#662

pending completion

Build # #662

Build Type

push

github-actions

Committed by

web-flow

Commit Message

<a href="https://github.com/Badgerati/Pode/commit/<a class=hub.com/Badgerati/Pode/commit/<a class="double-link" href="https://git"><a class=hub.com/Badgerati/Pode/commit/<a class="double-link" href="https://git"><a class=hub.com/Badgerati/Pode/commit/a48e9af343670a8d82451a16dedd6e9344f27280">a48e9af34<a href="https://github.com/Badgerati/Pode/commit/a48e9af343670a8d82451a16dedd6e9344f27280">&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/Badgerati/Pode/commit/&lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/Badgerati/Pode/commit/&amp;lt;a class=&amp;quot;double-link&amp;quot; href=&amp;quot;https://git&quot;&gt;&amp;lt;a class=&lt;/a&gt;hub.com/Badgerati/Pode/commit/a48e9af343670a8d82451a16dedd6e9344f27280&quot;&gt;a48e9af34&lt;/a&gt;&lt;a href=&quot;https://github.com/Badgerati/Pode/commit/a48e9af343670a8d82451a16dedd6e9344f27280&quot;&gt;&amp;lt;a href=&amp;quot;https://github.com/Badgerati/Pode/commit/a48e9af343670a8d82451a16dedd6e93&lt;/a&gt;44f27280">&quot;&gt;Merge &lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/Badgerati/Pode/commit/&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/Badgerati/Pode/commit/<a class="double-link" href="https://github.com/Badgerati/Pode/commit/a68beaa786bbd79d8e2bcc4a35fedf7a8755ea2a">a68beaa78</a><a href="https://github.com/Badgerati/Pode/commit/a48e9af343670a8d82451a16dedd6e9344f27280">&amp;quot;&amp;gt;a68beaa78&amp;lt;/a&amp;gt;&amp;quot;&amp;gt;a68beaa78&amp;lt;/a&amp;gt;&amp;lt;a href=&amp;quot;https://github.com/Badgerati/Pode/commit/a48e9af343670a8d82451a16dedd6e9344f27&lt;/a&gt;280&quot;&gt; into &lt;/a&gt;&lt;a class=&quot;double-link&quot; href=&quot;https://github.com/Badgerati/Pode/commit/<a class="double-link" href="https://github.com/Badgerati/Pode/commit/7134d806e">7134d806e">7134d806e</a>

Run Details

155 of 155 new or added lines in 10 files covered. (100.0%)

2702 of 5601 relevant lines covered (48.24%)

1.24 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

46.04

/src/Private/Security.ps1

using namespace System.Security.Cryptography

function Test-PodeIPLimit
{
    param (
        [Parameter(Mandatory=$true)]
        [ValidateNotNull()]
        $IP
    )

    $type = 'IP'

    # get the limit rules and active list
    $rules = $PodeContext.Server.Limits.Rules[$type]
    $active = $PodeContext.Server.Limits.Active[$type]

    # if there are no rules, it's valid
    if (($null -eq $rules) -or ($rules.Count -eq 0)) {
        return $true
    }

    # get the ip address in bytes
    $IP = @{
        String = $IP.IPAddressToString
        Family = $IP.AddressFamily
        Bytes = $IP.GetAddressBytes()
    }

    # now
    $now = [DateTime]::UtcNow

    # is the ip active? (get a direct match, then try grouped subnets)
    $_active_ip = $active[$IP.String]
    if ($null -eq $_active_ip) {
        $_groups = @(foreach ($key in $active.Keys) {
            if ($active[$key].Rule.Grouped) {
                $active[$key]
            }
        })

        $_active_ip = @(foreach ($_group in $_groups) {
            if (Test-PodeIPAddressInRange -IP $IP -LowerIP $_group.Rule.Lower -UpperIP $_group.Rule.Upper) {
                $_group
                break
            }
        })[0]
    }

    # the ip is active, or part of a grouped subnet
    if ($null -ne $_active_ip) {
        # if limit is -1, always allowed
        if ($_active_ip.Rule.Limit -eq -1) {
            return $true
        }

        # check expire time, a reset if needed
        if ($now -ge $_active_ip.Expire) {
            $_active_ip.Rate = 0
            $_active_ip.Expire = $now.AddSeconds($_active_ip.Rule.Seconds)
        }

        # are we over the limit?
        if ($_active_ip.Rate -ge $_active_ip.Rule.Limit) {
            return $false
        }

        # increment the rate
        $_active_ip.Rate++
        return $true
    }

    # the ip isn't active
    else {
        # get the ip's rule
        $_rule_ip = @(foreach ($rule in $rules.Values) {
            if (Test-PodeIPAddressInRange -IP $IP -LowerIP $rule.Lower -UpperIP $rule.Upper) {
                $rule
                break
            }
        })[0]

