Lock the server down before the editor goes public (#427)
The editor is about to be opened to strangers: a post on Reddit and a guest access (#428). nginx served the whole workspace and ran every PHP file in it, the API let anybody guess passwords as fast as they liked, and one account could fill the disk. - nginx (shared web stack, outside this repo, backup in /root/config-backup-20261015/) hands out only the two pages, dist/, public/brand/, the uploads by kind and ending, and api/index.php. Everything else under /feuerwerk/ is a 404. - PHP behind it has display_errors off and no X-Powered-By. Plain HTTP forwards to HTTPS, the API refuses it. - Headers: a Content-Security-Policy without inline code or eval, nosniff, frame-ancestors, HSTS, Referrer-, Permissions-, COOP, CORP. - vite.config.ts writes the same policy into the built pages, so CI runs the whole suite under it. Pixi gets by without eval through pixi.js/unsafe-eval. The page CSS left its inline style for a file. - The harness fails a module for anything the policy refuses, from Chrome's log and from the page's securitypolicyviolation event. - LoginThrottle: five wrong passwords from one address within 15 minutes, and it gets 429 until 15 minutes after the last of them. The address is the last X-Forwarded-For entry, the Brandmauer's own. - Quota: 1 GB per account for uploads, projects and snapshots. Only a write that grows the account is refused (413). Admins have no limit. - A write whose Sec-Fetch-Site says another site is refused (403). - The session cookie carries Secure, nginx passes HTTPS on. - showFailure puts the message in as text, not as HTML. - Every PHP script outside api/ stops unless it runs on the command line. - The video worker sees the checkout read-only and can only write data/videos. No capabilities, 2 GB and 256 processes at most. - tests/php/rights.test.php runs the API under php -S on a scratch directory and asks every route as signed out, owner, stranger and admin. A route named in api/index.php but missing in the matrix fails it. limits.test.php covers the brake and the quota. Findings: - tmp/ was readable from outside, with 79 copies of project files. Closed on 15.10. at 20:02 with chmod 750. The log back to 11.10. shows only our own requests. - Port 8080 is bound on 0.0.0.0, so the LAN could reach nginx past the Brandmauer. Left as it is: the web stack is not this project's. - npm audit finds nothing in what is shipped. Dev tools (vitest, brace-expansion, source-map-js) have advisories, not touched here. Tests: check 313 files / 4843 tests. PHP limits 21, rights 60, accounts 56, snapshots 15, releases 20, files 46 (videos 50/51, no ffmpeg in the web container). e2e on stein2, atx was off: 34+38+41 197/198, the one red check (a click in 41) passes with 41 alone, 27/27. 67 misses frames at 1080p on stein2 with and without this. Path list from outside: 10 served, 26 refused. ZAP baseline against the live site: nothing High or Medium under /feuerwerk/. Counter-checks: rights.test.php without the cross-site guard, the quota, the brake, the admin check of users, or with an undocumented route fails each time. A policy without wasm-unsafe-eval fails e2e 41 with the harness's own CSP line. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
adminandClaude Opus 5.5 committed
1 parent
a9e0b6d9fa
commit
cfd6d7a8df
27 files changed
+928
-37
No files matched your search
@@ -0,0 +1,119 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
/**
|
||||
* The brake on guessing passwords (#427): five failed sign-ins from one address within 15 minutes,
|
||||
* and that address is refused for 15 minutes after the last of them. The right password is refused
|
||||
* as well while it lasts, or guessing would only have to wait for its hit. A success does not wipe
|
||||
* the count either: with an account of one's own, that would be the way to reset it.
|
||||
*
|
||||
* `{dir}/{sha256(address)}.json` holds the times of the recent failures, written 0640 like
|
||||
* everything else that is private. The address is the one nginx found behind the Brandmauer.
