From 37d6961f33897b0c1cfc1872c115b6e3aeb9c5ca Mon Sep 17 00:00:00 2001 From: Maximilian Bosch Date: Sat, 10 Feb 2024 17:32:21 +0100 Subject: [PATCH] nixos/nextcloud: add regression test for not delivering code anymore PR #277382 didn't fix just an issue with .mjs files for the `forms` app, but an underlying, more problematic issue: for `/nix-apps` & `/store-apps`, the fcgi config for PHP and the block for assets were never reached. That meant that e.g. `/nix-apps/notes/lib/AppInfo/Application.php` returned the PHP source code as text/plain. Considering that there was never a fundamental change to how this config's structure, I'm pretty sure that the issue was pretty much there since the module exists. After consulting the NixOS security team we agreed that this is most likely harmless because you'd have to use private apps with secrets in the raw PHP code of said app. However, this is still problematic because one important assumption - that PHP code is never sent to the browser - is broken which is why we decided on not mentioning this impact in the previous PR from December 2023. To make sure that we don't regress our nginx config, I decided to add the reproducer which fails on 8bbbb228b4f6c0ecbd746296a67be7723b0851b9 as testcase to our integration tests. --- nixos/tests/nextcloud/with-postgresql-and-redis.nix | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/nixos/tests/nextcloud/with-postgresql-and-redis.nix b/nixos/tests/nextcloud/with-postgresql-and-redis.nix index 3c090f0d3c3b..855626aa2adf 100644 --- a/nixos/tests/nextcloud/with-postgresql-and-redis.nix +++ b/nixos/tests/nextcloud/with-postgresql-and-redis.nix @@ -39,7 +39,7 @@ in { }; extraAppsEnable = true; extraApps = { - inherit (pkgs."nextcloud${lib.versions.major config.services.nextcloud.package.version}Packages".apps) notify_push; + inherit (pkgs."nextcloud${lib.versions.major config.services.nextcloud.package.version}Packages".apps) notify_push notes; }; settings.trusted_proxies = [ "::1" ]; }; @@ -92,5 +92,7 @@ in { # redis cache should not be empty nextcloud.fail('test "[]" = "$(redis-cli --json KEYS "*")"') + + nextcloud.fail("curl -f http://nextcloud/nix-apps/notes/lib/AppInfo/Application.php") ''; })) args