mirror of
https://github.com/TecharoHQ/anubis.git
synced 2026-05-09 16:42:52 +00:00
Compare commits
12 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Xe Iaso
|
ed4615a5fb | ||
|
Xe Iaso
|
e1aaee29b9 | ||
|
BALLOON | FU-SEN
|
edbfd180b8 | ||
|
Xe Iaso
|
efde4f0dc7 | ||
|
Marielle Volz
|
24857f430f | ||
|
Simon Rozman
|
e0ece7d333 | ||
|
fhoekstra
|
3eab1d873d | ||
|
Jason Cameron
|
c7b31d0ca9 | ||
|
Xe Iaso
|
3154ff5004 | ||
|
Jason Cameron
|
5186d7d3ad | ||
|
Xe Iaso
|
c6d968874d | ||
|
Xe Iaso
|
14a8d0c75e |
@@ -29,3 +29,8 @@ Prolocation
|
||||
Necron
|
||||
Stargate
|
||||
FFXIV
|
||||
uvensys
|
||||
de
|
||||
resourced
|
||||
envoyproxy
|
||||
unipromos
|
||||
|
||||
@@ -12,9 +12,7 @@ deps:
|
||||
|
||||
assets: PATH:=$(PWD)/node_modules/.bin:$(PATH)
|
||||
assets: deps
|
||||
$(GO) generate ./...
|
||||
./web/build.sh
|
||||
./xess/build.sh
|
||||
$(NPM) run assets
|
||||
|
||||
build: assets
|
||||
$(GO) build -o ./var/anubis ./cmd/anubis
|
||||
|
||||
@@ -26,6 +26,12 @@ Anubis is brought to you by sponsors and donors like:
|
||||
|
||||
### Gold Tier
|
||||
|
||||
<a href="https://www.unipromos.com/?utm_campaign=github&utm_medium=referral&utm_content=anubis">
|
||||
<img src="./docs/static/img/sponsors/unipromos.webp" alt="Unipromos" height="64" />
|
||||
</a>
|
||||
<a href="https://uvensys.de/?utm_campaign=github&utm_medium=referral&utm_content=anubis">
|
||||
<img src="./docs/static/img/sponsors/uvensys.webp" alt="Uvensys" height="64">
|
||||
</a>
|
||||
<a href="https://distrust.co?utm_campaign=github&utm_medium=referral&utm_content=anubis">
|
||||
<img src="./docs/static/img/sponsors/distrust-logo.webp" alt="Distrust" height="64">
|
||||
</a>
|
||||
|
||||
+2
-2
@@ -418,8 +418,8 @@ func main() {
|
||||
|
||||
var redirectDomainsList []string
|
||||
if *redirectDomains != "" {
|
||||
domains := strings.Split(*redirectDomains, ",")
|
||||
for _, domain := range domains {
|
||||
domains := strings.SplitSeq(*redirectDomains, ",")
|
||||
for domain := range domains {
|
||||
_, err = url.Parse(domain)
|
||||
if err != nil {
|
||||
log.Fatalf("cannot parse redirect-domain %q: %s", domain, err.Error())
|
||||
|
||||
@@ -10,6 +10,7 @@ import (
|
||||
"net/http"
|
||||
"os"
|
||||
"regexp"
|
||||
"slices"
|
||||
"strings"
|
||||
|
||||
"github.com/TecharoHQ/anubis/lib/config"
|
||||
@@ -210,11 +211,8 @@ func parseRobotsTxt(input io.Reader) ([]RobotsRule, error) {
|
||||
|
||||
// Mark blacklisted user agents (those with "Disallow: /")
|
||||
for i := range rules {
|
||||
for _, disallow := range rules[i].Disallows {
|
||||
if disallow == "/" {
|
||||
rules[i].IsBlacklist = true
|
||||
break
|
||||
}
|
||||
if slices.Contains(rules[i].Disallows, "/") {
|
||||
rules[i].IsBlacklist = true
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
@@ -158,8 +158,8 @@ func TestDataFileConversion(t *testing.T) {
|
||||
}
|
||||
|
||||
if strings.ToLower(*outputFormat) == "yaml" {
|
||||
var actualData []interface{}
|
||||
var expectedData []interface{}
|
||||
var actualData []any
|
||||
var expectedData []any
|
||||
|
||||
err = yaml.Unmarshal(actualOutput, &actualData)
|
||||
if err != nil {
|
||||
@@ -178,8 +178,8 @@ func TestDataFileConversion(t *testing.T) {
|
||||
t.Errorf("Output mismatch for %s\nExpected:\n%s\n\nActual:\n%s", tc.name, expectedStr, actualStr)
|
||||
}
|
||||
} else {
|
||||
var actualData []interface{}
|
||||
var expectedData []interface{}
|
||||
var actualData []any
|
||||
var expectedData []any
|
||||
|
||||
err = json.Unmarshal(actualOutput, &actualData)
|
||||
if err != nil {
|
||||
@@ -419,6 +419,6 @@ Disallow: /`
|
||||
|
||||
// compareData performs a deep comparison of two data structures,
|
||||
// ignoring differences that are semantically equivalent in YAML/JSON
|
||||
func compareData(actual, expected interface{}) bool {
|
||||
func compareData(actual, expected any) bool {
|
||||
return reflect.DeepEqual(actual, expected)
|
||||
}
|
||||
|
||||
@@ -8,4 +8,5 @@
|
||||
- import: (data)/crawlers/marginalia.yaml
|
||||
- import: (data)/crawlers/mojeekbot.yaml
|
||||
- import: (data)/crawlers/commoncrawl.yaml
|
||||
- import: (data)/crawlers/wikimedia-citoid.yaml
|
||||
- import: (data)/crawlers/yandexbot.yaml
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
# Wikimedia Foundation citation services
|
||||
# https://www.mediawiki.org/wiki/Citoid
|
||||
|
||||
- name: wikimedia-citoid
|
||||
user_agent_regex: "Citoid/WMF"
|
||||
action: ALLOW
|
||||
remote_addresses: [
|
||||
"208.80.152.0/22",
|
||||
"2620:0:860::/46",
|
||||
]
|
||||
|
||||
- name: wikimedia-zotero-translation-server
|
||||
user_agent_regex: "ZoteroTranslationServer/WMF"
|
||||
action: ALLOW
|
||||
remote_addresses: [
|
||||
"208.80.152.0/22",
|
||||
"2620:0:860::/46",
|
||||
]
|
||||
@@ -11,6 +11,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
|
||||
|
||||
## [Unreleased]
|
||||
|
||||
- fix: prevent nil pointer panic in challenge validation when threshold rules match during PassChallenge (#1463)
|
||||
- Instruct reverse proxies to not cache error pages.
|
||||
- Fixed mixed tab/space indentation in Caddy documentation code block
|
||||
|
||||
|
||||
@@ -48,6 +48,8 @@ This simply enables SSL offloading, sets some useful and required headers and ro
|
||||
|
||||
Due to the fact that HAProxy can decode JWT, we are able to verify the Anubis token directly in HAProxy and route the traffic to the specific backends ourselves.
|
||||
|
||||
Mind that rule logic to allow Git HTTP and other legit bot traffic to bypass is delegated from Anubis to HAProxy then. If required, you should implement any whitelisting in HAProxy using `acl_anubis_ignore` yourself.
|
||||
|
||||
In this example are three applications behind one HAProxy frontend. Only App1 and App2 are secured via Anubis; App3 is open for everyone. The path `/excluded/path` can also be accessed by anyone.
