tim/xxx
1
0
Fork 0
Code Issues Pull Requests Releases Activity

Take redirects off the Host header.

Browse Source 
Same-site redirects are now relative paths, and a saved page on another site is ignored. The HTTP to HTTPS redirect takes its host from the new SITE_URL setting, and without it the pages refuse plain HTTP.
This commit is contained in:
tim
2026-09-26 15:27:51 +02:00
parent 4657088d23
commit be814a3ba5
16 changed files with 149 additions and 73 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tests/php/Pages/AddEditorTest.php
+3 -3
View File
@@ -20,13 +20,13 @@ class AddEditorTest extends PageTestCase {
public function testVisitorsAreSentToTheLogin(): void {
$this->cookies = array();
$this->assertRedirect('https://xxx.org.za/publish/login', $this->get('/publish/addeditor'));
$this->assertRedirect('https://xxx.org.za/publish/login', $this->add(array('csrf_token' => '')));
$this->assertRedirect('/publish/login', $this->get('/publish/addeditor'));
$this->assertRedirect('/publish/login', $this->add(array('csrf_token' => '')));
$this->assertCount(1, $this->tables()['editors']);
}
public function testPlainHttpIsSentToHttps(): void {
$this->assertRedirect('https://xxx.org.za/publish/addeditor', $this->get('/publish/addeditor', array('X-Test-Plain' => '1')));
$this->assertRedirect('https://site.test/publish/addeditor', $this->get('/publish/addeditor', array('X-Test-Plain' => '1')));
}
public function testTheFormHasTheToken(): void {
tests/php/Pages/EditTest.php
+2 -2
View File
@@ -23,11 +23,11 @@ class EditTest extends PageTestCase {
public function testVisitorsAreSentToTheLogin(): void {
$this->cookies = array();
$this->assertRedirect('https://xxx.org.za/publish/login', $this->get('/publish/edit'));
$this->assertRedirect('/publish/login', $this->get('/publish/edit'));
}
public function testPlainHttpIsSentToHttps(): void {
$this->assertRedirect('https://xxx.org.za/publish/edit?id=1', $this->get('/publish/edit?id=1', array('X-Test-Plain' => '1')));
$this->assertRedirect('https://site.test/publish/edit?id=1', $this->get('/publish/edit?id=1', array('X-Test-Plain' => '1')));
}
public function testTheQueueIsShownFirst(): void {
tests/php/Pages/HttpsTest.php
+23
View File
@@ -0,0 +1,23 @@
<?php
namespace Xxx\Tests\Pages;
use Xxx\Tests\Support\PageTestCase;
// require_https() in config.lib.php when SITE_URL is empty
class HttpsTest extends PageTestCase {
protected static function serverEnv(): array {
// proc_open() drops a variable with an empty value, so use a blank one
return array('SITE_URL' => ' ');
}
public function testWithoutASiteUrlPlainHttpIsRefused(): void {
$answer = $this->get('/publish/login', array('X-Test-Plain' => '1'));
$this->assertSame(403, $answer['status']);
$this->assertNull($this->header($answer, 'Location'));
$this->assertSame("This page needs HTTPS.\n", $answer['body']);
}
public function testWithoutASiteUrlHttpsStillWorks(): void {
$this->assertSame(200, $this->get('/publish/login')['status']);
}
}
tests/php/Pages/LoginTest.php
+48 -12
View File
@@ -1,6 +1,7 @@
<?php
namespace Xxx\Tests\Pages;
use PHPUnit\Framework\Attributes\DataProvider;
use Xxx\Tests\Support\PageTestCase;
// publish/login.php, publish/logout.php and persistent logins
@@ -25,16 +26,17 @@ class LoginTest extends PageTestCase {
* sends an editor on to the edit page.
