BoomMicrophone/nixpkgs-suyu
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

nixos/nextcloud: add regression test for not delivering code anymore

Browse source 
PR #277382 didn't fix just an issue with .mjs files for the `forms` app,
but an underlying, more problematic issue: for `/nix-apps` &
`/store-apps`, the fcgi config for PHP and the block for assets were
never reached.

That meant that e.g. `/nix-apps/notes/lib/AppInfo/Application.php`
returned the PHP source code as text/plain. Considering that there was
never a fundamental change to how this config's structure, I'm pretty
sure that the issue was pretty much there since the module exists.

After consulting the NixOS security team we agreed that this is most
likely harmless because you'd have to use private apps with secrets in
the raw PHP code of said app. However, this is still problematic because
one important assumption - that PHP code is never sent to the browser -
is broken which is why we decided on not mentioning this impact in the
previous PR from December 2023.

To make sure that we don't regress our nginx config, I decided to add
the reproducer which fails on 8bbbb228b4
as testcase to our integration tests.
This commit is contained in:
Maximilian Bosch 2024-02-10 17:32:21 +01:00
parent 5a7b241264
commit 37d6961f33
No known key found for this signature in database
1 changed files with 3 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
nixos/tests/nextcloud/with-postgresql-and-redis.nix
View file

@ -39,7 +39,7 @@ in {
}; };
extraAppsEnable = true; extraAppsEnable = true;
extraApps = { extraApps = {
inherit (pkgs."nextcloud${lib.versions.major config.services.nextcloud.package.version}Packages".apps) notify_push; inherit (pkgs."nextcloud${lib.versions.major config.services.nextcloud.package.version}Packages".apps) notify_push notes;
}; };
settings.trusted_proxies = [ "::1" ]; settings.trusted_proxies = [ "::1" ];
}; };
@ -92,5 +92,7 @@ in {
# redis cache should not be empty # redis cache should not be empty
nextcloud.fail('test "[]" = "$(redis-cli --json KEYS "*")"') nextcloud.fail('test "[]" = "$(redis-cli --json KEYS "*")"')
nextcloud.fail("curl -f http://nextcloud/nix-apps/notes/lib/AppInfo/Application.php")
''; '';
})) args })) args