        # if ip not in rules, it's valid
        # (add to active list as always allowed - saves running where search everytime)
        if ($null -eq $_rule_ip) {
            $active.Add($IP.String, @{
                Rule = @{
                    Limit = -1
                }
            })

            return $true
        }

        # add ip to active list (ip if not grouped, else the subnet if it's grouped)
        $_ip = (Resolve-PodeValue -Check $_rule_ip.Grouped -TrueValue $_rule_ip.IP -FalseValue $IP.String)

        $active.Add($_ip, @{
            Rule = $_rule_ip
            Rate = 1
            Expire = $now.AddSeconds($_rule_ip.Seconds)
        })

        # if limit is 0, it's never allowed
        return ($_rule_ip -ne 0)
    }
}

function Test-PodeIPAccess
{
    param (
        [Parameter(Mandatory=$true)]
        [ValidateNotNull()]
        $IP
    )

    $type = 'IP'

    # get permission lists for ip
    $allow = $PodeContext.Server.Access.Allow[$type]
    $deny = $PodeContext.Server.Access.Deny[$type]

    # are they empty?
    $alEmpty = (($null -eq $allow) -or ($allow.Count -eq 0))
    $dnEmpty = (($null -eq $deny) -or ($deny.Count -eq 0))

    # if both are empty, value is valid
    if ($alEmpty -and $dnEmpty) {
        return $true
    }

    # get the ip address in bytes
    $IP = @{
        Family = $IP.AddressFamily
        Bytes = $IP.GetAddressBytes()
    }

    # if value in allow, it's allowed
    if (!$alEmpty) {
        $match = @(foreach ($value in $allow.Values) {
            if (Test-PodeIPAddressInRange -IP $IP -LowerIP $value.Lower -UpperIP $value.Upper) {
                $value
                break
            }
        })[0]

        if ($null -ne $match) {
            return $true
        }
    }

    # if value in deny, it's disallowed
    if (!$dnEmpty) {
        $match = @(foreach ($value in $deny.Values) {
            if (Test-PodeIPAddressInRange -IP $IP -LowerIP $value.Lower -UpperIP $value.Upper) {
                $value
                break
            }
        })[0]

        if ($null -ne $match) {
            return $false
        }
    }

    # if we have an allow, it's disallowed (because it's not in there)
    if (!$alEmpty) {
        return $false
    }

    # otherwise it's allowed (because it's not in the deny)
    return $true
}

function Add-PodeIPLimit
{
    param (
        [Parameter(Mandatory=$true)]
        [ValidateNotNull()]
        [string]
        $IP,

        [Parameter(Mandatory=$true)]
        [int]
        $Limit,

        [Parameter(Mandatory=$true)]
        [int]
        $Seconds,

        [switch]
        $Group
    )

    # current limit type
    $type = 'IP'

    # ensure limit and seconds are non-zero and negative
    if ($Limit -le 0) {
        throw "Limit value cannot be 0 or less for $($IP)"
    }

    if ($Seconds -le 0) {
        throw "Seconds value cannot be 0 or less for $($IP)"
    }

    # get current rules
    $rules = $PodeContext.Server.Limits.Rules[$type]

    # setup up perm type
    if ($null -eq $rules) {
        $PodeContext.Server.Limits.Rules[$type] = @{}
        $PodeContext.Server.Limits.Active[$type] = @{}
        $rules = $PodeContext.Server.Limits.Rules[$type]
    }

    # have we already added the ip?
    elseif ($rules.ContainsKey($IP)) {
        return
    }

    # calculate the lower/upper ip bounds
    if (Test-PodeIPAddressIsSubnetMask -IP $IP) {
        $_tmp = Get-PodeSubnetRange -SubnetMask $IP
        $_tmpLo = Get-PodeIPAddress -IP $_tmp.Lower
        $_tmpHi = Get-PodeIPAddress -IP $_tmp.Upper
    }
    elseif (Test-PodeIPAddressAny -IP $IP) {
        $_tmpLo = Get-PodeIPAddress -IP '0.0.0.0'
        $_tmpHi = Get-PodeIPAddress -IP '255.255.255.255'
    }
    else {
        $_tmpLo = Get-PodeIPAddress -IP $IP
        $_tmpHi = $_tmpLo
    }

    # add limit rule for ip
    $rules.Add($IP, @{
        Limit = $Limit
        Seconds = $Seconds
        Grouped = [bool]$Group
        IP = $IP
        Lower = @{
            Family = $_tmpLo.AddressFamily
            Bytes = $_tmpLo.GetAddressBytes()
        }
        Upper = @{
            Family = $_tmpHi.AddressFamily
            Bytes = $_tmpHi.GetAddressBytes()
        }
    })
}

function Add-PodeIPAccess
{
    param (
        [Parameter(Mandatory=$true)]
        [ValidateSet('Allow', 'Deny')]
        [string]
        $Access,

        [Parameter(Mandatory=$true)]
        [string]
        $IP
    )

    # current access type
    $type = 'IP'

    # get opposite permission
    $opp = "$(if ($Access -ieq 'allow') { 'Deny' } else { 'Allow' })"

    # get permission lists for type
    $permType = $PodeContext.Server.Access[$Access][$type]
    $oppType = $PodeContext.Server.Access[$opp][$type]

