golem15/sm-seo-plugin
4
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: the crawler and the Chrome guard keep to the site's port

Browse Source 
Fetcher.Allowed and Key, the rendered comparison and the Chrome request
guard accept an address only on the site's effective port (explicit,
else 443 for https and 80 for http), so page code cannot make headless
Chrome reach other services on the site host's address and a link to
another port is not reported as a page of the site.
This commit is contained in:
Jakub Zych
2026-11-04 22:56:02 +01:00
parent cfeb3dff12
commit 3fdb44bce2
9 changed files with 138 additions and 48 deletions
Download Patch File Download Diff File Expand all files Collapse all files

24
classes/crawl/render_test.go
View File

@@ -14,8 +14,9 @@ import (
)
// TestAllowRequest pins what the headless browser may load: https on the
// site host and its www twin, data: and blob:; http only in trusted mode;
// other hosts, credentials in the URL and every other scheme refused.
// site host and its www twin on the site's port, data: and blob:; http
// only in trusted mode, also on the site's port; other hosts and ports,
// credentials in the URL and every other scheme refused (L3 WR-03).
func TestAllowRequest(t *testing.T) {
hosts := []string{"example.test", "www.example.test"}
for _, tc := range []struct {
@@ -25,11 +26,13 @@ func TestAllowRequest(t *testing.T) {
}{
{"https://example.test/a.js", false, true},
{"https://WWW.example.test/b.css", false, true},
{"https://example.test:8443/x", false, true},
{"https://example.test:8443/x", false, false},
{"https://example.test:443/x", false, true},
{"https://example.test:80/x", false, false},
{"data:image/png;base64,AAAA", false, true},
{"blob:https://example.test/uuid", false, true},
{"http://example.test/a.js", false, false},
{"http://example.test/a.js", true, true},
{"http://example.test/a.js", true, false}, // trusted, but port 80 is not the site's 443
{"https://cdn.other.test/lib.js", false, false},
{"https://example.test.evil.test/x", false, false},
{"https://user:pw@example.test/x", false, false},
@@ -38,11 +41,19 @@ func TestAllowRequest(t *testing.T) {
{"javascript:alert(1)", true, false},
{"://bad", false, false},
} {
if got := allowRequest(tc.url, hosts, tc.trusted); got != tc.want {
if got := allowRequest(tc.url, hosts, "443", tc.trusted); got != tc.want {
t.Errorf("allowRequest(%q, trusted=%v) = %v, want %v", tc.url, tc.trusted, got, tc.want)
}
}
if !allowRequest("https://[::1]/x", []string{"[::1]"}, false) {
// A trusted http site on its own port: that port only.
if !allowRequest("http://example.test:3000/x", hosts, "3000", true) || allowRequest("http://example.test:3001/x", hosts, "3000", true) ||
allowRequest("http://example.test/x", hosts, "3000", true) {
t.Error("trusted http keeps to the site's port")
}
if !allowRequest("data:text/plain,x", hosts, "3000", false) || !allowRequest("blob:https://example.test/uuid", hosts, "3000", false) {
t.Error("data: and blob: are allowed on any port")
}
if !allowRequest("https://[::1]/x", []string{"[::1]"}, "443", false) {
t.Fatal("a bracketed IPv6 host must match")
}
}
@@ -138,6 +149,7 @@ func TestRenderTabTimeout(t *testing.T) {
t.Cleanup(func() { close(hung) })
r := &chromeRenderer{
allowed: []string{"example.test"},
port: "443",
browserCtx: context.Background(),
newTab: func(parent context.Context) (context.Context, context.CancelFunc) {
return context.WithCancel(parent)