mirror of
https://codeberg.org/PostERG/xamxam.git
synced 2026-11-09 11:10:08 +01:00
Pontoporeia
554fc57455
The passive scan flagged 3x MEDIUM 'PHPSESSID missing Secure' and an
admin-login cookie missing HttpOnly. Root cause was not the cookie code
but scheme detection: every call site read $_SERVER['HTTPS'] directly,
which is unset when TLS is terminated in front of PHP-FPM, so the Secure
flag was silently dropped.
Add RequestUtil::isSecure()/baseUrl() as the single scheme detector:
1. $_SERVER['HTTPS'] (direct TLS)
2. X-Forwarded-Proto — only from a loopback/private peer, so a remote
client cannot spoof it
3. SERVER_PORT == 443
Replace all 8 inline $_SERVER['HTTPS'] idioms (App, AdminAuth, 4x filepond
endpoints, validate-access, admin/acces, SystemController self-ping).
nginx: forward the scheme to php-fpm in all 4 fastcgi blocks
(fastcgi_param HTTPS $https + X-Forwarded-Proto $scheme) and uncomment
server_tokens off. Config validated with nginx -t (real config, alpine
container).
AdminAuth: logout() now clears the session cookie with the same
path/domain/secure/httponly/samesite it was set with, instead of the
legacy positional setcookie() that dropped SameSite.
Tests (+24, 340 total):
- RequestUtilTest: scheme detection incl. proxy trust boundaries
- SessionCookieTest: logout emits a hardened deletion cookie
- PeerTubeIntegrationTest: PeerTube keeps using its absolute instance_url
and is unaffected by scheme changes (Guzzle MockHandler)
- NginxConfigTest: pins HTTPS forwarding, HSTS includeSubDomains,
server_tokens off
PeerTube uses an absolute instance_url from the DB and never derives URLs
from the request, so the integration is unchanged — the regression tests
lock that invariant in.
86 lines
3.0 KiB
PHP
86 lines
3.0 KiB
PHP
<?php
|
|
|
|
use PHPUnit\Framework\TestCase;
|
|
|
|
/**
|
|
* NginxConfigTest — regression guard for the passive-scan hardening.
|
|
*
|
|
* The scan found live responses where:
|
|
* - HSTS lacked includeSubDomains (config drift),
|
|
* - PHP did not know the request was HTTPS (Secure cookie flag dropped),
|
|
* - the nginx version was disclosed via the Server header.
|
|
*
|
|
* The PHP-side fixes only work if nginx forwards the scheme to PHP-FPM and
|
|
* hides its version. These assertions pin the config so a later edit can't
|
|
* silently undo them.
|
|
*
|
|
* Full syntax validation still runs server-side via `nginx -t` in
|
|
* scripts/deploy-server.sh.
|
|
*/
|
|
class NginxConfigTest extends TestCase
|
|
{
|
|
private string $conf;
|
|
|
|
protected function setUp(): void
|
|
{
|
|
$path = APP_ROOT . '/../nginx/xamxam.conf';
|
|
$this->assertFileExists($path);
|
|
$this->conf = (string) file_get_contents($path);
|
|
}
|
|
|
|
public function testServerTokensDisabled(): void
|
|
{
|
|
$this->assertMatchesRegularExpression(
|
|
'/^\s*server_tokens\s+off;/m',
|
|
$this->conf,
|
|
'server_tokens must be active (not commented) to hide the nginx version'
|
|
);
|
|
}
|
|
|
|
public function testHstsIncludesSubdomainsAndPreload(): void
|
|
{
|
|
$this->assertMatchesRegularExpression(
|
|
'/add_header\s+Strict-Transport-Security\s+"max-age=\d+;\s*includeSubDomains;\s*preload;"/',
|
|
$this->conf,
|
|
'HSTS must include includeSubDomains; preload'
|
|
);
|
|
}
|
|
|
|
/**
|
|
* Every php-fpm location must forward HTTPS + the original scheme, or
|
|
* RequestUtil falls back to insecure and cookies lose the Secure flag.
|
|
*/
|
|
public function testEveryPhpLocationForwardsHttpsSignal(): void
|
|
{
|
|
$phpValueCount = preg_match_all('/fastcgi_param\s+PHP_VALUE\s+"upload_max_filesize/m', $this->conf);
|
|
$httpsCount = preg_match_all('/fastcgi_param\s+HTTPS\s+\$https;/m', $this->conf);
|
|
$protoCount = preg_match_all('/fastcgi_param\s+HTTP_X_FORWARDED_PROTO\s+\$scheme;/m', $this->conf);
|
|
|
|
$this->assertGreaterThan(0, $phpValueCount, 'expected php-fpm locations');
|
|
$this->assertSame(
|
|
$phpValueCount,
|
|
$httpsCount,
|
|
"every php-fpm block must set fastcgi_param HTTPS (\$phpValue=$phpValueCount, https=$httpsCount)"
|
|
);
|
|
$this->assertSame(
|
|
$phpValueCount,
|
|
$protoCount,
|
|
"every php-fpm block must set X-Forwarded-Proto (\$phpValue=$phpValueCount, proto=$protoCount)"
|
|
);
|
|
}
|
|
|
|
/**
|
|
* The admin location must keep its CSP and noindex header, and must not
|
|
* inherit a broken frame-ancestors from the parent.
|
|
*/
|
|
public function testAdminLocationKeepsSecurityHeaders(): void
|
|
{
|
|
$this->assertMatchesRegularExpression(
|
|
'#location\s+\^~\s+/admin/\s*\{.*?add_header\s+Content-Security-Policy#s',
|
|
$this->conf,
|
|
'admin location must define its own CSP'
|
|
);
|
|
$this->assertStringContainsString('X-Robots-Tag "noindex, nofollow"', $this->conf);
|
|
}
|
|
}
|