vole
Clone
Read only, no credentials:
https://rodent.software/git/vole.git
Write over SSH with a registered key:
git clone ssh://git@0.0.0.0:2222/vole.git
A free and open-source forge that lives in your Git repo.
Fuzz the path validators and the Markdown sanitizer
5fce878d41da32448803f3a4f4d42c7841fba331 · Keenan Nemetz · 10d ago · parent d9f5a930
Fuzz the path validators and the Markdown sanitizer Two pieces of untrusted text decide where a file is written and what a browser runs: the validators that turn a request path, an artifact glob, or a site directory into a place under a root, and the markdown boundary where goldmark and bluemonday turn a pushed body into HTML a page trusts. The sanitizer assertions parse the output with an HTML parser rather than searching the string, because the difference is the whole question: a script tag rendered as text is a text node, and hand-written <script> looks the same to a substring search. The test asks what the browser will do: no script-shaped element, no on* attribute, and no scheme outside http, https, mailto. The path targets state the guarantee the way the caller uses it -- joined to a root, the result stays under that root -- and pin that cleaning is idempotent, so one page cannot become two cache keys. cleanPath's comment claimed dot segments were refused; they are resolved, and the comment now says so, which is what the property pins. Closes #98.
ci/fuzz_paths_test.go +100
| @@ -0,0 +1,100 @@ | |||
| 1 | package ci | ||
| 2 | |||
| 3 | import ( | ||
| 4 | "path" | ||
| 5 | "path/filepath" | ||
| 6 | "strings" | ||
| 7 | "testing" | ||
| 8 | ) | ||
| 9 | |||
| 10 | // FuzzValidateArtifactPath drives the check on the glob a workflow uses to declare | ||
| 11 | // its artifacts. The pattern is matched against slash-separated paths relative to | ||
| 12 | // the job's checkout, so what has to hold is that an accepted pattern describes a | ||
| 13 | // place inside that checkout rather than above it. | ||
| 14 | func FuzzValidateArtifactPath(f *testing.F) { | ||
| 15 | for _, seed := range []string{ | ||
| 16 | "dist/vole-linux-*", | ||
| 17 | "dist/*.deb", | ||
| 18 | "*", | ||
| 19 | "**", | ||
| 20 | "../outside", | ||
| 21 | "a/../../b", | ||
| 22 | "/absolute/*", | ||
| 23 | "dist/", | ||
| 24 | "", | ||
| 25 | "[.][.]/x", | ||
| 26 | "a\x00b", | ||
| 27 | "dist/{a,b}", | ||
| 28 | "a/..", | ||
| 29 | "..", | ||
| 30 | ".", | ||
| 31 | } { | ||
| 32 | f.Add(seed) | ||
| 33 | } | ||
| 34 | f.Fuzz(func(t *testing.T, pattern string) { | ||
| 35 | if err := ValidateArtifactPath(pattern); err != nil { | ||
| 36 | return | ||
| 37 | } | ||
| 38 | if strings.HasPrefix(pattern, "/") || filepath.IsAbs(pattern) { | ||
| 39 | t.Fatalf("ValidateArtifactPath(%q) accepted an absolute pattern", pattern) | ||
| 40 | } | ||
| 41 | for _, segment := range strings.Split(pattern, "/") { | ||
| 42 | if segment == ".." { | ||
| 43 | t.Fatalf("ValidateArtifactPath(%q) accepted a pattern that climbs", pattern) | ||
| 44 | } | ||
| 45 | } | ||
| 46 | // The collector matches this against a path it derived from the walk, so an | ||
| 47 | // accepted pattern has to be one path.Match can compile at all. | ||
| 48 | if _, err := path.Match(pattern, "probe"); err != nil { | ||
| 49 | t.Fatalf("ValidateArtifactPath(%q) accepted a pattern path.Match refuses: %v", pattern, err) | ||
| 50 | } | ||
| 51 | }) | ||
| 52 | } | ||
| 53 | |||
| 54 | // FuzzValidatePagesPath is the same for a site directory, which is joined to the | ||
| 55 | // checkout to find the tree a site is published from. That one does reach a | ||
| 56 | // filesystem, so the climb is the whole point. | ||
| 57 | func FuzzValidatePagesPath(f *testing.F) { | ||
| 58 | for _, seed := range []string{ | ||
| 59 | "site", | ||
| 60 | "site/", | ||
| 61 | "dist/site", | ||
| 62 | ".", | ||
| 63 | "", | ||
| 64 | "..", | ||
| 65 | "../site", | ||
| 66 | "site/../../etc", | ||
| 67 | "/absolute", | ||
| 68 | "site/*", | ||
| 69 | "site?", | ||
| 70 | "[a]", | ||
| 71 | "si:te", | ||
| 72 | "si\nte", | ||
| 73 | "a\x00b", | ||
| 74 | "....//x", | ||
| 75 | } { | ||
| 76 | f.Add(seed) | ||
| 77 | } | ||
| 78 | f.Fuzz(func(t *testing.T, dir string) { | ||
| 79 | if err := ValidatePagesPath(dir); err != nil { | ||
| 80 | return | ||
| 81 | } | ||
| 82 | if strings.HasPrefix(dir, "/") || filepath.IsAbs(dir) { | ||
| 83 | t.Fatalf("ValidatePagesPath(%q) accepted an absolute directory", dir) | ||
| 84 | } | ||
| 85 | for _, segment := range strings.Split(dir, "/") { | ||
| 86 | if segment == ".." { | ||
| 87 | t.Fatalf("ValidatePagesPath(%q) accepted a directory that climbs", dir) | ||
| 88 | } | ||
| 89 | } | ||
| 90 | if strings.ContainsAny(dir, "*?[\x00\r\n:") { | ||
| 91 | t.Fatalf("ValidatePagesPath(%q) accepted a character it is supposed to refuse", dir) | ||
| 92 | } | ||
| 93 | // Stated the way the caller uses it: joined to the checkout, the result is | ||
| 94 | // still inside the checkout. | ||
| 95 | joined := filepath.Join("/checkout", dir) | ||
| 96 | if joined != "/checkout" && !strings.HasPrefix(joined+string(filepath.Separator), "/checkout"+string(filepath.Separator)) { | ||
| 97 | t.Fatalf("ValidatePagesPath(%q) accepted %q, which resolves to %q", dir, dir, joined) | ||
| 98 | } | ||
| 99 | }) | ||
| 100 | } | ||