|
||||
|
||||
```mermaid
|
||||
|
||||
@@ -130,3 +130,52 @@ Then point your Ingress to the Anubis port:
|
||||
# diff-add
|
||||
name: anubis
|
||||
```
|
||||
|
||||
## Envoy Gateway
|
||||
|
||||
If you are using envoy-gateway, the `X-Real-Ip` header is not set by default, but Anubis does require it. You can resolve this by adding the header, either on the specific `HTTPRoute` where Anubis is listening, or on the `ClientTrafficPolicy` to apply it to any number of Gateways:
|
||||
|
||||
HTTPRoute:
|
||||
```yaml
|
||||
apiVersion: gateway.networking.k8s.io/v1
|
||||
kind: HTTPRoute
|
||||
metadata:
|
||||
name: app-route
|
||||
spec:
|
||||
hostnames: ["app.domain.tld"]
|
||||
parentRefs:
|
||||
- name: envoy-external
|
||||
namespace: network
|
||||
sectionName: https
|
||||
rules:
|
||||
- backendRefs:
|
||||
- identifier: *app
|
||||
port: anubis
|
||||
filters:
|
||||
- type: RequestHeaderModifier
|
||||
requestHeaderModifier:
|
||||
set:
|
||||
- name: X-Real-Ip
|
||||
value: "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%"
|
||||
```
|
||||
|
||||
Applying to any number of Gateways:
|
||||
```yaml
|
||||
apiVersion: gateway.envoyproxy.io/v1alpha1
|
||||
kind: ClientTrafficPolicy
|
||||
metadata:
|
||||
name: envoy
|
||||
spec:
|
||||
headers:
|
||||
earlyRequestHeaders:
|
||||
set:
|
||||
- name: X-Real-Ip
|
||||
value: "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%"
|
||||
clientIPDetection:
|
||||
xForwardedFor:
|
||||
trustedCIDRs:
|
||||
- 10.96.0.0/16 # Cluster pod CIDR
|
||||
targetSelectors: # These will apply to all Gateways
|
||||
- group: gateway.networking.k8s.io
|
||||
kind: Gateway
|
||||
```
|
||||
|
||||
@@ -35,6 +35,12 @@ Anubis is brought to you by sponsors and donors like:
|
||||
|
||||
### Gold Tier
|
||||
|
||||
<a href="https://www.unipromos.com/?utm_campaign=github&utm_medium=referral&utm_content=anubis">
|
||||
<img src="/img/sponsors/unipromos.webp" alt="Uvensys" height="64" />
|
||||
</a>
|
||||
<a href="https://uvensys.de/?utm_campaign=github&utm_medium=referral&utm_content=anubis">
|
||||
<img src="/img/sponsors/uvensys.webp" alt="Uvensys" height="64" />
|
||||
</a>
|
||||
<a href="https://distrust.co?utm_campaign=github&utm_medium=referral&utm_content=anubis">
|
||||
<img src="/img/sponsors/distrust-logo.webp" alt="Distrust" height="64" />
|
||||
</a>
|
||||
|
||||
@@ -22,3 +22,13 @@ If you use a browser extension such as [JShelter](https://jshelter.org/), you wi
|
||||
## Does Anubis mine Bitcoin?
|
||||
|
||||
No. Anubis does not mine Bitcoin or any other cryptocurrency.
|
||||
|
||||
## I disabled Just-in-time compilation in my browser. Why is Anubis slow?
|
||||
|
||||
Anubis proof-of-work checks run an open source JavaScript program in your browser. These checks do a lot of complicated math and aim to be done quickly, so the execution speed depends on [Just-in-time (JIT) compilation](https://en.wikipedia.org/wiki/Just-in-time_compilation). JIT compiles JavaScript from the Internet into native machine code at runtime. The code produced by the JIT engine is almost as good as if it was written in a native programming language and compiled for your computer in particular. Without JIT, all JavaScript programs on every website you visit run through a slow interpreter.
|
||||
|
||||
This interpreter is much slower than native code because it has to translate each low level JavaScript operation into many dozens of calls to execute. This means that using the interpreter incurs a massive performance hit by its very nature; it takes longer to add numbers than if the CPU just added the numbers directly.
|
||||
|
||||
Some users choose to disable JIT as a hardening measure against theoretical browser exploits. This is a reasonable choice if you face targeted attacks from well-resourced adversaries (such as nation-state actors), but it comes with real performance costs.
|
||||
|
||||
If you've disabled JIT and find Anubis checks slow, re-enabling JIT is the fix. There is no way for Anubis to work around this on our end.
|
||||
|
||||
BIN
Binary file not shown.
|
After Width: | Height: | Size: 1.8 KiB |
BIN
Binary file not shown.
|
After Width: | Height: | Size: 7.0 KiB |
@@ -1,6 +1,6 @@
|
||||
module github.com/TecharoHQ/anubis
|
||||
|
||||
go 1.24.2
|
||||
go 1.25.0
|
||||
|
||||
require (
|
||||
github.com/TecharoHQ/thoth-proto v0.5.0
|
||||
@@ -50,7 +50,7 @@ require (
|
||||
github.com/Microsoft/go-winio v0.6.2 // indirect
|
||||
github.com/ProtonMail/go-crypto v1.3.0 // indirect
|
||||
github.com/Songmu/gitconfig v0.2.1 // indirect
|
||||
github.com/TecharoHQ/yeet v0.6.3 // indirect
|
||||
github.com/TecharoHQ/yeet v0.5.0 // indirect
|
||||
github.com/a-h/parse v0.0.0-20250122154542-74294addb73e // indirect
|
||||
github.com/andybalholm/brotli v1.2.0 // indirect
|
||||
github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
|
||||
@@ -188,9 +188,9 @@ require (
|
||||
golang.org/x/mod v0.31.0 // indirect
|
||||
golang.org/x/oauth2 v0.32.0 // indirect
|
||||
golang.org/x/sync v0.19.0 // indirect
|
||||
golang.org/x/sys v0.39.0 // indirect
|
||||
golang.org/x/sys v0.42.0 // indirect
|
||||
