mirror of
https://github.com/kevinveenbirkenbach/homepage.veen.world.git
synced 2026-08-24 05:04:33 +00:00
Kevin Veen-Birkenbach
747ce379cc
ProxyFix defaults x_for to 1, so ProxyFix(app.wsgi_app, x_proto=1) never disabled it: request.remote_addr and the access log were forgeable by any client that reached the app directly. It is x_for=0 now, asserted rather than assumed. A mutation audit over the change set reverted 196 deliberate behaviours and found 47 that no test noticed. This closes the ones that carry damage: - apod_background lost its key check, its transport guard, its status guard and its media-type check without a single test failing. Each one turns a slow or unhappy NASA into a 500 on every page. - Untrusted values reached innerHTML through window.I18N, which the translation backend writes, and the modal's click handlers stacked so a later click opened an earlier popup's URL. - The sync tool could ask for HTML instead of text, translate from "auto" instead of English, run without a timeout, store an empty translation that marks the string done for good, abandon 28 languages because one could not be written, and report success after reaching nothing. - Neither the lint target, the CI jobs, the vendored RTL stylesheet, the documented environment keys, nor any of the four hardenings in scripts/run-e2e.sh was observed by anything. Three of the new tests passed for the wrong reason on their first cut — a mock that answered None whether or not the guard existed, a raise_for_status that was never called, a string that stayed in the file after the mutation. The audit found those too; all 24 reverts now fail. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
259 lines
8.9 KiB
Python
259 lines
8.9 KiB
Python
import json
|
|
import os
|
|
import shutil
|
|
import subprocess
|
|
import sys
|
|
import tempfile
|
|
import unittest
|
|
from pathlib import Path
|
|
from unittest.mock import Mock, patch
|
|
|
|
import requests
|
|
|
|
REPO_ROOT = Path(__file__).resolve().parents[2]
|
|
|
|
app_module = None
|
|
flask_app = None
|
|
i18n = None
|
|
_origin = None
|
|
_workdir = None
|
|
|
|
|
|
def setUpModule():
|
|
"""Import the app with a disposable configuration as the working directory.
|
|
|
|
``app.app`` reads ``config.yaml`` relative to the process working directory
|
|
at import time, so the chdir has to happen before the import.
|
|
"""
|
|
global app_module, flask_app, i18n, _origin, _workdir
|
|
|
|
_origin = os.getcwd()
|
|
_workdir = tempfile.mkdtemp(prefix="portfolio-routes-")
|
|
shutil.copy(
|
|
REPO_ROOT / "app" / "config.sample.yaml", Path(_workdir) / "config.yaml"
|
|
)
|
|
os.chdir(_workdir)
|
|
|
|
from app import app as imported_module
|
|
from app.utils import i18n as imported_i18n
|
|
|
|
app_module = imported_module
|
|
flask_app = imported_module.app
|
|
i18n = imported_i18n
|
|
flask_app.config["NASA_API_KEY"] = None
|
|
|
|
|
|
def tearDownModule():
|
|
os.chdir(_origin)
|
|
shutil.rmtree(_workdir, ignore_errors=True)
|
|
|
|
|
|
class AppRouteMixin:
|
|
"""Shared setup. A mixin rather than a TestCase subclass, so that every
|
|
test class below still names ``unittest.TestCase`` as a direct base — the
|
|
lint guardrail in tests/lint/ does not resolve inherited aliases."""
