|
| 1 | +// @ts-check |
| 2 | +import assert from 'node:assert/strict'; |
| 3 | +import { describe, it } from 'node:test'; |
| 4 | +import { App } from '../../../dist/core/app/app.js'; |
| 5 | +import { parseRoute } from '../../../dist/core/routing/parse-route.js'; |
| 6 | +import { createComponent, render } from '../../../dist/runtime/server/index.js'; |
| 7 | +import { createManifest } from './test-helpers.js'; |
| 8 | + |
| 9 | +/** |
| 10 | + * Security tests for double-slash URL prefix middleware authorization bypass. |
| 11 | + * |
| 12 | + * Vulnerability: A normalization inconsistency between route matching and middleware |
| 13 | + * URL construction allows bypassing middleware-based authorization by prepending an |
| 14 | + * extra `/` to the URL path (e.g., `//admin` instead of `/admin`). |
| 15 | + * |
| 16 | + * - `removeBase("//admin")` strips one slash → router matches `/admin` |
| 17 | + * - `context.url.pathname` preserves `//admin` → middleware `startsWith("/admin")` fails |
| 18 | + * |
| 19 | + * See: withastro/astro-security#5 |
| 20 | + * CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions |
| 21 | + * CWE-285: Improper Authorization |
| 22 | + */ |
| 23 | + |
| 24 | +const routeOptions = /** @type {Parameters<typeof parseRoute>[1]} */ ( |
| 25 | + /** @type {any} */ ({ |
| 26 | + config: { base: '/', trailingSlash: 'ignore' }, |
| 27 | + pageExtensions: [], |
| 28 | + }) |
| 29 | +); |
| 30 | + |
| 31 | +const adminRouteData = parseRoute('admin', routeOptions, { |
| 32 | + component: 'src/pages/admin.astro', |
| 33 | +}); |
| 34 | + |
| 35 | +const dashboardRouteData = parseRoute('dashboard', routeOptions, { |
| 36 | + component: 'src/pages/dashboard.astro', |
| 37 | +}); |
| 38 | + |
| 39 | +const publicRouteData = parseRoute('index.astro', routeOptions, { |
| 40 | + component: 'src/pages/index.astro', |
| 41 | +}); |
| 42 | + |
| 43 | +const adminPage = createComponent(() => { |
| 44 | + return render`<h1>Admin Panel</h1>`; |
| 45 | +}); |
| 46 | + |
| 47 | +const dashboardPage = createComponent(() => { |
| 48 | + return render`<h1>Dashboard</h1>`; |
| 49 | +}); |
| 50 | + |
| 51 | +const publicPage = createComponent(() => { |
| 52 | + return render`<h1>Public</h1>`; |
| 53 | +}); |
| 54 | + |
| 55 | +const pageMap = new Map([ |
| 56 | + [ |
| 57 | + adminRouteData.component, |
| 58 | + async () => ({ |
| 59 | + page: async () => ({ |
| 60 | + default: adminPage, |
| 61 | + }), |
| 62 | + }), |
| 63 | + ], |
| 64 | + [ |
| 65 | + dashboardRouteData.component, |
| 66 | + async () => ({ |
| 67 | + page: async () => ({ |
| 68 | + default: dashboardPage, |
| 69 | + }), |
| 70 | + }), |
| 71 | + ], |
| 72 | + [ |
| 73 | + publicRouteData.component, |
| 74 | + async () => ({ |
| 75 | + page: async () => ({ |
| 76 | + default: publicPage, |
| 77 | + }), |
| 78 | + }), |
| 79 | + ], |
| 80 | +]); |
| 81 | + |
| 82 | +/** |
| 83 | + * Middleware that blocks access to /admin and /dashboard routes, |
| 84 | + * as recommended in the official Astro authentication docs. |
| 85 | + * @returns {() => Promise<{onRequest: import('../../../dist/types/public/common.js').MiddlewareHandler}>} |
| 86 | + */ |
| 87 | +function createAuthMiddleware() { |
| 88 | + return async () => ({ |
| 89 | + onRequest: /** @type {import('../../../dist/types/public/common.js').MiddlewareHandler} */ ( |
