mirror of
https://github.com/TecharoHQ/anubis.git
synced 2026-06-09 22:08:15 +00:00
926f3d1d0e
This is based on private evaluation of a prerelease security product. I cannot comment further other than I am impressed by its output. This commit is a squash of several commits. The impactful commits have details underneath markdown heading twos. ## fix(metrics): don't expose pprof by default pprof[1] is the Go standard library profiling toolkit. It is invaluable for diagnosing how Go programs perform in the wild. However it also is able to expose secret data set with command line flags. This is not ideal and should be mitigated by correctly configured firewall rules. We don't live in a world where people correctly configure firewall rules, so we have to fix things for people. Welcome to 2026. [1]: https://pkg.go.dev/runtime/pprof Ref: AWOO-001 ## fix(honeypot/naive): cap r9k delay to one second Otherwise this can get unbounded, which can cause problems with lesser HTTP proxies such as Apache. Ref: AWOO-002 ## fix(policy): mend an edge case with subrequest auth and query strings This fixes an unlikely edge case where using subrequest auth and query strings with path based filtering can cause reality to differ from administrator intent. This effectively strips the query string from subrequest auth checks. This deficiency should be fixed in the future. Ref: AWOO-004 ## fix(expressions): mend possible nil pointer deref edge case If Anubis just started up, load averages may not be set in memory. This can cause a nil pointer dereference which could fail requests with weird errors until the async thread sets the load averages. Ref: AWOO-005 ## fix(lib): mend case where domainless redirects could allow cross-domain redirects Ref: AWOO-009 ## fix(expressions): validate randInt bounds before rand.IntN Non-positive or platform-overflowing arguments to the CEL randInt helper used to reach rand.IntN unchecked, surfacing a CEL evaluator error during request processing when policies passed attacker-influenced values (e.g. contentLength). Reject non-positive bounds and detect int narrowing explicitly, returning a typed CEL error in both cases. Ref: AWOO-010 Signed-off-by: Xe Iaso <xe.iaso@techaro.lol>
176 lines
4.5 KiB
Go
176 lines
4.5 KiB
Go
package bbolt
|
|
|
|
import (
|
|
"encoding/json"
|
|
"path/filepath"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/TecharoHQ/anubis/lib/store/storetest"
|
|
"go.etcd.io/bbolt"
|
|
)
|
|
|
|
func TestImpl(t *testing.T) {
|
|
path := filepath.Join(t.TempDir(), "db")
|
|
t.Log(path)
|
|
data, err := json.Marshal(Config{
|
|
Path: path,
|
|
})
|
|
if err != nil {
|
|
t.Fatal(err)
|
|
}
|
|
|
|
storetest.Common(t, Factory{}, json.RawMessage(data))
|
|
}
|
|
|
|
// newTestStore returns a Store backed by a throwaway bbolt database that is
|
|
// closed when the test finishes.
|
|
func newTestStore(t *testing.T) *Store {
|
|
t.Helper()
|
|
|
|
db, err := bbolt.Open(filepath.Join(t.TempDir(), "db"), 0600, nil)
|
|
if err != nil {
|
|
t.Fatalf("can't open bbolt database: %v", err)
|
|
}
|
|
t.Cleanup(func() { db.Close() })
|
|
|
|
return &Store{bdb: db}
|
|
}
|
|
|
|
// mustSet writes a value with the given relative expiry, failing the test on error.
|
|
func mustSet(t *testing.T, s *Store, key, value string, expiry time.Duration) {
|
|
t.Helper()
|
|
|
|
if err := s.Set(t.Context(), key, []byte(value), expiry); err != nil {
|
|
t.Fatalf("Set(%q): %v", key, err)
|
|
}
|
|
}
|
|
|
|
// readExpiry returns the expiry timestamp currently stored for key, as a Get
|
|
// would parse it. It fails the test if the bucket or expiry is missing.
|
|
func readExpiry(t *testing.T, s *Store, key string) time.Time {
|
|
t.Helper()
|
|
|
|
var out time.Time
|
|
if err := s.bdb.View(func(tx *bbolt.Tx) error {
|
|
b := tx.Bucket([]byte(key))
|
|
if b == nil {
|
|
t.Fatalf("bucket %q missing", key)
|
|
}
|
|
|
|
expiry, err := time.Parse(time.RFC3339Nano, string(b.Get([]byte("expiry"))))
|
|
if err != nil {
|
|
return err
|
|
}
|
|
out = expiry
|
|
return nil
|
|
}); err != nil {
|
|
t.Fatalf("reading expiry for %q: %v", key, err)
|
|
}
|
|
|
|
return out
|
|
}
|
|
|
|
// rawData reads the raw data value for key directly, bypassing the expiry check
|
|
// in Get so tests can observe whether a bucket physically exists. It returns nil
|
|
// when the bucket is absent.
