mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-08-29 10:02:37 +09:00
Jeremy Daer
7d5bb50b9b
- Resolve the guarded endpoint IP lazily inside WebPush::Notification#deliver (on the bounded delivery worker) instead of eagerly when the notification is built on the serial enqueue path, so a slow resolver can't stall the push job before any delivery starts. resolved_endpoint_ip only reads the already-loaded endpoint attribute, so it is safe off the AR connection. - Pin the delivery socket with an explicit nil proxy address so http_proxy/ https_proxy can't route the request through a proxy that re-resolves the host and defeats the ipaddr pin. - Revalidate an existing subscription on re-registration so a row predating endpoint validation gets the same 422 as a fresh create instead of being kept alive by touch. - Regression tests: resolution deferred to delivery, pin survives proxy env, legacy invalid row rejected with 422.
54 lines
2.2 KiB
Ruby
54 lines
2.2 KiB
Ruby
require "test_helper"
|
|
|
|
class WebPush::PersistentRequestTest < ActiveSupport::TestCase
|
|
ENDPOINT = "https://fcm.googleapis.com/fcm/send/test123"
|
|
|
|
# The delivery must connect to the public IP resolved and guarded by
|
|
# Push::Subscription, never re-resolve the raw endpoint host at connect time --
|
|
# otherwise a rebind between resolution and delivery reopens the SSRF. An empty
|
|
# message keeps the request past encryption and onto the socket we assert on.
|
|
test "pins delivery to endpoint_ip instead of re-resolving the host" do
|
|
host = URI(ENDPOINT).host
|
|
WebMock.disable_net_connect! allow: [ host ]
|
|
|
|
TCPSocket.expects(:open).with { |*args, **| args.first == host }.never
|
|
TCPSocket.expects(:open).with { |*args, **| args.first == DnsTestHelper::WEB_PUSH_PUBLIC_TEST_IP && args[1] == 443 }.throws(:pinned_to_ip)
|
|
|
|
assert_throws :pinned_to_ip do
|
|
WebPush.payload_send \
|
|
message: "",
|
|
endpoint: ENDPOINT,
|
|
endpoint_ip: DnsTestHelper::WEB_PUSH_PUBLIC_TEST_IP,
|
|
p256dh: "", auth: "", vapid: {},
|
|
urgency: "high"
|
|
end
|
|
end
|
|
|
|
# An egress proxy would open the TCP connection itself and re-resolve the
|
|
# endpoint host, defeating the ipaddr pin. The pinned path must ignore
|
|
# http_proxy/https_proxy and connect straight to the resolved public IP.
|
|
test "ignores proxy env so the pin can't be routed through a re-resolving proxy" do
|
|
host = URI(ENDPOINT).host
|
|
|
|
saved = ENV.slice("http_proxy", "https_proxy", "HTTP_PROXY", "HTTPS_PROXY")
|
|
%w[ http_proxy https_proxy HTTP_PROXY HTTPS_PROXY ].each { |k| ENV[k] = "http://proxy.internal:3128" }
|
|
|
|
WebMock.disable_net_connect! allow: [ host ]
|
|
|
|
TCPSocket.expects(:open).with { |*args, **| args.first == "proxy.internal" }.never
|
|
TCPSocket.expects(:open).with { |*args, **| args.first == DnsTestHelper::WEB_PUSH_PUBLIC_TEST_IP && args[1] == 443 }.throws(:pinned_to_ip)
|
|
|
|
assert_throws :pinned_to_ip do
|
|
WebPush.payload_send \
|
|
message: "",
|
|
endpoint: ENDPOINT,
|
|
endpoint_ip: DnsTestHelper::WEB_PUSH_PUBLIC_TEST_IP,
|
|
p256dh: "", auth: "", vapid: {},
|
|
urgency: "high"
|
|
end
|
|
ensure
|
|
%w[ http_proxy https_proxy HTTP_PROXY HTTPS_PROXY ].each { |k| ENV.delete(k) }
|
|
saved.each { |k, v| ENV[k] = v }
|
|
end
|
|
end
|