    # setup up perm type
    if ($null -eq $permType) {
        $PodeContext.Server.Access[$Access][$type] = @{}
        $permType = $PodeContext.Server.Access[$Access][$type]
    }

    # have we already added the ip?
    elseif ($permType.ContainsKey($IP)) {
        return
    }

    # remove from opp type
    if ($null -ne $oppType -and $oppType.ContainsKey($IP)) {
        $oppType.Remove($IP)
    }

    # calculate the lower/upper ip bounds
    if (Test-PodeIPAddressIsSubnetMask -IP $IP) {
        $_tmp = Get-PodeSubnetRange -SubnetMask $IP
        $_tmpLo = Get-PodeIPAddress -IP $_tmp.Lower
        $_tmpHi = Get-PodeIPAddress -IP $_tmp.Upper
    }
    elseif (Test-PodeIPAddressAny -IP $IP) {
        $_tmpLo = Get-PodeIPAddress -IP '0.0.0.0'
        $_tmpHi = Get-PodeIPAddress -IP '255.255.255.255'
    }
    else {
        $_tmpLo = Get-PodeIPAddress -IP $IP
        $_tmpHi = $_tmpLo
    }

    # add access rule for ip
    $permType.Add($IP, @{
        Lower = @{
            Family = $_tmpLo.AddressFamily
            Bytes = $_tmpLo.GetAddressBytes()
        }
        Upper = @{
            Family = $_tmpHi.AddressFamily
            Bytes = $_tmpHi.GetAddressBytes()
        }
    })
}

function Get-PodeCsrfToken
{
    # key name to search
    $key = $PodeContext.Server.Cookies.Csrf.Name

    # check the payload
    if (!(Test-IsEmpty $WebEvent.Data[$key])) {
        return $WebEvent.Data[$key]
    }

    # check the query string
    if (!(Test-IsEmpty $WebEvent.Query[$key])) {
        return $WebEvent.Query[$key]
    }

    # check the headers
    $value = (Get-PodeHeader -Name $key)
    if (!(Test-IsEmpty $value)) {
        return $value
    }

    return $null
}

function Test-PodeCsrfToken
{
    param (
        [Parameter()]
        [string]
        $Secret,

        [Parameter()]
        [string]
        $Token
    )

    # if there's no token/secret, fail
    if ((Test-IsEmpty $Secret) -or (Test-IsEmpty $Token)) {
        return $false
    }

    # the token must start with "t:"
    if (!$Token.StartsWith('t:')) {
        return $false
    }

    # get the salt from the token
    $_token = $Token.Substring(2)
    $periodIndex = $_token.LastIndexOf('.')
    if ($periodIndex -eq -1) {
        return $false
    }

    $salt = $_token.Substring(0, $periodIndex)

    # ensure the token is valid
    if ((Restore-PodeCsrfToken -Secret $Secret -Salt $salt) -ne $Token) {
        return $false
    }

    return $true
}

function New-PodeCsrfSecret
{
    # see if there's already a secret in session/cookie
    $secret = (Get-PodeCsrfSecret)
    if (!(Test-IsEmpty $secret)) {
        return $secret
    }

    # otherwise, make a new secret and cache it
    $secret = (New-PodeGuid -Secure -Length 16)
    Set-PodeCsrfSecret -Secret $secret
    return $secret
}

function Get-PodeCsrfSecret
{
    # key name to get secret
    $key = $PodeContext.Server.Cookies.Csrf.Name

    # are we getting it from a cookie, or session?
    if ($PodeContext.Server.Cookies.Csrf.UseCookies) {
        return (Get-PodeCookie `
            -Name $PodeContext.Server.Cookies.Csrf.Name `
            -Secret $PodeContext.Server.Cookies.Csrf.Secret).Value
    }

    # on session
    else {
        return $WebEvent.Session.Data[$key]
    }
}

function Set-PodeCsrfSecret
{
    param (
        [Parameter(Mandatory=$true)]
        [string]
        $Secret
    )

    # key name to set secret under
    $key = $PodeContext.Server.Cookies.Csrf.Name

    # are we setting this on a cookie, or session?
    if ($PodeContext.Server.Cookies.Csrf.UseCookies) {
        (Set-PodeCookie `
            -Name $PodeContext.Server.Cookies.Csrf.Name `
            -Value $Secret `
            -Secret $PodeContext.Server.Cookies.Csrf.Secret) | Out-Null
    }

    # on session
    else {
        $WebEvent.Session.Data[$key] = $Secret
    }
}

function Restore-PodeCsrfToken
{
    param (
        [Parameter(Mandatory=$true)]
        [string]
        $Secret,

        [Parameter(Mandatory=$true)]
        [string]
        $Salt
    )

    return "t:$($Salt).$(Invoke-PodeSHA256Hash -Value "$($Salt)-$($Secret)")"
}

function Test-PodeCsrfConfigured
{
    return (!(Test-IsEmpty $PodeContext.Server.Cookies.Csrf))
}

function Get-PodeCertificateByFile
{
    param(
        [Parameter(Mandatory=$true)]
        [string]
        $Certificate,

