adminandClaude Opus 5.5
cfd6d7a8df
The editor is about to be opened to strangers: a post on Reddit and a guest access (#428). nginx served the whole workspace and ran every PHP file in it, the API let anybody guess passwords as fast as they liked, and one account could fill the disk. - nginx (shared web stack, outside this repo, backup in /root/config-backup-20261015/) hands out only the two pages, dist/, public/brand/, the uploads by kind and ending, and api/index.php. Everything else under /feuerwerk/ is a 404. - PHP behind it has display_errors off and no X-Powered-By. Plain HTTP forwards to HTTPS, the API refuses it. - Headers: a Content-Security-Policy without inline code or eval, nosniff, frame-ancestors, HSTS, Referrer-, Permissions-, COOP, CORP. - vite.config.ts writes the same policy into the built pages, so CI runs the whole suite under it. Pixi gets by without eval through pixi.js/unsafe-eval. The page CSS left its inline style for a file. - The harness fails a module for anything the policy refuses, from Chrome's log and from the page's securitypolicyviolation event. - LoginThrottle: five wrong passwords from one address within 15 minutes, and it gets 429 until 15 minutes after the last of them. The address is the last X-Forwarded-For entry, the Brandmauer's own. - Quota: 1 GB per account for uploads, projects and snapshots. Only a write that grows the account is refused (413). Admins have no limit. - A write whose Sec-Fetch-Site says another site is refused (403). - The session cookie carries Secure, nginx passes HTTPS on. - showFailure puts the message in as text, not as HTML. - Every PHP script outside api/ stops unless it runs on the command line. - The video worker sees the checkout read-only and can only write data/videos. No capabilities, 2 GB and 256 processes at most. - tests/php/rights.test.php runs the API under php -S on a scratch directory and asks every route as signed out, owner, stranger and admin. A route named in api/index.php but missing in the matrix fails it. limits.test.php covers the brake and the quota. Findings: - tmp/ was readable from outside, with 79 copies of project files. Closed on 15.10. at 20:02 with chmod 750. The log back to 11.10. shows only our own requests. - Port 8080 is bound on 0.0.0.0, so the LAN could reach nginx past the Brandmauer. Left as it is: the web stack is not this project's. - npm audit finds nothing in what is shipped. Dev tools (vitest, brace-expansion, source-map-js) have advisories, not touched here. Tests: check 313 files / 4843 tests. PHP limits 21, rights 60, accounts 56, snapshots 15, releases 20, files 46 (videos 50/51, no ffmpeg in the web container). e2e on stein2, atx was off: 34+38+41 197/198, the one red check (a click in 41) passes with 41 alone, 27/27. 67 misses frames at 1080p on stein2 with and without this. Path list from outside: 10 served, 26 refused. ZAP baseline against the live site: nothing High or Medium under /feuerwerk/. Counter-checks: rights.test.php without the cross-site guard, the quota, the brake, the admin check of users, or with an undocumented route fails each time. A policy without wasm-unsafe-eval fails e2e 41 with the harness's own CSP line. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
86 lines
3.4 KiB
PHP
86 lines
3.4 KiB
PHP
<?php
|
||
declare(strict_types=1);
|
||
|
||
// A command-line script: under a web server it does nothing (#427).
|
||
if (PHP_SAPI !== 'cli') {
|
||
exit(1);
|
||
}
|
||
|
||
/**
|
||
* The snapshot store (#231) on a scratch directory. Plain PHP like accounts.test.php; CI runs it
|
||
* with `php tests/php/snapshots.test.php` and reads the last line.
|
||
*/
|
||
|
||
require __DIR__ . '/../../api/lib/AtomicFile.php';
|
||
require __DIR__ . '/../../api/lib/Store.php';
|
||
require __DIR__ . '/../../api/lib/SnapshotStore.php';
|
||
|
||
$failed = 0;
|
||
$passed = 0;
|
||
|
||
function check(string $name, bool $ok, mixed $got = null): void
|
||
{
|
||
global $failed, $passed;
|
||
if ($ok) {
|
||
$passed++;
|
||
echo "PASS {$name}\n";
|
||
return;
|
||
}
|
||
$failed++;
|
||
echo "FAIL {$name}", $got === null ? '' : ' — got ' . json_encode($got), "\n";
|
||
}
|
||
|
||
$dir = sys_get_temp_dir() . '/feuerwerk-php-snapshots-' . bin2hex(random_bytes(4));
|
||
mkdir($dir);
|
||
$snapshots = new SnapshotStore($dir);
|
||
|
||
check('a project without snapshots lists none', $snapshots->list('p1') === []);
|
||
|
||
$doc = ['revision' => 4, 'project' => ['id' => 'p1', 'name' => 'Game', 'assets' => [['id' => 'a']]]];
|
||
$first = $snapshots->create('p1', $doc, 'first');
|
||
$second = $snapshots->create('p1', ['revision' => 5] + $doc, 'second');
|
||
check('a snapshot keeps its name and the revision it copied', $first['name'] === 'first' && $first['revision'] === 4, $first);
|
||
check('two snapshots get two ids', $first['id'] !== $second['id']);
|
||
check('the summary carries no project', !isset($first['project']));
|
||
check('the snapshot file is not readable for the web server', (fileperms("{$dir}/p1/{$first['id']}.json") & 0o007) === 0);
|
||
|
||
$listed = $snapshots->list('p1');
|
||
check(
|
||
'the list is newest first, also within one second',
|
||
array_column($listed, 'name') === ['second', 'first'],
|
||
array_column($listed, 'name'),
|
||
);
|
||
// The ids are random, so two files come back from the folder in the right order half the time
|
||
// anyway. With eight, the folder's own order matching by chance is one in 40320.
|
||
$more = new SnapshotStore("{$dir}/order");
|
||
foreach (range(1, 8) as $n) {
|
||
$more->create('p', $doc, "n{$n}");
|
||
}
|
||
check(
|
||
'eight made in a row list in reverse order of making',
|
||
array_column($more->list('p'), 'name') === ['n8', 'n7', 'n6', 'n5', 'n4', 'n3', 'n2', 'n1'],
|
||
array_column($more->list('p'), 'name'),
|
||
);
|
||
|
||
$loaded = $snapshots->load('p1', $first['id']);
|
||
check('a snapshot loads the project as it was copied', $loaded !== null && $loaded['project'] === $doc['project'], $loaded);
|
||
check('a snapshot of another project is not found', $snapshots->load('p2', $first['id']) === null);
|
||
|
||
file_put_contents("{$dir}/p1/broken.json", '{"id":"broken"');
|
||
check('a broken file is left out of the list', count($snapshots->list('p1')) === 2, $snapshots->list('p1'));
|
||
unlink("{$dir}/p1/broken.json");
|
||
|
||
check('deleting a snapshot says so', $snapshots->delete('p1', $first['id']));
|
||
check('it is gone from the list', array_column($snapshots->list('p1'), 'name') === ['second']);
|
||
check('deleting it again says it was not there', !$snapshots->delete('p1', $first['id']));
|
||
|
||
$snapshots->create('p2', $doc, 'other');
|
||
$snapshots->deleteAll('p1');
|
||
check('deleting all removes the folder of that project', !is_dir("{$dir}/p1"));
|
||
check('and leaves the snapshots of other projects', count($snapshots->list('p2')) === 1);
|
||
|
||
exec('rm -rf ' . escapeshellarg($dir));
|
||
|
||
echo $failed === 0 ? "ALL PASSED – {$passed} checks\n" : "{$failed} FAILED, {$passed} passed\n";
|
||
exit($failed === 0 ? 0 : 1);
|