surtic86andClaude Opus 5.5
84c8b81f0a
Fixes the nine findings of security audit run 1 on 2.4.1 (T1-T11). F1: Uploads that are not complete now count only the bytes the server received, and a chunk that goes above the storage quota gets 422. An anonymous uploader can no longer fill the quota with declared sizes. F2: The share password and the admin login have a second limit without the address (20 attempts per minute per share and per e-mail), because a forged X-Forwarded-For changes the address. F3: The system password gate and the admin check now also run on Livewire updates, so an old uploader snapshot cannot register files. F4: The session keeps a fingerprint of the system password's hash. When the admin changes the system password, earlier verifications end. F5: The page after the upload opens only in the session that created the share, and only while recipients can still reach the share. F6: The share password limit counts an attempt before the password is checked, so parallel attempts cannot pass it. F7: The system password has the same two limits (5 per address, 20 in total per minute). F8: A password change or reset signs the user's other sessions out. F9: The only admin cannot delete the account, which would open /setup to every visitor. The setup wizard also holds the admin password to the password defaults, and Livewire applies EnsureAdmin to updates. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
125 lines
4.7 KiB
PHP
125 lines
4.7 KiB
PHP
<?php
|
|
|
|
use App\Models\Setting;
|
|
use App\Models\Share;
|
|
use App\Models\ShareFile;
|
|
use App\Services\ShareService;
|
|
use Illuminate\Support\Facades\Storage;
|
|
|
|
/**
|
|
* PUT a chunk's bytes as the uploader's page does, with the given pending shares in the session.
|
|
*
|
|
* @param array<int, string> $pendingShares
|
|
*/
|
|
function putChunk(mixed $test, ShareFile $file, int $index, string $chunk, array $pendingShares): mixed
|
|
{
|
|
return $test->withSession(['pending_shares' => $pendingShares])->call(
|
|
'PUT',
|
|
route('upload.chunk', ['shareFile' => $file, 'index' => $index]),
|
|
server: ['CONTENT_TYPE' => 'application/octet-stream', 'HTTP_ACCEPT' => 'application/json'],
|
|
content: $chunk,
|
|
);
|
|
}
|
|
|
|
test('a chunk for a pending share this session started is stored', function () {
|
|
Storage::fake('shares');
|
|
config(['uploads.chunk_size' => 4]);
|
|
$file = app(ShareService::class)->registerFile(null, 'notes.txt', 6, null);
|
|
|
|
$response = putChunk($this, $file, 0, encryptedChunk($file, 'abcd', 0, false), [$file->share->token]);
|
|
|
|
$response->assertOk()->assertExactJson(['uploaded_chunks' => 1]);
|
|
expect($file->refresh()->uploaded_chunks)->toBe(1);
|
|
});
|
|
|
|
test('a chunk that takes the stored bytes beyond the storage quota returns 422', function () {
|
|
Storage::fake('shares');
|
|
config(['uploads.chunk_size' => 4]);
|
|
Setting::set('max_storage_quota', 100);
|
|
$file = app(ShareService::class)->registerFile(null, 'notes.txt', 6, null);
|
|
Share::factory()->create(['total_size' => 98]);
|
|
|
|
$response = putChunk($this, $file, 0, encryptedChunk($file, 'abcd', 0, false), [$file->share->token]);
|
|
|
|
$response->assertStatus(422);
|
|
expect($file->refresh()->uploaded_chunks)->toBe(0);
|
|
});
|
|
|
|
test('a chunk for a pending share another session started returns 404', function () {
|
|
Storage::fake('shares');
|
|
$file = app(ShareService::class)->registerFile(null, 'notes.txt', 4, null);
|
|
|
|
$response = putChunk($this, $file, 0, encryptedChunk($file, 'abcd', 0, true), ['someOtherToken12']);
|
|
|
|
$response->assertNotFound();
|
|
expect($file->refresh()->uploaded_chunks)->toBe(0);
|
|
});
|
|
|
|
test('a chunk for a share that is already complete returns 404', function () {
|
|
Storage::fake('shares');
|
|
$file = app(ShareService::class)->registerFile(null, 'notes.txt', 4, null);
|
|
$file->share->update(['completed_at' => now()]);
|
|
|
|
$response = putChunk($this, $file, 0, encryptedChunk($file, 'abcd', 0, true), [$file->share->token]);
|
|
|
|
$response->assertNotFound();
|
|
});
|
|
|
|
test('a chunk for a removed file returns 404', function () {
|
|
Storage::fake('shares');
|
|
$service = app(ShareService::class);
|
|
$file = $service->registerFile(null, 'notes.txt', 4, null);
|
|
$chunk = encryptedChunk($file, 'abcd', 0, true);
|
|
$token = $file->share->token;
|
|
$service->removeFile($file);
|
|
|
|
$response = putChunk($this, $file, 0, $chunk, [$token]);
|
|
|
|
$response->assertNotFound();
|
|
});
|
|
|
|
test('a chunk that skips ahead returns 409 with the number of chunks stored', function () {
|
|
Storage::fake('shares');
|
|
config(['uploads.chunk_size' => 4]);
|
|
$file = app(ShareService::class)->registerFile(null, 'notes.txt', 6, null);
|
|
|
|
$response = putChunk($this, $file, 1, encryptedChunk($file, 'ef', 1, true), [$file->share->token]);
|
|
|
|
$response->assertConflict()->assertExactJson(['uploaded_chunks' => 0]);
|
|
expect($file->refresh()->uploaded_chunks)->toBe(0);
|
|
});
|
|
|
|
test('a chunk sent again after it was stored is acknowledged without storing it twice', function () {
|
|
Storage::fake('shares');
|
|
config(['uploads.chunk_size' => 4]);
|
|
$file = app(ShareService::class)->registerFile(null, 'notes.txt', 6, null);
|
|
$chunk = encryptedChunk($file, 'abcd', 0, false);
|
|
putChunk($this, $file, 0, $chunk, [$file->share->token]);
|
|
|
|
$response = putChunk($this, $file->refresh(), 0, $chunk, [$file->share->token]);
|
|
|
|
$response->assertOk()->assertExactJson(['uploaded_chunks' => 1]);
|
|
expect($file->refresh()->uploaded_chunks)->toBe(1);
|
|
});
|
|
|
|
test('an invalid chunk returns 422 and is not stored', function () {
|
|
Storage::fake('shares');
|
|
$file = app(ShareService::class)->registerFile(null, 'notes.txt', 4, null);
|
|
|
|
$response = putChunk($this, $file, 0, str_repeat("\0", 20), [$file->share->token]);
|
|
|
|
$response->assertUnprocessable();
|
|
expect($file->refresh()->uploaded_chunks)->toBe(0);
|
|
});
|
|
|
|
test('a chunk is refused until the system password was entered', function () {
|
|
Storage::fake('shares');
|
|
Setting::set('system_password', bcrypt('system-secret'));
|
|
$file = app(ShareService::class)->registerFile(null, 'notes.txt', 4, null);
|
|
|
|
$response = putChunk($this, $file, 0, encryptedChunk($file, 'abcd', 0, true), [$file->share->token]);
|
|
|
|
$response->assertRedirect(route('system-password'));
|
|
expect($file->refresh()->uploaded_chunks)->toBe(0);
|
|
});
|