mirror of
https://github.com/lunchcat/sif.git
synced 2026-07-28 22:40:54 -07:00
TigahandGitHub
243e0aba16
* feat(modules): add haproxy stats, nexus and pushgateway exposure modules * chore(modules): trim redundant module header comments drop the top-line comments on the new infra exposure modules that just restated the id/name fields already in the info block
90 lines
3.1 KiB
Go
90 lines
3.1 KiB
Go
package modules_test
|
|
|
|
import (
|
|
"context"
|
|
"net/http"
|
|
"net/http/httptest"
|
|
"testing"
|
|
"time"
|
|
|
|
"github.com/vmfunc/sif/internal/modules"
|
|
)
|
|
|
|
func runNexusRepositoryModule(t *testing.T, status int, body string) *modules.Result {
|
|
t.Helper()
|
|
def, err := modules.ParseYAMLModule("../../modules/recon/nexus-repository-exposure.yaml")
|
|
if err != nil {
|
|
t.Fatalf("parse nexus repository module: %v", err)
|
|
}
|
|
srv := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
|
|
w.WriteHeader(status)
|
|
_, _ = w.Write([]byte(body))
|
|
}))
|
|
defer srv.Close()
|
|
|
|
res, err := modules.ExecuteHTTPModule(context.Background(), srv.URL, def, modules.Options{
|
|
Timeout: 5 * time.Second,
|
|
Threads: 2,
|
|
})
|
|
if err != nil {
|
|
t.Fatalf("execute nexus repository module: %v", err)
|
|
}
|
|
return res
|
|
}
|
|
|
|
func nexusExtract(res *modules.Result, key string) string {
|
|
for _, f := range res.Findings {
|
|
if v := f.Extracted[key]; v != "" {
|
|
return v
|
|
}
|
|
}
|
|
return ""
|
|
}
|
|
|
|
func TestNexusRepositoryExposureModule(t *testing.T) {
|
|
// real nexus rest catalog shape: name, format, type, url with the /repository/ content path
|
|
catalogBody := `[{"name":"maven-central","format":"maven2","type":"proxy",` +
|
|
`"url":"https://nexus.example.com/repository/maven-central"},` +
|
|
`{"name":"npm-hosted","format":"npm","type":"hosted",` +
|
|
`"url":"https://nexus.example.com/repository/npm-hosted"}]`
|
|
|
|
t.Run("an exposed nexus repository catalog is flagged and names extracted", func(t *testing.T) {
|
|
res := runNexusRepositoryModule(t, 200, catalogBody)
|
|
if len(res.Findings) == 0 {
|
|
t.Fatal("expected a nexus repository finding")
|
|
}
|
|
if v := nexusExtract(res, "nexus_repository_names"); v != "maven-central" {
|
|
t.Errorf("nexus_repository_names=%q, want maven-central", v)
|
|
}
|
|
})
|
|
|
|
t.Run("an anonymous-disabled nexus returning 401 is not a leak", func(t *testing.T) {
|
|
body := `{"format":"basic","type":"realm","errors":[{"id":"*","message":"authentication required"}]}`
|
|
if res := runNexusRepositoryModule(t, 401, body); len(res.Findings) > 0 {
|
|
t.Errorf("a 401 auth-required response should not match, got %d findings", len(res.Findings))
|
|
}
|
|
})
|
|
|
|
t.Run("a catalog without repository content urls is not flagged", func(t *testing.T) {
|
|
// shares format and type but the url is not a /repository/ content path
|
|
body := `[{"name":"thing","format":"maven2","type":"proxy",` +
|
|
`"url":"https://example.com/service/rest/v1/status"}]`
|
|
if res := runNexusRepositoryModule(t, 200, body); len(res.Findings) > 0 {
|
|
t.Errorf("a catalog without a /repository/ url should not match, got %d findings", len(res.Findings))
|
|
}
|
|
})
|
|
|
|
t.Run("an unrelated json api with format and type is not nexus", func(t *testing.T) {
|
|
body := `{"format":"json","type":"object","data":[]}`
|
|
if res := runNexusRepositoryModule(t, 200, body); len(res.Findings) > 0 {
|
|
t.Errorf("a generic json with format and type should not match, got %d findings", len(res.Findings))
|
|
}
|
|
})
|
|
|
|
t.Run("a plain 200 body is not a leak", func(t *testing.T) {
|
|
if res := runNexusRepositoryModule(t, 200, "ok"); len(res.Findings) > 0 {
|
|
t.Errorf("a plain 200 body should not match, got %d findings", len(res.Findings))
|
|
}
|
|
})
|
|
}
|