golang.org/x/telemetry v0.0.0-20251203150158-8fff8a5912fc // indirect
|
||||
golang.org/x/term v0.38.0 // indirect
|
||||
golang.org/x/term v0.40.0 // indirect
|
||||
golang.org/x/tools v0.40.0 // indirect
|
||||
golang.org/x/vuln v1.1.4 // indirect
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20251213004720-97cd9d5aeac2 // indirect
|
||||
@@ -198,7 +198,7 @@ require (
|
||||
google.golang.org/protobuf v1.36.11 // indirect
|
||||
gopkg.in/warnings.v0 v0.1.2 // indirect
|
||||
honnef.co/go/tools v0.6.1 // indirect
|
||||
mvdan.cc/sh/v3 v3.12.0 // indirect
|
||||
mvdan.cc/sh/v3 v3.13.0 // indirect
|
||||
sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
|
||||
)
|
||||
|
||||
@@ -212,4 +212,5 @@ tool (
|
||||
golang.org/x/tools/cmd/stringer
|
||||
golang.org/x/vuln/cmd/govulncheck
|
||||
honnef.co/go/tools/cmd/staticcheck
|
||||
mvdan.cc/sh/v3/cmd/gosh
|
||||
)
|
||||
|
||||
@@ -31,14 +31,12 @@ github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f h1:tCbYj7/299ek
|
||||
github.com/ProtonMail/go-mime v0.0.0-20230322103455-7d82a3887f2f/go.mod h1:gcr0kNtGBqin9zDW9GOHcVntrwnjrK+qdJ06mWYBybw=
|
||||
github.com/ProtonMail/gopenpgp/v2 v2.7.1 h1:Awsg7MPc2gD3I7IFac2qE3Gdls0lZW8SzrFZ3k1oz0s=
|
||||
github.com/ProtonMail/gopenpgp/v2 v2.7.1/go.mod h1:/BU5gfAVwqyd8EfC3Eu7zmuhwYQpKs+cGD8M//iiaxs=
|
||||
github.com/ProtonMail/gopenpgp/v3 v3.3.0 h1:N6rHCH5PWwB6zSRMgRj1EbAMQHUAAHxH3Oo4KibsPwY=
|
||||
github.com/ProtonMail/gopenpgp/v3 v3.3.0/go.mod h1:J+iNPt0/5EO9wRt7Eit9dRUlzyu3hiGX3zId6iuaKOk=
|
||||
github.com/Songmu/gitconfig v0.2.1 h1:cZsqELfMtxWVI8ovq17gbvsR4qLfoYLAiXy5GwtJWbk=
|
||||
github.com/Songmu/gitconfig v0.2.1/go.mod h1:XM4O3SoXFnli9Ql2G7qXK2Fg7LJwf7Hs8GLFEOJlzmM=
|
||||
github.com/TecharoHQ/thoth-proto v0.5.0 h1:Fa663s4soYiURSU8MfW9tZ2wF+LsCRSaYmjUSyagfBM=
|
||||
github.com/TecharoHQ/thoth-proto v0.5.0/go.mod h1:C/U7FqTxpVn4V/qebC/GcW32I0h9xzsmWehF27KFOJs=
|
||||
github.com/TecharoHQ/yeet v0.6.3 h1:Iev6TYt/tpFYU73kbkNIYjCObYTvlihtby+htGF4Us8=
|
||||
github.com/TecharoHQ/yeet v0.6.3/go.mod h1:ltt+PWPjnvmQJxEHsdJ5K9u3GoWK83vSLWCCp8XbxqI=
|
||||
github.com/TecharoHQ/yeet v0.5.0 h1:6zL/9q0cnAI/79VA7fggcxDowzPA6D76I7+rvDLHNlM=
|
||||
github.com/TecharoHQ/yeet v0.5.0/go.mod h1:qjWkZGADLgzB+bdm8W1GhdSBbwxVskdrvXssKraTSwQ=
|
||||
github.com/a-h/parse v0.0.0-20250122154542-74294addb73e h1:HjVbSQHy+dnlS6C3XajZ69NYAb5jbGNfHanvm1+iYlo=
|
||||
github.com/a-h/parse v0.0.0-20250122154542-74294addb73e/go.mod h1:3mnrkvGpurZ4ZrTDbYU84xhwXW2TjTKShSwjRi2ihfQ=
|
||||
github.com/a-h/templ v0.3.960 h1:trshEpGa8clF5cdI39iY4ZrZG8Z/QixyzEyUnA7feTM=
|
||||
@@ -495,8 +493,8 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.17.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
|
||||
golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
|
||||
golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
|
||||
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
|
||||
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/telemetry v0.0.0-20251203150158-8fff8a5912fc h1:bH6xUXay0AIFMElXG2rQ4uiE+7ncwtiOdPfYK1NK2XA=
|
||||
golang.org/x/telemetry v0.0.0-20251203150158-8fff8a5912fc/go.mod h1:hKdjCMrbv9skySur+Nek8Hd0uJ0GuxJIoIX2payrIdQ=
|
||||
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
|
||||
@@ -504,8 +502,8 @@ golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuX
|
||||
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
|
||||
golang.org/x/term v0.8.0/go.mod h1:xPskH00ivmX89bAKVGSKKtLOWNx2+17Eiy94tnKShWo=
|
||||
golang.org/x/term v0.17.0/go.mod h1:lLRBjIVuehSbZlaOtGMbcMncT+aqLLLmKrsjNrUguwk=
|
||||
golang.org/x/term v0.38.0 h1:PQ5pkm/rLO6HnxFR7N2lJHOZX6Kez5Y1gDSJla6jo7Q=
|
||||
golang.org/x/term v0.38.0/go.mod h1:bSEAKrOT1W+VSu9TSCMtoGEOUcKxOKgl3LE5QEF/xVg=
|
||||
golang.org/x/term v0.40.0 h1:36e4zGLqU4yhjlmxEaagx2KuYbJq3EwY8K943ZsHcvg=
|
||||
golang.org/x/term v0.40.0/go.mod h1:w2P8uVp06p2iyKKuvXIm7N/y0UCRt3UfJTfZ7oOpglM=
|
||||
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
|
||||
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
|
||||
@@ -559,8 +557,8 @@ honnef.co/go/tools v0.6.1 h1:R094WgE8K4JirYjBaOpz/AvTyUu/3wbmAoskKN/pxTI=
|
||||
honnef.co/go/tools v0.6.1/go.mod h1:3puzxxljPCe8RGJX7BIy1plGbxEOZni5mR2aXe3/uk4=
|
||||
k8s.io/apimachinery v0.34.3 h1:/TB+SFEiQvN9HPldtlWOTp0hWbJ+fjU+wkxysf/aQnE=
|
||||
k8s.io/apimachinery v0.34.3/go.mod h1:/GwIlEcWuTX9zKIg2mbw0LRFIsXwrfoVxn+ef0X13lw=
|
||||
mvdan.cc/sh/v3 v3.12.0 h1:ejKUR7ONP5bb+UGHGEG/k9V5+pRVIyD+LsZz7o8KHrI=
|
||||
mvdan.cc/sh/v3 v3.12.0/go.mod h1:Se6Cj17eYSn+sNooLZiEUnNNmNxg0imoYlTu4CyaGyg=
|
||||
mvdan.cc/sh/v3 v3.13.0 h1:dSfq/MVsY4w0Vsi6Lbs0IcQquMVqLdKLESAOZjuHdLg=
|
||||
mvdan.cc/sh/v3 v3.13.0/go.mod h1:KV1GByGPc/Ho0X1E6Uz9euhsIQEj4hwyKnodLlFLoDM=
|
||||
pault.ag/go/debian v0.18.0 h1:nr0iiyOU5QlG1VPnhZLNhnCcHx58kukvBJp+dvaM6CQ=
|
||||
pault.ag/go/debian v0.18.0/go.mod h1:JFl0XWRCv9hWBrB5MDDZjA5GSEs1X3zcFK/9kCNIUmE=
|
||||
pault.ag/go/topsort v0.1.1 h1:L0QnhUly6LmTv0e3DEzbN2q6/FGgAcQvaEw65S53Bg4=
|
||||
|
||||
@@ -36,7 +36,7 @@ func Glob(pattern, subj string) bool {
|
||||
end := len(parts) - 1
|
||||
|
||||
// Go over the leading parts and ensure they match.
