diff options
| author | Maximilian Bosch <maximilian@mbosch.me> | 2024-02-10 17:32:21 +0100 |
|---|---|---|
| committer | Maximilian Bosch <maximilian@mbosch.me> | 2024-02-10 17:52:19 +0100 |
| commit | 37d6961f33897b0c1cfc1872c115b6e3aeb9c5ca (patch) | |
| tree | 9f36db75815ae50ca2ef16d20bd40f1a569abc78 /nixos/tests/nextcloud | |
| parent | 5a7b241264578c55cd25aa7422121aef072ce588 (diff) | |
nixos/nextcloud: add regression test for not delivering code anymore
PR #277382 didn't fix just an issue with .mjs files for the `forms` app, but an underlying, more problematic issue: for `/nix-apps` & `/store-apps`, the fcgi config for PHP and the block for assets were never reached. That meant that e.g. `/nix-apps/notes/lib/AppInfo/Application.php` returned the PHP source code as text/plain. Considering that there was never a fundamental change to how this config's structure, I'm pretty sure that the issue was pretty much there since the module exists. After consulting the NixOS security team we agreed that this is most likely harmless because you'd have to use private apps with secrets in the raw PHP code of said app. However, this is still problematic because one important assumption - that PHP code is never sent to the browser - is broken which is why we decided on not mentioning this impact in the previous PR from December 2023. To make sure that we don't regress our nginx config, I decided to add the reproducer which fails on 8bbbb228b4f6c0ecbd746296a67be7723b0851b9 as testcase to our integration tests.
Diffstat (limited to 'nixos/tests/nextcloud')
| -rw-r--r-- | nixos/tests/nextcloud/with-postgresql-and-redis.nix | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/nixos/tests/nextcloud/with-postgresql-and-redis.nix b/nixos/tests/nextcloud/with-postgresql-and-redis.nix index 3c090f0d3c3b7..855626aa2adf4 100644 --- a/nixos/tests/nextcloud/with-postgresql-and-redis.nix +++ b/nixos/tests/nextcloud/with-postgresql-and-redis.nix @@ -39,7 +39,7 @@ in { }; extraAppsEnable = true; extraApps = { - inherit (pkgs."nextcloud${lib.versions.major config.services.nextcloud.package.version}Packages".apps) notify_push; + inherit (pkgs."nextcloud${lib.versions.major config.services.nextcloud.package.version}Packages".apps) notify_push notes; }; settings.trusted_proxies = [ "::1" ]; }; @@ -92,5 +92,7 @@ in { # redis cache should not be empty nextcloud.fail('test "[]" = "$(redis-cli --json KEYS "*")"') + + nextcloud.fail("curl -f http://nextcloud/nix-apps/notes/lib/AppInfo/Application.php") ''; })) args |