truss-image 0.25.0

// Tests ported from imgproxy and imagor security test patterns.
//
// imgproxy: security/source_test.go (network address filtering, source validation)
// imagor:   loader/httploader/httploader_test.go (SSRF via redirects, percent-encoded attacks)
//           filestorage/filestorage_test.go (path traversal)

mod common;

use common::{
    png_bytes, send_transform_request, spawn_fixture_server, spawn_server, split_response, temp_dir,
};
use std::fs;
use std::io::{Read, Write};
use std::net::TcpStream;
use std::time::{Duration, Instant};
use truss::ServerConfig;

// ---------------------------------------------------------------------------
// SSRF: redirect chain to private IP (from imagor TestWithAllowedSourcesRedirect)
// ---------------------------------------------------------------------------

#[test]
fn ssrf_redirect_to_metadata_endpoint_is_blocked() {
    // The fixture server redirects to the AWS metadata endpoint.
    // Even with insecure sources allowed, metadata endpoints must be blocked
    // on every hop of the redirect chain.
    let storage_root = temp_dir("ssrf-redirect-metadata");
    let (url, fixture) = spawn_fixture_server(vec![(
        "302 Found".to_string(),
        vec![(
            "Location".to_string(),
            "http://169.254.169.254/latest/meta-data".to_string(),
        )],
        Vec::new(),
    )]);
    let (addr, handle) = spawn_server(
        ServerConfig::new(storage_root, Some("secret".to_string())).with_insecure_url_sources(true),
    );
    let body =
        format!(r#"{{"source":{{"kind":"url","url":"{url}"}},"options":{{"format":"jpeg"}}}}"#);
    let response = send_transform_request(addr, &body, Some("secret"));

    handle
        .join()
        .expect("join server thread")
        .expect("serve one request");
    fixture.join().expect("join fixture server");

    let (header, content_type, body) = split_response(&response);
    let body = String::from_utf8(body).expect("utf8 response body");

    assert!(
        header.starts_with("HTTP/1.1 403"),
        "redirect to metadata should be blocked, got: {header}"
    );
    assert_eq!(content_type, "application/problem+json");
    assert!(
        body.contains("cloud metadata"),
        "error should mention cloud metadata, got: {body}"
    );
}

// ---------------------------------------------------------------------------
// SSRF: non-http scheme rejected (from imgproxy security tests)
// ---------------------------------------------------------------------------

#[test]
fn ssrf_ftp_scheme_rejected() {
    let storage_root = temp_dir("ssrf-ftp");
    let (addr, handle) = spawn_server(
        ServerConfig::new(storage_root, Some("secret".to_string())).with_insecure_url_sources(true),
    );
    let response = send_transform_request(
        addr,
        r#"{"source":{"kind":"url","url":"ftp://evil.com/image.png"},"options":{"format":"jpeg"}}"#,
        Some("secret"),
    );
    handle
        .join()
        .expect("join server thread")
        .expect("serve one request");

    let (header, _, body) = split_response(&response);
    let body = String::from_utf8(body).expect("utf8");
    assert!(
        header.starts_with("HTTP/1.1 400"),
        "ftp scheme should be rejected, got: {header}"
    );
    assert!(body.contains("http"));
}

#[test]
fn ssrf_file_scheme_rejected() {
    let storage_root = temp_dir("ssrf-file");
    let (addr, handle) = spawn_server(
        ServerConfig::new(storage_root, Some("secret".to_string())).with_insecure_url_sources(true),
    );
    let response = send_transform_request(
        addr,
        r#"{"source":{"kind":"url","url":"file:///etc/passwd"},"options":{"format":"jpeg"}}"#,
        Some("secret"),
    );
    handle
        .join()
        .expect("join server thread")
        .expect("serve one request");

    let (header, _, _) = split_response(&response);
    assert!(
        header.starts_with("HTTP/1.1 400"),
        "file scheme should be rejected, got: {header}"
    );
}

#[test]
fn ssrf_data_scheme_rejected() {
    let storage_root = temp_dir("ssrf-data");
    let (addr, handle) = spawn_server(
        ServerConfig::new(storage_root, Some("secret".to_string())).with_insecure_url_sources(true),
    );
    let response = send_transform_request(
        addr,
        r#"{"source":{"kind":"url","url":"data:image/png;base64,iVBOR"},"options":{"format":"jpeg"}}"#,
        Some("secret"),
    );
    handle
        .join()
        .expect("join server thread")
        .expect("serve one request");

    let (header, _, _) = split_response(&response);
    assert!(
        header.starts_with("HTTP/1.1 400"),
        "data scheme should be rejected, got: {header}"
    );
}

