KNEL/KNELProductionContainers
2
0
Fork 0
Code Pull Requests Actions Packages Releases Activity
Files
integration
KNELProductionContainers/CloudronPackages/APISIX/apisix-source/t/plugin/security-warning.t
ReachableCEO 54cc5f7308 feat(apisix): add Cloudron package 
- Implements Apache APISIX packaging for Cloudron platform.
- Includes Dockerfile, CloudronManifest.json, and start.sh.
- Configured to use Cloudron's etcd addon.

🤖 Generated with Gemini CLI
Co-Authored-By: Gemini <noreply@google.com>
2025-09-04 09:42:47 -05:00

571 lines
16 KiB
Perl
Raw Permalink Blame History

#
# Licensed to the Apache Software Foundation (ASF) under one or more
# contributor license agreements. See the NOTICE file distributed with
# this work for additional information regarding copyright ownership.
# The ASF licenses this file to You under the Apache License, Version 2.0
# (the "License"); you may not use this file except in compliance with
# the License. You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
use t::APISIX 'no_plan';
repeat_each(1);
no_long_string();
no_root_location();
add_block_preprocessor(sub {
my ($block) = @_;
if (!defined $block->request) {
$block->set_value("request", "GET /t");
}
});
run_tests();
__DATA__
=== TEST 1: authz-casdoor no https
--- config
location /t {
content_by_lua_block {
local plugin = require("apisix.plugins.authz-casdoor")
local fake_uri = "http://127.0.0.1:" .. ngx.var.server_port
local callback_url = "http://127.0.0.1:" .. ngx.var.server_port ..
"/anything/callback"
local conf = {
callback_url = callback_url,
endpoint_addr = fake_uri,
client_id = "7ceb9b7fda4a9061ec1c",
client_secret = "3416238e1edf915eac08b8fe345b2b95cdba7e04"
}
local ok, err = plugin.check_schema(conf)
if not ok then
ngx.say(err)
end
ngx.say("done")
}
}
--- response_body
done
--- error_log
Using authz-casdoor endpoint_addr with no TLS is a security risk
Using authz-casdoor callback_url with no TLS is a security risk
=== TEST 2: authz-casdoor with TLS
--- config
location /t {
content_by_lua_block {
local plugin = require("apisix.plugins.authz-casdoor")
local fake_uri = "https://127.0.0.1:" .. ngx.var.server_port
local callback_url = "https://127.0.0.1:" .. ngx.var.server_port ..
"/anything/callback"
local conf = {
callback_url = callback_url,
endpoint_addr = fake_uri,
client_id = "7ceb9b7fda4a9061ec1c",
client_secret = "3416238e1edf915eac08b8fe345b2b95cdba7e04"
}
local ok, err = plugin.check_schema(conf)
if not ok then
ngx.say(err)
end
ngx.say("done")
}
}
--- response_body
done
--- no_error_log
Using authz-casdoor endpoint_addr with no TLS is a security risk
Using authz-casdoor callback_url with no TLS is a security risk
=== TEST 3: authz keycloak with no TLS
--- config
location /t {
content_by_lua_block {
local check = {"discovery", "token_endpoint", "resource_registration_endpoint", "access_denied_redirect_uri"}
local plugin = require("apisix.plugins.authz-keycloak")
local ok, err = plugin.check_schema({
client_id = "foo",
discovery = "http://host.domain/realms/foo/protocol/openid-connect/token",
token_endpoint = "http://token_endpoint.domain",
resource_registration_endpoint = "http://resource_registration_endpoint.domain",
access_denied_redirect_uri = "http://access_denied_redirect_uri.domain"
})
if not ok then
ngx.say(err)
end
ngx.say("done")
}
}
--- request
GET /t
--- response_body
done
--- error_log
Using authz-keycloak discovery with no TLS is a security risk
Using authz-keycloak token_endpoint with no TLS is a security risk
Using authz-keycloak resource_registration_endpoint with no TLS is a security
Using authz-keycloak access_denied_redirect_uri with no TLS is a security risk
=== TEST 4: authz keycloak with TLS
--- config
location /t {
content_by_lua_block {
local check = {"discovery", "token_endpoint", "resource_registration_endpoint", "access_denied_redirect_uri"}
local plugin = require("apisix.plugins.authz-keycloak")
local ok, err = plugin.check_schema({
client_id = "foo",
discovery = "https://host.domain/realms/foo/protocol/openid-connect/token",
token_endpoint = "https://token_endpoint.domain",
