Lock the server down before the editor goes public (#427)
The editor is about to be opened to strangers: a post on Reddit and a guest access (#428). nginx served the whole workspace and ran every PHP file in it, the API let anybody guess passwords as fast as they liked, and one account could fill the disk. - nginx (shared web stack, outside this repo, backup in /root/config-backup-20261015/) hands out only the two pages, dist/, public/brand/, the uploads by kind and ending, and api/index.php. Everything else under /feuerwerk/ is a 404. - PHP behind it has display_errors off and no X-Powered-By. Plain HTTP forwards to HTTPS, the API refuses it. - Headers: a Content-Security-Policy without inline code or eval, nosniff, frame-ancestors, HSTS, Referrer-, Permissions-, COOP, CORP. - vite.config.ts writes the same policy into the built pages, so CI runs the whole suite under it. Pixi gets by without eval through pixi.js/unsafe-eval. The page CSS left its inline style for a file. - The harness fails a module for anything the policy refuses, from Chrome's log and from the page's securitypolicyviolation event. - LoginThrottle: five wrong passwords from one address within 15 minutes, and it gets 429 until 15 minutes after the last of them. The address is the last X-Forwarded-For entry, the Brandmauer's own. - Quota: 1 GB per account for uploads, projects and snapshots. Only a write that grows the account is refused (413). Admins have no limit. - A write whose Sec-Fetch-Site says another site is refused (403). - The session cookie carries Secure, nginx passes HTTPS on. - showFailure puts the message in as text, not as HTML. - Every PHP script outside api/ stops unless it runs on the command line. - The video worker sees the checkout read-only and can only write data/videos. No capabilities, 2 GB and 256 processes at most. - tests/php/rights.test.php runs the API under php -S on a scratch directory and asks every route as signed out, owner, stranger and admin. A route named in api/index.php but missing in the matrix fails it. limits.test.php covers the brake and the quota. Findings: - tmp/ was readable from outside, with 79 copies of project files. Closed on 15.10. at 20:02 with chmod 750. The log back to 11.10. shows only our own requests. - Port 8080 is bound on 0.0.0.0, so the LAN could reach nginx past the Brandmauer. Left as it is: the web stack is not this project's. - npm audit finds nothing in what is shipped. Dev tools (vitest, brace-expansion, source-map-js) have advisories, not touched here. Tests: check 313 files / 4843 tests. PHP limits 21, rights 60, accounts 56, snapshots 15, releases 20, files 46 (videos 50/51, no ffmpeg in the web container). e2e on stein2, atx was off: 34+38+41 197/198, the one red check (a click in 41) passes with 41 alone, 27/27. 67 misses frames at 1080p on stein2 with and without this. Path list from outside: 10 served, 26 refused. ZAP baseline against the live site: nothing High or Medium under /feuerwerk/. Counter-checks: rights.test.php without the cross-site guard, the quota, the brake, the admin check of users, or with an undocumented route fails each time. A policy without wasm-unsafe-eval fails e2e 41 with the harness's own CSP line. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
adminandClaude Opus 5.5 committed
1 parent
a9e0b6d9fa
commit
cfd6d7a8df
27 files changed
+928
-37
No files matched your search
@@ -1,6 +1,11 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
// A command-line script: under a web server it does nothing (#427).
|
||||
if (PHP_SAPI !== 'cli') {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/**
|
||||
* Accounts, roles and who may touch which project (#180, #179), without a web server: the stores
|
||||
* work on a scratch directory. Plain PHP, no framework – CI runs it with `php tests/php/accounts.test.php`
|
||||
|
||||
@@ -1,6 +1,11 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
// A command-line script: under a web server it does nothing (#427).
|
||||
if (PHP_SAPI !== 'cli') {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/**
|
||||
* Uploaded files in a folder per account (#344): the stores, the folders in `users.json` and the
|
||||
* check whether a project still uses a file. Plain PHP like releases.test.php; CI runs it with
|
||||
|
||||
@@ -0,0 +1,126 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
// A command-line script: under a web server it does nothing (#427).
