's transaction variable, such as tx.app_gitea. SWW_APPS names each hostname's apps. A hostname gets only its apps' fixes; while SWW_APPS is unset, every hostname gets every app's fixes. Listing forgejo, a fork of gitea, brings gitea's fixes too. A hostname in SWW_APPS that is not a DNS name, such as *.example.com, stops the start. Unset, SWW_APPS is logged at start as null; set empty, as "". Model: opus-5-5
123 lines
3.6 KiB
Go
123 lines
3.6 KiB
Go
package coreruleset_test
|
|
|
|
import (
|
|
"net/http"
|
|
"slices"
|
|
"testing"
|
|
|
|
"sneak.berlin/go/smallwebwaf/internal/coreruleset"
|
|
)
|
|
|
|
// forgejo is Forgejo's name in SWW_APPS.
|
|
const forgejo = "forgejo"
|
|
|
|
// forgejoHost is the hostname of the tests of SWW_APPS that serves Forgejo.
|
|
const forgejoHost = "code.example"
|
|
|
|
func TestForgejoFixesApplyOnlyToAHostnameThatServesForgejo(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := servingApps(t, map[string][]string{
|
|
forgejoHost: {forgejo}, otherHost: {wordpress},
|
|
})
|
|
|
|
// A search of a wiki, a search of the admin page, and a file name in
|
|
// Forgejo's flash cookie, which only Forgejo's fixes let through.
|
|
for _, fixed := range []struct {
|
|
request request
|
|
result coreruleset.Result
|
|
}{
|
|
{get("/alice/tools/wiki/search?q=python3"), matched(932260)},
|
|
{get("/admin/repos?q=python3"), matched(932260)},
|
|
{
|
|
get("/alice/tools", "Cookie: flash=success%3DFile%2Bpackage.json%2Bdeleted"),
|
|
matched(930120),
|
|
},
|
|
} {
|
|
wantResult(t, crs, withHost(fixed.request, forgejoHost), coreruleset.Result{})
|
|
wantResult(t, crs, withHost(fixed.request, otherHost), fixed.result)
|
|
}
|
|
}
|
|
|
|
func TestHostnameListingForgejoGetsGiteasFixesToo(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
crs := servingApps(t, map[string][]string{forgejoHost: {forgejo}})
|
|
|
|
for _, fixed := range giteaFixed {
|
|
wantResult(t, crs, withHost(fixed.request, forgejoHost), coreruleset.Result{})
|
|
}
|
|
}
|
|
|
|
// forgejoSearches are Forgejo's searches whose q skips some rules: the
|
|
// wiki's and the admin page's, from Forgejo's fixes, and the searches for a
|
|
// name, from gitea's.
|
|
//
|
|
//nolint:gochecknoglobals // a constant cannot be a list
|
|
var forgejoSearches = []string{
|
|
"/alice/tools/wiki/search",
|
|
"/admin/repos",
|
|
"/explore/repos",
|
|
"/explore/users",
|
|
"/alice/tools/branches",
|
|
"/alice/-/packages",
|
|
"/api/v1/packages/alice",
|
|
"/alice",
|
|
}
|
|
|
|
// forgejoAttacks are an SQL injection, a path traversal, a script injection
|
|
// and a shell command after a ";", as query values.
|
|
//
|
|
//nolint:gochecknoglobals // a constant cannot be a list
|
|
var forgejoAttacks = []string{
|
|
sqlInjection, "..%2Fcustom%2Fconf%2Fapp.ini", scriptInjection, commandInjection,
|
|
}
|
|
|
|
func TestForgejoAttacksAreRefusedInItsSearches(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
|
|
|
|
defaults, bodies := atDefaults(t), readingBodies(t)
|
|
|
|
for _, path := range forgejoSearches {
|
|
for _, attack := range forgejoAttacks {
|
|
if got := inspect(t, defaults, get(path+"?q="+attack)); got.Score < threshold {
|
|
t.Errorf("GET %s?q=%s let through: %+v", path, attack, got)
|
|
}
|
|
|
|
// The same field in a form data body.
|
|
r := request{http.MethodPost, path, []string{formData}}
|
|
if got, _ := inspectBody(t, bodies, r, "q="+attack); got.Score < threshold {
|
|
t.Errorf("POST %s q=%s let through: %+v", path, attack, got)
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
func TestForgejoExclusionsAreNarrow(t *testing.T) {
|
|
t.Parallel()
|
|
|
|
const threshold = 5 // SWW_WAF_ANOMALY_THRESHOLD's default
|
|
|
|
crs := atDefaults(t)
|
|
|
|
// /bin/sh and the hard values, which q lets through on the wiki's
|
|
// search, stay refused in q on paths near it and in another field on it.
|
|
// /alice/wiki/search would be the code search of a repository named
|
|
// wiki, where gitea's fixes let q through. Forgejo has no owner
|
|
// named api, so /api/wiki/search is not one.
|
|
for _, target := range []string{
|
|
"/alice/tools/wiki/Home?q=",
|
|
"/alice/tools/wiki/search/x?q=",
|
|
"/api/wiki/search?q=",
|
|
"/alice/tools/wiki/search?other=",
|
|
} {
|
|
for _, value := range slices.Concat([]string{"%2Fbin%2Fsh"}, hardValues) {
|
|
if got := inspect(t, crs, get(target+value)); got.Score < threshold {
|
|
t.Errorf("%s%s let through: %+v", target, value, got)
|
|
}
|
|
}
|
|
}
|
|
}
|