// ---------------------------------------------------------------------------
// SSRF: URL with embedded credentials (from imgproxy)
// ---------------------------------------------------------------------------

#[test]
fn ssrf_url_with_userinfo_rejected() {
    let storage_root = temp_dir("ssrf-userinfo");
    let (addr, handle) = spawn_server(
        ServerConfig::new(storage_root, Some("secret".to_string())).with_insecure_url_sources(true),
    );
    let response = send_transform_request(
        addr,
        r#"{"source":{"kind":"url","url":"http://admin:pass@example.com/image.png"},"options":{"format":"jpeg"}}"#,
        Some("secret"),
    );
    handle
        .join()
        .expect("join server thread")
        .expect("serve one request");

    let (header, _, body) = split_response(&response);
    let body = String::from_utf8(body).expect("utf8");
    assert!(
        header.starts_with("HTTP/1.1 400"),
        "URL with userinfo should be rejected, got: {header}"
    );
    assert!(body.contains("user"));
}

// ---------------------------------------------------------------------------
// SSRF: loopback via various representations (from imgproxy security/source_test.go)
// ---------------------------------------------------------------------------

#[test]
fn ssrf_private_ip_ranges_blocked_in_strict_mode() {
    let _storage_root = temp_dir("ssrf-private-strict");

    // Test representative private IPs that should be blocked in strict mode.
    let blocked_urls = [
        ("http://10.0.0.1/img.png", "10.0.0.0/8 private"),
        ("http://172.16.0.1/img.png", "172.16.0.0/12 private"),
        ("http://192.168.1.1/img.png", "192.168.0.0/16 private"),
    ];

    for (url, description) in blocked_urls {
        let storage = temp_dir(&format!("ssrf-priv-{}", description.replace('/', "-")));
        let (addr, handle) = spawn_server(ServerConfig::new(storage, Some("secret".to_string())));
        let body =
            format!(r#"{{"source":{{"kind":"url","url":"{url}"}},"options":{{"format":"jpeg"}}}}"#);
        let response = send_transform_request(addr, &body, Some("secret"));
        handle
            .join()
            .expect("join server thread")
            .expect("serve one request");

        let (header, _, _) = split_response(&response);
        assert!(
            header.starts_with("HTTP/1.1 403"),
            "{description} should be blocked in strict mode, got: {header}"
        );
    }
}

#[test]
fn ssrf_non_standard_port_blocked_in_strict_mode() {
    let storage_root = temp_dir("ssrf-port-strict");
    let (addr, handle) = spawn_server(ServerConfig::new(storage_root, Some("secret".to_string())));
    let response = send_transform_request(
        addr,
        r#"{"source":{"kind":"url","url":"http://example.com:8080/image.png"},"options":{"format":"jpeg"}}"#,
        Some("secret"),
    );
    handle
        .join()
        .expect("join server thread")
        .expect("serve one request");

    let (header, _, body) = split_response(&response);
    let body = String::from_utf8(body).expect("utf8");
    assert!(
        header.starts_with("HTTP/1.1 403"),
        "non-standard port should be blocked, got: {header}"
    );
    assert!(body.contains("port"));
}

// ---------------------------------------------------------------------------
// Path traversal via E2E (from imagor filestorage tests)
// ---------------------------------------------------------------------------

#[test]
fn path_traversal_via_transform_request_is_rejected() {
    let storage_root = temp_dir("path-traversal-e2e");
    fs::write(storage_root.join("legit.png"), png_bytes()).expect("write legit image");
    let (addr, handle) = spawn_server(ServerConfig::new(storage_root, Some("secret".to_string())));

    let response = send_transform_request(
        addr,
        r#"{"source":{"kind":"path","path":"../../etc/passwd"},"options":{"format":"jpeg"}}"#,
        Some("secret"),
    );
    handle
        .join()
        .expect("join server thread")
        .expect("serve one request");

    let (header, _, _) = split_response(&response);
    assert!(
        header.starts_with("HTTP/1.1 400"),
        "path traversal should be rejected, got: {header}"
    );
}