resource_registration_endpoint = "https://resource_registration_endpoint.domain",
access_denied_redirect_uri = "https://access_denied_redirect_uri.domain"
})
if not ok then
ngx.say(err)
end
ngx.say("done")
}
}
--- request
GET /t
--- response_body
done
--- no_error_log
Using authz-keycloak discovery with no TLS is a security risk
Using authz-keycloak token_endpoint with no TLS is a security risk
Using authz-keycloak resource_registration_endpoint with no TLS is a security
Using authz-keycloak access_denied_redirect_uri with no TLS is a security risk
=== TEST 5: cas auth with no TLS
--- config
location /t {
content_by_lua_block {
local plugin = require("apisix.plugins.cas-auth")
local ok, err = plugin.check_schema({
idp_uri = "http://a.com",
cas_callback_uri = "/a/b",
logout_uri = "/c/d"
})
if not ok then
ngx.say(err)
else
ngx.say("passed")
end
}
}
--- response_body
passed
--- error_log
risk
=== TEST 6: cas auth with TLS
--- config
location /t {
content_by_lua_block {
local plugin = require("apisix.plugins.cas-auth")
local ok, err = plugin.check_schema({
idp_uri = "https://a.com",
cas_callback_uri = "/a/b",
logout_uri = "/c/d"
})
if not ok then
ngx.say(err)
else
ngx.say("passed")
end
}
}
--- response_body
passed
--- no_error_log
risk
=== TEST 7: clickhouse logger with no TLS
--- config
location /t {
content_by_lua_block {
local plugin = require("apisix.plugins.clickhouse-logger")
local ok, err = plugin.check_schema({
timeout = 3,
retry_delay = 1,
batch_max_size = 500,
user = "default",
password = "a",
database = "default",
logtable = "t",
endpoint_addrs = {
"http://127.0.0.1:1980/clickhouse_logger_server",
"http://127.0.0.2:1980/clickhouse_logger_server",
},
max_retry_count = 1,
name = "clickhouse logger",
ssl_verify = false
})
if not ok then
ngx.say(err)
else
ngx.say("passed")
end
}
}
--- response_body
passed
--- error_log
Using clickhouse-logger endpoint_addrs with no TLS is a security risk
=== TEST 8: clickhouse logger with TLS
--- config
location /t {
content_by_lua_block {
local plugin = require("apisix.plugins.clickhouse-logger")
local ok, err = plugin.check_schema({
timeout = 3,
retry_delay = 1,
batch_max_size = 500,
user = "default",
password = "a",
database = "default",
logtable = "t",
endpoint_addrs = {
"https://127.0.0.1:1980/clickhouse_logger_server",
"https://127.0.0.2:1980/clickhouse_logger_server",
},
max_retry_count = 1,
name = "clickhouse logger",
ssl_verify = false
})
if not ok then
ngx.say(err)
else
ngx.say("passed")
end
}
}
--- response_body
passed
--- no_error_log
Using clickhouse-logger endpoint_addrs with no TLS is a security risk
=== TEST 9: elastic search logger with no TLS
--- config
location /t {
content_by_lua_block {
local ok, err
local plugin = require("apisix.plugins.elasticsearch-logger")
ok, err = plugin.check_schema({
endpoint_addrs = {
"http://127.0.0.1:9200"
},
field = {
index = "services"
}
})
if err then
ngx.say(err)
else
ngx.say("passed")
end
}
}
--- response_body_like
passed
--- error_log
Using elasticsearch-logger endpoint_addrs with no TLS is a security risk
=== TEST 10: elastic search logger with TLS
--- config
location /t {
content_by_lua_block {
local ok, err
local plugin = require("apisix.plugins.elasticsearch-logger")
ok, err = plugin.check_schema({
endpoint_addrs = {
"https://127.0.0.1:9200"
},
field = {
index = "services"
}
})
if err then
ngx.say(err)
else
ngx.say("passed")
end
}
}
--- response_body_like
passed
--- no_error_log
Using elasticsearch-logger endpoint_addrs with no TLS is a security risk
=== TEST 11: error log logger with tcp.tls = false
--- config
location /t {
content_by_lua_block {
local plugin = require("apisix.plugins.error-log-logger")
local ok, err = plugin.check_schema({
tcp = {
host = "host.com",
port = "99",
tls = false,
},
skywalking = {
endpoint_addr = "http://a.bcd"
},
clickhouse = {
endpoint_addr = "http://some.com",
user = "user",
password = "secret",
database = "yes",
logtable = "some"
},
})
ngx.say(ok and "done" or err)
}
}
--- request
GET /t
--- response_body
done
--- error_log
Using error-log-logger skywalking.endpoint_addr with no TLS is a security risk