|
|
|
|
def setUp(self):
|
|
self.client = flask_app.test_client()
|
|
self.addCleanup(i18n.clear_catalogs)
|
|
self.addCleanup(flask_app.config["TRANSLATED_CONFIG"].clear)
|
|
|
|
|
|
class TestRouting(AppRouteMixin, unittest.TestCase):
|
|
def test_unrelated_single_segment_paths_are_not_redirected(self):
|
|
for path in ("/robots.txt", "/favicon.ico", "/sitemap.xml"):
|
|
with self.subTest(path=path):
|
|
self.assertEqual(self.client.get(path).status_code, 404)
|
|
|
|
def test_language_path_redirects_to_the_canonical_trailing_slash(self):
|
|
response = self.client.get("/de")
|
|
|
|
self.assertEqual(response.status_code, 308)
|
|
self.assertTrue(response.headers["Location"].endswith("/de/"))
|
|
|
|
def test_supported_language_renders(self):
|
|
response = self.client.get("/de/")
|
|
|
|
self.assertEqual(response.status_code, 200)
|
|
self.assertIn('<html lang="de"', response.get_data(as_text=True))
|
|
|
|
def test_unsupported_language_is_not_found(self):
|
|
self.assertEqual(self.client.get("/xx/").status_code, 404)
|
|
|
|
|
|
class TestNegotiation(AppRouteMixin, unittest.TestCase):
|
|
def test_regional_tag_beats_a_lower_ranked_exact_match(self):
|
|
response = self.client.get("/", headers={"Accept-Language": "de-DE,en;q=0.8"})
|
|
|
|
self.assertIn('<html lang="de"', response.get_data(as_text=True))
|
|
|
|
def test_negotiated_route_declares_that_it_varies(self):
|
|
response = self.client.get("/", headers={"Accept-Language": "de-DE"})
|
|
|
|
self.assertEqual(response.headers.get("Vary"), "Accept-Language")
|
|
|
|
|
|
class TestEscaping(AppRouteMixin, unittest.TestCase):
|
|
def test_catalog_content_is_html_escaped(self):
|
|
i18n._catalogs["de"] = {"Copy": "<script>alert('ui')</script>"}
|
|
|
|
body = self.client.get("/de/").get_data(as_text=True)
|
|
|
|
self.assertNotIn("<script>alert('ui')</script>", body)
|
|
self.assertIn("<script>alert('ui')", body)
|
|
|
|
def test_configuration_content_is_html_escaped(self):
|
|
i18n._catalogs["de"] = {"Imprint": "<script>alert('config')</script>"}
|
|
|
|
body = self.client.get("/de/").get_data(as_text=True)
|
|
|
|
self.assertNotIn("<script>alert('config')</script>", body)
|
|
self.assertIn("<script>alert('config')", body)
|
|
|
|
|
|
class TestApodBackground(AppRouteMixin, unittest.TestCase):
|
|
def setUp(self):
|
|
super().setUp()
|
|
self.addCleanup(flask_app.config.__setitem__, "NASA_API_KEY", None)
|
|
flask_app.config["NASA_API_KEY"] = "key"
|
|
|
|
def test_no_request_is_made_without_a_key(self):
|
|
flask_app.config["NASA_API_KEY"] = None
|
|
|
|
with patch("app.app.requests.get") as get:
|
|
self.assertIsNone(app_module.apod_background())
|
|
|
|
get.assert_not_called()
|
|
|
|
def test_a_transport_failure_costs_the_background_not_the_page(self):
|
|
with patch(
|
|
"app.app.requests.get", side_effect=requests.ConnectionError("down")
|
|
):
|
|
self.assertIsNone(app_module.apod_background())
|
|
|
|
self.assertEqual(self.client.get("/en/").status_code, 200)
|
|
|
|
def test_an_error_response_costs_the_background_not_the_page(self):
|
|
refusal = Mock(ok=False)
|
|
refusal.json.return_value = {"media_type": "image", "url": "https://i.test/x"}
|
|
|
|
with patch("app.app.requests.get", return_value=refusal):
|
|
self.assertIsNone(app_module.apod_background())
|
|
|
|
def test_a_video_of_the_day_is_not_used_as_a_background(self):
|
|
answer = Mock(ok=True)
|
|
answer.json.return_value = {"media_type": "video", "url": "https://v.test/x"}
|
|
|
|
with patch("app.app.requests.get", return_value=answer):
|
|
self.assertIsNone(app_module.apod_background())
|
|
|
|
def test_an_image_of_the_day_is_used(self):
|
|