|
|
func rawData(t *testing.T, s *Store, key string) []byte {
|
|
t.Helper()
|
|
|
|
var out []byte
|
|
if err := s.bdb.View(func(tx *bbolt.Tx) error {
|
|
b := tx.Bucket([]byte(key))
|
|
if b == nil {
|
|
return nil
|
|
}
|
|
data := b.Get([]byte("data"))
|
|
out = make([]byte, len(data))
|
|
copy(out, data)
|
|
return nil
|
|
}); err != nil {
|
|
t.Fatalf("reading data for %q: %v", key, err)
|
|
}
|
|
|
|
return out
|
|
}
|
|
|
|
// TestDeleteIfExpired guards against AWOO-015: a stale async delete scheduled by
|
|
// an expired Get must not erase a value that was refreshed (or otherwise differs
|
|
// from) the generation it observed.
|
|
func TestDeleteIfExpired(t *testing.T) {
|
|
const key = "challenge"
|
|
|
|
for _, tt := range []struct {
|
|
setup func(t *testing.T, s *Store) time.Time
|
|
name string
|
|
wantValue string
|
|
wantPresent bool
|
|
}{
|
|
{
|
|
name: "deletes the observed expired generation",
|
|
setup: func(t *testing.T, s *Store) time.Time {
|
|
mustSet(t, s, key, "old", -time.Minute)
|
|
return readExpiry(t, s, key)
|
|
},
|
|
wantPresent: false,
|
|
},
|
|
{
|
|
name: "preserves a refreshed generation",
|
|
setup: func(t *testing.T, s *Store) time.Time {
|
|
mustSet(t, s, key, "old", -time.Minute)
|
|
observed := readExpiry(t, s, key)
|
|
mustSet(t, s, key, "fresh", time.Hour)
|
|
return observed
|
|
},
|
|
wantPresent: true,
|
|
wantValue: "fresh",
|
|
},
|
|
{
|
|
name: "skips on generation mismatch",
|
|
setup: func(t *testing.T, s *Store) time.Time {
|
|
mustSet(t, s, key, "old", -time.Minute)
|
|
// An expiry we never wrote: even though the stored value is
|
|
// expired, it is a different generation and must be left alone.
|
|
return time.Now().Add(-2 * time.Hour)
|
|
},
|
|
wantPresent: true,
|
|
wantValue: "old",
|
|
},
|
|
{
|
|
name: "skips a non-expired observation",
|
|
setup: func(t *testing.T, s *Store) time.Time {
|
|
mustSet(t, s, key, "live", time.Hour)
|
|
return readExpiry(t, s, key)
|
|
},
|
|
wantPresent: true,
|
|
wantValue: "live",
|
|
},
|
|
{
|
|
name: "no-op when bucket is absent",
|
|
setup: func(t *testing.T, s *Store) time.Time {
|
|
return time.Now().Add(-time.Hour)
|
|
},
|
|
wantPresent: false,
|
|
},
|
|
} {
|
|
t.Run(tt.name, func(t *testing.T) {
|
|
s := newTestStore(t)
|
|
observed := tt.setup(t, s)
|
|
|
|
if err := s.deleteIfExpired(t.Context(), key, observed); err != nil {
|
|
t.Fatalf("deleteIfExpired(%q): %v", key, err)
|
|
}
|
|
|
|
got := rawData(t, s, key)
|
|
switch {
|
|
case tt.wantPresent && got == nil:
|
|
t.Fatalf("key %q: want present with value %q, got deleted", key, tt.wantValue)
|
|
case tt.wantPresent && string(got) != tt.wantValue:
|
|
t.Errorf("key %q: want value %q, got %q", key, tt.wantValue, string(got))
|
|
case !tt.wantPresent && got != nil:
|
|
t.Errorf("key %q: want deleted, got value %q", key, string(got))
|
|
}
|
|
})
|
|
}
|
|
}
|