|
||||
for i := 0; i < end; i++ {
|
||||
for i := range end {
|
||||
idx := strings.Index(subj, parts[i])
|
||||
|
||||
switch i {
|
||||
|
||||
@@ -184,7 +184,7 @@ func TestHashCollisions(t *testing.T) {
|
||||
for _, prefix := range prefixes {
|
||||
for _, suffix := range suffixes {
|
||||
for _, variation := range variations {
|
||||
for i := 0; i < 100; i++ {
|
||||
for i := range 100 {
|
||||
input := fmt.Sprintf("%s%s%s-%d", prefix, suffix, variation, i)
|
||||
hash := XXHash64sum(input)
|
||||
if existing, exists := xxhashHashes[hash]; exists {
|
||||
@@ -211,7 +211,7 @@ func TestHashCollisions(t *testing.T) {
|
||||
|
||||
seqCount := 0
|
||||
for _, pattern := range patterns {
|
||||
for i := 0; i < 10000; i++ {
|
||||
for i := range 10000 {
|
||||
input := fmt.Sprintf(pattern, i)
|
||||
hash := XXHash64sum(input)
|
||||
if existing, exists := xxhashHashes[hash]; exists {
|
||||
|
||||
@@ -120,7 +120,7 @@ func (i *Impl) makeAffirmations() []string {
|
||||
count := rand.IntN(5) + 1
|
||||
|
||||
var result []string
|
||||
for j := 0; j < count; j++ {
|
||||
for range count {
|
||||
result = append(result, i.affirmation.Spin())
|
||||
}
|
||||
|
||||
@@ -131,7 +131,7 @@ func (i *Impl) makeSpins() []string {
|
||||
count := rand.IntN(5) + 1
|
||||
|
||||
var result []string
|
||||
for j := 0; j < count; j++ {
|
||||
for range count {
|
||||
result = append(result, i.body.Spin())
|
||||
}
|
||||
|
||||
|
||||
+1
-1
@@ -16,7 +16,7 @@ func (lo *ListOr[T]) UnmarshalJSON(data []byte) error {
|
||||
|
||||
// Check if first non-whitespace character is '['
|
||||
firstChar := data[0]
|
||||
for i := 0; i < len(data); i++ {
|
||||
for i := range data {
|
||||
if data[i] != ' ' && data[i] != '\t' && data[i] != '\n' && data[i] != '\r' {
|
||||
firstChar = data[i]
|
||||
break
|
||||
|
||||
@@ -95,7 +95,7 @@ func TestMemoryUsage(t *testing.T) {
|
||||
|
||||
// Run getTarget many times
|
||||
u, _ := url.Parse("/path/to/resource?query=1&foo=bar&baz=qux")
|
||||
for i := 0; i < 10000; i++ {
|
||||
for range 10000 {
|
||||
_ = cache.getTarget(u)
|
||||
}
|
||||
|
||||
@@ -129,7 +129,7 @@ func TestMemoryUsage(t *testing.T) {
|
||||
runtime.GC()
|
||||
runtime.ReadMemStats(&m1)
|
||||
|
||||
for i := 0; i < 1000; i++ {
|
||||
for range 1000 {
|
||||
_ = cache.extractOGTags(doc)
|
||||
}
|
||||
|
||||
|
||||
@@ -3,6 +3,7 @@ package ogtags
|
||||
import (
|
||||
"context"
|
||||
"net/url"
|
||||
"slices"
|
||||
"strings"
|
||||
"testing"
|
||||
"unicode/utf8"
|
||||
@@ -78,7 +79,7 @@ func FuzzGetTarget(f *testing.F) {
|
||||
}
|
||||
|
||||
// Ensure no memory corruption by calling multiple times
|
||||
for i := 0; i < 3; i++ {
|
||||
for range 3 {
|
||||
result2 := cache.getTarget(u)
|
||||
if result != result2 {
|
||||
t.Errorf("getTarget not deterministic: %q != %q", result, result2)
|
||||
@@ -148,11 +149,8 @@ func FuzzExtractOGTags(f *testing.F) {
|
||||
}
|
||||
}
|
||||
if !approved {
|
||||
for _, tag := range cache.approvedTags {
|
||||
if property == tag {
|
||||
approved = true
|
||||
break
|
||||
}
|
||||
if slices.Contains(cache.approvedTags, property) {
|
||||
approved = true
|
||||
}
|
||||
}
|
||||
if !approved {
|
||||
@@ -260,11 +258,8 @@ func FuzzExtractMetaTagInfo(f *testing.F) {
|
||||
}
|
||||
}
|
||||
if !approved {
|
||||
for _, tag := range cache.approvedTags {
|
||||
if property == tag {
|
||||
approved = true
|
||||
break
|
||||
}
|
||||
if slices.Contains(cache.approvedTags, property) {
|
||||
approved = true
|
||||
}
|
||||
}
|
||||
if !approved {
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
package ogtags
|
||||
|
||||
import (
|
||||
"slices"
|
||||
"strings"
|
||||
|
||||
"golang.org/x/net/html"
|
||||
@@ -65,10 +66,8 @@ func (c *OGTagCache) extractMetaTagInfo(n *html.Node) (property, content string)
|
||||
}
|
||||
|
||||
// Check exact matches
|
||||
for _, tag := range c.approvedTags {
|
||||
if propertyKey == tag {
|
||||
return propertyKey, content
|
||||
}
|
||||
if slices.Contains(c.approvedTags, propertyKey) {
|
||||
return propertyKey, content
|
||||
}
|
||||
|
||||
return "", content
|
||||
|
||||
@@ -270,7 +270,7 @@ func TestPlaywrightBrowser(t *testing.T) {
|
||||
|
||||
var performedAction action
|
||||
var err error
|
||||
for i := 0; i < 5; i++ {
|
||||
for i := range 5 {
|
||||
performedAction, err = executeTestCase(t, tc, typ, anubisURL)
|
||||
if performedAction == tc.action {
|
||||
break
|
||||
|
||||
+23
-4
@@ -81,11 +81,11 @@ type Server struct {
|
||||
func (s *Server) getTokenKeyfunc() jwt.Keyfunc {
|
||||
// return ED25519 key if HS512 is not set
|
||||
if len(s.hs512Secret) == 0 {
|
||||
return func(token *jwt.Token) (interface{}, error) {
|
||||
return func(token *jwt.Token) (any, error) {
|
||||
return s.ed25519Priv.Public().(ed25519.PublicKey), nil
|
||||
}
|
||||
} else {
|
||||
return func(token *jwt.Token) (interface{}, error) {
|
||||
return func(token *jwt.Token) (any, error) {
|
||||
return s.hs512Secret, nil
|
||||
}
|
||||
}
|
||||
@@ -106,6 +106,13 @@ func (s *Server) issueChallenge(ctx context.Context, r *http.Request, lg *slog.L
|
||||
//return nil, errors.New("[unexpected] this codepath should be impossible, asked to issue a challenge for a non-challenge rule")
|
||||
}
|
||||
|
||||
if rule.Challenge == nil {
|
||||
rule.Challenge = &config.ChallengeRules{
|
||||
Difficulty: s.policy.DefaultDifficulty,
|
||||
Algorithm: config.DefaultAlgorithm,
|
||||
}
|
||||
}
|
||||
|
||||
id, err := uuid.NewV7()
|
||||
if err != nil {
|
||||
return nil, err
|
||||
@@ -491,7 +498,11 @@ func (s *Server) PassChallenge(w http.ResponseWriter, r *http.Request) {
|
||||
chall, err := s.getChallenge(r)
|
||||
if err != nil {
|
||||
lg.Error("getChallenge failed", "err", err)
|
||||
s.respondWithError(w, r, fmt.Sprintf("%s: %s", localizer.T("internal_server_error"), rule.Challenge.Algorithm), makeCode(err))
|
||||
algorithm := "unknown"
|
||||
if rule.Challenge != nil {
|
||||
algorithm = rule.Challenge.Algorithm
|
||||
}
|
||||
s.respondWithError(w, r, fmt.Sprintf("%s: %s", localizer.T("internal_server_error"), algorithm), makeCode(err))
|
||||
return
|
||||
}
|
||||
|
||||
@@ -638,8 +649,16 @@ func (s *Server) check(r *http.Request, lg *slog.Logger) (policy.CheckResult, *p
|
||||
}
|
||||
|
||||
if matches {
|
||||
challRules := t.Challenge
|
||||
if challRules == nil {
|
||||
// Non-CHALLENGE thresholds (ALLOW/DENY) don't have challenge config.
|
||||
// Use an empty struct so hydrateChallengeRule can fill from stored
|
||||
// challenge data during validation, rather than baking in defaults
|
||||
// that could mismatch the difficulty the client actually solved for.
|
||||
challRules = &config.ChallengeRules{}
|
||||
}
|
||||
return cr("threshold/"+t.Name, t.Action, weight), &policy.Bot{
|
||||
Challenge: t.Challenge,
|
||||
Challenge: challRules,
|
||||
Rules: &checker.List{},
|
||||
}, nil
|
||||
}
|
||||
|
||||
+2
-2
@@ -38,8 +38,8 @@ func NewTLogWriter(t *testing.T) io.Writer {
|
||||
|
||||
// Write splits input on newlines and logs each line separately.
