fix(caddycode): validate + escape generation config — block CRLF / " / brace injection in Caddyfile interpolation (DC-070) [glm-grade=A]
This commit is contained in:
DashCaddy Polish Loop
@@ -0,0 +1,277 @@
|
||||
/**
|
||||
* DC-070: Caddycode config sanitization — validate the structural config
|
||||
* that flows into generateSiteBlock(), and confirm that the post-fix
|
||||
* generation does NOT interpolate raw user input into Caddyfile text.
|
||||
*
|
||||
* The endpoint /caddycode/generate was, pre-fix, the single most exposed
|
||||
* surface in the Caddy-as-code path: every JSON field flowed verbatim into
|
||||
* the Caddyfile text that /caddycode→POST /load feeds to Caddy.
|
||||
*
|
||||
* Bug class under test:
|
||||
* 1. CRLF / newline in `domain` → close the block and inject a new site
|
||||
* 2. `"` (quote) in a header value → break out of the quoted-string
|
||||
* context and append arbitrary directives
|
||||
* 3. `}` in `tls`, `authService`, `stripPrefix`, or `upstream` →
|
||||
* prematurely close the parent block (or open a new one)
|
||||
* 4. `://` or `;` in `upstream` → header injection / path smuggling
|
||||
*
|
||||
* Post-fix: validateGenerationConfig rejects every one of these at the
|
||||
* route layer with 400 + enumerable errors; the helper-level tests here
|
||||
* pin the rejection rules independent of the route.
|
||||
*/
|
||||
|
||||
const { __test } = require('../../routes/caddycode');
|
||||
const { validateGenerationConfig, escapeCaddyQuotedString, generateSiteBlock } = __test;
|
||||
|
||||
const BASE_OK = {
|
||||
domain: 'app.example.com',
|
||||
upstream: 'localhost:8080',
|
||||
};
|
||||
|
||||
function check(cond, msg) {
|
||||
if (!cond) throw new Error('assertion failed: ' + msg);
|
||||
}
|
||||
|
||||
describe('DC-070: caddycode config sanitization', () => {
|
||||
describe('validateGenerationConfig — happy paths', () => {
|
||||
test('minimal valid config passes', () => {
|
||||
const r = validateGenerationConfig(BASE_OK);
|
||||
check(r.valid === true, `expected valid=true, got errors=${JSON.stringify(r.errors)}`);
|
||||
check(Array.isArray(r.errors) && r.errors.length === 0, 'expected no errors');
|
||||
});
|
||||
|
||||
test('full valid config (auth + headers + stripPrefix + tls CA) passes', () => {
|
||||
const r = validateGenerationConfig({
|
||||
domain: 'chat.example.com',
|
||||
upstream: 'localhost:8096',
|
||||
tls: 'letsencrypt',
|
||||
auth: true,
|
||||
authService: 'chat',
|
||||
upstreamProtocol: 'https',
|
||||
headers: {
|
||||
'X-Frame-Options': 'DENY',
|
||||
'X-Content-Type-Options': 'nosniff',
|
||||
'Strict-Transport-Security': 'max-age=63072000',
|
||||
},
|
||||
stripPrefix: '/api/v1',
|
||||
});
|
||||
check(r.valid === true, `expected valid, got errors=${JSON.stringify(r.errors)}`);
|
||||
});
|
||||
|
||||
test('IPv6 bracket-form upstream accepted', () => {
|
||||
const r = validateGenerationConfig({ domain: 'dns.example.com', upstream: '[::1]:5380' });
|
||||
check(r.valid === true, `IPv6 bracket should pass: ${JSON.stringify(r.errors)}`);
|
||||
});
|
||||
|
||||
test('bare host without :port rejected (DC-070 round 2)', () => {
|
||||
// Round-1 polish: Caddy reverse_proxy requires an explicit :port
|
||||
// segment. A bare `localhost` would produce a Caddyfile that
|
||||
// either fails to reload or silently picks a default port.
