From 506a1c98e716754455387be9ace3ad7aec9c47a3 Mon Sep 17 00:00:00 2001 From: Mark Felder Date: Mon, 29 May 2023 13:55:48 -0400 Subject: ConnCase: Make sure the host we use in tests is the actual Endpoint host --- test/support/conn_case.ex | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'test') diff --git a/test/support/conn_case.ex b/test/support/conn_case.ex index f010fec33..d6729ab87 100644 --- a/test/support/conn_case.ex +++ b/test/support/conn_case.ex @@ -120,6 +120,10 @@ defmodule Pleroma.Web.ConnCase do Mox.verify_on_exit!() - {:ok, conn: Phoenix.ConnTest.build_conn()} + {:ok, + conn: + Phoenix.ConnTest.build_conn() + |> Map.put(:host, Pleroma.Web.Endpoint.host()) + |> Plug.Test.init_test_session(%{})} end end -- cgit v1.2.3 From 843fcca5b4d022e4c088d4a60839b4a286500148 Mon Sep 17 00:00:00 2001 From: Mark Felder Date: Mon, 29 May 2023 13:59:51 -0400 Subject: Validate Host header matches expected value before allowing access to MediaProxy --- .../web/media_proxy/media_proxy_controller_test.exs | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) (limited to 'test') diff --git a/test/pleroma/web/media_proxy/media_proxy_controller_test.exs b/test/pleroma/web/media_proxy/media_proxy_controller_test.exs index 9ce092fd8..3971330d4 100644 --- a/test/pleroma/web/media_proxy/media_proxy_controller_test.exs +++ b/test/pleroma/web/media_proxy/media_proxy_controller_test.exs @@ -54,6 +54,23 @@ defmodule Pleroma.Web.MediaProxy.MediaProxyControllerTest do } = get(conn, "/proxy/hhgfh/eeee/fff") end + test "it returns a 400 for invalid host", %{conn: conn} do + clear_config([:media_proxy, :base_url], "http://mp.localhost/") + + url = + MediaProxy.encode_url("https://pleroma.social/logo.jpeg") + |> URI.parse() + |> Map.put(:host, "wronghost") + |> URI.to_string() + + with_mock Pleroma.ReverseProxy, + call: fn _conn, _url, _opts -> %Conn{status: :success} end do + %{status: status} = get(conn, url) + + assert status == 400 + end + end + test "redirects to valid url when filename is invalidated", %{conn: conn, url: url} do invalid_url = String.replace(url, "test.png", "test-file.png") response = get(conn, invalid_url) -- cgit v1.2.3 From a60dd0d92dae2471025827bc57d3cf3194003110 Mon Sep 17 00:00:00 2001 From: Mark Felder Date: Mon, 29 May 2023 14:16:03 -0400 Subject: Validate Host header matches expected value before allowing access to Uploads --- test/pleroma/web/plugs/uploaded_media_plug_test.exs | 14 ++++++++++++++ 1 file changed, 14 insertions(+) (limited to 'test') diff --git a/test/pleroma/web/plugs/uploaded_media_plug_test.exs b/test/pleroma/web/plugs/uploaded_media_plug_test.exs index 8323ff6ab..262c8c288 100644 --- a/test/pleroma/web/plugs/uploaded_media_plug_test.exs +++ b/test/pleroma/web/plugs/uploaded_media_plug_test.exs @@ -40,4 +40,18 @@ defmodule Pleroma.Web.Plugs.UploadedMediaPlugTest do &(&1 == {"content-disposition", ~s[inline; filename="\\"cofe\\".gif"]}) ) end + + test "denies access to media if wrong Host", %{ + attachment_url: attachment_url + } do + conn = get(build_conn(), attachment_url) + + assert conn.status == 200 + + clear_config([Pleroma.Upload, :base_url], "http://media.localhost/") + + conn = get(build_conn(), attachment_url) + + assert conn.status == 400 + end end -- cgit v1.2.3 From 43bb2f39db0bd7028512cba402f6b5aa1610c1db Mon Sep 17 00:00:00 2001 From: Mark Felder Date: Mon, 29 May 2023 15:05:37 -0400 Subject: Remove unwanted parameter --- test/support/conn_case.ex | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) (limited to 'test') diff --git a/test/support/conn_case.ex b/test/support/conn_case.ex index d6729ab87..c1cb0295b 100644 --- a/test/support/conn_case.ex +++ b/test/support/conn_case.ex @@ -123,7 +123,6 @@ defmodule Pleroma.Web.ConnCase do {:ok, conn: Phoenix.ConnTest.build_conn() - |> Map.put(:host, Pleroma.Web.Endpoint.host()) - |> Plug.Test.init_test_session(%{})} + |> Map.put(:host, Pleroma.Web.Endpoint.host())} end end -- cgit v1.2.3 From b3c3bd99c390a4e5081d411011688e38285547b0 Mon Sep 17 00:00:00 2001 From: Mark Felder Date: Tue, 30 May 2023 16:56:09 -0400 Subject: Switch from serving a 400 to a 302 --- .../media_proxy/media_proxy_controller_test.exs | 27 ++++++++++++++++++---- .../pleroma/web/plugs/uploaded_media_plug_test.exs | 21 +++++++++++++++-- 2 files changed, 41 insertions(+), 7 deletions(-) (limited to 'test') diff --git a/test/pleroma/web/media_proxy/media_proxy_controller_test.exs b/test/pleroma/web/media_proxy/media_proxy_controller_test.exs index 3971330d4..019e389b7 100644 --- a/test/pleroma/web/media_proxy/media_proxy_controller_test.exs +++ b/test/pleroma/web/media_proxy/media_proxy_controller_test.exs @@ -54,20 +54,37 @@ defmodule Pleroma.Web.MediaProxy.MediaProxyControllerTest do } = get(conn, "/proxy/hhgfh/eeee/fff") end - test "it returns a 400 for invalid host", %{conn: conn} do - clear_config([:media_proxy, :base_url], "http://mp.localhost/") + test "it returns a 302 for invalid host", %{conn: conn} do + new_proxy_base = "http://mp.localhost/" - url = + %{scheme: new_proxy_scheme, host: new_proxy_host, port: new_proxy_port} = + URI.parse(new_proxy_base) + + clear_config([:media_proxy, :base_url], new_proxy_base) + + proxy_url = MediaProxy.encode_url("https://pleroma.social/logo.jpeg") |> URI.parse() |> Map.put(:host, "wronghost") |> URI.to_string() + expected_url = + URI.parse(proxy_url) + |> Map.put(:host, new_proxy_host) + |> Map.put(:port, new_proxy_port) + |> Map.put(:scheme, new_proxy_scheme) + |> URI.to_string() + with_mock Pleroma.ReverseProxy, call: fn _conn, _url, _opts -> %Conn{status: :success} end do - %{status: status} = get(conn, url) + %{resp_headers: resp_headers, status: status} = get(conn, proxy_url) + + assert status == 302 - assert status == 400 + assert Enum.any?( + resp_headers, + &(&1 == {"location", expected_url}) + ) end end diff --git a/test/pleroma/web/plugs/uploaded_media_plug_test.exs b/test/pleroma/web/plugs/uploaded_media_plug_test.exs index 262c8c288..fcc523cf4 100644 --- a/test/pleroma/web/plugs/uploaded_media_plug_test.exs +++ b/test/pleroma/web/plugs/uploaded_media_plug_test.exs @@ -48,10 +48,27 @@ defmodule Pleroma.Web.Plugs.UploadedMediaPlugTest do assert conn.status == 200 - clear_config([Pleroma.Upload, :base_url], "http://media.localhost/") + new_media_base = "http://media.localhost:8080" + + %{scheme: new_media_scheme, host: new_media_host, port: new_media_port} = + URI.parse(new_media_base) + + clear_config([Pleroma.Upload, :base_url], new_media_base) conn = get(build_conn(), attachment_url) - assert conn.status == 400 + expected_url = + URI.parse(attachment_url) + |> Map.put(:host, new_media_host) + |> Map.put(:port, new_media_port) + |> Map.put(:scheme, new_media_scheme) + |> URI.to_string() + + assert conn.status == 302 + + assert Enum.any?( + conn.resp_headers, + &(&1 == {"location", expected_url}) + ) end end -- cgit v1.2.3