|
||||
if (PHP_SAPI !== 'cli') {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/**
|
||||
* The brake on wrong passwords and the quota of an account (#427), on a scratch directory with a
|
||||
* clock of its own. Plain PHP like releases.test.php; CI runs it with `php tests/php/limits.test.php`
|
||||
* and reads the last line.
|
||||
*/
|
||||
|
||||
require __DIR__ . '/../../api/lib/AtomicFile.php';
|
||||
require __DIR__ . '/../../api/lib/LoginThrottle.php';
|
||||
require __DIR__ . '/../../api/lib/Quota.php';
|
||||
require __DIR__ . '/../../api/lib/Store.php';
|
||||
require __DIR__ . '/../../api/lib/UserStore.php';
|
||||
|
||||
$failed = 0;
|
||||
$passed = 0;
|
||||
|
||||
function check(string $name, bool $ok, mixed $got = null): void
|
||||
{
|
||||
global $failed, $passed;
|
||||
if ($ok) {
|
||||
$passed++;
|
||||
echo "PASS {$name}\n";
|
||||
return;
|
||||
}
|
||||
$failed++;
|
||||
echo "FAIL {$name}", $got === null ? '' : ' — got ' . json_encode($got), "\n";
|
||||
}
|
||||
|
||||
$dir = sys_get_temp_dir() . '/feuerwerk-php-limits-' . bin2hex(random_bytes(4));
|
||||
mkdir($dir);
|
||||
|
||||
// --- LoginThrottle ---------------------------------------------------------------------------------
|
||||
|
||||
$now = 1_000_000;
|
||||
$throttle = new LoginThrottle("{$dir}/sign-ins", static function () use (&$now): int {
|
||||
return $now;
|
||||
});
|
||||
$window = LoginThrottle::WINDOW_SECONDS;
|
||||
|
||||
check('an address that never failed may try', $throttle->waitFor('203.0.113.7') === 0);
|
||||
for ($i = 1; $i < LoginThrottle::MAX_FAILURES; $i++) {
|
||||
$throttle->fail('203.0.113.7');
|
||||
$now += 10;
|
||||
}
|
||||
check('four failures still let it try', $throttle->waitFor('203.0.113.7') === 0, $throttle->waitFor('203.0.113.7'));
|
||||
$wait = $throttle->fail('203.0.113.7');
|
||||
check('the fifth locks it for the whole window', $wait === $window, $wait);
|
||||
check('and asking says so', $throttle->waitFor('203.0.113.7') === $window);
|
||||
check('another address is not touched', $throttle->waitFor('198.51.100.1') === 0);
|
||||
|
||||
$now += $window - 1;
|
||||
check('one second before the end it still waits', $throttle->waitFor('203.0.113.7') === 1, $throttle->waitFor('203.0.113.7'));
|
||||
$now += 1;
|
||||
check('15 minutes after the last failure it may try again', $throttle->waitFor('203.0.113.7') === 0);
|
||||
$throttle->fail('203.0.113.7');
|
||||
check('and the old failures no longer count', $throttle->waitFor('203.0.113.7') === 0);
|
||||
|
||||
// Failures spread wider than the window never add up to five.