|
||||
func (w *TLogWriter) Write(p []byte) (n int, err error) {
|
||||
lines := strings.Split(string(p), "\n")
|
||||
for _, line := range lines {
|
||||
lines := strings.SplitSeq(string(p), "\n")
|
||||
for line := range lines {
|
||||
if line != "" {
|
||||
w.t.Log(line)
|
||||
}
|
||||
|
||||
@@ -10,6 +10,7 @@ var (
|
||||
ErrFailed = errors.New("challenge: user failed challenge")
|
||||
ErrMissingField = errors.New("challenge: missing field")
|
||||
ErrInvalidFormat = errors.New("challenge: field has invalid format")
|
||||
ErrInvalidInput = errors.New("challenge: input is nil or missing required fields")
|
||||
)
|
||||
|
||||
func NewError(verb, publicReason string, privateReason error) *Error {
|
||||
|
||||
@@ -1,6 +1,7 @@
|
||||
package challenge
|
||||
|
||||
import (
|
||||
"fmt"
|
||||
"log/slog"
|
||||
"net/http"
|
||||
"sort"
|
||||
@@ -50,12 +51,44 @@ type IssueInput struct {
|
||||
Store store.Interface
|
||||
}
|
||||
|
||||
func (in *IssueInput) Valid() error {
|
||||
if in == nil {
|
||||
return fmt.Errorf("%w: IssueInput is nil", ErrInvalidInput)
|
||||
}
|
||||
if in.Rule == nil {
|
||||
return fmt.Errorf("%w: Rule is nil", ErrInvalidInput)
|
||||
}
|
||||
if in.Rule.Challenge == nil {
|
||||
return fmt.Errorf("%w: Rule.Challenge is nil", ErrInvalidInput)
|
||||
}
|
||||
if in.Challenge == nil {
|
||||
return fmt.Errorf("%w: Challenge is nil", ErrInvalidInput)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
type ValidateInput struct {
|
||||
Rule *policy.Bot
|
||||
Challenge *Challenge
|
||||
Store store.Interface
|
||||
}
|
||||
|
||||
func (in *ValidateInput) Valid() error {
|
||||
if in == nil {
|
||||
return fmt.Errorf("%w: ValidateInput is nil", ErrInvalidInput)
|
||||
}
|
||||
if in.Rule == nil {
|
||||
return fmt.Errorf("%w: Rule is nil", ErrInvalidInput)
|
||||
}
|
||||
if in.Rule.Challenge == nil {
|
||||
return fmt.Errorf("%w: Rule.Challenge is nil", ErrInvalidInput)
|
||||
}
|
||||
if in.Challenge == nil {
|
||||
return fmt.Errorf("%w: Challenge is nil", ErrInvalidInput)
|
||||
}
|
||||
return nil
|
||||
}
|
||||
|
||||
type Impl interface {
|
||||
// Setup registers any additional routes with the Impl for assets or API routes.
|
||||
Setup(mux *http.ServeMux)
|
||||
|
||||
@@ -24,6 +24,10 @@ type Impl struct{}
|
||||
func (i *Impl) Setup(mux *http.ServeMux) {}
|
||||
|
||||
func (i *Impl) Issue(w http.ResponseWriter, r *http.Request, lg *slog.Logger, in *challenge.IssueInput) (templ.Component, error) {
|
||||
if err := in.Valid(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
u, err := r.URL.Parse(anubis.BasePrefix + "/.within.website/x/cmd/anubis/api/pass-challenge")
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("can't render page: %w", err)
|
||||
@@ -49,6 +53,10 @@ func (i *Impl) Issue(w http.ResponseWriter, r *http.Request, lg *slog.Logger, in
|
||||
}
|
||||
|
||||
func (i *Impl) Validate(r *http.Request, lg *slog.Logger, in *challenge.ValidateInput) error {
|
||||
if err := in.Valid(); err != nil {
|
||||
return challenge.NewError("validate", "invalid input", err)
|
||||
}
|
||||
|
||||
wantTime := in.Challenge.IssuedAt.Add(time.Duration(in.Rule.Challenge.Difficulty) * 800 * time.Millisecond)
|
||||
|
||||
if time.Now().Before(wantTime) {
|
||||
|
||||
@@ -8,7 +8,7 @@ LICENSE='/*
|
||||
@licstart The following is the entire license notice for the
|
||||
JavaScript code in this page.
|
||||
|
||||
Copyright (c) 2025 Xe Iaso <xe.iaso@techaro.lol>
|
||||
Copyright (c) 2026 Xe Iaso <xe.iaso@techaro.lol>
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
@@ -41,9 +41,9 @@ for the JavaScript code in this page.
|
||||
mkdir -p static/js
|
||||
|
||||
for file in js/*.tsx; do
|
||||
filename="${file##*/}" # Extracts "app.jsx" from "./js/app.jsx"
|
||||
output="${filename%.tsx}.js" # Changes "app.jsx" to "app.js"
|
||||
echo $output
|
||||
filename="${file##*/}" # Extracts "app.jsx" from "./js/app.jsx"
|
||||
output="${filename%.tsx}.js" # Changes "app.jsx" to "app.js"
|
||||
echo $output
|
||||
|
||||
esbuild "${file}" --minify --bundle --outfile=static/"${output}" --banner:js="${LICENSE}"
|
||||
esbuild "${file}" --minify --bundle --outfile=static/"${output}" --banner:js="${LICENSE}"
|
||||
done
|
||||
@@ -17,7 +17,7 @@ import (
|
||||
"github.com/a-h/templ"
|
||||
)
|
||||
|
||||
//go:generate ./build.sh
|
||||
//go:generate go tool gosh ./build.sh
|
||||
//go:generate go tool github.com/a-h/templ/cmd/templ generate
|
||||
|
||||
//go:embed static/app.js
|
||||
@@ -39,6 +39,10 @@ type impl struct{}
|
||||
func (i *impl) Setup(mux *http.ServeMux) {}
|
||||
|
||||
func (i *impl) Issue(w http.ResponseWriter, r *http.Request, lg *slog.Logger, in *challenge.IssueInput) (templ.Component, error) {
|
||||
if err := in.Valid(); err != nil {
|
||||
return nil, err
|
||||
}
|
||||
|
||||
u, err := r.URL.Parse(anubis.BasePrefix + "/.within.website/x/cmd/anubis/api/pass-challenge")
|
||||
if err != nil {
|
||||
return nil, fmt.Errorf("can't render page: %w", err)
|
||||
@@ -57,6 +61,10 @@ func (i *impl) Issue(w http.ResponseWriter, r *http.Request, lg *slog.Logger, in
|
||||
}
|
||||
|
||||
func (i *impl) Validate(r *http.Request, lg *slog.Logger, in *challenge.ValidateInput) error {
|
||||
if err := in.Valid(); err != nil {
|
||||
return challenge.NewError("validate", "invalid input", err)
|
||||
}
|
||||
|
||||
wantTime := in.Challenge.IssuedAt.Add(time.Duration(in.Rule.Challenge.Difficulty) * 80 * time.Millisecond)
|
||||
|
||||
if time.Now().Before(wantTime) {
|
||||
|
||||
@@ -33,6 +33,10 @@ func (i *Impl) Issue(w http.ResponseWriter, r *http.Request, lg *slog.Logger, in
|
||||
}
|
||||
|
||||
func (i *Impl) Validate(r *http.Request, lg *slog.Logger, in *chall.ValidateInput) error {
|
||||
if err := in.Valid(); err != nil {
|
||||
return chall.NewError("validate", "invalid input", err)
|
||||
}
|
||||
|
||||
rule := in.Rule
|
||||
challenge := in.Challenge.RandomData
|
||||
|
||||
|
||||
@@ -30,6 +30,62 @@ func mkRequest(t *testing.T, values map[string]string) *http.Request {
|
||||
return req
|
||||
}
|
||||
|
||||
// TestValidateNilRuleChallenge reproduces the panic from
|
||||
// https://github.com/TecharoHQ/anubis/issues/1463
|
||||
//
|
||||
// When a threshold rule matches during PassChallenge, check() can return
|
||||
// a policy.Bot with Challenge == nil. After hydrateChallengeRule fails to
|
||||
// run (or the error path hits before it), Validate dereferences
|
||||
// rule.Challenge.Difficulty and panics.
|
||||
func TestValidateNilRuleChallenge(t *testing.T) {
|
||||
i := &Impl{Algorithm: "fast"}
|
||||
lg := slog.With()
|
||||
|
||||
// This is the exact response for SHA256("hunter" + "0") with 0 leading zeros required.