|
||||
const r = validateGenerationConfig({ domain: 'app.example.com', upstream: 'localhost' });
|
||||
check(r.valid === false, `bare host should reject: ${JSON.stringify(r.errors)}`);
|
||||
});
|
||||
|
||||
test('upstream with non-numeric port rejected', () => {
|
||||
const r = validateGenerationConfig({ domain: 'app.example.com', upstream: 'localhost:abc' });
|
||||
check(r.valid === false, `non-numeric port should reject: ${JSON.stringify(r.errors)}`);
|
||||
});
|
||||
});
|
||||
|
||||
describe('validateGenerationConfig — injection rejection', () => {
|
||||
test('CRLF in domain rejected', () => {
|
||||
const r = validateGenerationConfig({ ...BASE_OK, domain: 'evil.com\nnew.site.example.com {' });
|
||||
check(r.valid === false, 'CRLF should reject');
|
||||
check(r.errors.some((e) => /domain/.test(e)), `expected error to mention domain, got ${JSON.stringify(r.errors)}`);
|
||||
});
|
||||
|
||||
test('brace in domain rejected', () => {
|
||||
const r = validateGenerationConfig({ ...BASE_OK, domain: 'evil} malicious' });
|
||||
check(r.valid === false, 'brace should reject');
|
||||
});
|
||||
|
||||
test('"://" in upstream rejected', () => {
|
||||
const r = validateGenerationConfig({ ...BASE_OK, upstream: 'http://evil.tld/x' });
|
||||
check(r.valid === false, ':// should reject');
|
||||
});
|
||||
|
||||
test('space + brace in upstream rejected', () => {
|
||||
const r = validateGenerationConfig({ ...BASE_OK, upstream: 'localhost:8080 } evil {' });
|
||||
check(r.valid === false, 'whitespace+brace in upstream should reject');
|
||||
});
|
||||
|
||||
test('CRLF in header value rejected', () => {
|
||||
const r = validateGenerationConfig({
|
||||
...BASE_OK,
|
||||
headers: { 'X-Custom': 'innocent\r\nHost: evil.tld' },
|
||||
});
|
||||
check(r.valid === false, 'CRLF in header value should reject');
|
||||
check(r.errors.some((e) => /CR or LF/i.test(e)), `expected CR/LF error: ${JSON.stringify(r.errors)}`);
|
||||
});
|
||||
|
||||
test('bad header key charset rejected', () => {
|
||||
const r = validateGenerationConfig({
|
||||
...BASE_OK,
|
||||
headers: { 'X Bad Key': 'innocent' },
|
||||
});
|
||||
check(r.valid === false, 'space in header key should reject');
|
||||
});
|
||||
|
||||
test('non-string tls rejected', () => {
|
||||
const r = validateGenerationConfig({ ...BASE_OK, tls: 'evil directive' });
|
||||
check(r.valid === false, 'whitespace+word tls should reject');
|
||||
});
|
||||
|
||||
test('empty authService when auth=true rejected', () => {
|
||||
const r = validateGenerationConfig({ ...BASE_OK, auth: true });
|
||||
check(r.valid === false, 'auth=true requires authService');
|
||||
});
|
||||
|
||||
test('upstreamProtocol other than http/https rejected', () => {
|
||||
const r = validateGenerationConfig({ ...BASE_OK, upstreamProtocol: 'javascript' });
|
||||
check(r.valid === false, 'non-http protocol should reject');
|
||||
});
|
||||
|
||||
test('stripPrefix without leading slash rejected', () => {
|
||||
const r = validateGenerationConfig({ ...BASE_OK, stripPrefix: 'app/v1' });
|
||||
check(r.valid === false, 'stripPrefix without leading slash should reject');
|
||||
});
|
||||
|
||||
test('stripPrefix with brace rejected', () => {
|
||||
const r = validateGenerationConfig({ ...BASE_OK, stripPrefix: '/api/{evil}' });
|
||||
check(r.valid === false, 'stripPrefix with brace should reject');
|
||||
});
|
||||
|
||||
test('multiple errors returned together (enumerable)', () => {
|
||||
const r = validateGenerationConfig({
|
||||
domain: 'evil }',
|
||||
upstream: 'localhost:8080 } malicious {',
|
||||
tls: 'bad tls',
|
||||
auth: true,
|
||||
headers: { 'X B': 'oops' },
|
||||
});
|
||||
check(r.valid === false, 'should reject');
|
||||
check(r.errors.length >= 4, `expected multiple errors, got ${r.errors.length}: ${JSON.stringify(r.errors)}`);
|
||||
});
|
||||
});
|
||||
|
||||
describe('escapeCaddyQuotedString', () => {
|
||||
test('escapes backslash and quote', () => {
|
||||
check(escapeCaddyQuotedString('a"b\\c') === 'a\\"b\\\\c', 'should escape both');
|
||||
});
|
||||
|
||||
test('safe string passes through verbatim', () => {
|
||||
check(escapeCaddyQuotedString('hello') === 'hello', 'safe string unchanged');
|
||||
});
|
||||
|
||||
test('empty string survives', () => {
|
||||
check(escapeCaddyQuotedString('') === '', 'empty string survives');
|
||||
});
|
||||
});
|
||||
|
||||
describe('generateSiteBlock — quote-breakout defence-in-depth', () => {
|
||||
test('post-validation, header value with " is properly escaped', () => {
|
||||
// The validator REJECTS this upstream (CRLF + quote) but the
|
||||
// generator must also escape `"` even if a future code path bypasses
|
||||
// validation. This test pins the dual-defence.
|
||||
const cfg = {
|
||||
domain: 'app.example.com',
|
||||
upstream: 'localhost:8080',
|
||||
headers: { 'X-Custom': 'a"b' },
|
||||
};
|
||||
// The validator rejects CRLF + chars outside the charset, but a bare
|
||||
// `"` is technically allowed by /[\r\n]/ (only CR/LF). However the
|
||||
// GENERATOR must still escape it. Verify by calling generateSiteBlock
|
||||
// directly with a manually-validated config.
|
||||
const out = generateSiteBlock(cfg);
|
||||
// The header line should appear as: X-Custom "a\"b"
|
||||
// i.e. the raw `"` in the value MUST be escaped, otherwise the Caddyfile
|
||||
// line breaks out of the quoted context.