        [Parameter()]
        [string]
        $Password = $null
    )

    $path = Get-PodeRelativePath -Path $Certificate -JoinRoot -Resolve
    $cert = $null

    if ([string]::IsNullOrWhiteSpace($Password)) {
        $cert = [X509Certificates.X509Certificate2]::new($path)
    }
    else {
        $cert = [X509Certificates.X509Certificate2]::new($path, $Password)
    }

    return $cert
}

function Find-PodeCertificateInCertStore
{
    param(
        [Parameter(Mandatory=$true)]
        [X509Certificates.X509FindType]
        $FindType,

        [Parameter(Mandatory=$true)]
        [string]
        $Query
    )

    # fail if not windows
    if (!(Test-IsWindows)) {
        throw "Certificate Thumbprints/Name are only supported on Windows"
    }

    # open the currentuser\my store
    $x509store = [X509Certificates.X509Store]::new(
        [X509Certificates.StoreName]::My,
        [X509Certificates.StoreLocation]::CurrentUser
    )

    try {
        # attempt to find the cert
        $x509store.Open([X509Certificates.OpenFlags]::ReadOnly)
        $x509certs = $x509store.Certificates.Find($FindType, $Query, $false)
    }
    finally {
        # close the store!
        if ($null -ne $x509store) {
            Close-PodeDisposable -Disposable $x509store -Close
        }
    }

    # fail if no cert found for query
    if (($null -eq $x509certs) -or ($x509certs.Count -eq 0)) {
        throw "No certificate could be found in CurrentUser\My for '$($Thumbprint)'"
    }

    return ([X509Certificates.X509Certificate2]($x509certs[0]))
}

function Get-PodeCertificateByThumbprint
{
    param(
        [Parameter(Mandatory=$true)]
        [string]
        $Thumbprint
    )

    return (Find-PodeCertificateInCertStore -FindType [X509FindType]::FindByThumbprint -Query $Thumbprint)
}

function Get-PodeCertificateByName
{
    param(
        [Parameter(Mandatory=$true)]
        [string]
        $Name
    )

    return (Find-PodeCertificateInCertStore -FindType [X509FindType]::FindBySubjectName -Query $Name)
}

function New-PodeSelfSignedCertificate
{
    $sanBuilder = [X509Certificates.SubjectAlternativeNameBuilder]::new()
    $sanBuilder.AddIpAddress([ipaddress]::Loopback) | Out-Null
    $sanBuilder.AddIpAddress([ipaddress]::IPv6Loopback) | Out-Null
    $sanBuilder.AddDnsName('localhost') | Out-Null

    if (![string]::IsNullOrWhiteSpace($env:COMPUTERNAME)) {
        $sanBuilder.AddDnsName($env:COMPUTERNAME) | Out-Null
    }

    $rsa = [RSA]::Create(2048)
    $distinguishedName = [X500DistinguishedName]::new("CN=localhost")

    $req = [X509Certificates.CertificateRequest]::new(
        $distinguishedName,
        $rsa,
        [HashAlgorithmName]::SHA256,
        [RSASignaturePadding]::Pkcs1
    )

    $flags = (
        [X509Certificates.X509KeyUsageFlags]::DataEncipherment -bor
        [X509Certificates.X509KeyUsageFlags]::KeyEncipherment -bor
        [X509Certificates.X509KeyUsageFlags]::DigitalSignature
    )

    $req.CertificateExtensions.Add(
        [X509Certificates.X509KeyUsageExtension]::new(
            $flags,
            $false
        )
    ) | Out-Null

    $oid = [OidCollection]::new()
    $oid.Add([Oid]::new('1.3.6.1.5.5.7.3.1')) | Out-Null

    $req.CertificateExtensions.Add(
        [X509Certificates.X509EnhancedKeyUsageExtension]::new(
            $oid,
            $false
        )
    )

    $req.CertificateExtensions.Add($sanBuilder.Build()) | Out-Null

    $cert = $req.CreateSelfSigned(
        [System.DateTimeOffset]::UtcNow.AddDays(-1),
        [System.DateTimeOffset]::UtcNow.AddYears(10)
    )

    if (Test-IsWindows) {
        $cert.FriendlyName = 'localhost'
    }

    $cert = [X509Certificates.X509Certificate2]::new(
        $cert.Export([X509Certificates.X509ContentType]::Pfx, 'self-signed'),
        'self-signed'
    )