|
||||
$now += $window;
|
||||
for ($i = 0; $i < 10; $i++) {
|
||||
$throttle->fail('192.0.2.9');
|
||||
$now += (int) ($window / 4) + 1;
|
||||
}
|
||||
check('failures spread over more than 15 minutes never lock', $throttle->waitFor('192.0.2.9') === 0);
|
||||
|
||||
check(
|
||||
'the rule as a function: five within the window wait for the rest of it',
|
||||
LoginThrottle::wait([100, 200, 300, 400, 500], 600) === 500 + $window - 600,
|
||||
);
|
||||
check('four do not', LoginThrottle::wait([100, 200, 300, 400], 600) === 0);
|
||||
check(
|
||||
'nor five of which the first is a whole window before the last',
|
||||
LoginThrottle::wait([500 - $window, 200, 300, 400, 500], 600) === 0,
|
||||
);
|
||||
|
||||
$files = glob("{$dir}/sign-ins/*.json") ?: [];
|
||||
check('one file per address that failed, named by its hash', count($files) === 2 &&!str_contains(implode('', $files), '203.0.113.7'), $files);
|
||||
check('which the web server may not read', (fileperms($files[0]) & 0o007) === 0);
|
||||
|
||||
touch($files[0], $now - 2 * $window - 1);
|
||||
check('pruning drops an address whose failures are all old', $throttle->prune() >= 1 && !is_file($files[0]));
|
||||
|
||||
// --- Quota -----------------------------------------------------------------------------------------
|
||||
|
||||
$data = "{$dir}/data";
|
||||
mkdir("{$data}/projects", 0775, true);
|
||||
$users = new UserStore("{$data}/users.json");
|
||||
$users->put('ann', 'password1');
|
||||
$folder = $users->folderOf('ann', true);
|
||||
mkdir("{$data}/sounds/{$folder}", 0775, true);
|
||||
file_put_contents("{$data}/sounds/{$folder}/" . str_repeat('a', 64) . '.wav', str_repeat("\0", 3000));
|
||||
mkdir("{$data}/videos/{$folder}", 0775, true);
|
||||
file_put_contents("{$data}/videos/{$folder}/" . str_repeat('b', 64) . '.mp4', str_repeat("\0", 2000));
|
||||
$doc = (new Store("{$data}/projects", 'ann'))->create('Mine');
|
||||
$projectBytes = filesize("{$data}/projects/{$doc['id']}.json");
|
||||
mkdir("{$data}/snapshots/{$doc['id']}", 0775, true);
|
||||
file_put_contents("{$data}/snapshots/{$doc['id']}/s1.json", str_repeat('x', 500));
|
||||
// Somebody else's things do not count, nor do the files that belong to nobody.
|
||||
$theirs = (new Store("{$data}/projects", 'bob'))->create('Theirs');
|
||||
file_put_contents("{$data}/sounds/" . str_repeat('c', 64) . '.wav', str_repeat("\0", 9000));
|
||||
|
||||
$quota = new Quota($data, 10_000);
|
||||
$used = $quota->usage('ann', $folder);
|
||||
check('usage adds the uploads, the projects and their snapshots', $used === 3000 + 2000 + $projectBytes + 500, [$used, $projectBytes]);
|
||||
check('what fits is let through', $quota->refusal('ann', $folder, 10_000 - $used) === null);
|
||||
$refusal = $quota->refusal('ann', $folder, 10_000 - $used + 1);
|
||||
check('one byte more is refused, saying how full the account is', is_string($refusal) && str_contains($refusal, 'Not enough space'), $refusal);
|
||||
check('a write that makes nothing larger always fits', (new Quota($data, 1))->refusal('ann', $folder, 0) === null);
|
||||
check(
|
||||
'an account without uploads counts its projects only',
|
||||
$quota->usage('bob', '') === filesize("{$data}/projects/{$theirs['id']}.json"),
|
||||
$quota->usage('bob', ''),
|
||||
);
|
||||
check('the limit is 1 GB unless a test says otherwise', Quota::BYTES === 1024 * 1024 * 1024);
|
||||
|
||||
exec('rm -rf ' . escapeshellarg($dir));
|
||||
|
||||
echo $failed === 0 ? "ALL PASSED – {$passed} checks\n" : "{$failed} FAILED, {$passed} passed\n";
|
||||
exit($failed === 0 ? 0 : 1);
|
||||
@@ -1,6 +1,11 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
// A command-line script: under a web server it does nothing (#427).
|
||||
if (PHP_SAPI !== 'cli') {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/**
|
||||
* The release store (#266) on a scratch directory. Plain PHP like snapshots.test.php; CI runs it
|
||||
* with `php tests/php/releases.test.php` and reads the last line.
|
||||
|
||||
@@ -0,0 +1,296 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
// A command-line script: under a web server it does nothing (#427).
|
||||
if (PHP_SAPI !== 'cli') {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/**
|
||||
* Who may do what (#427): every route of the API asked by somebody signed out, by the owner of what
|
||||
* it is about, by another account and by an administrator. The API runs for real under `php -S` on
|
||||
* a scratch directory (FEUERWERK_DATA) with a small quota (FEUERWERK_QUOTA_BYTES), so nothing of a
|
||||
* checkout's own data is touched.
