e2e/isolation_test.go
171 lines · 7039 bytes
1package e2e
2
3import (
4 "fmt"
5 "net/http"
6 "os"
7 "strings"
8 "testing"
9)
10
11// TestPrivateRepoIsInvisible walks every read surface as a stranger and
12// as an anonymous visitor, and asserts a private repository is
13// indistinguishable from one that does not exist.
14//
15// The threat model states this as one rule — "every surface answers 'not
16// found' identically" — but it was only ever tested per feature, in
17// whichever test happened to think of it. A surface added later leaks
18// without anything failing. This is the cross-cutting version: the list
19// of surfaces is the thing under test, so adding a route without adding
20// it here is the omission that shows up.
21func TestPrivateRepoIsInvisible(t *testing.T) {
22 inst := startInstanceWith(t, "[web]\nmode = \"accounts\"\n")
23 ownerKey := inst.newKey(t, "owner")
24 strangerKey := inst.newKey(t, "stranger")
25 inst.admin(t, "admin", "user", "create", "owner", "--key", ownerKey+".pub")
26 inst.admin(t, "admin", "user", "create", "stranger", "--key", strangerKey+".pub")
27
28 if _, errOut, code := inst.ssh(t, ownerKey, "", "repo", "create", "owner/secret", "--private"); code != 0 {
29 t.Fatalf("repo create: %s", errOut)
30 }
31 // Distinctive strings: if any of these reach a stranger through any
32 // surface, the grep below finds it whatever shape the leak took.
33 const (
34 repoWord = "zulqarnain" // in the description
35 titleWord = "brontosaurus" // in an issue title
36 bodyWord = "quinquagenarian" // in an issue body only
37 fileWord = "pterodactyl" // in a file only
38 )
39 inst.ssh(t, ownerKey, "", "repo", "settings", "description", "owner/secret", "'"+repoWord+"'")
40 inst.ssh(t, ownerKey, "", "repo", "topics", "add", "owner/secret", repoWord)
41 if _, errOut, code := inst.ssh(t, ownerKey, "", "issue", "create", "owner/secret",
42 "--title", "'"+titleWord+"'", "--body", "'"+bodyWord+"'"); code != 0 {
43 t.Fatalf("issue create: %s", errOut)
44 }
45
46 env := inst.gitEnv(ownerKey)
47 work := t.TempDir()
48 mustGit(t, work, env, "clone", inst.sshURL("owner/secret"), "w")
49 dir := work + "/w"
50 os.WriteFile(dir+"/notes.txt", []byte(fileWord+"\n"), 0o644)
51 mustGit(t, dir, env, "checkout", "-q", "-b", "main")
52 mustGit(t, dir, env, "add", ".")
53 mustGit(t, dir, env, "commit", "-q", "-m", "secret work")
54 mustGit(t, dir, env, "push", "-q", "origin", "main")
55 mustGit(t, dir, env, "checkout", "-q", "-b", "feat")
56 mustGit(t, dir, env, "commit", "-q", "--allow-empty", "-m", "more")
57 mustGit(t, dir, env, "push", "-q", "origin", "feat")
58 inst.ssh(t, ownerKey, "", "mr", "create", "owner/secret",
59 "--source", "feat", "--target", "main", "--title", "'"+titleWord+" mr'")
60
61 secrets := []string{repoWord, titleWord, bodyWord, fileWord}
62 // The repository's own name is not secret in the same way — a name is
63 // guessable — but its content must never appear.
64 webPaths := []string{
65 "/owner/secret", "/owner/secret/issues", "/owner/secret/issues/1",
66 "/owner/secret/mrs", "/owner/secret/mrs/1", "/owner/secret/refs",
67 "/owner/secret/tree/main/", "/owner/secret/blob/main/notes.txt",
68 "/owner/secret/raw/main/notes.txt", "/owner/secret/log",
69 "/owner/secret/releases", "/owner/secret/builds", "/owner/secret/wiki",
70 "/owner/secret/labels",
71 "/owner/secret/compare/main...feat", "/owner/secret/milestones",
72 "/owner/secret/archive/main.tar.gz", "/owner/secret/badge/build.svg",
73 "/owner/secret/search?q=" + fileWord,
74 "/owner", "/explore", "/explore?q=" + repoWord,
75 "/search?q=" + repoWord, "/search?q=" + titleWord, "/search?q=" + bodyWord,
76 "/owner/secret/info/refs?service=git-upload-pack",
77 }
78
79 // Anonymous.
