adminandClaude Opus 5.5
cfd6d7a8df
The editor is about to be opened to strangers: a post on Reddit and a guest access (#428). nginx served the whole workspace and ran every PHP file in it, the API let anybody guess passwords as fast as they liked, and one account could fill the disk. - nginx (shared web stack, outside this repo, backup in /root/config-backup-20261015/) hands out only the two pages, dist/, public/brand/, the uploads by kind and ending, and api/index.php. Everything else under /feuerwerk/ is a 404. - PHP behind it has display_errors off and no X-Powered-By. Plain HTTP forwards to HTTPS, the API refuses it. - Headers: a Content-Security-Policy without inline code or eval, nosniff, frame-ancestors, HSTS, Referrer-, Permissions-, COOP, CORP. - vite.config.ts writes the same policy into the built pages, so CI runs the whole suite under it. Pixi gets by without eval through pixi.js/unsafe-eval. The page CSS left its inline style for a file. - The harness fails a module for anything the policy refuses, from Chrome's log and from the page's securitypolicyviolation event. - LoginThrottle: five wrong passwords from one address within 15 minutes, and it gets 429 until 15 minutes after the last of them. The address is the last X-Forwarded-For entry, the Brandmauer's own. - Quota: 1 GB per account for uploads, projects and snapshots. Only a write that grows the account is refused (413). Admins have no limit. - A write whose Sec-Fetch-Site says another site is refused (403). - The session cookie carries Secure, nginx passes HTTPS on. - showFailure puts the message in as text, not as HTML. - Every PHP script outside api/ stops unless it runs on the command line. - The video worker sees the checkout read-only and can only write data/videos. No capabilities, 2 GB and 256 processes at most. - tests/php/rights.test.php runs the API under php -S on a scratch directory and asks every route as signed out, owner, stranger and admin. A route named in api/index.php but missing in the matrix fails it. limits.test.php covers the brake and the quota. Findings: - tmp/ was readable from outside, with 79 copies of project files. Closed on 15.10. at 20:02 with chmod 750. The log back to 11.10. shows only our own requests. - Port 8080 is bound on 0.0.0.0, so the LAN could reach nginx past the Brandmauer. Left as it is: the web stack is not this project's. - npm audit finds nothing in what is shipped. Dev tools (vitest, brace-expansion, source-map-js) have advisories, not touched here. Tests: check 313 files / 4843 tests. PHP limits 21, rights 60, accounts 56, snapshots 15, releases 20, files 46 (videos 50/51, no ffmpeg in the web container). e2e on stein2, atx was off: 34+38+41 197/198, the one red check (a click in 41) passes with 41 alone, 27/27. 67 misses frames at 1080p on stein2 with and without this. Path list from outside: 10 served, 26 refused. ZAP baseline against the live site: nothing High or Medium under /feuerwerk/. Counter-checks: rights.test.php without the cross-site guard, the quota, the brake, the admin check of users, or with an undocumented route fails each time. A policy without wasm-unsafe-eval fails e2e 41 with the harness's own CSP line. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
73 lines
2.4 KiB
YAML
73 lines
2.4 KiB
YAML
# Runs the whole proof on the Gitea runner: gate, the editor suite and the three example games.
|
||
#
|
||
# The suite runs on `feuerwerk-wsl`, the runner in the WSL2 distro feuerwerk-ci on
|
||
# melektaus-atx (#283). Its label picks the image built from tools/ci/Dockerfile. The GPU
|
||
# (/dev/dxg and the Windows driver libraries), /dev/shm and FEUERWERK_BROWSER=wsl come from that
|
||
# runner's own config.yaml, not from here – without them chromium falls back to software WebGL and
|
||
# the harness stops. The gate needs no GPU and runs on `feuerwerk-ci`, the runner on stein2 with
|
||
# the same image. Pointing the suite at that label too moves the browser runs back to stein2.
|
||
#
|
||
# Two jobs without `needs:`, so they start together. The gate does not stand in front of the
|
||
# suite: a lint error used to cost the full e2e run before it was reported, and the run reported
|
||
# it after six minutes instead of one. Both still have to pass for the push to be green.
|
||
#
|
||
# On two runners the gate's vitest no longer shares cores with the suite's chromium, which
|
||
# measures text widths and frame counts. GM_TEST_WORKERS still caps vitest at two workers, for the
|
||
# day both jobs share one runner again.
|
||
name: feuerwerk
|
||
|
||
on:
|
||
push:
|
||
workflow_dispatch:
|
||
|
||
jobs:
|
||
gate:
|
||
runs-on: feuerwerk-ci
|
||
timeout-minutes: 20
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: Install
|
||
run: npm ci --no-audit --no-fund
|
||
|
||
- name: Gate
|
||
run: ./check.sh
|
||
env:
|
||
GM_TEST_WORKERS: 2
|
||
|
||
# The API's own rules (#180, #179, #231, #266, #427). Not part of check.sh: the host the editor is
|
||
# built on has no PHP, the image does. rights.test.php runs the API itself under `php -S`.
|
||
- name: PHP tests
|
||
run: |
|
||
php tests/php/accounts.test.php
|
||
php tests/php/snapshots.test.php
|
||
php tests/php/releases.test.php
|
||
php tests/php/files.test.php
|
||
php tests/php/videos.test.php
|
||
php tests/php/limits.test.php
|
||
php tests/php/rights.test.php
|
||
|
||
suite:
|
||
runs-on: feuerwerk-wsl
|
||
timeout-minutes: 45
|
||
steps:
|
||
- uses: actions/checkout@v4
|
||
|
||
- name: Versions
|
||
run: |
|
||
node --version
|
||
chromium --version
|
||
php --version | head -1
|
||
|
||
- name: Install
|
||
run: npm ci --no-audit --no-fund
|
||
|
||
- name: Build
|
||
run: npm run build
|
||
|
||
- name: Editor suite
|
||
run: tools/ci/run-e2e.sh
|
||
|
||
- name: Example games
|
||
run: tools/ci/run-smokes.sh
|