|
||||
const challengeStr = "hunter"
|
||||
const response = "2652bdba8fb4d2ab39ef28d8534d7694c557a4ae146c1e9237bd8d950280500e"
|
||||
|
||||
req := mkRequest(t, map[string]string{
|
||||
"nonce": "0",
|
||||
"elapsedTime": "69",
|
||||
"response": response,
|
||||
})
|
||||
|
||||
for _, tc := range []struct {
|
||||
name string
|
||||
input *challenge.ValidateInput
|
||||
}{
|
||||
{
|
||||
name: "nil-rule-challenge",
|
||||
input: &challenge.ValidateInput{
|
||||
Rule: &policy.Bot{},
|
||||
Challenge: &challenge.Challenge{RandomData: challengeStr},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "nil-rule",
|
||||
input: &challenge.ValidateInput{
|
||||
Challenge: &challenge.Challenge{RandomData: challengeStr},
|
||||
},
|
||||
},
|
||||
{
|
||||
name: "nil-challenge",
|
||||
input: &challenge.ValidateInput{Rule: &policy.Bot{Challenge: &config.ChallengeRules{Algorithm: "fast"}}},
|
||||
},
|
||||
{
|
||||
name: "nil-input",
|
||||
input: nil,
|
||||
},
|
||||
} {
|
||||
t.Run(tc.name, func(t *testing.T) {
|
||||
err := i.Validate(req, lg, tc.input)
|
||||
if !errors.Is(err, challenge.ErrInvalidInput) {
|
||||
t.Fatalf("expected ErrInvalidInput, got: %v", err)
|
||||
}
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
func TestBasic(t *testing.T) {
|
||||
i := &Impl{Algorithm: "fast"}
|
||||
bot := &policy.Bot{
|
||||
|
||||
@@ -228,8 +228,8 @@ type ImportStatement struct {
|
||||
}
|
||||
|
||||
func (is *ImportStatement) open() (fs.File, error) {
|
||||
if strings.HasPrefix(is.Import, "(data)/") {
|
||||
fname := strings.TrimPrefix(is.Import, "(data)/")
|
||||
if after, ok := strings.CutPrefix(is.Import, "(data)/"); ok {
|
||||
fname := after
|
||||
fin, err := data.BotPolicies.Open(fname)
|
||||
return fin, err
|
||||
}
|
||||
@@ -325,7 +325,7 @@ func (sc StatusCodes) Valid() error {
|
||||
}
|
||||
|
||||
type fileConfig struct {
|
||||
OpenGraph openGraphFileConfig `json:"openGraph,omitempty"`
|
||||
OpenGraph openGraphFileConfig `json:"openGraph"`
|
||||
Impressum *Impressum `json:"impressum,omitempty"`
|
||||
Store *Store `json:"store"`
|
||||
Bots []BotOrImport `json:"bots"`
|
||||
|
||||
@@ -188,7 +188,6 @@ func TestBotValid(t *testing.T) {
|
||||
}
|
||||
|
||||
for _, cs := range tests {
|
||||
cs := cs
|
||||
t.Run(cs.name, func(t *testing.T) {
|
||||
err := cs.bot.Valid()
|
||||
if err == nil && cs.err == nil {
|
||||
@@ -216,7 +215,6 @@ func TestConfigValidKnownGood(t *testing.T) {
|
||||
}
|
||||
|
||||
for _, st := range finfos {
|
||||
st := st
|
||||
t.Run(st.Name(), func(t *testing.T) {
|
||||
fin, err := os.Open(filepath.Join("testdata", "good", st.Name()))
|
||||
if err != nil {
|
||||
@@ -303,7 +301,6 @@ func TestConfigValidBad(t *testing.T) {
|
||||
}
|
||||
|
||||
for _, st := range finfos {
|
||||
st := st
|
||||
t.Run(st.Name(), func(t *testing.T) {
|
||||
fin, err := os.Open(filepath.Join("testdata", "bad", st.Name()))
|
||||
if err != nil {
|
||||
|
||||
@@ -24,7 +24,6 @@ func TestBadConfigs(t *testing.T) {
|
||||
}
|
||||
|
||||
for _, st := range finfos {
|
||||
st := st
|
||||
t.Run(st.Name(), func(t *testing.T) {
|
||||
if _, err := LoadPoliciesOrDefault(t.Context(), filepath.Join("config", "testdata", "bad", st.Name()), anubis.DefaultDifficulty, "info"); err == nil {
|
||||
t.Fatal(err)
|
||||
@@ -42,7 +41,6 @@ func TestGoodConfigs(t *testing.T) {
|
||||
}
|
||||
|
||||
for _, st := range finfos {
|
||||
st := st
|
||||
t.Run(st.Name(), func(t *testing.T) {
|
||||
t.Run("with-thoth", func(t *testing.T) {
|
||||
ctx := thothmock.WithMockThoth(t)
|
||||
|
||||
+12
-7
@@ -182,10 +182,7 @@ func makeCode(err error) string {
|
||||
enc := base64.StdEncoding.EncodeToString(buf.Bytes())
|
||||
var builder strings.Builder
|
||||
for i := 0; i < len(enc); i += width {
|
||||
end := i + width
|
||||
if end > len(enc) {
|
||||
end = len(enc)
|
||||
}
|
||||
end := min(i+width, len(enc))
|
||||
builder.WriteString(enc[i:end])
|
||||
builder.WriteByte('\n')
|
||||
}
|
||||
@@ -222,8 +219,12 @@ func (s *Server) RenderIndex(w http.ResponseWriter, r *http.Request, cr policy.C
|
||||
chall, err := s.issueChallenge(r.Context(), r, lg, cr, rule)
|
||||
if err != nil {
|
||||
lg.Error("can't get challenge", "err", err)
|
||||
algorithm := "unknown"
|
||||
if rule.Challenge != nil {
|
||||
algorithm = rule.Challenge.Algorithm
|
||||
}
|
||||
s.ClearCookie(w, CookieOpts{Name: anubis.TestCookieName, Host: r.Host})
|
||||
s.respondWithError(w, r, fmt.Sprintf("%s: %s", localizer.T("internal_server_error"), rule.Challenge.Algorithm), makeCode(err))
|
||||
s.respondWithError(w, r, fmt.Sprintf("%s: %s", localizer.T("internal_server_error"), algorithm), makeCode(err))
|
||||
return
|
||||
}
|
||||
|
||||
@@ -248,9 +249,13 @@ func (s *Server) RenderIndex(w http.ResponseWriter, r *http.Request, cr policy.C
|
||||
|
||||
impl, ok := challenge.Get(chall.Method)
|
||||
if !ok {
|
||||
lg.Error("check failed", "err", "can't get algorithm", "algorithm", rule.Challenge.Algorithm)
|
||||
algorithm := "unknown"
|
||||
if rule.Challenge != nil {
|
||||
algorithm = rule.Challenge.Algorithm
|
||||
}
|
||||
lg.Error("check failed", "err", "can't get algorithm", "algorithm", algorithm)
|
||||
s.ClearCookie(w, CookieOpts{Name: anubis.TestCookieName, Host: r.Host})
|
||||
s.respondWithError(w, r, fmt.Sprintf("%s: %s", localizer.T("internal_server_error"), rule.Challenge.Algorithm), makeCode(err))
|
||||
s.respondWithError(w, r, fmt.Sprintf("%s: %s", localizer.T("internal_server_error"), algorithm), makeCode(err))
|
||||
return
|
||||
}
|
||||
|
||||
|
||||
@@ -9,7 +9,7 @@
|
||||
"anubis_compromise": "Anubisは妥協策です。AnubisはHashcashのようなProof-of-Work方式を採用しており、これは元々メールスパムを減らすために提案された仕組みです。個人レベルでは追加の負荷は無視できる程度ですが、大規模なスクレイピングでは負荷が積み重なり、スクレイピングのコストが大幅に増加します。",
|
||||
"hack_purpose": "最終的に、これはヘッドレスブラウザのフィンガープリントと識別に時間を費やすためのプレースホルダーソリューションです（例：フォントレンダリングの方法による）。これにより、正当なユーザーにはチャレンジのプルーフオブワークページを提示する必要がなくなります。",
|
||||
"jshelter_note": "Anubisは、JShelterのようなプラグインが無効化する最新のJavaScript機能を必要とします。このドメインではJShelterや同様のプラグインを無効にしてください。",
|
||||
"version_info": "このウェブサイトはAnubisバージョンで動作しています",
|
||||
"version_info": "このウェブサイトはAnubisで動作しています バージョン",
|
||||
"try_again": "再試行",
|
||||
"go_home": "ホームに戻る",
|
||||
"contact_webmaster": "もしブロックされるべきでないと思われる場合は、ウェブマスターにご連絡ください：",
|
||||
|
||||
@@ -103,7 +103,7 @@ func TestBotEnvironment(t *testing.T) {
|
||||
t.Fatalf("failed to compile expression %q: %v", tt.expression, err)
|
||||
}
|
||||
|
||||
result, _, err := prog.Eval(map[string]interface{}{
|
||||
result, _, err := prog.Eval(map[string]any{
|
||||
"headers": tt.headers,
|
||||
})
|
||||
if err != nil {
|
||||
@@ -168,7 +168,7 @@ func TestBotEnvironment(t *testing.T) {
|
||||
t.Fatalf("failed to compile expression %q: %v", tt.expression, err)
|
||||
}
|
||||
|
||||
result, _, err := prog.Eval(map[string]interface{}{
|
||||
result, _, err := prog.Eval(map[string]any{
|
||||
"path": tt.path,
|
||||
})
|
||||
if err != nil {
|
||||
@@ -280,7 +280,7 @@ func TestBotEnvironment(t *testing.T) {
