meleki/feuerwerk
1
0 Fork 0
Code Issues 38 Actions Projects 1 Wiki Activity

Lock the server down before the editor goes public (#427)
feuerwerk / gate (push) Failing after 5m1s
Details
feuerwerk / suite (push) Canceled after 4m52s
Details

Browse Source 
The editor is about to be opened to strangers: a post on Reddit and a
guest access (#428). nginx served the whole workspace and ran every PHP
file in it, the API let anybody guess passwords as fast as they liked,
and one account could fill the disk.

- nginx (shared web stack, outside this repo, backup in
  /root/config-backup-20261015/) hands out only the two pages, dist/,
  public/brand/, the uploads by kind and ending, and api/index.php.
  Everything else under /feuerwerk/ is a 404.
- PHP behind it has display_errors off and no X-Powered-By. Plain HTTP
  forwards to HTTPS, the API refuses it.
- Headers: a Content-Security-Policy without inline code or eval,
  nosniff, frame-ancestors, HSTS, Referrer-, Permissions-, COOP, CORP.
- vite.config.ts writes the same policy into the built pages, so CI
  runs the whole suite under it. Pixi gets by without eval through
  pixi.js/unsafe-eval. The page CSS left its inline style for a file.
- The harness fails a module for anything the policy refuses, from
  Chrome's log and from the page's securitypolicyviolation event.
- LoginThrottle: five wrong passwords from one address within 15
  minutes, and it gets 429 until 15 minutes after the last of them.
  The address is the last X-Forwarded-For entry, the Brandmauer's own.
- Quota: 1 GB per account for uploads, projects and snapshots. Only a
  write that grows the account is refused (413). Admins have no limit.
- A write whose Sec-Fetch-Site says another site is refused (403).
- The session cookie carries Secure, nginx passes HTTPS on.
- showFailure puts the message in as text, not as HTML.
- Every PHP script outside api/ stops unless it runs on the command
  line.
- The video worker sees the checkout read-only and can only write
  data/videos. No capabilities, 2 GB and 256 processes at most.
- tests/php/rights.test.php runs the API under php -S on a scratch
  directory and asks every route as signed out, owner, stranger and
  admin. A route named in api/index.php but missing in the matrix
  fails it. limits.test.php covers the brake and the quota.

Findings:

- tmp/ was readable from outside, with 79 copies of project files.
  Closed on 15.10. at 20:02 with chmod 750. The log back to 11.10.
  shows only our own requests.
- Port 8080 is bound on 0.0.0.0, so the LAN could reach nginx past the
  Brandmauer. Left as it is: the web stack is not this project's.
- npm audit finds nothing in what is shipped. Dev tools (vitest,
  brace-expansion, source-map-js) have advisories, not touched here.

Tests: check 313 files / 4843 tests. PHP limits 21, rights 60,
accounts 56, snapshots 15, releases 20, files 46 (videos 50/51, no
ffmpeg in the web container). e2e on stein2, atx was off: 34+38+41
197/198, the one red check (a click in 41) passes with 41 alone,
27/27. 67 misses frames at 1080p on stein2 with and without this.
Path list from outside: 10 served, 26 refused. ZAP baseline against
the live site: nothing High or Medium under /feuerwerk/.
Counter-checks: rights.test.php without the cross-site guard, the
quota, the brake, the admin check of users, or with an undocumented
route fails each time. A policy without wasm-unsafe-eval fails e2e 41
with the harness's own CSP line.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
adminandClaude Opus 5.5 committed 2026-10-15 23:05:32 +02:00
1 parent a9e0b6d9fa
commit cfd6d7a8df
27 files changed
+928 -37
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

api/index.php
+122 -18
View File
@@ -8,12 +8,23 @@ declare(strict_types=1);
* site's nginx configuration does not pass PATH_INFO to PHP.