|
||||
*/
|
||||
final class LoginThrottle
|
||||
{
|
||||
public const MAX_FAILURES = 5;
|
||||
public const WINDOW_SECONDS = 15 * 60;
|
||||
|
||||
/** @param (Closure():int)|null $clock the tests' way to move time on */
|
||||
public function __construct(
|
||||
private readonly string $dir,
|
||||
private readonly ?Closure $clock = null,
|
||||
) {}
|
||||
|
||||
/**
|
||||
* Seconds until another attempt counts, 0 when one may be made now.
|
||||
*
|
||||
* @param list<int> $failures when the recent failures were
|
||||
*/
|
||||
public static function wait(array $failures, int $now): int
|
||||
{
|
||||
$times = self::recent($failures, $now);
|
||||
sort($times);
|
||||
$until = 0;
|
||||
for ($i = self::MAX_FAILURES - 1; $i < count($times); $i++) {
|
||||
if ($times[$i] - $times[$i - self::MAX_FAILURES + 1] < self::WINDOW_SECONDS) {
|
||||
$until = $times[$i] + self::WINDOW_SECONDS;
|
||||
}
|
||||
}
|
||||
return max(0, $until - $now);
|
||||
}
|
||||
|
||||
/** Seconds until `$address` may try again, 0 when it may now. */
|
||||
public function waitFor(string $address): int
|
||||
{
|
||||
$path = $this->path($address);
|
||||
$raw = is_file($path) ? file_get_contents($path) : false;
|
||||
return self::wait($raw === false ? [] : self::decode($raw), $this->now());
|
||||
}
|
||||
|
||||
/** Counts a failed attempt of `$address` and answers the wait that follows from it. */
|
||||
public function fail(string $address): int
|
||||
{
|
||||
if (!is_dir($this->dir) && !mkdir($this->dir, 0775, true) && !is_dir($this->dir)) {
|
||||
throw new RuntimeException('Cannot create the directory of failed sign-ins');
|
||||
}
|
||||
$path = $this->path($address);
|
||||
$handle = fopen($path, 'c+');
|
||||
if ($handle === false) {
|
||||
throw new RuntimeException('Cannot count a failed sign-in');
|
||||
}
|
||||
try {
|
||||
chmod($path, AtomicFile::HIDDEN);
|
||||
flock($handle, LOCK_EX);
|
||||
$now = $this->now();
|
||||
$failures = self::recent(self::decode((string) stream_get_contents($handle)), $now);
|
||||
$failures[] = $now;
|
||||
ftruncate($handle, 0);
|
||||
rewind($handle);
|
||||
fwrite($handle, (string) json_encode(['failures' => $failures]));
|
||||
fflush($handle);
|
||||
return self::wait($failures, $now);
|
||||
} finally {
|
||||
flock($handle, LOCK_UN);
|
||||
fclose($handle);
|
||||
}
|
||||
}
|
||||
|
||||
/** Removes the files of addresses whose failures are all too old to matter. */
|
||||
public function prune(): int
|
||||
{
|
||||
$removed = 0;
|
||||
foreach (glob($this->dir . '/*.json') ?: [] as $path) {
|
||||
if ((int) filemtime($path) < $this->now() - 2 * self::WINDOW_SECONDS && unlink($path)) {
|
||||
$removed++;
|
||||
}
|
||||
}
|
||||
return $removed;
|
||||
}
|
||||
|
||||
/**
|
||||
* The failures that can still matter: five of them lie within one window, and the lock lasts one
|
||||
* window after the last, so nothing older than two windows can.
