flaxo/ghost

public

Source code of Ghost - On Ghost

delivery: send signed webhooks with an SSRF guardd7e1e3013 days ago300 lines · 9.2 KB

1	package main
2
3	import (
4	"context"
5	"crypto/aes"
6	"crypto/cipher"
7	"crypto/rand"
8	"encoding/base64"
9	"encoding/json"
10	"errors"
11	"io"
12	"net"
13	"net/http"
14	"net/http/httptest"
15	"net/netip"
16	"strconv"
17	"testing"
18	"time"
19
20	"github.com/jackc/pgx/v5/pgxpool"
21	)
22
23	func TestBlocked(t *
24	tests := []struct
25	addr string
26	blockedStrict, blockedLAN bool
27	}{
28	{"93.184.216.34", false,
29	{"2606:2800:220:1::1", false,
30	{"127.0.0.1", true,
31	{"::1", true,
32	{"10.1.2.3", true,
33	{"172.16.0.1", true,
34	{"192.168.1.4", true,
35	{"100.64.0.1", true,
36	{"fd00::1", true,
37	{"::ffff:127.0.0.1", true,
38	{"169.254.169.254", true,
39	{"::ffff:169.254.169.254", true,
40	{"fe80::1", true,
41	{"0.0.0.0", true,
42	{"224.0.0.1", true,
43	}
44	for _, tt
45	a := netip.
46	if got := blocked
47	t.Errorf("blocked(
48	}
49	if got := blocked
50	t.Errorf("blocked(
51	}
52	}
53	}
54
55	func TestWebhookClientRefusesLoopbackOnTheDialedIP(t *
56	hits := make(
57	srv := httptest.
58	defer srv.Close()
59
60	// "localhost" resolves to 127.0.0.1: the check runs after DNS, on the real address.
61	url := "http://localhost:"
62	_, err :=
63	if !errors.Is
64	t.Fatalf("err =
65	}
66	if len(hits)
67	t.Error("request reached the loopback server
68	}
69	}
70
71	func TestSignedHeaders(t *
72	secret, body :=
73	now := time.
74	h := signedHeaders(
75
76	if h["X-Ghost-Timestamp"
77	t.Errorf("headers =
78	}
79	// What a receiver computes: HMAC over "<timestamp>.<raw body>".
80	if want := "
81	t.Errorf("X-Ghost-Signature-256 =
82	}
83	if want := "
84	t.Errorf("X-Hub-Signature-256 =
85	}
86	}
87
88	func TestOpenSecret(t *
89	key := make([]
90	rand.Read(key
91	got, err :=
92	if err != nil
93	t.Fatalf("openSecret =
94	}
95	other := make([]
96	if _, err
97	t.Error("opened a secret with the wrong key
98	}
99	}
100
101	func TestParseRetryAfter(t *
102	now := time.
103	tests := []struct
104	v string
105	want time.
106	ok bool
107	}{
108	{"120", 2 *
109	{"Tue, 29 Sep 2026 12:05:00 GMT", 5 *
110	{"", 0, false}
111	{"soon", 0,
112	}
113	for _, tt
114	got, ok :=
115	if got != tt
116	t.Errorf("parseRetryAfter(
117	}
118	}
119	}
120
121	// sealSecret encrypts like the API does: "v1:" + base64(nonce \|\| AES-256-GCM ciphertext).
122	func sealSecret(t *
123	t.Helper()
124	block, err :=
125	if err != nil
126	t.Fatal(err
127	}
128	gcm, err :=
129	if err != nil
130	t.Fatal(err
131	}
132	nonce := make([]
133	rand.Read(nonce
134	return "v1:" + base64
135	}
136
137	// webhookFixture inserts an organization, an endpoint pointing at url and one
138	// webhook job. Deleting the organization cascades to all three.
139	func webhookFixture(t *
140	t.Helper()
141	key := make([]
142	rand.Read(key
143	suffix := strconv.
144	org := "org_test_delivery_"
145
146	_, err :=
147	`INSERT INTO organization (id, name, slug, created_at) VALUES ($1, 'Delivery test', $2, now())`,
148	org, "test-delivery-"+
149	if err != nil
150	t.Fatal(err
151	}
152	t.Cleanup(func()
153	if _, err
154	t.Errorf("cleanup:
155	}
156	})
157
158	var endpointID string
159	err = db.
160	`INSERT INTO webhook_endpoint (id, organization_id, url, secret, events)
161	VALUES ($1, $2, $3, $4, '{issue.opened}') RETURNING id`,
162	"whk_test_"+suffix,
163	if err != nil
164	t.Fatal(err
165	}
166
167	payload, _ :=
168	j := Job
169	err = db.
170	`INSERT INTO delivery_job (kind, idempotency_key, payload, endpoint_id)
171	VALUES ('webhook', $1 \|\| gen_random_uuid()::text, $2, $3) RETURNING id`,
172	testKeyPrefix, payload,
173	if err != nil
174	t.Fatal(err
175	}
176	return webhookSender{db
177	}
178
179	func TestWebhookSendSignsAndRecordsTheAttempt(t *
180	db := testDB(
181	type received struct
182	header http.
183	body []byte
184	}
185	reqs := make(
186	srv := httptest.
187	body, _ :=
188	reqs <- received
189	w.Write([]byte
190	}))
191	defer srv.Close()
192	s, j,
193
194	if err := s
195	t.Fatal(err
196	}
197	r := <-reqs
198	gotBody := r.
199	got := struct{
200
201	if string(gotBody)
202	t.Errorf("body =
203	}
204	ts := got.
205	if want := "
206	t.Error("signature does not verify with the endpoint secret
207	}
208	if got.Header.
209	t.Errorf("X-Ghost-Delivery =
210	}
211
212	var (
213	status int
214	body string
215	)
216	err := db.
217	`SELECT status_code, response_body FROM delivery_attempt WHERE job_id = $1`, j.
218	if err != nil
219	t.Fatal(err
220	}
221	if status != 200
222	t.Errorf("attempt =
223	}
224	}
225
226	func TestWebhookResponseClassification(t *
227	db := testDB(
228	tests := []struct
229	name string
230	status int
231	header map[string]
232	check func(t
233	}{
234	{"500 retries", 500,
235	var p permanentError
236	if err == nil
237	t.Errorf("err =
238	}
239	}},
240	{"410 disables the endpoint", 410,
241	var p permanentError
242	if !errors.As
243	t.Errorf("err =
244	}
245	if active {
246	t.Error("endpoint still active after 410
247	}
248	}},
249	{"429 honors Retry-After", 429,
250	var r retryAfterError
251	if !errors.As
252	t.Errorf("err =
253	}
254	}},
255	{"redirect is not followed", 302,
256	if err == nil
257	t.Errorf("err =
258	}
259	}},
260	}
261	for _, tt
262	t.Run(tt
263	srv := httptest.
264	for k, v
265	w.Header().Set
266	}
267	w.WriteHeader(tt
268	}))
269	defer srv.Close()
270	s, j,
271
272	err := s.
273
274	var active bool
275	if err := db
276	t.Fatal(err
277	}
278	tt.check(t
279	})
280	}
281	}
282
283	func TestWebhookSendDropsJobForDisabledEndpoint(t *
284	db := testDB(
285	hits := make(
286	srv := httptest.
287	defer srv.Close()
288	s, j,
289	if _, err
290	t.Fatal(err
291	}
292
293	var p permanentError
294	if err := s
295	t.Errorf("err =
296	}
297	if len(hits)
298	t.Error("sent to a disabled endpoint
299	}
300	}