    return $cert
}

1	using namespace System.Security.Cryptography
2
3	function Test-PodeIPLimit
4	{
5	param (
6	[Parameter(Mandatory=$true)]
7	[ValidateNotNull()]
8	$IP
9	)
10
11	$type = 'IP'	×
12
13	# get the limit rules and active list
14	$rules = $PodeContext.Server.Limits.Rules[$type]	×
15	$active = $PodeContext.Server.Limits.Active[$type]	×
16
17	# if there are no rules, it's valid
18	if (($null -eq $rules) -or ($rules.Count -eq 0)) {	×
19	return $true	×
20	}
21
22	# get the ip address in bytes
23	$IP = @{	×
24	String = $IP.IPAddressToString	×
25	Family = $IP.AddressFamily	×
26	Bytes = $IP.GetAddressBytes()	×
27	}
28
29	# now
30	$now = [DateTime]::UtcNow	×
31
32	# is the ip active? (get a direct match, then try grouped subnets)
33	$_active_ip = $active[$IP.String]	×
34	if ($null -eq $_active_ip) {	×
35	$_groups = @(foreach ($key in $active.Keys) {	×
36	if ($active[$key].Rule.Grouped) {	×
37	$active[$key]	×
38	}
39	})
40
41	$_active_ip = @(foreach ($_group in $_groups) {	×
42	if (Test-PodeIPAddressInRange -IP $IP -LowerIP $_group.Rule.Lower -UpperIP $_group.Rule.Upper) {	×
43	$_group	×
44	break
45	}
46	})[0]
47	}
48
49	# the ip is active, or part of a grouped subnet
50	if ($null -ne $_active_ip) {	×
51	# if limit is -1, always allowed
52	if ($_active_ip.Rule.Limit -eq -1) {	×
53	return $true	×
54	}
55
56	# check expire time, a reset if needed
57	if ($now -ge $_active_ip.Expire) {	×
58	$_active_ip.Rate = 0	×
59	$_active_ip.Expire = $now.AddSeconds($_active_ip.Rule.Seconds)	×
60	}
61
62	# are we over the limit?
63	if ($_active_ip.Rate -ge $_active_ip.Rule.Limit) {	×
64	return $false	×
65	}
66
67	# increment the rate
68	$_active_ip.Rate++	×
69	return $true	×
70	}
71
72	# the ip isn't active
73	else {
74	# get the ip's rule
75	$_rule_ip = @(foreach ($rule in $rules.Values) {	×
76	if (Test-PodeIPAddressInRange -IP $IP -LowerIP $rule.Lower -UpperIP $rule.Upper) {	×
77	$rule	×
78	break
79	}
80	})[0]
81
82	# if ip not in rules, it's valid
83	# (add to active list as always allowed - saves running where search everytime)
84	if ($null -eq $_rule_ip) {	×
85	$active.Add($IP.String, @{	×
86	Rule = @{	×
87	Limit = -1	×
88	}
89	})
90
91	return $true	×
92	}
93
94	# add ip to active list (ip if not grouped, else the subnet if it's grouped)
95	$_ip = (Resolve-PodeValue -Check $_rule_ip.Grouped -TrueValue $_rule_ip.IP -FalseValue $IP.String)	×
96
97	$active.Add($_ip, @{	×
98	Rule = $_rule_ip	×
99	Rate = 1	×
100	Expire = $now.AddSeconds($_rule_ip.Seconds)	×
101	})
102
103	# if limit is 0, it's never allowed
104	return ($_rule_ip -ne 0)	×
105	}
106	}
107
108	function Test-PodeIPAccess
109	{
110	param (
111	[Parameter(Mandatory=$true)]
112	[ValidateNotNull()]
113	$IP
114	)
115
116	$type = 'IP'	×
117
118	# get permission lists for ip
119	$allow = $PodeContext.Server.Access.Allow[$type]	×
120	$deny = $PodeContext.Server.Access.Deny[$type]	×
121
122	# are they empty?
123	$alEmpty = (($null -eq $allow) -or ($allow.Count -eq 0))	×
124	$dnEmpty = (($null -eq $deny) -or ($deny.Count -eq 0))	×
125
126	# if both are empty, value is valid
127	if ($alEmpty -and $dnEmpty) {	×
128	return $true	×
129	}
130
131	# get the ip address in bytes
132	$IP = @{	×
133	Family = $IP.AddressFamily	×
134	Bytes = $IP.GetAddressBytes()	×
135	}
136
137	# if value in allow, it's allowed
138	if (!$alEmpty) {	×
139	$match = @(foreach ($value in $allow.Values) {	×
140	if (Test-PodeIPAddressInRange -IP $IP -LowerIP $value.Lower -UpperIP $value.Upper) {	×
141	$value	×
142	break
143	}
144	})[0]
145
146	if ($null -ne $match) {	×
147	return $true	×
148	}
149	}
150
151	# if value in deny, it's disallowed
152	if (!$dnEmpty) {	×
153	$match = @(foreach ($value in $deny.Values) {	×