|
||||
t.Fatalf("failed to compile expression %q: %v", tt.expression, err)
|
||||
}
|
||||
|
||||
result, _, err := prog.Eval(map[string]interface{}{})
|
||||
result, _, err := prog.Eval(map[string]any{})
|
||||
if err != nil {
|
||||
t.Fatalf("failed to evaluate expression %q: %v", tt.expression, err)
|
||||
}
|
||||
@@ -359,7 +359,7 @@ func TestBotEnvironment(t *testing.T) {
|
||||
t.Fatalf("failed to compile expression %q: %v", tt.expression, err)
|
||||
}
|
||||
|
||||
result, _, err := prog.Eval(map[string]interface{}{})
|
||||
result, _, err := prog.Eval(map[string]any{})
|
||||
if err != nil {
|
||||
t.Fatalf("failed to evaluate expression %q: %v", tt.expression, err)
|
||||
}
|
||||
@@ -421,7 +421,7 @@ func TestBotEnvironment(t *testing.T) {
|
||||
t.Fatalf("failed to compile expression %q: %v", tt.expression, err)
|
||||
}
|
||||
|
||||
result, _, err := prog.Eval(map[string]interface{}{})
|
||||
result, _, err := prog.Eval(map[string]any{})
|
||||
if err != nil {
|
||||
t.Fatalf("failed to evaluate expression %q: %v", tt.expression, err)
|
||||
}
|
||||
@@ -514,7 +514,7 @@ func TestBotEnvironment(t *testing.T) {
|
||||
t.Fatalf("failed to compile expression %q: %v", tt.expression, err)
|
||||
}
|
||||
|
||||
result, _, err := prog.Eval(map[string]interface{}{})
|
||||
result, _, err := prog.Eval(map[string]any{})
|
||||
if err != nil {
|
||||
t.Fatalf("failed to evaluate expression %q: %v", tt.expression, err)
|
||||
}
|
||||
@@ -572,7 +572,7 @@ func TestBotEnvironment(t *testing.T) {
|
||||
t.Fatalf("failed to compile expression %q: %v", tt.expression, err)
|
||||
}
|
||||
|
||||
result, _, err := prog.Eval(map[string]interface{}{})
|
||||
result, _, err := prog.Eval(map[string]any{})
|
||||
if tt.evalError {
|
||||
if err == nil {
|
||||
t.Errorf("%s: expected an evaluation error, but got none", tt.description)
|
||||
@@ -598,7 +598,7 @@ func TestThresholdEnvironment(t *testing.T) {
|
||||
}
|
||||
|
||||
tests := []struct {
|
||||
variables map[string]interface{}
|
||||
variables map[string]any
|
||||
name string
|
||||
expression string
|
||||
description string
|
||||
@@ -608,7 +608,7 @@ func TestThresholdEnvironment(t *testing.T) {
|
||||
{
|
||||
name: "weight-variable-available",
|
||||
expression: `weight > 100`,
|
||||
variables: map[string]interface{}{"weight": 150},
|
||||
variables: map[string]any{"weight": 150},
|
||||
expected: types.Bool(true),
|
||||
description: "should support weight variable in expressions",
|
||||
shouldCompile: true,
|
||||
@@ -616,7 +616,7 @@ func TestThresholdEnvironment(t *testing.T) {
|
||||
{
|
||||
name: "weight-variable-false-case",
|
||||
expression: `weight > 100`,
|
||||
variables: map[string]interface{}{"weight": 50},
|
||||
variables: map[string]any{"weight": 50},
|
||||
expected: types.Bool(false),
|
||||
description: "should correctly evaluate weight comparisons",
|
||||
shouldCompile: true,
|
||||
@@ -624,7 +624,7 @@ func TestThresholdEnvironment(t *testing.T) {
|
||||
{
|
||||
name: "missingHeader-not-available",
|
||||
expression: `missingHeader(headers, "Test")`,
|
||||
variables: map[string]interface{}{},
|
||||
variables: map[string]any{},
|
||||
expected: types.Bool(false), // not used
|
||||
description: "should not have missingHeader function available",
|
||||
shouldCompile: false,
|
||||
@@ -667,7 +667,7 @@ func TestNewEnvironment(t *testing.T) {
|
||||
tests := []struct {
|
||||
name string
|
||||
expression string
|
||||
variables map[string]interface{}
|
||||
variables map[string]any
|
||||
expectBool *bool // nil if we just want to test compilation or non-bool result
|
||||
description string
|
||||
shouldCompile bool
|
||||
@@ -675,7 +675,7 @@ func TestNewEnvironment(t *testing.T) {
|
||||
{
|
||||
name: "randInt-function-compilation",
|
||||
expression: `randInt(10)`,
|
||||
variables: map[string]interface{}{},
|
||||
variables: map[string]any{},
|
||||
expectBool: nil, // Don't check result, just compilation
|
||||
description: "should compile randInt function",
|
||||
shouldCompile: true,
|
||||
@@ -683,7 +683,7 @@ func TestNewEnvironment(t *testing.T) {
|
||||
{
|
||||
name: "randInt-range-validation",
|
||||
expression: `randInt(10) >= 0 && randInt(10) < 10`,
|
||||
variables: map[string]interface{}{},
|
||||
variables: map[string]any{},
|
||||
expectBool: boolPtr(true),
|
||||
description: "should return values in correct range",
|
||||
shouldCompile: true,
|
||||
@@ -691,7 +691,7 @@ func TestNewEnvironment(t *testing.T) {
|
||||
{
|
||||
name: "strings-extension-size",
|
||||
expression: `"hello".size() == 5`,
|
||||
variables: map[string]interface{}{},
|
||||
variables: map[string]any{},
|
||||
expectBool: boolPtr(true),
|
||||
description: "should support string extension functions",
|
||||
shouldCompile: true,
|
||||
@@ -699,7 +699,7 @@ func TestNewEnvironment(t *testing.T) {
|
||||
{
|
||||
name: "strings-extension-contains",
|
||||
expression: `"hello world".contains("world")`,
|
||||
variables: map[string]interface{}{},
|
||||
variables: map[string]any{},
|
||||
expectBool: boolPtr(true),
|
||||
description: "should support string contains function",
|
||||
shouldCompile: true,
|
||||
@@ -707,7 +707,7 @@ func TestNewEnvironment(t *testing.T) {
|
||||
{
|
||||
name: "strings-extension-startsWith",
|
||||
expression: `"hello world".startsWith("hello")`,
|
||||
variables: map[string]interface{}{},
|
||||
variables: map[string]any{},
|
||||
expectBool: boolPtr(true),
|
||||
description: "should support string startsWith function",
|
||||
shouldCompile: true,
|
||||
|
||||
@@ -32,7 +32,6 @@ func TestGoodConfigs(t *testing.T) {
|
||||
}
|
||||
|
||||
for _, st := range finfos {
|
||||
st := st
|
||||
t.Run(st.Name(), func(t *testing.T) {
|
||||
t.Run("with-thoth", func(t *testing.T) {
|
||||
fin, err := os.Open(filepath.Join("..", "config", "testdata", "good", st.Name()))
|
||||
@@ -71,7 +70,6 @@ func TestBadConfigs(t *testing.T) {
|
||||
}
|
||||
|
||||
for _, st := range finfos {
|
||||
st := st
|
||||
t.Run(st.Name(), func(t *testing.T) {
|
||||
fin, err := os.Open(filepath.Join("..", "config", "testdata", "bad", st.Name()))
|
||||
if err != nil {
|
||||
|
||||
@@ -6,6 +6,7 @@ import (
|
||||
"encoding/json"
|
||||
"fmt"
|
||||
"io"
|
||||
"maps"
|
||||
"sync"
|
||||
"testing"
|
||||
"time"
|
||||
@@ -36,9 +37,7 @@ func (m *mockS3) PutObject(ctx context.Context, in *s3.PutObjectInput, _ ...func
|
||||
m.data[aws.ToString(in.Key)] = bytes.Clone(b)
|
||||
if in.Metadata != nil {
|
||||
m.meta[aws.ToString(in.Key)] = map[string]string{}
|
||||
for k, v := range in.Metadata {
|
||||
m.meta[aws.ToString(in.Key)][k] = v
|
||||
}
|
||||
maps.Copy(m.meta[aws.ToString(in.Key)], in.Metadata)
|
||||
}
|
||||
m.bucket = aws.ToString(in.Bucket)
|
||||
return &s3.PutObjectOutput{}, nil
|
||||
|
||||
@@ -103,7 +103,7 @@ func (s Sentinel) Valid() error {
|
||||
// redisClient is satisfied by *valkey.Client and *valkey.ClusterClient.