*/
private function assertLoggedIn(array $answer): void {
$this->assertRedirect('https://' . $this->host() . '/publish/login', $answer);
$this->assertRedirect('https://xxx.org.za/publish/edit', $this->get('/publish/login'));
}
private function host(): string {
return parse_url(self::$base, PHP_URL_HOST) . ':' . parse_url(self::$base, PHP_URL_PORT);
$this->assertRedirect('/publish/login', $answer);
$this->assertRedirect('/publish/edit', $this->get('/publish/login'));
}
public function testPlainHttpIsSentToHttps(): void {
$this->assertRedirect('https://xxx.org.za/publish/login', $this->get('/publish/login', array('X-Test-Plain' => '1')));
$this->assertRedirect('https://site.test/publish/login', $this->get('/publish/login', array('X-Test-Plain' => '1')));
}
public function testAForgedHostDoesNotMoveTheHttpsRedirect(): void {
$this->assertRedirect('https://site.test/publish/login',
$this->get('/publish/login', array('X-Test-Plain' => '1', 'Host' => 'evil.example')));
}
public function testTheFormHasATokenAndTheCaptcha(): void {
@@ -60,16 +62,38 @@ class LoginTest extends PageTestCase {
$this->get('/article?id=1');
$answer = $this->post('/publish/login', array('login' => '1', 'username' => 'ed', 'password' => 'secret',
'csrf_token' => $token, 'g-recaptcha-response' => 'pass'));
$this->assertRedirect('https://' . $this->host() . '/article?id=1', $answer);
$this->assertRedirect('/article?id=1', $answer);
$this->assertArrayNotHasKey('referrer', $this->session());
}
public function testAForgedHostDoesNotMoveTheLoginRedirect(): void {
$token = $this->csrfToken($this->get('/publish/login')['body']);
$this->get('/article?id=1');
$answer = $this->request('POST', '/publish/login', array('login' => '1', 'username' => 'ed', 'password' => 'secret',
'csrf_token' => $token, 'g-recaptcha-response' => 'pass'),
array('Host' => 'evil.example'));
$this->assertRedirect('/article?id=1', $answer);
}
public static function otherSites(): array {
return array(array('@evil.example/'), array('//evil.example/'), array('/\\evil.example/'), array('https://evil.example/'));
}
#[DataProvider('otherSites')]
public function testALastPageOnAnotherSiteIsIgnored(string $referrer): void {
$token = $this->csrfToken($this->get('/publish/login')['body']);
$this->startSession(array('csrf_token' => $token, 'referrer' => $referrer));
$answer = $this->post('/publish/login', array('login' => '1', 'username' => 'ed', 'password' => 'secret',
'csrf_token' => $token, 'g-recaptcha-response' => 'pass'));
$this->assertRedirect('/publish/edit', $answer);
}
public function testWithoutALastPageTheLoginGoesToTheEditPage(): void {
$token = $this->csrfToken($this->get('/publish/login')['body']);
$this->startSession(array('csrf_token' => $token));
$answer = $this->post('/publish/login', array('login' => '1', 'username' => 'ed', 'password' => 'secret',
'csrf_token' => $token, 'g-recaptcha-response' => 'pass'));
$this->assertRedirect('https://xxx.org.za/publish/edit', $answer);
$this->assertRedirect('/publish/edit', $answer);
}
public function testTheWrongPasswordIsDenied(): void {
@@ -125,7 +149,7 @@ class LoginTest extends PageTestCase {
public function testAnEditorWhoIsLoggedInGoesToTheEditPage(): void {
$this->loginAs();
$this->assertRedirect('https://xxx.org.za/publish/edit', $this->get('/publish/login'));
$this->assertRedirect('/publish/edit', $this->get('/publish/login'));
}
public function testRememberMeKeepsTheEditorLoggedIn(): void {
@@ -151,7 +175,7 @@ class LoginTest extends PageTestCase {
public function testLogoutNeedsTheToken(): void {
$this->loginAs();