#[test]
fn path_traversal_with_dotdot_in_middle_is_rejected() {
    let storage_root = temp_dir("path-traversal-mid");
    fs::create_dir_all(storage_root.join("sub")).expect("create subdir");
    fs::write(storage_root.join("sub/image.png"), png_bytes()).expect("write image");
    let (addr, handle) = spawn_server(ServerConfig::new(storage_root, Some("secret".to_string())));

    let response = send_transform_request(
        addr,
        r#"{"source":{"kind":"path","path":"/sub/../../../etc/passwd"},"options":{"format":"jpeg"}}"#,
        Some("secret"),
    );
    handle
        .join()
        .expect("join server thread")
        .expect("serve one request");

    let (header, _, _) = split_response(&response);
    assert!(
        header.starts_with("HTTP/1.1 400"),
        "mid-path traversal should be rejected, got: {header}"
    );
}

#[test]
fn dotgit_access_does_not_leak_raw_file_content() {
    // From imagor: filestorage protects .git directories.
    // truss does not have a path-policy deny-list for dotfiles, so the
    // request reaches the image codec which rejects it as a non-image (415).
    // We verify that:
    //   1. The status is exactly 415 (unsupported media type).
    //   2. The response body does NOT contain the raw file content.
    let storage_root = temp_dir("path-traversal-git");
    fs::create_dir_all(storage_root.join(".git/logs")).expect("create .git dir");
    let secret_content = b"ref: refs/heads/main\n";
    fs::write(storage_root.join(".git/logs/HEAD"), secret_content).expect("write git log");
    let (addr, handle) = spawn_server(ServerConfig::new(storage_root, Some("secret".to_string())));

    let response = send_transform_request(
        addr,
        r#"{"source":{"kind":"path","path":"/.git/logs/HEAD"},"options":{"format":"jpeg"}}"#,
        Some("secret"),
    );
    handle
        .join()
        .expect("join server thread")
        .expect("serve one request");

    let (header, content_type, body) = split_response(&response);
    assert!(
        header.starts_with("HTTP/1.1 415"),
        ".git file should be rejected as non-image (415), got: {header}"
    );
    assert_eq!(content_type, "application/problem+json");
    // The raw file content must never appear in the response body.
    assert!(
        !body
            .windows(secret_content.len())
            .any(|w| w == secret_content),
        "response must not leak raw .git file content"
    );
}

// ---------------------------------------------------------------------------
// Remote URL errors (from imgproxy imagedata tests)
// ---------------------------------------------------------------------------

#[test]
fn remote_upstream_4xx_returns_502() {
    // From imgproxy: TestDownloadStatusNotFound → maps to 502
    let storage_root = temp_dir("remote-4xx");
    let (url, fixture) = spawn_fixture_server(vec![(
        "404 Not Found".to_string(),
        vec![("Content-Type".to_string(), "text/plain".to_string())],
        b"not found".to_vec(),
    )]);
    let (addr, handle) = spawn_server(
        ServerConfig::new(storage_root, Some("secret".to_string())).with_insecure_url_sources(true),
    );
    let body =
        format!(r#"{{"source":{{"kind":"url","url":"{url}"}},"options":{{"format":"jpeg"}}}}"#);
    let response = send_transform_request(addr, &body, Some("secret"));

    handle
        .join()
        .expect("join server thread")
        .expect("serve one request");
    fixture.join().expect("join fixture server");

    let (header, content_type, body) = split_response(&response);
    let body = String::from_utf8(body).expect("utf8");
    assert!(
        header.starts_with("HTTP/1.1 502"),
        "upstream 404 should map to 502, got: {header}"
    );
    assert_eq!(content_type, "application/problem+json");
    assert!(body.contains("upstream HTTP 404"));
}

#[test]
fn remote_upstream_5xx_returns_502() {
    // From imgproxy: TestDownloadStatusInternalServerError → 5xx maps to 502
    let storage_root = temp_dir("remote-5xx");
    let (url, fixture) = spawn_fixture_server(vec![(
        "500 Internal Server Error".to_string(),
        vec![("Content-Type".to_string(), "text/plain".to_string())],
        b"server error".to_vec(),
    )]);
    let (addr, handle) = spawn_server(
        ServerConfig::new(storage_root, Some("secret".to_string())).with_insecure_url_sources(true),
    );
    let body =
        format!(r#"{{"source":{{"kind":"url","url":"{url}"}},"options":{{"format":"jpeg"}}}}"#);
    let response = send_transform_request(addr, &body, Some("secret"));

    handle
        .join()
        .expect("join server thread")
        .expect("serve one request");
    fixture.join().expect("join fixture server");

    let (header, _, body) = split_response(&response);
    let body = String::from_utf8(body).expect("utf8");
    assert!(
        header.starts_with("HTTP/1.1 502"),
        "upstream 500 should map to 502, got: {header}"
    );
    assert!(body.contains("upstream HTTP 500"));
}