*
* GET ?r=auth/session → {user, role} (both null while nobody is signed in)
* POST ?r=auth/login {username,password} → {user, role} | 401
* POST ?r=auth/login {username,password} → {user, role} | 401 | 429
* POST ?r=auth/logout → 204
* POST ?r=auth/password {currentPassword,newPassword} → 204 | 401 | 422
* POST ?r=auth/password {currentPassword,newPassword} → 204 | 401 | 422 | 429
* (the only auth route that needs a session; ends the account's
* other logins, keeps the one asking)
*
* Five wrong passwords from one address within 15 minutes, and it gets 429 with `Retry-After` for
* the next 15 (see LoginThrottle, #427).
*
* A request that changes something (anything but GET) is refused with 403 when the browser says it
* comes from another site, `Sec-Fetch-Site` being `cross-site` or `same-site`: the session cookie is
* SameSite=Lax, and every subdomain of the site counts as the same site to it. Tools send no such
* header and their own cookie.
*
* An account takes up at most 1 GB with its uploads, projects and snapshots (see Quota); a write that
* would make it larger is refused with 413. Administrators have no limit.
*
* Everything below needs a signed-in user (401 otherwise), and projects belong to one: a project
* of somebody else answers like one that is not there – unless the one asking is an administrator
* (#179), who reads and saves it like their own; a save keeps its owner. Deleting a project is
@@ -99,9 +110,11 @@ require __DIR__ . '/lib/Auth.php';
require __DIR__ . '/lib/FileUsage.php';
require __DIR__ . '/lib/HashedFileStore.php'; // before the font, sound and texture stores built on it
require __DIR__ . '/lib/FontStore.php';
require __DIR__ . '/lib/LoginThrottle.php';
require __DIR__ . '/lib/OriginalName.php';
require __DIR__ . '/lib/PixelStore.php';
require __DIR__ . '/lib/PluginStore.php';
require __DIR__ . '/lib/Quota.php';
require __DIR__ . '/lib/ReleaseStore.php';
require __DIR__ . '/lib/Response.php';
require __DIR__ . '/lib/SessionStore.php';
@@ -134,6 +147,20 @@ const MAX_SOUND_BYTES = 256 * 1024 * 1024;
*/
const MAX_VIDEO_BYTES = 2048 * 1024 * 1024;
/**
* Where everything the API keeps lies, and how much of it an account may fill. The rights test
* (tests/php/rights.test.php) runs the API under `php -S` on a scratch directory with a small quota;
* behind nginx neither can be moved.
*/
define('DATA_DIR', testSetting('FEUERWERK_DATA') ?? dirname(__DIR__) . '/data');
define('QUOTA_BYTES', (int) (testSetting('FEUERWERK_QUOTA_BYTES') ?? Quota::BYTES));
function testSetting(string $name): ?string
{
$value = PHP_SAPI === 'cli-server' ? getenv($name) : false;
return is_string($value) && $value !== '' ? $value : null;
}
set_error_handler(static function (int $severity, string $message, string $file, int $line): bool {
// PHP calls the handler for a call silenced with `@` as well, only with less reported: that
// warning was expected and is answered where it happens (an unreadable image is a 422).
@@ -147,6 +174,7 @@ set_error_handler(static function (int $severity, string $message, string $file,
function routeAuth(array $parts, string $method, Auth $auth): never
{
$what = $parts[1] ?? '';
$throttle = new LoginThrottle(DATA_DIR . '/sign-ins');
if ($what === 'session') {
if ($method !== 'GET') {
@@ -163,8 +191,10 @@ function routeAuth(array $parts, string $method, Auth $auth): never
Response::error('Method not allowed', 405);
}
$body = Response::body();
refuseWhileThrottled($throttle);
$user = $auth->logIn((string) ($body['username'] ?? ''), (string) ($body['password'] ?? ''));
if ($user === null) {
countFailure($throttle);
// One message for both halves: which of the two was wrong is the attacker's question.
