package modules_test
import (
"context"
"net/http"
"net/http/httptest"
"testing"
"time"
"github.com/vmfunc/sif/internal/modules"
)
func runHAProxyStatsModule(t *testing.T, status int, body string) *modules.Result {
t.Helper()
def, err := modules.ParseYAMLModule("../../modules/recon/haproxy-stats-exposure.yaml")
if err != nil {
t.Fatalf("parse haproxy stats module: %v", err)
}
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(status)
_, _ = w.Write([]byte(body))
}))
defer srv.Close()
res, err := modules.ExecuteHTTPModule(context.Background(), srv.URL, def, modules.Options{
Timeout: 5 * time.Second,
Threads: 2,
})
if err != nil {
t.Fatalf("execute haproxy stats module: %v", err)
}
return res
}
func haproxyExtract(res *modules.Result, key string) string {
for _, f := range res.Findings {
if v := f.Extracted[key]; v != "" {
return v
}
}
return ""
}
func TestHAProxyStatsExposureModule(t *testing.T) {
// title and process-info banner text taken verbatim from a live haproxy stats page
statsBody := `Statistics Report for HAProxy on formilux` +
`Statistics Report for HAProxy on formilux
` +
`> General process information
` +
`HAProxy version 3.5-dev1, released 2026/06/25
` +
`pid = 1314390 (process #1, nbproc = 1, nbthread = 4)
`
t.Run("an exposed haproxy stats page is flagged and versioned", func(t *testing.T) {
res := runHAProxyStatsModule(t, 200, statsBody)
if len(res.Findings) == 0 {
t.Fatal("expected a haproxy stats finding")
}
if v := haproxyExtract(res, "haproxy_version"); v != "3.5" {
t.Errorf("haproxy_version=%q, want 3.5", v)
}
})
t.Run("a basic-auth challenge is not a leak", func(t *testing.T) {
body := `401 Unauthorized` +
`401 Unauthorized
You need a valid user and password to access this content.`
if res := runHAProxyStatsModule(t, 401, body); len(res.Findings) > 0 {
t.Errorf("a 401 stats auth challenge should not match, got %d findings", len(res.Findings))
}
})
t.Run("a page merely mentioning haproxy is not a leak", func(t *testing.T) {
// prose that names haproxy but is not the stats page itself
body := `Our load balancer
` +
`We run HAProxy version 2.8 behind nginx for high availability.
`
if res := runHAProxyStatsModule(t, 200, body); len(res.Findings) > 0 {
t.Errorf("prose mentioning haproxy version should not match, got %d findings", len(res.Findings))
}
})
t.Run("a stats title without the version banner is not enough", func(t *testing.T) {
// shares the title anchor but not the version banner, proving both are load-bearing
body := `Statistics Report for something else` +
`Statistics Report for pid 1 on host`
if res := runHAProxyStatsModule(t, 200, body); len(res.Findings) > 0 {
t.Errorf("a title-only page should not match without the version banner, got %d findings", len(res.Findings))
}
})
t.Run("a plain 200 body is not a leak", func(t *testing.T) {
if res := runHAProxyStatsModule(t, 200, "ok"); len(res.Findings) > 0 {
t.Errorf("a plain 200 body should not match, got %d findings", len(res.Findings))
}
})
}