|
||||
*
|
||||
* @param list<int> $failures
|
||||
* @return list<int>
|
||||
*/
|
||||
private static function recent(array $failures, int $now): array
|
||||
{
|
||||
return array_values(array_filter($failures, static fn(int $at): bool => $at > $now - 2 * self::WINDOW_SECONDS));
|
||||
}
|
||||
|
||||
/** @return list<int> */
|
||||
private static function decode(string $raw): array
|
||||
{
|
||||
$data = json_decode($raw, true);
|
||||
$failures = is_array($data) && is_array($data['failures'] ?? null) ? $data['failures'] : [];
|
||||
return array_values(array_map('intval', array_filter($failures, 'is_int')));
|
||||
}
|
||||
|
||||
private function path(string $address): string
|
||||
{
|
||||
return $this->dir . '/' . hash('sha256', $address) . '.json';
|
||||
}
|
||||
|
||||
private function now(): int
|
||||
{
|
||||
return $this->clock === null ? time() : ($this->clock)();
|
||||
}
|
||||
}
|
||||
@@ -0,0 +1,77 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
/**
|
||||
* How much of the disk an account may take (#427): 1 GB for its uploads, its projects and their
|
||||
* snapshots together. Administrators have no limit; the router does not ask for them.
|
||||
*
|
||||
* Only a write that makes an account larger is refused, so one that is full can still save a smaller
|
||||
* project or delete files. Pixel cels are kept apart: they belong to nobody and are small by rule
|
||||
* (`PixelStore::MAX_BYTES`).
|
||||
*/
|
||||
final class Quota
|
||||
{
|
||||
public const BYTES = 1024 * 1024 * 1024;
|
||||
|
||||
/** The upload folders that are counted, each with a folder per account. */
|
||||
private const KINDS = ['textures', 'fonts', 'sounds', 'videos'];
|
||||
|
||||
public function __construct(
|
||||
private readonly string $data,
|
||||
private readonly int $limit = self::BYTES,
|
||||
) {}
|
||||
|
||||
/** Bytes `$owner` takes up: everything in their upload folder, their projects and their snapshots. */
|
||||
public function usage(string $owner, string $folder): int
|
||||
{
|
||||
$bytes = 0;
|
||||
if (preg_match('/^' . UserStore::FOLDER_PATTERN . '$/', $folder)) {
|
||||
foreach (self::KINDS as $kind) {
|
||||
$bytes += self::sizeOf("{$this->data}/{$kind}/{$folder}");
|
||||
}
|
||||
}
|
||||
$projects = new Store("{$this->data}/projects", $owner);
|
||||
foreach ($projects->listOf($owner) as $project) {
|
||||
$bytes += (int) @filesize("{$this->data}/projects/{$project['id']}.json");
|
||||
$bytes += self::sizeOf("{$this->data}/snapshots/{$project['id']}");
|
||||
}
|
||||
return $bytes;
|
||||
}
|
||||
|
||||
/** Why `$adding` more bytes do not fit, or null when they do (or add nothing). */
|
||||
public function refusal(string $owner, string $folder, int $adding): ?string
|
||||
{
|
||||
if ($adding <= 0) {
|
||||
return null;
|
||||
}
|
||||
$used = $this->usage($owner, $folder);
|
||||
if ($used + $adding <= $this->limit) {
|
||||
return null;
|
||||
}
|
||||
return sprintf(
|
||||
'Not enough space: this account uses %s of its %s',
|
||||
self::megabytes($used),
|
||||
self::megabytes($this->limit),
|
||||
);
|
||||
}
|
||||
|
||||
private static function megabytes(int $bytes): string
|
||||
{
|
||||
return number_format($bytes / 1024 / 1024, $bytes < 10 * 1024 * 1024 ? 1 : 0, '.', '') . ' MB';
|
||||
}
|
||||
|
||||
private static function sizeOf(string $dir): int
|
||||
{
|
||||
if (!is_dir($dir)) {
|
||||
return 0;
|
||||
}
|
||||
$bytes = 0;
|
||||
$files = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($dir, FilesystemIterator::SKIP_DOTS));
|
||||
foreach ($files as $file) {
|
||||
if ($file->isFile()) {
|
||||
$bytes += $file->getSize();
|
||||
}
|
||||
}
|
||||
return $bytes;
|
||||
}
|
||||
}
|
||||
Reference in new issue
Block a user