$this->assertRedirect('https://xxx.org.za/', $this->get('/publish/logout?token=wrong'));
$this->assertRedirect('/', $this->get('/publish/logout?token=wrong'));
$this->assertSame('ed', $this->session()['editor']);
}
@@ -164,13 +188,25 @@ class LoginTest extends PageTestCase {
$session = self::$state . '/sessions/sess_' . $this->cookies['PHPSESSID'];
$answer = $this->get('/publish/logout?token=' . $token);
$this->assertRedirect('https://' . $this->host() . '/article?id=2', $answer);
$this->assertRedirect('/article?id=2', $answer);
$this->assertFileDoesNotExist($session);
$this->assertArrayNotHasKey('PHPSESSID', $this->cookies);
$this->assertArrayNotHasKey('PersistentAuth', $this->cookies);
$this->assertSame(array(hash('sha256', 'other device')), array_column($this->tables()['persistent_sessions'], 'session'));
}
public function testAForgedHostDoesNotMoveTheLogoutRedirect(): void {
$token = $this->loginAs('ed', array('referrer' => '/article?id=2'));
$this->assertRedirect('/article?id=2',
$this->get('/publish/logout?token=' . $token, array('Host' => 'evil.example')));
}
#[DataProvider('otherSites')]
public function testLogoutIgnoresALastPageOnAnotherSite(string $referrer): void {
$token = $this->loginAs('ed', array('referrer' => $referrer));
$this->assertRedirect('/', $this->get('/publish/logout?token=' . $token));
}
public function testLogoutDoesNotGoBackToTheLogoutPage(): void {
$token = $this->loginAs('ed', array('referrer' => '/publish/logout'));
$this->assertRedirect('/', $this->get('/publish/logout?token=' . $token));
tests/php/Pages/SubmitTest.php
+1 -1
View File
@@ -16,7 +16,7 @@ class SubmitTest extends PageTestCase {
}
public function testPlainHttpIsSentToHttps(): void {
$this->assertRedirect('https://xxx.org.za/publish', $this->get('/publish', array('X-Test-Plain' => '1')));
$this->assertRedirect('https://site.test/publish', $this->get('/publish', array('X-Test-Plain' => '1')));
}
public function testTheFormHasATokenAndTheCaptcha(): void {
tests/php/Support/PageTestCase.php
+6 -1
View File
@@ -15,6 +15,11 @@ abstract class PageTestCase extends \PHPUnit\Framework\TestCase {
protected static string $base;
private static $server = NULL;
// Environment variables for the server, on top of the usual ones
protected static function serverEnv(): array {
return array();
}
// The cookies that the site set, name => value
protected array $cookies = array();
@@ -43,7 +48,7 @@ abstract class PageTestCase extends \PHPUnit\Framework\TestCase {
'XXX_TEST_LOG' => self::$state . '/php.log',
'MAIL_LOG' => self::$state . '/mail.jsonl',
'UPLOAD_DIR' => self::$state . '/tmp/uploads',
);
) + static::serverEnv();
$log = array('file', self::$state . '/server.log', 'a');
self::$server = proc_open($command, array(0 => array('file', '/dev/null', 'r'), 1 => $log, 2 => $log), $pipes, XXX_ROOT, $env);
tests/php/fixtures/router.php
+2 -1
View File
@@ -47,7 +47,8 @@ function xxx_page_route() {
if (!isset($_SERVER['HTTP_X_TEST_PLAIN']))
$_SERVER['HTTPS'] = 'on';
$_SERVER['SERVER_NAME'] = 'xxx.org.za';
// Apache with UseCanonicalName Off also takes SERVER_NAME from the Host header
$_SERVER['SERVER_NAME'] = preg_replace('/:\d+$/', '', $_SERVER['HTTP_HOST'] ?? '');
$_SERVER['REMOTE_ADDR'] = $_SERVER['HTTP_X_TEST_ADDRESS'] ?? '192.0.2.1';
$_SERVER['SCRIPT_FILENAME'] = $file;
$_SERVER['SCRIPT_NAME'] = $_SERVER['PHP_SELF'] = substr($file, strlen(XXX_ROOT));
tests/php/fixtures/test.env
+1
View File
@@ -3,6 +3,7 @@ DB_HOST=db.test
DB_USER=test-user
DB_PASS=test-pass
DB_NAME=test-db
SITE_URL=https://site.test
RECAPTCHA_SITE_KEY=test-site-key
RECAPTCHA_SECRET=test-secret
GOOGLE_ANALYTICS_ID=