e2e/isolation_test.go
172 lines · 7053 bytes
1package e2e
2
3import (
4 "fmt"
5 "net/http"
6 "os"
7 "strings"
8 "testing"
9)
10
11// TestPrivateRepoIsInvisible walks every read surface as a stranger and
12// as an anonymous visitor, and asserts a private repository is
13// indistinguishable from one that does not exist.
14//
15// The threat model states this as one rule — "every surface answers 'not
16// found' identically" — but it was only ever tested per feature, in
17// whichever test happened to think of it. A surface added later leaks
18// without anything failing. This is the cross-cutting version: the list
19// of surfaces is the thing under test, so adding a route without adding
20// it here is the omission that shows up.
21func TestPrivateRepoIsInvisible(t *testing.T) {
22 t.Parallel()
23 inst := startInstanceWith(t, "[web]\nmode = \"accounts\"\n")
24 ownerKey := inst.newKey(t, "owner")
25 strangerKey := inst.newKey(t, "stranger")
26 inst.admin(t, "admin", "user", "create", "owner", "--key", ownerKey+".pub")
27 inst.admin(t, "admin", "user", "create", "stranger", "--key", strangerKey+".pub")
28
29 if _, errOut, code := inst.ssh(t, ownerKey, "", "repo", "create", "owner/secret", "--private"); code != 0 {
30 t.Fatalf("repo create: %s", errOut)
31 }
32 // Distinctive strings: if any of these reach a stranger through any
33 // surface, the grep below finds it whatever shape the leak took.
34 const (
35 repoWord = "zulqarnain" // in the description
36 titleWord = "brontosaurus" // in an issue title
37 bodyWord = "quinquagenarian" // in an issue body only
38 fileWord = "pterodactyl" // in a file only
39 )
40 inst.ssh(t, ownerKey, "", "repo", "settings", "description", "owner/secret", "'"+repoWord+"'")
41 inst.ssh(t, ownerKey, "", "repo", "topics", "add", "owner/secret", repoWord)
42 if _, errOut, code := inst.ssh(t, ownerKey, "", "issue", "create", "owner/secret",
43 "--title", "'"+titleWord+"'", "--body", "'"+bodyWord+"'"); code != 0 {
44 t.Fatalf("issue create: %s", errOut)
45 }
46
47 env := inst.gitEnv(ownerKey)
48 work := t.TempDir()
49 mustGit(t, work, env, "clone", inst.sshURL("owner/secret"), "w")
50 dir := work + "/w"
51 os.WriteFile(dir+"/notes.txt", []byte(fileWord+"\n"), 0o644)
52 mustGit(t, dir, env, "checkout", "-q", "-b", "main")
53 mustGit(t, dir, env, "add", ".")
54 mustGit(t, dir, env, "commit", "-q", "-m", "secret work")
55 mustGit(t, dir, env, "push", "-q", "origin", "main")
56 mustGit(t, dir, env, "checkout", "-q", "-b", "feat")
57 mustGit(t, dir, env, "commit", "-q", "--allow-empty", "-m", "more")
58 mustGit(t, dir, env, "push", "-q", "origin", "feat")
59 inst.ssh(t, ownerKey, "", "mr", "create", "owner/secret",
60 "--source", "feat", "--target", "main", "--title", "'"+titleWord+" mr'")
61
62 secrets := []string{repoWord, titleWord, bodyWord, fileWord}
63 // The repository's own name is not secret in the same way — a name is
64 // guessable — but its content must never appear.
65 webPaths := []string{
66 "/owner/secret", "/owner/secret/issues", "/owner/secret/issues/1",
67 "/owner/secret/mrs", "/owner/secret/mrs/1", "/owner/secret/refs",
68 "/owner/secret/tree/main/", "/owner/secret/blob/main/notes.txt",
69 "/owner/secret/raw/main/notes.txt", "/owner/secret/log",
70 "/owner/secret/releases", "/owner/secret/builds", "/owner/secret/wiki",
71 "/owner/secret/labels",
72 "/owner/secret/compare/main...feat", "/owner/secret/milestones",
73 "/owner/secret/archive/main.tar.gz", "/owner/secret/badge/build.svg",
74 "/owner/secret/search?q=" + fileWord,
75 "/owner", "/explore", "/explore?q=" + repoWord,
76 "/search?q=" + repoWord, "/search?q=" + titleWord, "/search?q=" + bodyWord,
77 "/owner/secret/info/refs?service=git-upload-pack",
78 }
79
80 // Anonymous.