#[test]
fn remote_upstream_403_returns_502() {
    // From imgproxy: TestDownloadStatusForbidden → maps to 502
    let storage_root = temp_dir("remote-403");
    let (url, fixture) = spawn_fixture_server(vec![(
        "403 Forbidden".to_string(),
        vec![("Content-Type".to_string(), "text/plain".to_string())],
        b"forbidden".to_vec(),
    )]);
    let (addr, handle) = spawn_server(
        ServerConfig::new(storage_root, Some("secret".to_string())).with_insecure_url_sources(true),
    );
    let body =
        format!(r#"{{"source":{{"kind":"url","url":"{url}"}},"options":{{"format":"jpeg"}}}}"#);
    let response = send_transform_request(addr, &body, Some("secret"));

    handle
        .join()
        .expect("join server thread")
        .expect("serve one request");
    fixture.join().expect("join fixture server");

    let (header, _, body) = split_response(&response);
    let body = String::from_utf8(body).expect("utf8");
    assert!(
        header.starts_with("HTTP/1.1 502"),
        "upstream 403 should map to 502, got: {header}"
    );
    assert!(body.contains("upstream HTTP 403"));
}

// ---------------------------------------------------------------------------
// Slow-header denial of service
// ---------------------------------------------------------------------------

/// A client that trickles header bytes is answered rather than held.
///
/// The socket read timeout is an inactivity timeout and resets on every byte, so a client
/// sending a header line every few seconds used to hold its worker forever. With a pool of
/// `max(max_concurrent_transforms, 8)` threads and a worker dedicated to a connection from
/// accept to close, that many trickling connections took the whole server down — the
/// liveness probe with it — for a few bytes a minute. The header phase now has a wall-clock
/// budget, so the connection ends whatever the client does.
///
/// The test trickles for longer than the budget and asserts the server answered first.
#[test]
fn slow_header_client_is_answered_rather_than_held() {
    let storage_root = temp_dir("slow-headers");
    fs::write(storage_root.join("image.png"), png_bytes()).expect("write source fixture");
    let (addr, handle) = spawn_server(ServerConfig::new(storage_root, Some("secret".to_string())));

    let started = Instant::now();
    let mut stream = TcpStream::connect(addr).expect("connect to test server");
    // Short enough that the trickle loop below stays responsive, long enough that a single
    // read is not mistaken for the server having nothing to say.
    stream
        .set_read_timeout(Some(Duration::from_millis(250)))
        .expect("set read timeout");
    stream
        .write_all(b"GET /health HTTP/1.1\r\n")
        .expect("write the request line");
    stream.flush().expect("flush");

    // Keep the socket busy without ever finishing the headers, for longer than the budget.
    // Each write resets an inactivity timeout; only a budget for the phase as a whole ends
    // this. The read is interleaved with the writes and the loop stops the moment the
    // answer arrives: writing on past the server's close would reset the connection on
    // Windows and discard the response that is the point of the test.
    let mut response = Vec::new();
    let trickle_until = Instant::now() + Duration::from_secs(40);
    while Instant::now() < trickle_until {
        let mut chunk = [0_u8; 1024];
        match stream.read(&mut chunk) {
            Ok(0) => break,
            Ok(read) => {
                response.extend_from_slice(&chunk[..read]);
                break;
            }
            Err(_) => {}
        }
        if stream.write_all(b"X-Pad: y\r\n").is_err() || stream.flush().is_err() {
            break;
        }
    }

    handle
        .join()
        .expect("join server thread")
        .expect("serve one request");

    let elapsed = started.elapsed();
    assert!(
        elapsed < Duration::from_secs(45),
        "the connection was held for {elapsed:?}"
    );
    let response = String::from_utf8_lossy(&response);
    assert!(
        response.starts_with("HTTP/1.1 408 Request Timeout"),
        "unexpected response: {response}"
    );
}

