mirror of
https://github.com/jokob-sk/NetAlertX.git
synced 2026-10-28 12:01:13 -04:00
42 lines
1.6 KiB
Python
42 lines
1.6 KiB
Python
"""Regression guards: workflows.json must only be writable through the CSRF-protected endpoint."""
|
|
|
|
import os
|
|
import re
|
|
|
|
REPO_ROOT = os.path.join(os.path.dirname(__file__), "..", "..")
|
|
QUERY_JSON = os.path.join(REPO_ROOT, "front", "php", "server", "query_json.php")
|
|
SESSION_STARTERS = [
|
|
os.path.join(REPO_ROOT, "front", "php", "templates", "security.php"),
|
|
os.path.join(REPO_ROOT, "front", "php", "templates", "auth.php"),
|
|
]
|
|
|
|
|
|
def _read(path):
|
|
"""Return the text content of a file."""
|
|
with open(path, "r") as f:
|
|
return f.read()
|
|
|
|
|
|
def test_query_json_has_no_write_path():
|
|
"""query_json.php is read-only: no POST handler and no file writes."""
|
|
src = _read(QUERY_JSON)
|
|
assert not re.search(r"REQUEST_METHOD'\]\s*===\s*'POST'", src), "POST branch must not exist"
|
|
assert "file_put_contents" not in src, "query_json.php must not write files"
|
|
assert "php://input" not in src, "query_json.php must not read a request body"
|
|
|
|
|
|
def test_query_json_rejects_non_get_methods():
|
|
"""Any non-GET method falls through to a 405 response."""
|
|
src = _read(QUERY_JSON)
|
|
assert "http_response_code(405)" in src
|
|
|
|
|
|
def test_session_cookie_sets_samesite():
|
|
"""Every file that starts the PHP session must set a SameSite attribute first."""
|
|
for path in SESSION_STARTERS:
|
|
src = _read(path)
|
|
start = src.index("session_start()")
|
|
params = src.find("session_set_cookie_params")
|
|
assert params != -1 and params < start, f"{path}: SameSite must be set before session_start()"
|
|
assert re.search(r"'samesite'\s*=>\s*'(Lax|Strict)'", src), f"{path}: missing SameSite Lax/Strict"
|