aaribaud/ESPSomfy-RTS
0
0
Fork 0
mirror of https://github.com/rstrouse/ESPSomfy-RTS.git synced 2026-10-31 13:52:15 +01:00
Code Issues Projects Releases Packages Wiki Activity

fix: close the token bypass below a route, review fixes for 4b

Browse source 
The routes matched any path below them, and a web asset name there
passed the token check: GET /backup/a.js returned the backup under
Secured. Every route is now an exact match, and a web asset sits in
the root only.

- e2e: those paths answer 401 or 404; the restore test now fails when
  the chunks skip the token check (checked with the check removed).
- WEB_CORS lets the socket take Origin: null instead of skipping the
  Origin check.
- ADR 0006, GLOSSARY and README: the Origin check in either mode, /ws
  as a public route, the Host header behind a reverse proxy.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
cjkas 2026-10-28 19:39:51 +01:00
parent ecb0260f61
commit 0ee52d6d9f
10 changed files with 105 additions and 51 deletions
Download patch file Download diff file Expand all files Collapse all files

13
test/test_httpaccess/test_main.cpp
View file

@ -34,6 +34,11 @@ static void test_a_path_leaving_the_root_is_not_a_web_asset() {
TEST_ASSERT_FALSE(isWebAsset("/../shades.cfg.js"));
TEST_ASSERT_FALSE(isWebAsset("/x/../index.js"));
}
static void test_a_file_below_the_root_is_not_a_web_asset() {
TEST_ASSERT_FALSE(isWebAsset("/backup/a.js"));
TEST_ASSERT_FALSE(isWebAsset("/js/index.js"));
TEST_ASSERT_FALSE(isWebAsset("//index.js"));
}
static void test_a_missing_or_relative_path_is_not_a_web_asset() {
TEST_ASSERT_FALSE(isWebAsset(nullptr));
TEST_ASSERT_FALSE(isWebAsset(""));
@ -71,6 +76,12 @@ static void test_a_route_differing_in_case_or_length_needs_the_token() {
TEST_ASSERT_FALSE(isPublicRoute("/logins", false));
TEST_ASSERT_FALSE(isPublicRoute("/ws/", false));
}
static void test_a_web_asset_name_below_a_route_needs_the_token() {
TEST_ASSERT_FALSE(isPublicRoute("/backup/a.js", false));
TEST_ASSERT_FALSE(isPublicRoute("/shadeCommand/a.png", false));
TEST_ASSERT_FALSE(isPublicRoute("/updateFirmware/x.js", false));
TEST_ASSERT_FALSE(isPublicRoute("/login/a.js", false));
}
static void test_a_preflight_is_public() {
TEST_ASSERT_TRUE(isPublicRoute("/backup", true));
}
@ -118,6 +129,7 @@ int main(int, char **) {
RUN_TEST(test_a_compressed_file_is_not_asked_for_by_name);
RUN_TEST(test_a_type_alone_is_not_a_web_asset);
RUN_TEST(test_a_path_leaving_the_root_is_not_a_web_asset);
RUN_TEST(test_a_file_below_the_root_is_not_a_web_asset);
RUN_TEST(test_a_missing_or_relative_path_is_not_a_web_asset);
RUN_TEST(test_logging_in_and_ssdp_are_public);
RUN_TEST(test_the_socket_checks_its_own_token);
@ -125,6 +137,7 @@ int main(int, char **) {
RUN_TEST(test_the_other_routes_need_the_token);
RUN_TEST(test_an_unknown_path_needs_the_token);
RUN_TEST(test_a_route_differing_in_case_or_length_needs_the_token);
RUN_TEST(test_a_web_asset_name_below_a_route_needs_the_token);
RUN_TEST(test_a_preflight_is_public);
RUN_TEST(test_the_page_the_device_served_matches);
RUN_TEST(test_https_behind_a_proxy_matches);