|
||||
*
|
||||
* Each route the header comment of api/index.php names has to be in the matrix: a new route that is
|
||||
* not asked about here makes this test fail rather than stay open unnoticed.
|
||||
*
|
||||
* Plain PHP like releases.test.php; CI runs it with `php tests/php/rights.test.php`.
|
||||
*/
|
||||
|
||||
require __DIR__ . '/../../api/lib/AtomicFile.php';
|
||||
require __DIR__ . '/../../api/lib/UserStore.php';
|
||||
|
||||
$failed = 0;
|
||||
$passed = 0;
|
||||
|
||||
function check(string $name, bool $ok, mixed $got = null): void
|
||||
{
|
||||
global $failed, $passed;
|
||||
if ($ok) {
|
||||
$passed++;
|
||||
echo "PASS {$name}\n";
|
||||
return;
|
||||
}
|
||||
$failed++;
|
||||
echo "FAIL {$name}", $got === null ? '' : ' — got ' . json_encode($got, JSON_UNESCAPED_SLASHES), "\n";
|
||||
}
|
||||
|
||||
const QUOTA = 300_000;
|
||||
|
||||
$root = dirname(__DIR__, 2);
|
||||
$base = sys_get_temp_dir() . '/feuerwerk-php-rights-' . bin2hex(random_bytes(4));
|
||||
$data = "{$base}/data";
|
||||
mkdir("{$base}/www", 0775, true);
|
||||
mkdir($data, 0775, true);
|
||||
symlink($root, "{$base}/www/feuerwerk");
|
||||
|
||||
$users = new UserStore("{$data}/users.json");
|
||||
$users->put('alice', 'password-alice', 'user');
|
||||
$users->put('bob', 'password-bob', 'user');
|
||||
$users->put('root', 'password-root', 'admin');
|
||||
$users->put('carol', 'password-carol', 'user');
|
||||
|
||||
$probe = stream_socket_server('tcp://127.0.0.1:0');
|
||||
$port = (int) substr((string) stream_socket_get_name($probe, false), strrpos((string) stream_socket_get_name($probe, false), ':') + 1);
|
||||
fclose($probe);
|
||||
$server = proc_open(
|
||||
[PHP_BINARY, '-S', "127.0.0.1:{$port}", '-t', "{$base}/www"],
|
||||
[0 => ['file', '/dev/null', 'r'], 1 => ['file', '/dev/null', 'w'], 2 => ['file', "{$base}/server.log", 'w']],
|
||||
$pipes,
|
||||
null,
|
||||
['FEUERWERK_DATA' => $data, 'FEUERWERK_QUOTA_BYTES' => (string) QUOTA] + getenv(),
|
||||
);
|
||||
register_shutdown_function(static function () use ($server, $base): void {
|
||||
proc_terminate($server);
|
||||
exec('rm -rf ' . escapeshellarg($base));
|
||||
});
|
||||
|
||||
/**
|
||||
* One request against the API.