Response::error('Wrong user name or password', 401);
}
@@ -183,7 +213,10 @@ function routeAuth(array $parts, string $method, Auth $auth): never
if (!UserStore::isValidPassword($new)) {
Response::error('The new password needs at least ' . UserStore::MIN_PASSWORD_LENGTH . ' characters', 422);
}
// Guessing the current password from an open tab is guessing all the same.
refuseWhileThrottled($throttle);
if (!$auth->changePassword($user, (string) ($body['currentPassword'] ?? ''), $new)) {
countFailure($throttle);
Response::error('Wrong password', 401);
}
Response::noContent();
@@ -200,10 +233,47 @@ function routeAuth(array $parts, string $method, Auth $auth): never
Response::error('Not found', 404);
}
/** @param list<string> $parts */
function routeProjects(array $parts, string $method, string $owner, bool $seesAll): never
/** The address a request came from: nginx puts the one the Brandmauer saw there (#427). */
function clientAddress(): string
{
$store = new Store(dirname(__DIR__) . '/data/projects', $owner, $seesAll);
return (string) ($_SERVER['REMOTE_ADDR'] ?? '');
}
function countFailure(LoginThrottle $throttle): void
{
$throttle->fail(clientAddress());
// Now and then, so the folder holds the addresses of the last quarter of an hour and no more.
if (random_int(1, 20) === 1) {
$throttle->prune();
}
}
function refuseWhileThrottled(LoginThrottle $throttle): void
{
$wait = $throttle->waitFor(clientAddress());
if ($wait === 0) {
return;
}
header('Retry-After: ' . $wait);
Response::error('Too many failed sign-ins. Try again in ' . (int) ceil($wait / 60) . ' minutes', 429);
}
/**
* Bytes a project takes up as stored, 0 for one that is not there.
*/
function projectBytes(string $id): int
{
$path = DATA_DIR . "/projects/{$id}.json";
return is_file($path) ? (int) filesize($path) : 0;
}
/**
* @param list<string> $parts
* @param Closure(int):void $fits answers 413 when that many more bytes do not fit the quota
*/
function routeProjects(array $parts, string $method, string $owner, bool $seesAll, Closure $fits): never
{
$store = new Store(DATA_DIR . '/projects', $owner, $seesAll);
if (count($parts) === 1) {
if ($method === 'GET') {
@@ -215,6 +285,8 @@ function routeProjects(array $parts, string $method, string $owner, bool $seesAl
if ($name === '' || mb_strlen($name) > 120) {
Response::error('Project name must be 1–120 characters', 422);
}
// What an empty project takes up, give or take its name.
$fits(1024);
Response::json($store->create($name), 201);
}
Response::error('Method not allowed', 405);
@@ -225,11 +297,11 @@ function routeProjects(array $parts, string $method, string $owner, bool $seesAl
Response::error('Invalid project id', 400);
}
$snapshots = new SnapshotStore(dirname(__DIR__) . '/data/snapshots');
$snapshots = new SnapshotStore(DATA_DIR . '/snapshots');
if (($parts[2] ?? null) === 'snapshots') {
routeSnapshots($parts, $method, $store, $snapshots, $id);
routeSnapshots($parts, $method, $store, $snapshots, $id, $fits);
}
$releases = new ReleaseStore(dirname(__DIR__) . '/data/releases');
$releases = new ReleaseStore(DATA_DIR . '/releases');
if (($parts[2] ?? null) === 'release' && count($parts) === 3) {
routeRelease($method, $store, $releases, $id);
}
@@ -250,6 +322,11 @@ function routeProjects(array $parts, string $method, string $owner, bool $seesAl
if (!isset($body['revision']) || !is_int($body['revision']) || !is_array($body['project'] ?? null)) {
Response::error('Body must contain integer "revision" and object "project"', 422);
}
// Asked after whether the project is there for them: a 413 would tell a stranger it is.
if ($store->load($id) === null) {
Response::error('Project not found', 404);
}
$fits((int) ($_SERVER['CONTENT_LENGTH'] ?? 0) - projectBytes($id));
try {
$result = $store->save($id, $body['revision'], $body['project']);
} catch (StaleRevisionException $e) {
@@ -282,9 +359,13 @@ function routeProjects(array $parts, string $method, string $owner, bool $seesAl
* The snapshots of one project (#231). Whoever may load the project may see, make, restore and
* delete its snapshots; for everybody else the project, and with it this route, is not there.