154	if (Test-PodeIPAddressInRange -IP $IP -LowerIP $value.Lower -UpperIP $value.Upper) {	×
155	$value	×
156	break
157	}
158	})[0]
159
160	if ($null -ne $match) {	×
161	return $false	×
162	}
163	}
164
165	# if we have an allow, it's disallowed (because it's not in there)
166	if (!$alEmpty) {	×
167	return $false	×
168	}
169
170	# otherwise it's allowed (because it's not in the deny)
171	return $true	×
172	}
173
174	function Add-PodeIPLimit
175	{
176	param (
177	[Parameter(Mandatory=$true)]
178	[ValidateNotNull()]
179	[string]
180	$IP,
181
182	[Parameter(Mandatory=$true)]
183	[int]
184	$Limit,
185
186	[Parameter(Mandatory=$true)]
187	[int]
188	$Seconds,
189
190	[switch]
191	$Group
192	)
193
194	# current limit type
195	$type = 'IP'	2✔
196
197	# ensure limit and seconds are non-zero and negative
198	if ($Limit -le 0) {	2✔
199	throw "Limit value cannot be 0 or less for $($IP)"	4✔
200	}
201
202	if ($Seconds -le 0) {	2✔
203	throw "Seconds value cannot be 0 or less for $($IP)"	4✔
204	}
205
206	# get current rules
207	$rules = $PodeContext.Server.Limits.Rules[$type]	2✔
208
209	# setup up perm type
210	if ($null -eq $rules) {	2✔
211	$PodeContext.Server.Limits.Rules[$type] = @{}	2✔
212	$PodeContext.Server.Limits.Active[$type] = @{}	2✔
213	$rules = $PodeContext.Server.Limits.Rules[$type]	2✔
214	}
215
216	# have we already added the ip?
217	elseif ($rules.ContainsKey($IP)) {	×
218	return
219	}
220
221	# calculate the lower/upper ip bounds
222	if (Test-PodeIPAddressIsSubnetMask -IP $IP) {	2✔
223	$_tmp = Get-PodeSubnetRange -SubnetMask $IP	2✔
224	$_tmpLo = Get-PodeIPAddress -IP $_tmp.Lower	2✔
225	$_tmpHi = Get-PodeIPAddress -IP $_tmp.Upper	2✔
226	}
227	elseif (Test-PodeIPAddressAny -IP $IP) {	2✔
228	$_tmpLo = Get-PodeIPAddress -IP '0.0.0.0'	2✔
229	$_tmpHi = Get-PodeIPAddress -IP '255.255.255.255'	2✔
230	}
231	else {
232	$_tmpLo = Get-PodeIPAddress -IP $IP	2✔
233	$_tmpHi = $_tmpLo	2✔
234	}
235
236	# add limit rule for ip
237	$rules.Add($IP, @{	2✔
238	Limit = $Limit	2✔
239	Seconds = $Seconds	2✔
240	Grouped = [bool]$Group	2✔
241	IP = $IP	2✔
242	Lower = @{	2✔
243	Family = $_tmpLo.AddressFamily	2✔
244	Bytes = $_tmpLo.GetAddressBytes()	2✔
245	}
246	Upper = @{	2✔
247	Family = $_tmpHi.AddressFamily	2✔
248	Bytes = $_tmpHi.GetAddressBytes()	2✔
249	}
250	})
251	}
252
253	function Add-PodeIPAccess
254	{
255	param (
256	[Parameter(Mandatory=$true)]
257	[ValidateSet('Allow', 'Deny')]
258	[string]
259	$Access,
260
261	[Parameter(Mandatory=$true)]
262	[string]
263	$IP
264	)
265
266	# current access type
267	$type = 'IP'	2✔
268
269	# get opposite permission
270	$opp = "$(if ($Access -ieq 'allow') { 'Deny' } else { 'Allow' })"	8✔
271
272	# get permission lists for type
273	$permType = $PodeContext.Server.Access[$Access][$type]	2✔
274	$oppType = $PodeContext.Server.Access[$opp][$type]	2✔
275
276	# setup up perm type
277	if ($null -eq $permType) {	2✔
278	$PodeContext.Server.Access[$Access][$type] = @{}	2✔
279	$permType = $PodeContext.Server.Access[$Access][$type]	2✔
280	}
281
282	# have we already added the ip?
283	elseif ($permType.ContainsKey($IP)) {	×
284	return
285	}
286
287	# remove from opp type
288	if ($null -ne $oppType -and $oppType.ContainsKey($IP)) {	2✔
289	$oppType.Remove($IP)	2✔
290	}
291
292	# calculate the lower/upper ip bounds
293	if (Test-PodeIPAddressIsSubnetMask -IP $IP) {	2✔
294	$_tmp = Get-PodeSubnetRange -SubnetMask $IP	2✔
295	$_tmpLo = Get-PodeIPAddress -IP $_tmp.Lower	2✔
296	$_tmpHi = Get-PodeIPAddress -IP $_tmp.Upper	2✔
297	}
298	elseif (Test-PodeIPAddressAny -IP $IP) {	2✔
299	$_tmpLo = Get-PodeIPAddress -IP '0.0.0.0'	2✔
300	$_tmpHi = Get-PodeIPAddress -IP '255.255.255.255'	2✔
301	}
302	else {
303	$_tmpLo = Get-PodeIPAddress -IP $IP	2✔
304	$_tmpHi = $_tmpLo	2✔
305	}
306
307	# add access rule for ip