|
||||
*
|
||||
* @param array<string,string> $headers
|
||||
* @return array{status:int,body:mixed,headers:list<string>}
|
||||
*/
|
||||
function call(string $method, string $route, ?string $cookie = null, mixed $body = null, array $headers = []): array
|
||||
{
|
||||
global $port;
|
||||
$lines = [];
|
||||
if ($cookie !== null) {
|
||||
$lines[] = "Cookie: feuerwerk_session={$cookie}";
|
||||
}
|
||||
foreach ($headers as $name => $value) {
|
||||
$lines[] = "{$name}: {$value}";
|
||||
}
|
||||
$content = '';
|
||||
if (is_string($body)) {
|
||||
$content = $body;
|
||||
$lines[] = 'Content-Type: application/octet-stream';
|
||||
} elseif ($body !== null) {
|
||||
$content = (string) json_encode($body);
|
||||
$lines[] = 'Content-Type: application/json';
|
||||
}
|
||||
$context = stream_context_create(['http' => [
|
||||
'method' => $method,
|
||||
'header' => implode("\r\n", $lines),
|
||||
'content' => $content,
|
||||
'ignore_errors' => true,
|
||||
'timeout' => 20,
|
||||
]]);
|
||||
[$path, $query] = array_pad(explode('&', $route, 2), 2, null);
|
||||
$url = "http://127.0.0.1:{$port}/feuerwerk/api/index.php?r=" . $path . ($query === null ? '' : "&{$query}");
|
||||
$text = @file_get_contents($url, false, $context);
|
||||
$received = $http_response_header ?? [];
|
||||
preg_match('#^HTTP/\S+ (\d{3})#', $received[0] ?? '', $status);
|
||||
return [
|
||||
'status' => (int) ($status[1] ?? 0),
|
||||
'body' => $text === false || $text === '' ? null : json_decode($text, true),
|
||||
'headers' => $received,
|
||||
];
|
||||
}
|
||||
|
||||
function signIn(string $name, string $password): string
|
||||
{
|
||||
$answer = call('POST', 'auth/login', null, ['username' => $name, 'password' => $password]);
|
||||
foreach ($answer['headers'] as $line) {
|
||||
if (preg_match('/^Set-Cookie: feuerwerk_session=([^;]+)/i', $line, $match)) {
|
||||
return $match[1];
|
||||
}
|
||||
}
|
||||
throw new RuntimeException("{$name} could not sign in: " . json_encode($answer));
|
||||
}
|
||||
|
||||
$up = false;
|
||||
for ($i = 0; $i < 50 && !$up; $i++) {
|
||||
usleep(100_000);
|
||||
$up = call('GET', 'auth/session')['status'] === 200;
|
||||
}
|
||||
check('the API comes up on its scratch directory', $up, @file_get_contents("{$base}/server.log"));
|
||||
if (!$up) {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/** A PNG of one pixel: the smallest image the texture store takes. */
|
||||
$png = base64_decode('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR42mNk+M9QDwADhgGAWjR9awAAAABJRU5ErkJggg==');
|
||||
$wav = static fn(int $bytes, string $tag): string => 'RIFF' . pack('V', 36) . 'WAVE' . str_repeat("\0", $bytes) . $tag;
|
||||
|
||||
$alice = signIn('alice', 'password-alice');
|
||||
$bob = signIn('bob', 'password-bob');
|
||||
$admin = signIn('root', 'password-root');
|
||||
|
||||
// What the matrix asks about: a project of alice's that uses an image of hers, with a snapshot and a
|
||||
// release, and a sound of hers that nothing uses.
|
||||
$project = call('POST', 'projects', $alice, ['name' => 'Alice'])['body'];
|
||||
$texture = call('POST', 'textures&name=a.png', $alice, $png)['body']['file'] ?? '';
|
||||
$sound = call('POST', 'sounds&name=a.wav', $alice, $wav(32, 'alice'))['body']['file'] ?? '';
|
||||
$saved = call('PUT', "projects/{$project['id']}", $alice, [
|
||||
'revision' => 1,
|
||||
'project' => ['id' => $project['id'], 'name' => 'Alice', 'assets' => [['id' => 't', 'file' => $texture]]],
|
||||
]);
|
||||
$snapshot = call('POST', "projects/{$project['id']}/snapshots", $alice, ['name' => 'One'])['body'];
|
||||
$release = call('POST', "projects/{$project['id']}/release", $alice)['body'];
|
||||
check(
|
||||
'alice has her project, image, sound, snapshot and release',
|
||||
$saved['status'] === 200 && $texture !== '' && $sound !== '' && isset($snapshot['id'], $release['token']),
|
||||
[$saved['status'], $texture, $sound, $snapshot, $release],
|
||||
);
|
||||
$folder = explode('/', $texture)[0];
|
||||
$p = $project['id'];
|
||||
$s = $snapshot['id'];
|
||||
$missing = $folder . '/' . str_repeat('0', 64);
|
||||
|
||||
/**
|
||||
* Method, route, body, the route as the header comment of api/index.php names it, and the status
|
||||
* expected from [signed out, alice who owns it, bob who does not, an administrator]; null where
|
||||
* asking would destroy what the next rows need.
|
||||
*
|
||||
* @var list<array{0:string,1:string,2:mixed,3:string,4:array{0:?int,1:?int,2:?int,3:?int}}>
|
||||
*/
|
||||
$matrix = [
|
||||
['GET', 'auth/session', null, 'GET auth/session', [200, 200, 200, 200]],
|
||||
['POST', 'auth/login', ['username' => 'carol', 'password' => 'password-carol'], 'POST auth/login', [200, 200, 200, 200]],
|
||||
['POST', 'auth/logout', null, 'POST auth/logout', [204, null, null, null]],
|
||||
['POST', 'auth/password', ['currentPassword' => 'x', 'newPassword' => ''], 'POST auth/password', [401, 422, 422, 422]],
|
||||
|
||||
['GET', 'users', null, 'GET users', [401, 403, 403, 200]],
|
||||
['POST', 'users', ['username' => '', 'password' => '', 'role' => 'user'], 'POST users', [401, 403, 403, 422]],
|
||||
['PATCH', 'users/alice', [], 'PATCH users/{}', [401, 403, 403, 200]],
|
||||
['DELETE', 'users/nobody', null, 'DELETE users/{}', [401, 403, 403, 404]],
|
||||
|
||||
['GET', 'projects', null, 'GET projects', [401, 200, 200, 200]],
|
||||
['POST', 'projects', ['name' => ''], 'POST projects', [401, 422, 422, 422]],
|
||||
['GET', "projects/{$p}", null, 'GET projects/{}', [401, 200, 404, 200]],
|
||||
['PUT', "projects/{$p}", ['revision' => 999, 'project' => []], 'PUT projects/{}', [401, 409, 404, 409]],
|
||||
['DELETE', "projects/{$p}", null, 'DELETE projects/{}', [401, null, 404, 403]],
|
||||
['GET', "projects/{$p}/snapshots", null, 'GET projects/{}/snapshots', [401, 200, 404, 200]],
|
||||
['POST', "projects/{$p}/snapshots", [], 'POST projects/{}/snapshots', [401, 201, 404, 201]],
|
||||
['DELETE', "projects/{$p}/snapshots/{$s}", null, 'DELETE projects/{}/snapshots/{}', [401, null, 404, null]],
|
||||
['POST', "projects/{$p}/snapshots/{$s}/restore", ['revision' => -1], 'POST projects/{}/snapshots/{}/restore', [401, 409, 404, 409]],
|
||||
['GET', "projects/{$p}/release", null, 'GET projects/{}/release', [401, 200, 404, 200]],
|
||||
['POST', "projects/{$p}/release", null, 'POST projects/{}/release', [401, 200, 404, 200]],
|
||||
['DELETE', "projects/{$p}/release", null, 'DELETE projects/{}/release', [401, null, 404, null]],
|
||||
['GET', "releases/{$release['token']}", null, 'GET releases/{}', [200, 200, 200, 200]],
|
||||
|
||||
['GET', 'textures', null, 'GET textures', [401, 200, 200, 200]],
|
||||
['POST', 'textures&name=b.png', $png, 'POST textures', [401, 201, 201, 201]],
|
||||
['DELETE', "textures/{$texture}", null, 'DELETE textures/{}', [401, 409, 403, 409]],
|
||||
['GET', 'fonts', null, 'GET fonts', [401, 200, 200, 200]],
|
||||
['POST', 'fonts&name=x.ttf', 'not a font at all', 'POST fonts', [401, 422, 422, 422]],
|
||||
['DELETE', "fonts/{$missing}.ttf", null, 'DELETE fonts/{}', [401, 404, 403, 404]],
|
||||
['GET', 'sounds', null, 'GET sounds', [401, 200, 200, 200]],
|
||||
['POST', 'sounds&name=b.wav', $wav(32, 'b'), 'POST sounds', [401, 201, 201, 201]],
|
||||
['DELETE', "sounds/{$sound}", null, 'DELETE sounds/{}', [401, null, 403, null]],
|
||||
['GET', 'videos', null, 'GET videos', [401, 200, 200, 200]],
|
||||
['POST', 'videos&name=x.mov&convert=0', 'not a video at all', 'POST videos', [401, 422, 422, 422]],
|
||||
['POST', "videos/{$missing}.mp4/convert", null, 'POST videos/{}/convert', [401, 404, 403, 404]],
|
||||
['DELETE', "videos/{$missing}.mp4", null, 'DELETE videos/{}', [401, 404, 403, 404]],
|
||||
['POST', 'pixels', 'not a cel', 'POST pixels', [401, 422, 422, 422]],
|
||||
['GET', 'plugins', null, 'GET plugins', [401, 200, 200, 200]],
|
||||
['GET', 'plugins/nothing.js', null, 'GET plugins/{}', [401, 404, 404, 404]],
|
||||
];
|
||||
|
||||
$actors = ['signed out' => null, 'alice' => $alice, 'bob' => $bob, 'an administrator' => $admin];
|
||||
foreach ($matrix as [$method, $route, $body, $documented, $expected]) {
|
||||
$got = [];
|
||||
$want = [];
|
||||
foreach (array_values($actors) as $i => $cookie) {
|
||||
if ($expected[$i] === null) {
|
||||
continue;
|
||||
}
|
||||
$got[] = call($method, $route, $cookie, $body)['status'];
|
||||
$want[] = $expected[$i];
|
||||
}
|
||||
check("{$documented}: " . implode(' / ', array_map(
|
||||
static fn(string $who, ?int $status): string => "{$who} " . ($status ?? '-'),
|
||||
array_keys($actors),
|
||||
$expected,
|
||||
)), $got === $want, $got);
|
||||
}
|
||||
|
||||
// Every route the API documents is asked about above.
|
||||
preg_match_all('/^\s*\*\s+(GET|POST|PUT|PATCH|DELETE)\s+\?r=([^\s&\[]+)/m', (string) file_get_contents("{$root}/api/index.php"), $found, PREG_SET_ORDER);
|
||||
$documentedRoutes = array_values(array_unique(array_map(
|
||||
static fn(array $m): string => $m[1] . ' ' . preg_replace('/\{[^}]*\}/', '{}', $m[2]),
|
||||
$found,
|
||||
)));
|
||||
$asked = array_unique(array_column($matrix, 3));
|
||||
$unasked = array_values(array_diff($documentedRoutes, $asked));
|
||||
check('every route of the API is in the matrix', count($documentedRoutes) > 30 && $unasked === [], $unasked ?: count($documentedRoutes));
|
||||
check('and the matrix asks about no route the API does not name', array_values(array_diff($asked, $documentedRoutes)) === [], array_values(array_diff($asked, $documentedRoutes)));
|
||||
|
||||
// --- Paths, depth and unknown routes --------------------------------------------------------------
|
||||
|
||||
check('an unknown route is 401 signed out', call('GET', 'nothing')['status'] === 401);
|
||||
check('and 404 signed in', call('GET', 'nothing', $alice)['status'] === 404);
|
||||
check('a path that climbs out of a store is refused for a user', call('DELETE', 'textures/../users.json', $bob)['status'] === 403);
|
||||
check('and not found for an administrator', call('DELETE', 'textures/../users.json', $admin)['status'] === 404);
|
||||
check('a project id that climbs out is no project id', call('GET', 'projects/..%2Fusers', $alice)['status'] === 400);
|
||||
check('a route deeper than its kind allows is not there', call('GET', "projects/{$p}/snapshots/{$s}/restore/more", $alice)['status'] === 404);
|
||||
check('the accounts file is still there', is_file("{$data}/users.json"));
|
||||
|
||||
// --- Requests from other sites --------------------------------------------------------------------
|
||||
|
||||
check(
|
||||
'a write from another site is refused before anything else',
|
||||
call('POST', 'projects', $alice, ['name' => 'x'], ['Sec-Fetch-Site' => 'cross-site'])['status'] === 403,
|
||||
);
|
||||
check(
|
||||
'so is one from a sibling subdomain',
|
||||
call('POST', 'auth/login', null, ['username' => 'alice', 'password' => 'password-alice'], ['Sec-Fetch-Site' => 'same-site'])['status'] === 403,
|
||||
);
|
||||
check(
|
||||
'the editor’s own page passes',
|
||||
call('POST', 'projects', $alice, ['name' => ''], ['Sec-Fetch-Site' => 'same-origin'])['status'] === 422,
|
||||
);
|
||||
check('reading from another site is no write', call('GET', 'projects', $alice, null, ['Sec-Fetch-Site' => 'cross-site'])['status'] === 200);
|
||||
|
||||
// --- Quota ----------------------------------------------------------------------------------------
|
||||
|
||||
$large = $wav(QUOTA, 'large');
|
||||
$refused = call('POST', 'sounds&name=large.wav', $alice, $large);
|
||||
check(
|
||||
'an upload past the quota is refused with 413, saying how full the account is',
|
||||
$refused['status'] === 413 && str_contains((string) ($refused['body']['error'] ?? ''), 'Not enough space'),
|
||||
$refused,
|
||||
);
|
||||
check('an administrator has no quota', call('POST', 'sounds&name=large.wav', $admin, $large)['status'] === 201);
|
||||
$big = ['id' => $p, 'name' => 'Alice', 'assets' => [], 'pad' => str_repeat('x', QUOTA)];
|
||||
check('so is a save that would grow a project past it', call('PUT', "projects/{$p}", $alice, ['revision' => 2, 'project' => $big])['status'] === 413);
|
||||
check('a save that keeps it small goes through', call('PUT', "projects/{$p}", $alice, ['revision' => 2, 'project' => ['name' => 'Alice']])['status'] === 200);
|
||||
|
||||
// --- Sign-ins: the brake -------------------------------------------------------------------------
|
||||
|
||||
$gone = signIn('carol', 'password-carol');
|
||||
check('signing out ends that session', call('POST', 'auth/logout', $gone)['status'] === 204 && call('GET', 'projects', $gone)['status'] === 401);
|
||||
$wrong = [];
|
||||
for ($i = 0; $i < 5; $i++) {
|
||||
$wrong[] = call('POST', 'auth/login', null, ['username' => 'bob', 'password' => 'guess'])['status'];
|
||||
}
|
||||
check('five wrong passwords are five 401', $wrong === [401, 401, 401, 401, 401], $wrong);
|
||||
$locked = call('POST', 'auth/login', null, ['username' => 'bob', 'password' => 'password-bob']);
|
||||
$retry = preg_grep('/^Retry-After: \d+$/i', $locked['headers']);
|
||||
check('then even the right one waits, with 429 and Retry-After', $locked['status'] === 429 && $retry !== [], $locked);
|
||||
check('the session of somebody already signed in goes on', call('GET', 'projects', $alice)['status'] === 200);
|
||||
|
||||
echo $failed === 0 ? "ALL PASSED – {$passed} checks\n" : "{$failed} FAILED, {$passed} passed\n";
|
||||
exit($failed === 0 ? 0 : 1);
|
||||
@@ -1,6 +1,11 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
// A command-line script: under a web server it does nothing (#427).
|
||||
if (PHP_SAPI !== 'cli') {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/**
|
||||
* The snapshot store (#231) on a scratch directory. Plain PHP like accounts.test.php; CI runs it
|
||||
* with `php tests/php/snapshots.test.php` and reads the last line.
|
||||
|
||||
@@ -1,6 +1,11 @@
|
||||
<?php
|
||||
declare(strict_types=1);
|
||||
|
||||
// A command-line script: under a web server it does nothing (#427).
|
||||
if (PHP_SAPI !== 'cli') {
|
||||
exit(1);
|
||||
}
|
||||
|
||||
/**
|
||||
* Videos (#402): the conversion rules, the store and its queue, and the worker with the real
|
||||
* ffmpeg. Plain PHP like files.test.php; CI runs it with `php tests/php/videos.test.php`. It needs
|
||||
|
||||
Reference in new issue
Block a user