81 for _, p := range webPaths {
82 status, body := inst.get(t, p)
83 checkNoLeak(t, "anonymous "+p, p, status, body, secrets)
84 }
85 // A logged-in stranger.
86 browser := inst.login(t, strangerKey)
87 for _, p := range webPaths {
88 status, body := browserGet(t, browser, inst.base()+p)
89 checkNoLeak(t, "stranger "+p, p, status, body, secrets)
90 }
91
92 // Control commands, as the stranger. Each must be exit 3 (not found)
93 // or return nothing about the repository — never exit 4, which would
94 // confirm the namespace exists.
95 cmds := [][]string{
96 {"repo", "show", "owner/secret"},
97 {"issue", "list", "owner/secret"},
98 {"issue", "show", "owner/secret", "1"},
99 {"mr", "list", "owner/secret"},
100 {"mr", "show", "owner/secret", "1"},
101 {"mr", "diff", "owner/secret", "1"},
102 {"repo", "grep", "owner/secret", fileWord},
103 {"repo", "log", "owner/secret"},
104 {"repo", "refs", "owner/secret"},
105 {"build", "list", "owner/secret"},
106 {"release", "list", "owner/secret"},
107 {"wiki", "list", "owner/secret"},
108 {"repo", "download", "owner/secret"},
109 }
110 for _, argv := range cmds {
111 out, errOut, code := inst.ssh(t, strangerKey, "", argv...)
112 label := "stranger " + strings.Join(argv, " ")
113 if code == 4 {
114 t.Errorf("%s: exit 4 (denied) confirms the repository exists; want 3", label)
115 }
116 checkNoLeakText(t, label, out+errOut, secrets)
117 }
118
119 // Listings a stranger legitimately reaches must not carry it either.
120 for _, argv := range [][]string{
121 {"repo", "list"}, {"explore"}, {"search", repoWord}, {"search", titleWord},
122 {"search", bodyWord}, {"feed"}, {"dashboard"}, {"profile", "show", "owner"},
123 } {
124 out, errOut, _ := inst.ssh(t, strangerKey, "", argv...)
125 checkNoLeakText(t, "stranger "+strings.Join(argv, " "), out+errOut, secrets)
126 }
127
128 // The owner can still see all of it, so the assertions above are
129 // measuring access control and not a broken fixture.
130 out, _, code := inst.ssh(t, ownerKey, "", "search", bodyWord, "--json")
131 if code != 0 || !strings.Contains(out, titleWord) {
132 t.Fatalf("owner cannot find their own issue by body; the fixture is wrong, not the ACL: %s", out)
133 }
134}
135
136// checkNoLeak asserts a response carries nothing about the private
137// repository. A search page echoes the query into its own form and filter
138// links, so a term that appears only because the prober typed it is not a
139// leak — those are dropped, and the surviving signals are a *different*
140// secret appearing, or a link to the repository, either of which can only
141// come from a result row.
142func checkNoLeak(t *testing.T, label, path string, status int, body string, secrets []string) {
143 t.Helper()
144 if status == http.StatusForbidden {
145 t.Errorf("%s: 403 confirms the namespace exists; want 404", label)
146 }
147 echoed := ""
148 if i := strings.Index(path, "q="); i >= 0 {
149 echoed = path[i+2:]
150 }
151 var forbidden []string
152 for _, s := range secrets {
153 if s != echoed {
154 forbidden = append(forbidden, s)
155 }
156 }
157 checkNoLeakText(t, fmt.Sprintf("%s (status %d)", label, status), body, forbidden)
158 // A listing that found the repository would link it. The repo's own
159 // pages are excluded: the URL under test is that link.
160 if !strings.HasPrefix(path, "/owner/secret") && strings.Contains(body, `href="/owner/secret`) {
161 t.Errorf("%s: links the private repository", label)
162 }
163}
164
165func checkNoLeakText(t *testing.T, label, body string, secrets []string) {
166 t.Helper()
167 for _, s := range secrets {
168 if strings.Contains(body, s) {
169 t.Errorf("%s leaked %q", label, s)
170 }
171 }
172}