/// The metadata block is the only rule left standing when
/// `TRUSS_ALLOW_INSECURE_URL_SOURCES` is set, so every spelling of an endpoint has to be
/// refused by it and not merely by the deny-list that the flag turns off.
///
/// A trailing dot makes a domain name absolute and resolves identically; `::a.b.c.d` and
/// `2002:a.b.c.d::` carry the same IPv4 address as `::ffff:a.b.c.d`. Asserting the detail
/// rather than the status is what separates a refusal by this rule from a fetch that
/// happened to fail.
#[test]
fn metadata_spellings_are_refused_even_when_insecure_sources_are_allowed() {
    let spellings = [
        "http://169.254.169.254/latest/meta-data",
        "http://169.254.169.254./latest/meta-data",
        "http://metadata.google.internal/computeMetadata/v1/",
        "http://metadata.google.internal./computeMetadata/v1/",
        "http://[::ffff:169.254.169.254]/latest/meta-data",
        "http://[::169.254.169.254]/latest/meta-data",
        "http://[2002:a9fe:a9fe::]/latest/meta-data",
        "http://[fd00:ec2::254]/latest/meta-data",
    ];

    for spelling in spellings {
        let storage_root = temp_dir("metadata-spellings");
        let (addr, handle) = spawn_server(
            ServerConfig::new(storage_root, Some("secret".to_string()))
                .with_insecure_url_sources(true),
        );
        let request_body = format!(
            r#"{{"source":{{"kind":"url","url":"{spelling}"}},"options":{{"format":"png"}}}}"#
        );
        let response = send_transform_request(addr, &request_body, Some("secret"));

        handle
            .join()
            .expect("join server thread")
            .expect("serve one request");

        let (header, _, body) = split_response(&response);
        let body = String::from_utf8_lossy(&body);
        assert!(
            header.starts_with("HTTP/1.1 403"),
            "{spelling} must be refused by the metadata rule: {header}\n{body}"
        );
        assert!(
            body.contains("cloud metadata"),
            "{spelling} must be refused for being a metadata endpoint: {body}"
        );
    }
}

// ---------------------------------------------------------------------------
// Rate limiting: what it applies to
// ---------------------------------------------------------------------------

/// A client that has exhausted its bucket is still answered by the health endpoints and the
/// metrics scrape, and is still shed on an image route.
///
/// Both halves matter. Shedding `/health/live` is a failed liveness probe, and an
/// orchestrator that fails enough of them restarts the process, so a burst of client traffic
/// became a restart; `/metrics` is how the limiter is observed, so a scrape shed at the
/// moment the limiter starts working is the moment the evidence of it working stops
/// arriving. Asserting the image route is still shed is what pins the exemption as a rule
/// rather than as a hole in the limiter.
#[test]
#[serial_test::serial]
fn rate_limiting_sheds_the_image_routes_and_not_the_probes() {
    let storage_root = temp_dir("rate-limit-exemptions");
    fs::write(storage_root.join("image.png"), png_bytes()).expect("write source fixture");

    // SAFETY: the test is serial, so nothing else reads the environment concurrently.
    unsafe {
        std::env::set_var("TRUSS_STORAGE_ROOT", &storage_root);
        std::env::set_var("TRUSS_RATE_LIMIT_RPS", "3");
        std::env::set_var("TRUSS_RATE_LIMIT_BURST", "3");
    }
    let mut config = ServerConfig::from_env().expect("configure a rate limited server");
    // SAFETY: same as above.
    unsafe {
        std::env::remove_var("TRUSS_STORAGE_ROOT");
        std::env::remove_var("TRUSS_RATE_LIMIT_RPS");
        std::env::remove_var("TRUSS_RATE_LIMIT_BURST");
    }
    config.shutdown_drain_secs = 0;

    let draining = std::sync::Arc::clone(&config.draining);
    let listener = std::net::TcpListener::bind("127.0.0.1:0").expect("bind");
    let addr = listener.local_addr().expect("addr");
    let handle = std::thread::spawn(move || truss::serve_with_config(listener, config));

    let get = |path: &str| -> u16 {
        let response = common::send_raw_request(
            addr,
            &format!("GET {path} HTTP/1.1\r\nHost: localhost\r\nConnection: close\r\n\r\n"),
        );
        let (header, _, _) = split_response(&response);
        common::status_code(&header)
    };

    // Empty the bucket on an image route. The signature is missing, so each request is
    // refused before any work happens, which is enough to spend a token.
    let mut shed = false;
    for _ in 0..12 {
        if get("/images/by-path?path=image.png") == 429 {
            shed = true;
        }
    }
    assert!(shed, "the bucket should be exhausted by twelve requests");

    for path in ["/health/live", "/health/ready", "/health", "/metrics"] {
        assert_ne!(get(path), 429, "{path} should not be rate limited");
    }
    assert_eq!(
        get("/images/by-path?path=image.png"),
        429,
        "an image route is still shed while the bucket is empty"
    );

    draining.store(true, std::sync::atomic::Ordering::SeqCst);
    let _ = std::net::TcpStream::connect(addr);
    let _ = handle.join().expect("join the server thread");
}