Using error-log-logger clickhouse.endpoint_addr with no TLS is a security risk
Keeping tcp.tls disabled in error-log-logger configuration is a security risk
=== TEST 12: error log logger with tcp.tls = true
--- config
location /t {
content_by_lua_block {
local plugin = require("apisix.plugins.error-log-logger")
local ok, err = plugin.check_schema({
tcp = {
host = "host.com",
port = "99",
tls = true,
},
skywalking = {
endpoint_addr = "https://a.bcd"
},
clickhouse = {
endpoint_addr = "https://some.com",
user = "user",
password = "secret",
database = "yes",
logtable = "some"
},
})
ngx.say(ok and "done" or err)
}
}
--- request
GET /t
--- response_body
done
--- no_error_log
Using error-log-logger skywalking.endpoint_addr with no TLS is a security risk
Using error-log-logger clickhouse.endpoint_addr with no TLS is a security risk
Keeping tcp.tls disabled in error-log-logger configuration is a security risk
=== TEST 13: forward auth with no TLS
--- config
location /t {
content_by_lua_block {
local plugin = require("apisix.plugins.forward-auth")
local ok, err = plugin.check_schema({uri = "http://127.0.0.1:8199"})
ngx.say(ok and "done" or err)
}
}
--- response_body
done
--- error_log
Using forward-auth uri with no TLS is a security risk
Using forward-auth uri with no TLS is a security risk
=== TEST 14: forward auth with TLS
--- config
location /t {
content_by_lua_block {
local plugin = require("apisix.plugins.forward-auth")
local ok, err = plugin.check_schema({uri = "https://127.0.0.1:8199"})
ngx.say(ok and "done" or err)
}
}
--- response_body
done
--- no_error_log
Using forward-auth uri with no TLS is a security risk
=== TEST 15: http-logger with no TLS
--- config
location /t {
content_by_lua_block {
local plugin = require("apisix.plugins.http-logger")
local ok, err = plugin.check_schema({uri = "http://127.0.0.1"})
if not ok then
ngx.say(err)
end
ngx.say("done")
}
}
--- response_body
done
--- error_log
Using http-logger uri with no TLS is a security risk
=== TEST 16: http-logger with TLS
--- config
location /t {
content_by_lua_block {
local plugin = require("apisix.plugins.http-logger")
local ok, err = plugin.check_schema({uri = "https://127.0.0.1"})
if not ok then
ngx.say(err)
end
ngx.say("done")
}
}
--- response_body
done
--- no_error_log
Using http-logger uri with no TLS is a security risk
=== TEST 17: ldap auth with no TLS
--- config
location /t {
content_by_lua_block {
local core = require("apisix.core")
local plugin = require("apisix.plugins.ldap-auth")
local ok, err = plugin.check_schema(
{
base_dn = "123",
ldap_uri = "127.0.0.1:1389",
tls_verify = false,
use_tls = false
})
if not ok then
ngx.say(err)
end
ngx.say("done")
}
}
--- response_body
done
--- error_log
Keeping tls_verify disabled in ldap-auth configuration is a security risk
Keeping use_tls disabled in ldap-auth configuration is a security risk
=== TEST 18: ldap auth with TLS
--- config
location /t {
content_by_lua_block {
local core = require("apisix.core")
local plugin = require("apisix.plugins.ldap-auth")
local ok, err = plugin.check_schema({base_dn = "123", ldap_uri = "127.0.0.1:1389", use_tls = true})
if not ok then
ngx.say(err)
end
ngx.say("done")
}
}
--- response_body
done
--- no_error_log
Using LDAP auth with TLS disabled is a security risk
=== TEST 19: loki-logger with no TLS
--- config
location /t {
content_by_lua_block {
local plugin = require("apisix.plugins.loki-logger")
local ok, err = plugin.check_schema({endpoint_addrs = {"http://127.0.0.1:8199"}})
ngx.say(ok and "done" or err)
}
}
--- response_body
done
--- error_log
Using loki-logger endpoint_addrs with no TLS is a security risk
Using loki-logger endpoint_addrs with no TLS is a security risk
Using loki-logger endpoint_addrs with no TLS is a security risk
=== TEST 20: loki logger with TLS
--- config
location /t {
content_by_lua_block {
local plugin = require("apisix.plugins.loki-logger")
local ok, err = plugin.check_schema({endpoint_addrs = {"https://127.0.0.1:8199"}})
ngx.say(ok and "done" or err)
}
}
--- response_body
done
--- no_error_log
Using loki-logger endpoint_addrs with no TLS is a security risk
View Git Blame Copy Permalink