caddy/caddytest/integration/phpfastcgi_test.go

// Copyright 2015 Matthew Holt and The Caddy Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

package integration

import (
	"fmt"
	"io"
	"net"
	"net/http"
	"net/http/fcgi"
	"os"
	"path/filepath"
	"strings"
	"testing"

	"github.com/caddyserver/caddy/v2/caddytest"
)

// startFakePHPFPM starts a FastCGI responder that reports the SCRIPT_FILENAME it
// was asked to execute, so a test can assert which script Caddy selected.
func startFakePHPFPM(t *testing.T) string {
	t.Helper()

	ln, err := net.Listen("tcp", "127.0.0.1:0")
	if err != nil {
		t.Fatalf("listening: %v", err)
	}
	t.Cleanup(func() { ln.Close() })

	go func() {
		_ = fcgi.Serve(ln, http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			env := fcgi.ProcessEnv(r)
			fmt.Fprintf(w, "SCRIPT_FILENAME=%s", env["SCRIPT_FILENAME"])
		}))
	}()

	return ln.Addr().String()
}

// A php_fastcgi route protected by a path matcher must not execute a script the
// matcher never evaluated. Path matchers judge the cleaned request path, so
// /admin.php/../../other.php is matched as /other.php and must not cause
// <root>/admin.php to be executed.
//
// `index off` is used so that php_fastcgi generates no rewrite route at all
// (fastcgi/caddyfile.go skips the redirect and try_files routes entirely). That
// rewrite is otherwise the only step that normalizes r.URL.Path before the
// transport reads it, so without this the test would be satisfied by the rewrite
// rather than by the transport, and would not cover the transport's own
// normalization.
func TestPHPFastCGIProtectedRouteIgnoresDotSegments(t *testing.T) {
	root := t.TempDir()
	if err := os.WriteFile(filepath.Join(root, "admin.php"), []byte("<?php // protected"), 0o644); err != nil {
		t.Fatalf("writing admin.php: %v", err)
	}

	backend := startFakePHPFPM(t)

	tester := caddytest.NewTester(t)
	tester.InitServer(fmt.Sprintf(`{
		skip_install_trust
		admin localhost:2999
		http_port     9080
		https_port    9443
		grace_period  1ns
	}

	localhost:9080 {
		root * %s

		handle /admin* {
			basic_auth {
				alice $2a$04$wqmCpxiUKZl83bZKH.Xp0uFvNQoGz3HoBH3IxBwRMrKoCRfTmc3KK
			}
			php_fastcgi %s {
				index off
			}
		}

		handle {
			php_fastcgi %s {
				index off
			}
		}
	}
	`, root, backend, backend), "caddyfile")

	get := func(t *testing.T, uri string, basicAuth bool) (int, string) {
		t.Helper()
		req, err := http.NewRequest(http.MethodGet, "http://localhost:9080"+uri, nil)
		if err != nil {
			t.Fatalf("building request: %v", err)
		}
		if basicAuth {
			req.SetBasicAuth("alice", "test-password")
		}
		resp, err := tester.Client.Do(req)
		if err != nil {
			t.Fatalf("requesting %q: %v", uri, err)
		}
		defer resp.Body.Close()
		body, err := io.ReadAll(resp.Body)
		if err != nil {
			t.Fatalf("reading body: %v", err)
		}
		return resp.StatusCode, string(body)
	}

	// The gate works for a direct request...
	if code, _ := get(t, "/admin.php", false); code != http.StatusUnauthorized {
		t.Fatalf("GET /admin.php without credentials: expected 401, got %d", code)
	}

	// ...and valid credentials reach the protected script, which proves the route
	// is wired up and the 401 above is the gate rather than a misconfiguration.
	code, body := get(t, "/admin.php", true)
	if code != http.StatusOK {
		t.Fatalf("GET /admin.php with credentials: expected 200, got %d", code)
	}
	if !strings.HasSuffix(body, filepath.Join(root, "admin.php")) {
		t.Fatalf("authenticated request should execute admin.php, got %q", body)
	}

	// The bypass: every path matcher sees /other.php, so the /admin* gate does not
	// fire. The transport must not then select admin.php.
	for _, payload := range []string{
		"/admin.php/../../other.php",
		"/admin.php/../other.php",
		"/admin.php/..%2f..%2fother.php",
		"/admin.php/%2e%2e/other.php",
	} {
		t.Run(payload, func(t *testing.T) {
			_, body := get(t, payload, false)
			if strings.Contains(body, "admin.php") {
				t.Fatalf("unauthenticated request %q selected the protected script: %s", payload, body)
			}
		})
	}
}