308	$permType.Add($IP, @{	2✔
309	Lower = @{	2✔
310	Family = $_tmpLo.AddressFamily	2✔
311	Bytes = $_tmpLo.GetAddressBytes()	2✔
312	}
313	Upper = @{	2✔
314	Family = $_tmpHi.AddressFamily	2✔
315	Bytes = $_tmpHi.GetAddressBytes()	2✔
316	}
317	})
318	}
319
320	function Get-PodeCsrfToken
321	{
322	# key name to search
323	$key = $PodeContext.Server.Cookies.Csrf.Name	2✔
324
325	# check the payload
326	if (!(Test-IsEmpty $WebEvent.Data[$key])) {	4✔
327	return $WebEvent.Data[$key]	2✔
328	}
329
330	# check the query string
331	if (!(Test-IsEmpty $WebEvent.Query[$key])) {	4✔
332	return $WebEvent.Query[$key]	2✔
333	}
334
335	# check the headers
336	$value = (Get-PodeHeader -Name $key)	4✔
337	if (!(Test-IsEmpty $value)) {	4✔
338	return $value	2✔
339	}
340
341	return $null	2✔
342	}
343
344	function Test-PodeCsrfToken
345	{
346	param (
347	[Parameter()]
348	[string]
349	$Secret,
350
351	[Parameter()]
352	[string]
353	$Token
354	)
355
356	# if there's no token/secret, fail
357	if ((Test-IsEmpty $Secret) -or (Test-IsEmpty $Token)) {	6✔
358	return $false	2✔
359	}
360
361	# the token must start with "t:"
362	if (!$Token.StartsWith('t:')) {	2✔
363	return $false	2✔
364	}
365
366	# get the salt from the token
367	$_token = $Token.Substring(2)	2✔
368	$periodIndex = $_token.LastIndexOf('.')	2✔
369	if ($periodIndex -eq -1) {	2✔
370	return $false	2✔
371	}
372
373	$salt = $_token.Substring(0, $periodIndex)	2✔
374
375	# ensure the token is valid
376	if ((Restore-PodeCsrfToken -Secret $Secret -Salt $salt) -ne $Token) {	4✔
377	return $false	2✔
378	}
379
380	return $true	2✔
381	}
382
383	function New-PodeCsrfSecret
384	{
385	# see if there's already a secret in session/cookie
386	$secret = (Get-PodeCsrfSecret)	4✔
387	if (!(Test-IsEmpty $secret)) {	4✔
388	return $secret	2✔
389	}
390
391	# otherwise, make a new secret and cache it
392	$secret = (New-PodeGuid -Secure -Length 16)	4✔
393	Set-PodeCsrfSecret -Secret $secret	2✔
394	return $secret	2✔
395	}
396
397	function Get-PodeCsrfSecret
398	{
399	# key name to get secret
400	$key = $PodeContext.Server.Cookies.Csrf.Name	2✔
401
402	# are we getting it from a cookie, or session?
403	if ($PodeContext.Server.Cookies.Csrf.UseCookies) {	2✔
404	return (Get-PodeCookie `	4✔
405	-Name $PodeContext.Server.Cookies.Csrf.Name `
406	-Secret $PodeContext.Server.Cookies.Csrf.Secret).Value
407	}
408
409	# on session
410	else {
411	return $WebEvent.Session.Data[$key]	2✔
412	}
413	}
414
415	function Set-PodeCsrfSecret
416	{
417	param (
418	[Parameter(Mandatory=$true)]
419	[string]
420	$Secret
421	)
422
423	# key name to set secret under
424	$key = $PodeContext.Server.Cookies.Csrf.Name	2✔
425
426	# are we setting this on a cookie, or session?
427	if ($PodeContext.Server.Cookies.Csrf.UseCookies) {	2✔
428	(Set-PodeCookie `	4✔
429	-Name $PodeContext.Server.Cookies.Csrf.Name `
430	-Value $Secret `
431	-Secret $PodeContext.Server.Cookies.Csrf.Secret) \| Out-Null	2✔
432	}
433
434	# on session
435	else {
436	$WebEvent.Session.Data[$key] = $Secret	2✔
437	}
438	}
439
440	function Restore-PodeCsrfToken
441	{
442	param (
443	[Parameter(Mandatory=$true)]
444	[string]
445	$Secret,
446
447	[Parameter(Mandatory=$true)]
448	[string]
449	$Salt
450	)
451
452	return "t:$($Salt).$(Invoke-PodeSHA256Hash -Value "$($Salt)-$($Secret)")"	10✔
453	}
454
455	function Test-PodeCsrfConfigured
456	{
457	return (!(Test-IsEmpty $PodeContext.Server.Cookies.Csrf))	6✔
458	}
459
460	function Get-PodeCertificateByFile
461	{
462	param(
463	[Parameter(Mandatory=$true)]
464	[string]
465	$Certificate,
466
467	[Parameter()]
468	[string]
469	$Password = $null
470	)
471
472	$path = Get-PodeRelativePath -Path $Certificate -JoinRoot -Resolve	×
473	$cert = $null	×
474
475	if ([string]::IsNullOrWhiteSpace($Password)) {	×