80 for _, p := range webPaths {
81 status, body := inst.get(t, p)
82 checkNoLeak(t, "anonymous "+p, p, status, body, secrets)
83 }
84 // A logged-in stranger.
85 browser := inst.login(t, strangerKey)
86 for _, p := range webPaths {
87 status, body := browserGet(t, browser, inst.base()+p)
88 checkNoLeak(t, "stranger "+p, p, status, body, secrets)
89 }
90
91 // Control commands, as the stranger. Each must be exit 3 (not found)
92 // or return nothing about the repository — never exit 4, which would
93 // confirm the namespace exists.
94 cmds := [][]string{
95 {"repo", "show", "owner/secret"},
96 {"issue", "list", "owner/secret"},
97 {"issue", "show", "owner/secret", "1"},
98 {"mr", "list", "owner/secret"},
99 {"mr", "show", "owner/secret", "1"},
100 {"mr", "diff", "owner/secret", "1"},
101 {"repo", "grep", "owner/secret", fileWord},
102 {"repo", "log", "owner/secret"},
103 {"repo", "refs", "owner/secret"},
104 {"build", "list", "owner/secret"},
105 {"release", "list", "owner/secret"},
106 {"wiki", "list", "owner/secret"},
107 {"repo", "download", "owner/secret"},
108 }
109 for _, argv := range cmds {
110 out, errOut, code := inst.ssh(t, strangerKey, "", argv...)
111 label := "stranger " + strings.Join(argv, " ")
112 if code == 4 {
113 t.Errorf("%s: exit 4 (denied) confirms the repository exists; want 3", label)
114 }
115 checkNoLeakText(t, label, out+errOut, secrets)
116 }
117
118 // Listings a stranger legitimately reaches must not carry it either.
119 for _, argv := range [][]string{
120 {"repo", "list"}, {"explore"}, {"search", repoWord}, {"search", titleWord},
121 {"search", bodyWord}, {"feed"}, {"dashboard"}, {"profile", "show", "owner"},
122 } {
123 out, errOut, _ := inst.ssh(t, strangerKey, "", argv...)
124 checkNoLeakText(t, "stranger "+strings.Join(argv, " "), out+errOut, secrets)
125 }
126
127 // The owner can still see all of it, so the assertions above are
128 // measuring access control and not a broken fixture.
129 out, _, code := inst.ssh(t, ownerKey, "", "search", bodyWord, "--json")
130 if code != 0 || !strings.Contains(out, titleWord) {
131 t.Fatalf("owner cannot find their own issue by body; the fixture is wrong, not the ACL: %s", out)
132 }
133}
134
135// checkNoLeak asserts a response carries nothing about the private
136// repository. A search page echoes the query into its own form and filter
137// links, so a term that appears only because the prober typed it is not a
138// leak — those are dropped, and the surviving signals are a *different*
139// secret appearing, or a link to the repository, either of which can only
140// come from a result row.
141func checkNoLeak(t *testing.T, label, path string, status int, body string, secrets []string) {
142 t.Helper()
143 if status == http.StatusForbidden {
144 t.Errorf("%s: 403 confirms the namespace exists; want 404", label)
145 }
146 echoed := ""
147 if i := strings.Index(path, "q="); i >= 0 {
148 echoed = path[i+2:]
149 }
150 var forbidden []string
151 for _, s := range secrets {
152 if s != echoed {
153 forbidden = append(forbidden, s)
154 }
155 }
156 checkNoLeakText(t, fmt.Sprintf("%s (status %d)", label, status), body, forbidden)
157 // A listing that found the repository would link it. The repo's own
158 // pages are excluded: the URL under test is that link.
159 if !strings.HasPrefix(path, "/owner/secret") && strings.Contains(body, `href="/owner/secret`) {
160 t.Errorf("%s: links the private repository", label)
161 }
162}
163
164func checkNoLeakText(t *testing.T, label, body string, secrets []string) {
165 t.Helper()
166 for _, s := range secrets {
167 if strings.Contains(body, s) {
168 t.Errorf("%s leaked %q", label, s)
169 }
170 }
171}