Startsida Utforska Hjälp
Logga in
vdd
/
nitter
spegling av https://github.com/zedeus/nitter
1
0
Fork 0
Filer Ärenden 0 Wiki
Träd: 530437167e
Grenar Taggar
nitter
/
tests
/
test_ssrf_1411.nim

test_ssrf_1411.nim 2.1 KB
Historik Rå

1234567891011121314151617181920212223242526272829303132333435363738 
  1. # SPDX-License-Identifier: AGPL-3.0-only
    2. 

  2. # Reproduction + regression test for issue #1411:
    3. 

  3. # SSRF via /video proxy with default HMAC key and missing host validation.
    4. 

  4. import std/[unittest, uri]
    5. 

  5. import ".."/src/utils
    6. 

  6. 

  7. suite "issue #1411 SSRF via /video proxy":
    8. 

  8.   setup:
    9. 

  9.     # The default key shipped in nitter.example.conf / config.nim.
    10. 

  10.     setHmacKey("secretkey")
    11. 

  11. 

  12.   test "HMAC for arbitrary SSRF URLs is forgeable with the default key":
    13. 

  13.     # These signatures were independently computed (Python hmac-sha256, uppercase
    14. 

  14.     # hex, first 13 chars) and observed live in the issue report.
    15. 

  15.     check getHmac("http://172.17.0.1:19999/secret_data.m3u8") == "BBD19ACC6C012"
    16. 

  16.     check getHmac("http://172.17.0.1:19999/secret_data.mp4")  == "0780F00DDF3E7"
    17. 

  17. 

  18.   test "isTwitterUrl rejects SSRF targets (the guard /video is missing)":
    19. 

  19.     # Internal / metadata hosts an attacker would target.
    20. 

  20.     check isTwitterUrl(parseUri("http://172.17.0.1:19999/secret_data.m3u8")) == false
    21. 

  21.     check isTwitterUrl(parseUri("http://169.254.169.254/latest/meta-data/x.m3u8")) == false
    22. 

  22.     check isTwitterUrl(parseUri("http://localhost/x.mp4")) == false
    23. 

  23.     check isTwitterUrl(parseUri("http://[::1]/x.mp4")) == false
    24. 

  24. 

  25.   test "isTwitterUrl rejects userinfo / look-alike host bypass attempts":
    26. 

  26.     check isTwitterUrl(parseUri("http://video.twimg.com@169.254.169.254/x.mp4")) == false
    27. 

  27.     check isTwitterUrl(parseUri("http://video.twimg.com.evil.com/x.mp4")) == false
    28. 

  28.     check isTwitterUrl(parseUri("http://evilvideo.twimg.com.attacker/x.mp4")) == false
    29. 

  29. 

  30.   test "isTwitterUrl rejects non-http schemes even on a Twitter host":
    31. 

  31.     check isTwitterUrl(parseUri("gopher://video.twimg.com/x.mp4")) == false
    32. 

  32.     check isTwitterUrl(parseUri("file:///etc/passwd")) == false
    33. 

  33.     check isTwitterUrl(parseUri("ftp://video.twimg.com/x.mp4")) == false
    34. 

  34. 

  35.   test "isTwitterUrl still allows legitimate Twitter video hosts":
    36. 

  36.     check isTwitterUrl(parseUri("https://video.twimg.com/ext_tw_video/1/pu/pl/x.m3u8")) == true
    37. 

  37.     check isTwitterUrl(parseUri("https://video.twimg.com/amplify_video/1/vid/x.mp4")) == true
    38. 

  38.     check isTwitterUrl(parseUri("https://prod-fastly-us-east-1.video.pscp.tv/x.m3u8")) == true
    39.