*
* A snapshot copies the project, and so does restoring one (the stand it replaces is kept), so both
* count against the quota with the project's size.
*
* @param list<string> $parts
* @param Closure(int):void $fits
*/
function routeSnapshots(array $parts, string $method, Store $store, SnapshotStore $snapshots, string $id): never
function routeSnapshots(array $parts, string $method, Store $store, SnapshotStore $snapshots, string $id, Closure $fits): never
{
$doc = $store->load($id);
if ($doc === null) {
@@ -297,6 +378,7 @@ function routeSnapshots(array $parts, string $method, Store $store, SnapshotStor
}
if ($method === 'POST') {
$name = snapshotName(Response::body());
$fits(projectBytes($id));
Response::json($snapshots->create($id, $doc, $name === '' ? gmdate('Y-m-d H:i') . ' UTC' : $name), 201);
}
Response::error('Method not allowed', 405);
@@ -329,6 +411,7 @@ function routeSnapshots(array $parts, string $method, Store $store, SnapshotStor
if (!isset($body['revision']) || !is_int($body['revision'])) {
Response::error('Body must contain integer "revision"', 422);
}
$fits(projectBytes($id));
// The same guard a save has: a tab that is behind must not throw away what another one saved.
if ($body['revision'] !== $doc['revision']) {
Response::error('Project was modified elsewhere', 409, ['revision' => $doc['revision']]);
@@ -379,7 +462,7 @@ function routeReleases(array $parts, string $method): never
if ($method !== 'GET' || count($parts) !== 2) {
Response::error('Not found', 404);
}
$release = (new ReleaseStore(dirname(__DIR__) . '/data/releases'))->load($parts[1]);
$release = (new ReleaseStore(DATA_DIR . '/releases'))->load($parts[1]);
if ($release === null) {
Response::error('Game not found', 404);
}
@@ -401,7 +484,7 @@ function snapshotName(array $body): string
function routeUsers(array $parts, string $method, Auth $auth, UserStore $users): never
{
$actor = $auth->requireAdmin();
$projects = new Store(dirname(__DIR__) . '/data/projects', $actor, true);
$projects = new Store(DATA_DIR . '/projects', $actor, true);
$shown = static function (string $name) use ($users): array {
foreach ($users->accounts() as $account) {
if (strcasecmp($account['username'], $name) === 0) {
@@ -519,6 +602,7 @@ function routeUsers(array $parts, string $method, Auth $auth, UserStore $users):
*
* @param list<string> $parts
* @param class-string<RuntimeException> $invalid what the store throws for bytes it cannot take
* @param Closure(int):void $fits
*/
function routeFiles(
array $parts,
@@ -530,6 +614,7 @@ function routeFiles(
int $maxBytes,
string $noun,
string $invalid,
Closure $fits,
): never {
if (count($parts) === 1) {
if ($method === 'GET') {
@@ -538,6 +623,7 @@ function routeFiles(
if ($method === 'POST') {
$tooLarge = "{$noun} must be at most " . ($maxBytes / 1024 / 1024) . ' MB';
$name = (string) ($_GET['name'] ?? '');
$fits((int) ($_SERVER['CONTENT_LENGTH'] ?? 0));
try {
// A video is too big for memory and goes from the request straight to disk.