answer = Mock(ok=True)
|
|
answer.json.return_value = {"media_type": "image", "url": "https://i.test/x"}
|
|
|
|
with patch("app.app.requests.get", return_value=answer):
|
|
self.assertEqual(app_module.apod_background(), "https://i.test/x")
|
|
|
|
|
|
class TestExternalUrls(AppRouteMixin, unittest.TestCase):
|
|
def test_only_the_forwarded_scheme_is_trusted(self):
|
|
proxy = flask_app.wsgi_app
|
|
|
|
self.assertEqual(proxy.x_proto, 1)
|
|
self.assertEqual(
|
|
(proxy.x_for, proxy.x_host, proxy.x_port, proxy.x_prefix), (0, 0, 0, 0)
|
|
)
|
|
|
|
def test_forwarded_scheme_reaches_the_canonical_and_alternates(self):
|
|
body = self.client.get(
|
|
"/en/",
|
|
headers={"Host": "portfolio.example.org", "X-Forwarded-Proto": "https"},
|
|
).get_data(as_text=True)
|
|
|
|
self.assertIn(
|
|
'<link rel="canonical" href="https://portfolio.example.org/en/">', body
|
|
)
|
|
self.assertIn('hreflang="ja" href="https://portfolio.example.org/ja/"', body)
|
|
self.assertNotIn("http://portfolio.example.org", body)
|
|
|
|
def test_trusted_hosts_are_parsed_from_a_comma_separated_list(self):
|
|
self.assertEqual(
|
|
app_module.trusted_hosts("a.test, b.test ,"), ["a.test", "b.test"]
|
|
)
|
|
|
|
def test_an_unset_trusted_hosts_value_disables_the_check(self):
|
|
self.assertIsNone(app_module.trusted_hosts(""))
|
|
self.assertIsNone(app_module.trusted_hosts(" , "))
|
|
|
|
def test_a_forged_host_is_rejected_once_trusted_hosts_are_named(self):
|
|
self.addCleanup(flask_app.config.__setitem__, "TRUSTED_HOSTS", None)
|
|
flask_app.config["TRUSTED_HOSTS"] = ["portfolio.example.org"]
|
|
|
|
forged = self.client.get("/de", headers={"Host": "evil.test"})
|
|
honest = self.client.get("/de/", headers={"Host": "portfolio.example.org"})
|
|
|
|
self.assertEqual(forged.status_code, 400)
|
|
self.assertEqual(honest.status_code, 200)
|
|
|
|
def test_forwarded_host_is_not_trusted(self):
|
|
response = self.client.get(
|
|
"/de",
|
|
headers={"Host": "portfolio.example.org", "X-Forwarded-Host": "evil.test"},
|
|
)
|
|
|
|
self.assertNotIn("evil.test", response.headers["Location"])
|
|
|
|
body = self.client.get(
|
|
"/en/",
|
|
headers={"Host": "portfolio.example.org", "X-Forwarded-Host": "evil.test"},
|
|
).get_data(as_text=True)
|
|
|
|
self.assertNotIn("evil.test", body)
|
|
|
|
|
|
class TestConfigurationReload(AppRouteMixin, unittest.TestCase):
|
|
def test_reloading_the_configuration_drops_the_catalog_memo(self):
|
|
i18n.catalog("de")
|
|
self.assertIn("de", i18n._catalogs)
|
|
|
|
app_module.load_config(flask_app)
|
|
|
|
self.assertEqual(i18n._catalogs, {})
|
|
|
|
def test_reloading_the_configuration_drops_the_translation_memo(self):
|
|
self.client.get("/de/")
|
|
self.assertIn("de", flask_app.config["TRANSLATED_CONFIG"])
|
|
|
|
app_module.load_config(flask_app)
|
|
|
|
self.assertEqual(flask_app.config["TRANSLATED_CONFIG"], {})
|
|
|
|
|
|
class TestTrustedHostsWiring(unittest.TestCase):
|
|
def test_the_environment_reaches_the_flask_configuration(self):
|
|
script = (
|
|
"import json, sys;"
|
|
f"sys.path.insert(0, {str(REPO_ROOT)!r});"
|
|
"from app.app import app;"
|
|
"print('TRUSTED=' + json.dumps(app.config['TRUSTED_HOSTS']))"
|
|
)
|
|
result = subprocess.run(
|
|
[sys.executable, "-c", script],
|
|
cwd=_workdir,
|
|
env={**os.environ, "TRUSTED_HOSTS": "a.test, b.test"},
|
|
capture_output=True,
|
|
text=True,
|
|
check=True,
|
|
)
|
|
|
|
reported = [
|
|
line for line in result.stdout.splitlines() if line.startswith("TRUSTED=")
|
|
]
|
|
self.assertEqual(
|
|
json.loads(reported[-1][len("TRUSTED=") :]), ["a.test", "b.test"]
|
|
)
|
|
|
|
|
|
if __name__ == "__main__":
|
|
unittest.main()
|