|
||||
check(out.includes('X-Custom "a\\"b"'), `expected escaped quote, got: ${out}`);
|
||||
});
|
||||
});
|
||||
|
||||
describe('route integration — /caddycode/generate wires validation', () => {
|
||||
const express = require('express');
|
||||
const request = require('supertest');
|
||||
const routes = require('../../routes/caddycode');
|
||||
|
||||
function buildApp() {
|
||||
const app = express();
|
||||
app.use(express.json());
|
||||
const wrap = (fn) => (req, res, next) => Promise.resolve(fn(req, res, next)).catch(next);
|
||||
return { app, wrap };
|
||||
}
|
||||
|
||||
test('valid config → 200 + caddyfile', async () => {
|
||||
const { app, wrap } = buildApp();
|
||||
app.use('/api/v1', routes({ asyncHandler: wrap }));
|
||||
const res = await request(app)
|
||||
.post('/api/v1/caddycode/generate')
|
||||
.send({ domain: 'app.example.com', upstream: 'localhost:8080' });
|
||||
check(res.status === 200, `expected 200, got ${res.status}`);
|
||||
check(typeof res.body.caddyfile === 'string', 'expected caddyfile string');
|
||||
check(res.body.caddyfile.includes('app.example.com'), 'caddyfile should include domain');
|
||||
});
|
||||
|
||||
test('CRLF in domain → 400 + enumerable errors', async () => {
|
||||
const { app, wrap } = buildApp();
|
||||
app.use('/api/v1', routes({ asyncHandler: wrap }));
|
||||
const res = await request(app)
|
||||
.post('/api/v1/caddycode/generate')
|
||||
.send({ domain: 'evil.com\nnew block', upstream: 'localhost:8080' });
|
||||
check(res.status === 400, `expected 400, got ${res.status}: ${JSON.stringify(res.body)}`);
|
||||
check(res.body.success === false, 'success should be false');
|
||||
check(Array.isArray(res.body.errors), `expected enumerable errors array, got body=${JSON.stringify(res.body)}`);
|
||||
check(res.body.errors.length >= 1, 'at least one error');
|
||||
});
|
||||
|
||||
test('"://" in upstream → 400', async () => {
|
||||
const { app, wrap } = buildApp();
|
||||
app.use('/api/v1', routes({ asyncHandler: wrap }));
|
||||
const res = await request(app)
|
||||
.post('/api/v1/caddycode/generate')
|
||||
.send({ domain: 'app.example.com', upstream: 'http://evil.tld/x' });
|
||||
check(res.status === 400, `expected 400, got ${res.status}`);
|
||||
});
|
||||
|
||||
test('header with CRLF → 400 + specific error', async () => {
|
||||
const { app, wrap } = buildApp();
|
||||
app.use('/api/v1', routes({ asyncHandler: wrap }));
|
||||
const res = await request(app)
|
||||
.post('/api/v1/caddycode/generate')
|
||||
.send({
|
||||
domain: 'app.example.com',
|
||||
upstream: 'localhost:8080',
|
||||
headers: { 'X-Bad': 'oops\r\nHost: evil.tld' },
|
||||
});
|
||||
check(res.status === 400, `expected 400, got ${res.status}`);
|
||||
check(res.body.errors.some((e) => /CR or LF/i.test(e)), `expected CR/LF mention: ${JSON.stringify(res.body.errors)}`);
|
||||
});
|
||||
|
||||
test('end-to-end: header value with quote + backslash round-trips through generator', async () => {
|
||||
// DC-070 round-2 polish (per GLM-5.3 review): the unit tests pin the
|
||||
// escape helper and the route reject path independently, but nothing
|
||||
// asserts the GENERATED Caddyfile is well-formed when a header value
|
||||
// contains BOTH " and \. Verify the generator escapes both so the
|
||||
// resulting line parses as a Caddyfile quoted string.
|
||||
const { app, wrap } = buildApp();
|
||||
app.use('/api/v1', routes({ asyncHandler: wrap }));
|
||||
const res = await request(app)
|
||||
.post('/api/v1/caddycode/generate')
|
||||
.send({
|
||||
domain: 'app.example.com',
|
||||
upstream: 'localhost:8080',
|
||||
headers: { 'X-Custom': 'a"b\\c' },
|
||||
});
|
||||
check(res.status === 200, `expected 200, got ${res.status}: ${JSON.stringify(res.body)}`);
|
||||
const out = res.body.caddyfile;
|
||||
check(typeof out === 'string', 'expected caddyfile string');
|
||||
// The header line should be EXACTLY: X-Custom "a\"b\\c"
|
||||
// i.e. the raw `"` and `\` in the value MUST be escaped.
|
||||
check(
|
||||
/X-Custom "a\\"b\\\\c"/.test(out),
|
||||
`expected escaped quote+backslash in generated Caddyfile, got: ${out}`
|
||||
);
|
||||
});
|
||||
});
|
||||
});
|
||||
Reference in New Issue
Block a user