if ($store instanceof VideoStore) {
@@ -586,7 +672,7 @@ function routeFiles(
if (!$store->exists($file)) {
Response::error("{$noun} not found", 404);
}
$uses = (new FileUsage(dirname(__DIR__) . '/data'))->of($file);
$uses = (new FileUsage(DATA_DIR))->of($file);
if ($uses !== []) {
Response::error(FileUsage::refusal($uses, $user, $isAdmin), 409);
}
@@ -603,7 +689,7 @@ function routePixels(array $parts, string $method): never
if (count($parts) !== 1 || $method !== 'POST') {
Response::error('Method not allowed', 405);
}
$store = new PixelStore(dirname(__DIR__) . '/data/pixels');
$store = new PixelStore(DATA_DIR . '/pixels');
$bytes = Response::rawBody();
if (strlen($bytes) > PixelStore::MAX_BYTES) {
Response::error('A cel is at most ' . PixelStore::MAX_BYTES . ' bytes', 413);
@@ -618,7 +704,7 @@ function routePixels(array $parts, string $method): never
/** @param list<string> $parts */
function routePlugins(array $parts, string $method): never
{
$store = new PluginStore(dirname(__DIR__) . '/data/plugins');
$store = new PluginStore(DATA_DIR . '/plugins');
if (count($parts) === 1) {
if ($method !== 'GET') {
@@ -650,6 +736,11 @@ try {
$route = trim((string) ($_GET['r'] ?? ''), '/');
$parts = $route === '' ? [] : explode('/', $route);
$site = (string) ($_SERVER['HTTP_SEC_FETCH_SITE'] ?? '');
if ($method !== 'GET' && $method !== 'HEAD' && ($site === 'cross-site' || $site === 'same-site')) {
Response::error('Requests from other sites are refused', 403);
}
$maxBody = ($parts[0] ?? '') === 'videos' ? MAX_VIDEO_BYTES : MAX_BODY_BYTES;
if ((int) ($_SERVER['CONTENT_LENGTH'] ?? 0) > $maxBody) {
Response::error('Request body too large', 413);
@@ -668,8 +759,8 @@ try {
Response::error('Not found', 404);
}
$users = new UserStore(dirname(__DIR__) . '/data/users.json');
$auth = new Auth($users, new SessionStore(dirname(__DIR__) . '/data/sessions'));
$users = new UserStore(DATA_DIR . '/users.json');
$auth = new Auth($users, new SessionStore(DATA_DIR . '/sessions'));
if ($parts[0] === 'auth') {
routeAuth($parts, $method, $auth);
}
@@ -683,10 +774,19 @@ try {
// dropped in by a stranger.
$user = $auth->require();
$isAdmin = $auth->role($user) === 'admin';
$data = dirname(__DIR__) . '/data';
$data = DATA_DIR;
$fits = static function (int $adding) use ($user, $isAdmin, $users): void {
if ($isAdmin) {
return;
}
$refusal = (new Quota(DATA_DIR, QUOTA_BYTES))->refusal($user, $users->folderOf($user), $adding);
if ($refusal !== null) {
Response::error($refusal, 413);
}
};
match ($parts[0]) {
'projects' => routeProjects($parts, $method, $user, $isAdmin),
'projects' => routeProjects($parts, $method, $user, $isAdmin, $fits),
'textures' => routeFiles(
$parts,
$method,
@@ -697,6 +797,7 @@ try {
MAX_TEXTURE_BYTES,
'Image',
InvalidImageException::class,
$fits,
),
'fonts' => routeFiles(
$parts,
@@ -708,6 +809,7 @@ try {
MAX_FONT_BYTES,
'Font',
InvalidFontException::class,
$fits,
),
'sounds' => routeFiles(
$parts,
@@ -719,6 +821,7 @@ try {
MAX_SOUND_BYTES,
'Sound',
InvalidSoundException::class,
$fits,
),
'videos' => routeFiles(
$parts,
@@ -730,6 +833,7 @@ try {
MAX_VIDEO_BYTES,
'Video',
InvalidVideoException::class,
$fits,
),
'pixels' => routePixels($parts, $method),
'plugins' => routePlugins($parts, $method),