adminandClaude Opus 5.5
cfd6d7a8df
The editor is about to be opened to strangers: a post on Reddit and a guest access (#428). nginx served the whole workspace and ran every PHP file in it, the API let anybody guess passwords as fast as they liked, and one account could fill the disk. - nginx (shared web stack, outside this repo, backup in /root/config-backup-20261015/) hands out only the two pages, dist/, public/brand/, the uploads by kind and ending, and api/index.php. Everything else under /feuerwerk/ is a 404. - PHP behind it has display_errors off and no X-Powered-By. Plain HTTP forwards to HTTPS, the API refuses it. - Headers: a Content-Security-Policy without inline code or eval, nosniff, frame-ancestors, HSTS, Referrer-, Permissions-, COOP, CORP. - vite.config.ts writes the same policy into the built pages, so CI runs the whole suite under it. Pixi gets by without eval through pixi.js/unsafe-eval. The page CSS left its inline style for a file. - The harness fails a module for anything the policy refuses, from Chrome's log and from the page's securitypolicyviolation event. - LoginThrottle: five wrong passwords from one address within 15 minutes, and it gets 429 until 15 minutes after the last of them. The address is the last X-Forwarded-For entry, the Brandmauer's own. - Quota: 1 GB per account for uploads, projects and snapshots. Only a write that grows the account is refused (413). Admins have no limit. - A write whose Sec-Fetch-Site says another site is refused (403). - The session cookie carries Secure, nginx passes HTTPS on. - showFailure puts the message in as text, not as HTML. - Every PHP script outside api/ stops unless it runs on the command line. - The video worker sees the checkout read-only and can only write data/videos. No capabilities, 2 GB and 256 processes at most. - tests/php/rights.test.php runs the API under php -S on a scratch directory and asks every route as signed out, owner, stranger and admin. A route named in api/index.php but missing in the matrix fails it. limits.test.php covers the brake and the quota. Findings: - tmp/ was readable from outside, with 79 copies of project files. Closed on 15.10. at 20:02 with chmod 750. The log back to 11.10. shows only our own requests. - Port 8080 is bound on 0.0.0.0, so the LAN could reach nginx past the Brandmauer. Left as it is: the web stack is not this project's. - npm audit finds nothing in what is shipped. Dev tools (vitest, brace-expansion, source-map-js) have advisories, not touched here. Tests: check 313 files / 4843 tests. PHP limits 21, rights 60, accounts 56, snapshots 15, releases 20, files 46 (videos 50/51, no ffmpeg in the web container). e2e on stein2, atx was off: 34+38+41 197/198, the one red check (a click in 41) passes with 41 alone, 27/27. 67 misses frames at 1080p on stein2 with and without this. Path list from outside: 10 served, 26 refused. ZAP baseline against the live site: nothing High or Medium under /feuerwerk/. Counter-checks: rights.test.php without the cross-site guard, the quota, the brake, the admin check of users, or with an undocumented route fails each time. A policy without wasm-unsafe-eval fails e2e 41 with the harness's own CSP line. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
60 lines
2.8 KiB
Bash
60 lines
2.8 KiB
Bash
#!/bin/bash
|
||
# Sourced, not run: it leaves the PHP server in the caller's background and exports
|
||
# FEUERWERK_BASE_URL, which every tool reads.
|
||
#
|
||
# The build wires its assets absolutely under /feuerwerk/dist/, so the checkout has to be
|
||
# served under that path segment – hence the symlink into /srv rather than `-t .`.
|
||
|
||
export FEUERWERK_BASE_URL=http://127.0.0.1:8080/feuerwerk/
|
||
|
||
feuerwerk_serve() {
|
||
local root
|
||
root=$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)
|
||
|
||
mkdir -p "$root/data/projects" "$root/data/textures"
|
||
node "$root/tools/ci/project-shells.mjs"
|
||
# The sign-in checks type wrong passwords on purpose, and every request here comes from one
|
||
# address: two runs within 15 minutes would lock the second one out (#427).
|
||
rm -rf "$root/data/sign-ins"
|
||
|
||
# Since #177 the API needs a session, and the check tools sign in as `e2e`. A fresh checkout has
|
||
# no accounts at all, so the job makes the one it needs, with a password of its own.
|
||
if [ ! -f "$root/data/e2e-password.txt" ]; then
|
||
head -c 24 /dev/urandom | base64 | tr -d '\n' >"$root/data/e2e-password.txt"
|
||
echo >>"$root/data/e2e-password.txt"
|
||
fi
|
||
php "$root/tools/make-user.php" e2e "$(cat "$root/data/e2e-password.txt")"
|
||
# The user management step (#179) needs an administrator of its own; it owns no project.
|
||
if [ ! -f "$root/data/e2e-admin-password.txt" ]; then
|
||
head -c 24 /dev/urandom | base64 | tr -d '\n' >"$root/data/e2e-admin-password.txt"
|
||
echo >>"$root/data/e2e-admin-password.txt"
|
||
fi
|
||
php "$root/tools/make-user.php" e2e-admin "$(cat "$root/data/e2e-admin-password.txt")" admin
|
||
|
||
# A server from an earlier step of the same job is fine to keep. Asked of the one route that
|
||
# answers without a session, so "is it up" does not depend on being signed in.
|
||
if curl -sf "${FEUERWERK_BASE_URL}api/index.php?r=auth/session" >/dev/null 2>&1; then
|
||
echo "server already up at $FEUERWERK_BASE_URL"
|
||
return 0
|
||
fi
|
||
|
||
mkdir -p /srv && ln -sfn "$root" /srv/feuerwerk
|
||
# Uploaded videos are converted by the worker (#402); on stein2 that is the container
|
||
# feuerwerk-video, here a process beside the server.
|
||
php "$root/tools/video-worker.php" "$root/data" >/tmp/video-worker.log 2>&1 &
|
||
# Without workers the single-threaded dev server stalls: the editor fetches project and
|
||
# textures in parallel. The router serves videos with Range requests, see there.
|
||
PHP_CLI_SERVER_WORKERS=8 php -S 0.0.0.0:8080 -t /srv "$root/tools/ci/router.php" >/tmp/php-server.log 2>&1 &
|
||
|
||
for _ in $(seq 60); do
|
||
curl -sf "${FEUERWERK_BASE_URL}api/index.php?r=auth/session" >/dev/null 2>&1 && break
|
||
sleep 0.5
|
||
done
|
||
if ! curl -sf "${FEUERWERK_BASE_URL}api/index.php?r=auth/session" >/dev/null 2>&1; then
|
||
echo "the server never came up" >&2
|
||
tail -20 /tmp/php-server.log >&2
|
||
return 1
|
||
fi
|
||
echo "serving $root at $FEUERWERK_BASE_URL"
|
||
}
|