mirror of
https://tangled.org/evan.jarrett.net/at-container-registry
synced 2026-09-10 04:06:06 +00:00
Evan JarrettandClaude Opus 5
39919cc832
The URL check accepted http:// while telling the user "must be https", and guarded no addresses at all. POST /api/webhooks with http://127.0.0.1:9/hook returned 200 and created the webhook, so both scheduled deliveries and the synchronous Test button would dial arbitrary destinations from the appview host, on demand, for any authenticated user. Loopback, link-local (including the cloud metadata endpoint at 169.254.169.254) and RFC1918 were all reachable. Enforces https, and refuses non-public destinations. The load-bearing half is the dial-time check, not the creation-time one. An attacker controls their own DNS, so a hostname that resolves publicly when the webhook is created can resolve to loopback when it is delivered, and a creation-time check cannot see a redirect either. The guard is therefore a net.Dialer Control hook on the delivery client, which inspects the resolved address on every connection attempt. Transport.Proxy is explicitly nil: honouring HTTP(S)_PROXY would route around the Control hook and hand the bypass straight back. Redirects are re-validated per hop and capped at 3. The creation-time check stays so the user gets an immediate, comprehensible error instead of a silent delivery failure later. IPv4-mapped IPv6 is unmapped before every check, so ::ffff:127.0.0.1 and friends hit the IPv4 rules. Ranges with no net.IP helper are listed explicitly: CGNAT, NAT64, ::/96, TEST-NET and reserved space. Both outbound paths are covered, since the scheduled dispatcher and the Test button both funnel through attemptDelivery. The dispatcher's other client is deliberately left unguarded: it fetches quota stats from holds, which legitimately live on private addresses, and those URLs are not user-supplied. Note this removes the ability to point a webhook at a localhost receiver in local development. There is deliberately no environment-variable escape hatch, since a security toggle read from the environment is the same bypass wearing a nicer coat. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PDqoCE1j3njokkZ9b1C5n9
88 lines
3.1 KiB
Go
88 lines
3.1 KiB
Go
package webhooks
|
|
|
|
import (
|
|
"context"
|
|
"net/http/httptest"
|
|
"testing"
|
|
"time"
|
|
|
|
"atcr.io/pkg/appview/db"
|
|
"atcr.io/pkg/atproto"
|
|
)
|
|
|
|
// scanForUser builds a minimal first-time scan record for dispatch tests.
|
|
func scanForUser(userDID string) *db.Scan {
|
|
return &db.Scan{
|
|
UserDID: userDID,
|
|
HoldDID: "did:web:hold",
|
|
Repository: "app",
|
|
ManifestDigest: "sha256:deadbeef",
|
|
ScannedAt: time.Now().UTC(),
|
|
ScannerVersion: "test",
|
|
}
|
|
}
|
|
|
|
// TestDispatchForScan_EntitlementGate verifies the dispatch-time backstop:
|
|
// paid triggers are dropped and the webhook count is capped when the limiter
|
|
// reports a non-entitled (e.g. self-hosted / downgraded) user.
|
|
func TestDispatchForScan_EntitlementGate(t *testing.T) {
|
|
conn, err := db.InitDB(":memory:", db.LibsqlConfig{})
|
|
if err != nil {
|
|
t.Fatalf("init db: %v", err)
|
|
}
|
|
defer conn.Close()
|
|
|
|
const userDID = "did:plc:scanent"
|
|
if err := db.UpsertUser(conn, &db.User{
|
|
DID: userDID, Handle: "se.test", PDSEndpoint: "https://pds", LastSeen: time.Now(),
|
|
}); err != nil {
|
|
t.Fatalf("upsert user: %v", err)
|
|
}
|
|
|
|
receiver := newFakeReceiver(8)
|
|
recvSrv := httptest.NewServer(receiver.handler())
|
|
defer recvSrv.Close()
|
|
|
|
// Two webhooks, both with the paid TriggerAll set, created oldest-first.
|
|
for i, id := range []string{"wh-old", "wh-new"} {
|
|
hook := &db.Webhook{
|
|
ID: id,
|
|
UserDID: userDID,
|
|
URL: recvSrv.URL,
|
|
Triggers: PackTriggers(TriggerFirst|TriggerAll, 0),
|
|
CreatedAt: time.Now().UTC().Add(time.Duration(i) * time.Second),
|
|
}
|
|
if err := db.InsertWebhook(conn, hook); err != nil {
|
|
t.Fatalf("insert hook %s: %v", id, err)
|
|
}
|
|
}
|
|
|
|
meta := atproto.AppviewMetadata{ClientShortName: "ATCR", BaseURL: "https://atcr.test"}
|
|
|
|
// Free tier: max 1 webhook, no paid triggers. The cap keeps only the oldest
|
|
// webhook, and scan:all (paid) is masked out — leaving just scan:first.
|
|
free := NewDispatcher(conn, meta, func(string) (int, bool) { return 1, false })
|
|
// The delivery guard refuses http and loopback addresses; the receiver here
|
|
// is an httptest server on 127.0.0.1, so relax it for this test. The guard
|
|
// itself is covered in ssrf_test.go.
|
|
free.allowLoopbackDeliveryForTest()
|
|
free.DispatchForScan(context.Background(), scanForUser(userDID), nil, "se.test", "latest", "https://hold")
|
|
if !receiver.waitFor(1, 2*time.Second) {
|
|
t.Fatalf("free tier: expected 1 delivery (scan:first on oldest hook), got %d", receiver.count())
|
|
}
|
|
time.Sleep(150 * time.Millisecond) // allow any erroneous extra deliveries to land
|
|
if got := receiver.count(); got != 1 {
|
|
t.Fatalf("free tier: expected exactly 1 delivery, got %d", got)
|
|
}
|
|
|
|
// Entitled: unlimited + all triggers. Both webhooks fire, each delivering
|
|
// scan:first AND scan:all = 4 deliveries (regression guard that the gate
|
|
// doesn't over-suppress).
|
|
entitled := NewDispatcher(conn, meta, func(string) (int, bool) { return -1, true })
|
|
entitled.allowLoopbackDeliveryForTest()
|
|
entitled.DispatchForScan(context.Background(), scanForUser(userDID), nil, "se.test", "latest", "https://hold")
|
|
if !receiver.waitFor(1+4, 2*time.Second) {
|
|
t.Fatalf("entitled: expected 4 more deliveries (2 hooks x scan:first+scan:all), total got %d", receiver.count())
|
|
}
|
|
}
|