|
||||
type redisClient interface {
|
||||
Get(ctx context.Context, key string) *valkey.StringCmd
|
||||
Set(ctx context.Context, key string, value interface{}, expiration time.Duration) *valkey.StatusCmd
|
||||
Set(ctx context.Context, key string, value any, expiration time.Duration) *valkey.StatusCmd
|
||||
Del(ctx context.Context, keys ...string) *valkey.IntCmd
|
||||
Ping(ctx context.Context) *valkey.StatusCmd
|
||||
}
|
||||
|
||||
+2
-2
@@ -11,8 +11,8 @@ func authUnaryClientInterceptor(token string) grpc.UnaryClientInterceptor {
|
||||
return func(
|
||||
ctx context.Context,
|
||||
method string,
|
||||
req interface{},
|
||||
reply interface{},
|
||||
req any,
|
||||
reply any,
|
||||
cc *grpc.ClientConn,
|
||||
invoker grpc.UnaryInvoker,
|
||||
opts ...grpc.CallOption,
|
||||
|
||||
+1
-1
@@ -8,7 +8,7 @@
|
||||
"test:integration": "npm run assets && go test -v ./internal/test",
|
||||
"test:integration:podman": "npm run assets && go test -v ./internal/test --playwright-runner=podman",
|
||||
"test:integration:docker": "npm run assets && go test -v ./internal/test --playwright-runner=docker",
|
||||
"assets": "go generate ./... && ./web/build.sh && ./xess/build.sh",
|
||||
"assets": "go generate ./...",
|
||||
"build": "npm run assets && go build -o ./var/anubis ./cmd/anubis",
|
||||
"dev": "npm run assets && go run ./cmd/anubis --use-remote-address --target http://localhost:3000",
|
||||
"container": "npm run assets && go run ./cmd/containerbuild",
|
||||
|
||||
+2
-2
@@ -1,6 +1,6 @@
|
||||
module github.com/TecharoHQ/anubis/test
|
||||
|
||||
go 1.24.5
|
||||
go 1.25.0
|
||||
|
||||
replace github.com/TecharoHQ/anubis => ..
|
||||
|
||||
@@ -90,7 +90,7 @@ require (
|
||||
go.yaml.in/yaml/v2 v2.4.3 // indirect
|
||||
golang.org/x/exp v0.0.0-20251209150349-8475f28825e9 // indirect
|
||||
golang.org/x/net v0.48.0 // indirect
|
||||
golang.org/x/sys v0.39.0 // indirect
|
||||
golang.org/x/sys v0.42.0 // indirect
|
||||
golang.org/x/text v0.32.0 // indirect
|
||||
google.golang.org/genproto/googleapis/api v0.0.0-20251213004720-97cd9d5aeac2 // indirect
|
||||
google.golang.org/genproto/googleapis/rpc v0.0.0-20251213004720-97cd9d5aeac2 // indirect
|
||||
|
||||
+2
-2
@@ -261,8 +261,8 @@ golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7w
|
||||
golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
|
||||
golang.org/x/sys v0.0.0-20220615213510-4f61da869c0c/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
|
||||
golang.org/x/sys v0.39.0 h1:CvCKL8MeisomCi6qNZ+wbb0DN9E5AATixKsvNtMoMFk=
|
||||
golang.org/x/sys v0.39.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
|
||||
golang.org/x/sys v0.42.0 h1:omrd2nAlyT5ESRdCLYdm3+fMfNFE/+Rf4bDIQImRJeo=
|
||||
golang.org/x/sys v0.42.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
|
||||
golang.org/x/text v0.32.0 h1:ZD01bjUt1FQ9WJ0ClOL5vxgxOI/sVCNgX1YtKwcY0mU=
|
||||
golang.org/x/text v0.32.0/go.mod h1:o/rUWzghvpD5TXrTIBuJU77MTaN0ljMWE47kxGJQ7jY=
|
||||
golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
|
||||
|
||||
+10
-10
@@ -8,7 +8,7 @@ LICENSE='/*
|
||||
@licstart The following is the entire license notice for the
|
||||
JavaScript code in this page.
|
||||
|
||||
Copyright (c) 2025 Xe Iaso <xe.iaso@techaro.lol>
|
||||
Copyright (c) 2026 Xe Iaso <xe.iaso@techaro.lol>
|
||||
|
||||
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||
of this software and associated documentation files (the "Software"), to deal
|
||||
@@ -42,15 +42,15 @@ cp ../lib/localization/locales/*.json static/locales/
|
||||
shopt -s nullglob globstar
|
||||
|
||||
for file in js/**/*.ts js/**/*.mjs; do
|
||||
out="static/${file}"
|
||||
if [[ "$file" == *.ts ]]; then
|
||||
out="static/${file%.ts}.mjs"
|
||||
fi
|
||||
out="static/${file}"
|
||||
if [[ "$file" == *.ts ]]; then
|
||||
out="static/${file%.ts}.mjs"
|
||||
fi
|
||||
|
||||
mkdir -p "$(dirname "$out")"
|
||||
mkdir -p "$(dirname "$out")"
|
||||
|
||||
esbuild "$file" --sourcemap --bundle --minify --outfile="$out" --banner:js="$LICENSE"
|
||||
gzip -f -k -n "$out"
|
||||
zstd -f -k --ultra -22 "$out"
|
||||
brotli -fZk "$out"
|
||||
esbuild "$file" --sourcemap --bundle --minify --outfile="$out" --banner:js="$LICENSE"
|
||||
gzip -f -k -n "$out"
|
||||
zstd -f -k --ultra -22 "$out"
|
||||
brotli -fZk "$out"
|
||||
done
|
||||
|
||||
@@ -3,6 +3,7 @@ package web
|
||||
import "embed"
|
||||
|
||||
//go:generate go tool github.com/a-h/templ/cmd/templ generate
|
||||
//go:generate go tool gosh ./build.sh
|
||||
|
||||
var (
|
||||
//go:embed static
|
||||
|
||||
@@ -12,6 +12,8 @@ import (
|
||||
"github.com/TecharoHQ/anubis/internal"
|
||||
)
|
||||
|
||||
//go:generate go tool gosh ./build.sh
|
||||
|
||||
var (
|
||||
//go:embed *.css static
|
||||
Static embed.FS
|
||||
|
||||
Reference in New Issue
Block a user