476	$cert = [X509Certificates.X509Certificate2]::new($path)	×
477	}
478	else {
479	$cert = [X509Certificates.X509Certificate2]::new($path, $Password)	×
480	}
481
482	return $cert	×
483	}
484
485	function Find-PodeCertificateInCertStore
486	{
487	param(
488	[Parameter(Mandatory=$true)]
489	[X509Certificates.X509FindType]
490	$FindType,
491
492	[Parameter(Mandatory=$true)]
493	[string]
494	$Query
495	)
496
497	# fail if not windows
498	if (!(Test-IsWindows)) {	×
499	throw "Certificate Thumbprints/Name are only supported on Windows"	×
500	}
501
502	# open the currentuser\my store
503	$x509store = [X509Certificates.X509Store]::new(	×
504	[X509Certificates.StoreName]::My,
505	[X509Certificates.StoreLocation]::CurrentUser
506	)
507
508	try {
509	# attempt to find the cert
510	$x509store.Open([X509Certificates.OpenFlags]::ReadOnly)	×
511	$x509certs = $x509store.Certificates.Find($FindType, $Query, $false)	×
512	}
513	finally {
514	# close the store!
515	if ($null -ne $x509store) {	×
516	Close-PodeDisposable -Disposable $x509store -Close	×
517	}
518	}
519
520	# fail if no cert found for query
521	if (($null -eq $x509certs) -or ($x509certs.Count -eq 0)) {	×
522	throw "No certificate could be found in CurrentUser\My for '$($Thumbprint)'"	×
523	}
524
525	return ([X509Certificates.X509Certificate2]($x509certs[0]))	×
526	}
527
528	function Get-PodeCertificateByThumbprint
529	{
530	param(
531	[Parameter(Mandatory=$true)]
532	[string]
533	$Thumbprint
534	)
535
536	return (Find-PodeCertificateInCertStore -FindType [X509FindType]::FindByThumbprint -Query $Thumbprint)	×
537	}
538
539	function Get-PodeCertificateByName
540	{
541	param(
542	[Parameter(Mandatory=$true)]
543	[string]
544	$Name
545	)
546
547	return (Find-PodeCertificateInCertStore -FindType [X509FindType]::FindBySubjectName -Query $Name)	×
548	}
549
550	function New-PodeSelfSignedCertificate
551	{
552	$sanBuilder = [X509Certificates.SubjectAlternativeNameBuilder]::new()	×
553	$sanBuilder.AddIpAddress([ipaddress]::Loopback) \| Out-Null	×
554	$sanBuilder.AddIpAddress([ipaddress]::IPv6Loopback) \| Out-Null	×
555	$sanBuilder.AddDnsName('localhost') \| Out-Null	×
556
557	if (![string]::IsNullOrWhiteSpace($env:COMPUTERNAME)) {	×
558	$sanBuilder.AddDnsName($env:COMPUTERNAME) \| Out-Null	×
559	}
560
561	$rsa = [RSA]::Create(2048)	×
562	$distinguishedName = [X500DistinguishedName]::new("CN=localhost")	×
563
564	$req = [X509Certificates.CertificateRequest]::new(	×
565	$distinguishedName,
566	$rsa,
567	[HashAlgorithmName]::SHA256,
568	[RSASignaturePadding]::Pkcs1
569	)
570
571	$flags = (	×
572	[X509Certificates.X509KeyUsageFlags]::DataEncipherment -bor	×
573	[X509Certificates.X509KeyUsageFlags]::KeyEncipherment -bor
574	[X509Certificates.X509KeyUsageFlags]::DigitalSignature
575	)
576
577	$req.CertificateExtensions.Add(	×
578	[X509Certificates.X509KeyUsageExtension]::new(
579	$flags,
580	$false
581	)
582	) \| Out-Null	×
583
584	$oid = [OidCollection]::new()	×
585	$oid.Add([Oid]::new('1.3.6.1.5.5.7.3.1')) \| Out-Null	×
586
587	$req.CertificateExtensions.Add(	×
588	[X509Certificates.X509EnhancedKeyUsageExtension]::new(
589	$oid,
590	$false
591	)
592	)
593
594	$req.CertificateExtensions.Add($sanBuilder.Build()) \| Out-Null	×
595
596	$cert = $req.CreateSelfSigned(	×
597	[System.DateTimeOffset]::UtcNow.AddDays(-1),
598	[System.DateTimeOffset]::UtcNow.AddYears(10)
599	)
600
601	if (Test-IsWindows) {	×
602	$cert.FriendlyName = 'localhost'	×
603	}
604
605	$cert = [X509Certificates.X509Certificate2]::new(	×
606	$cert.Export([X509Certificates.X509ContentType]::Pfx, 'self-signed'),
607	'self-signed'
608	)
609
610	return $cert	×
611	}

Badgerati / Pode / #662

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous