adminandClaude Opus 5.5
cfd6d7a8df
The editor is about to be opened to strangers: a post on Reddit and a guest access (#428). nginx served the whole workspace and ran every PHP file in it, the API let anybody guess passwords as fast as they liked, and one account could fill the disk. - nginx (shared web stack, outside this repo, backup in /root/config-backup-20261015/) hands out only the two pages, dist/, public/brand/, the uploads by kind and ending, and api/index.php. Everything else under /feuerwerk/ is a 404. - PHP behind it has display_errors off and no X-Powered-By. Plain HTTP forwards to HTTPS, the API refuses it. - Headers: a Content-Security-Policy without inline code or eval, nosniff, frame-ancestors, HSTS, Referrer-, Permissions-, COOP, CORP. - vite.config.ts writes the same policy into the built pages, so CI runs the whole suite under it. Pixi gets by without eval through pixi.js/unsafe-eval. The page CSS left its inline style for a file. - The harness fails a module for anything the policy refuses, from Chrome's log and from the page's securitypolicyviolation event. - LoginThrottle: five wrong passwords from one address within 15 minutes, and it gets 429 until 15 minutes after the last of them. The address is the last X-Forwarded-For entry, the Brandmauer's own. - Quota: 1 GB per account for uploads, projects and snapshots. Only a write that grows the account is refused (413). Admins have no limit. - A write whose Sec-Fetch-Site says another site is refused (403). - The session cookie carries Secure, nginx passes HTTPS on. - showFailure puts the message in as text, not as HTML. - Every PHP script outside api/ stops unless it runs on the command line. - The video worker sees the checkout read-only and can only write data/videos. No capabilities, 2 GB and 256 processes at most. - tests/php/rights.test.php runs the API under php -S on a scratch directory and asks every route as signed out, owner, stranger and admin. A route named in api/index.php but missing in the matrix fails it. limits.test.php covers the brake and the quota. Findings: - tmp/ was readable from outside, with 79 copies of project files. Closed on 15.10. at 20:02 with chmod 750. The log back to 11.10. shows only our own requests. - Port 8080 is bound on 0.0.0.0, so the LAN could reach nginx past the Brandmauer. Left as it is: the web stack is not this project's. - npm audit finds nothing in what is shipped. Dev tools (vitest, brace-expansion, source-map-js) have advisories, not touched here. Tests: check 313 files / 4843 tests. PHP limits 21, rights 60, accounts 56, snapshots 15, releases 20, files 46 (videos 50/51, no ffmpeg in the web container). e2e on stein2, atx was off: 34+38+41 197/198, the one red check (a click in 41) passes with 41 alone, 27/27. 67 misses frames at 1080p on stein2 with and without this. Path list from outside: 10 served, 26 refused. ZAP baseline against the live site: nothing High or Medium under /feuerwerk/. Counter-checks: rights.test.php without the cross-site guard, the quota, the brake, the admin check of users, or with an undocumented route fails each time. A policy without wasm-unsafe-eval fails e2e 41 with the harness's own CSP line. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
84 lines
3.4 KiB
PHP
84 lines
3.4 KiB
PHP
<?php
|
||
declare(strict_types=1);
|
||
|
||
// A command-line script: under a web server it does nothing (#427).
|
||
if (PHP_SAPI !== 'cli') {
|
||
exit(1);
|
||
}
|
||
|
||
/**
|
||
* The release store (#266) on a scratch directory. Plain PHP like snapshots.test.php; CI runs it
|
||
* with `php tests/php/releases.test.php` and reads the last line.
|
||
*/
|
||
|
||
require __DIR__ . '/../../api/lib/AtomicFile.php';
|
||
require __DIR__ . '/../../api/lib/Store.php';
|
||
require __DIR__ . '/../../api/lib/ReleaseStore.php';
|
||
|
||
$failed = 0;
|
||
$passed = 0;
|
||
|
||
function check(string $name, bool $ok, mixed $got = null): void
|
||
{
|
||
global $failed, $passed;
|
||
if ($ok) {
|
||
$passed++;
|
||
echo "PASS {$name}\n";
|
||
return;
|
||
}
|
||
$failed++;
|
||
echo "FAIL {$name}", $got === null ? '' : ' — got ' . json_encode($got), "\n";
|
||
}
|
||
|
||
$dir = sys_get_temp_dir() . '/feuerwerk-php-releases-' . bin2hex(random_bytes(4));
|
||
mkdir($dir);
|
||
$releases = new ReleaseStore($dir);
|
||
|
||
check('a project that was never released has none', $releases->of('p1') === null);
|
||
check('taking down a project without a release says so', $releases->takeDown('p1') === false);
|
||
|
||
$doc = ['id' => 'p1', 'name' => 'Game', 'revision' => 4, 'project' => ['id' => 'p1', 'assets' => [['id' => 'a']]]];
|
||
$first = $releases->publish($doc);
|
||
check('publishing hands out a 128-bit token', ReleaseStore::isValidToken($first['token']), $first);
|
||
check('the summary names the revision it copied', $first['revision'] === 4, $first);
|
||
check('the project now has that release', $releases->of('p1') === $first, $releases->of('p1'));
|
||
|
||
$loaded = $releases->load($first['token']);
|
||
check(
|
||
'the token loads the copy, its name and its project',
|
||
$loaded !== null && $loaded['project'] === $doc['project'] && $loaded['name'] === 'Game' && $loaded['projectId'] === 'p1',
|
||
$loaded,
|
||
);
|
||
check('the release file is not readable for the web server', (fileperms("{$dir}/{$first['token']}.json") & 0o007) === 0);
|
||
check('nor is the file that says which link a project has', (fileperms("{$dir}/projects/p1.json") & 0o007) === 0);
|
||
|
||
$changed = ['revision' => 7, 'project' => ['id' => 'p1', 'assets' => []]] + $doc;
|
||
$second = $releases->publish($changed);
|
||
check('publishing again keeps the link', $second['token'] === $first['token'], $second);
|
||
check('and replaces the copy', $releases->load($first['token'])['project'] === $changed['project']);
|
||
check('with the new revision', $second['revision'] === 7, $second);
|
||
|
||
$other = $releases->publish(['id' => 'p2'] + $doc);
|
||
check('another project gets another link', $other['token'] !== $first['token']);
|
||
|
||
check('an unknown token loads nothing', $releases->load(str_repeat('0', 32)) === null);
|
||
check('a token of the wrong shape loads nothing', $releases->load('../projects/p1') === null);
|
||
check('a project id is not a token', $releases->load('p1') === null);
|
||
|
||
check('taking down a release says so', $releases->takeDown('p1') === true);
|
||
check('the link is dead afterwards', $releases->load($first['token']) === null);
|
||
check('and the project has no release', $releases->of('p1') === null);
|
||
check('the other project keeps its own', $releases->load($other['token']) !== null);
|
||
|
||
$again = $releases->publish($doc);
|
||
check('publishing after a take-down hands out a new link', $again['token'] !== $first['token'], $again);
|
||
|
||
foreach (array_merge(glob("{$dir}/projects/*") ?: [], glob("{$dir}/*.json") ?: []) as $file) {
|
||
unlink($file);
|
||
}
|
||
@rmdir("{$dir}/projects");
|
||
@rmdir($dir);
|
||
|
||
echo $failed === 0 ? "ALL PASSED – {$passed} checks\n" : "{$failed} FAILED, {$passed} passed\n";
|
||
exit($failed === 0 ? 0 : 1);
|