| 90 | + async (context, next) => { |
| 91 | + const protectedPaths = ['/admin', '/dashboard']; |
| 92 | + if (protectedPaths.some((p) => context.url.pathname.startsWith(p))) { |
| 93 | + return new Response('Forbidden', { status: 403 }); |
| 94 | + } |
| 95 | + return next(); |
| 96 | + } |
| 97 | + ), |
| 98 | + }); |
| 99 | +} |
| 100 | + |
| 101 | +/** |
| 102 | + * @param {ReturnType<typeof createAuthMiddleware>} middleware |
| 103 | + */ |
| 104 | +function createApp(middleware) { |
| 105 | + return new App( |
| 106 | + createManifest({ |
| 107 | + routes: [ |
| 108 | + { routeData: adminRouteData }, |
| 109 | + { routeData: dashboardRouteData }, |
| 110 | + { routeData: publicRouteData }, |
| 111 | + ], |
| 112 | + pageMap, |
| 113 | + middleware, |
| 114 | + }), |
| 115 | + ); |
| 116 | +} |
| 117 | + |
| 118 | +describe('Security: double-slash URL prefix middleware bypass', () => { |
| 119 | + it('middleware blocks /admin with normal request', async () => { |
| 120 | + const app = createApp(createAuthMiddleware()); |
| 121 | + const request = new Request('http://example.com/admin'); |
| 122 | + const response = await app.render(request); |
| 123 | + assert.equal(response.status, 403, '/admin should be blocked by middleware'); |
| 124 | + }); |
| 125 | + |
| 126 | + it('middleware blocks //admin (double-slash bypass attempt)', async () => { |
| 127 | + const app = createApp(createAuthMiddleware()); |
| 128 | + const request = new Request('http://example.com//admin'); |
| 129 | + const response = await app.render(request); |
| 130 | + assert.equal(response.status, 403, '//admin should also be blocked by middleware'); |
| 131 | + }); |
| 132 | + |
| 133 | + it('middleware blocks ///admin (triple-slash bypass attempt)', async () => { |
| 134 | + const app = createApp(createAuthMiddleware()); |
| 135 | + const request = new Request('http://example.com///admin'); |
| 136 | + const response = await app.render(request); |
| 137 | + assert.equal(response.status, 403, '///admin should also be blocked by middleware'); |
| 138 | + }); |
| 139 | + |
| 140 | + it('middleware blocks //dashboard (double-slash on another protected route)', async () => { |
| 141 | + const app = createApp(createAuthMiddleware()); |
| 142 | + const request = new Request('http://example.com//dashboard'); |
| 143 | + const response = await app.render(request); |
| 144 | + assert.equal(response.status, 403, '//dashboard should also be blocked by middleware'); |
| 145 | + }); |
| 146 | + |
| 147 | + it('middleware blocks //admin/ (double-slash with trailing slash)', async () => { |
| 148 | + const app = createApp(createAuthMiddleware()); |
| 149 | + const request = new Request('http://example.com//admin/'); |
| 150 | + const response = await app.render(request); |
| 151 | + assert.equal(response.status, 403, '//admin/ should also be blocked by middleware'); |
| 152 | + }); |
| 153 | + |
| 154 | + it('public route is still accessible', async () => { |
| 155 | + const app = createApp(createAuthMiddleware()); |
| 156 | + const request = new Request('http://example.com/'); |
| 157 | + const response = await app.render(request); |
| 158 | + assert.equal(response.status, 200, '/ should be accessible'); |
| 159 | + const html = await response.text(); |
| 160 | + assert.match(html, /Public/); |
| 161 | + }); |
| 162 | +}); |
0 commit comments