Added tests that ensure redirects to unix socket paths from a regular HTTP server are disallowed.

Motivation:

Currently, redirects to any supported URL scheme will always be allowed, despite code being in place to seemingly prevent it. See swift-server#230.

Modifications:

- Added a method to HTTPBin to redirect to the specified target.
- Added failing tests that perform redirects from a regular server to a socket-based server and vice versa.

Result:

Failing tests that show that the existing redirect checks were inadequate.

Author: dimitribouniol

Tests/AsyncHTTPClientTests/HTTPClientTestUtils.swift

@@ -490,6 +490,12 @@ internal final class HttpBinHandler: ChannelInboundHandler {
                 headers.add(name: "Location", value: "/redirect/infinite1")
                 self.resps.append(HTTPResponseBuilder(status: .found, headers: headers))
                 return
+            case "/redirect/target":
+                var headers = self.responseHeaders
+                let targetURL = req.headers["X-Target-Redirect-URL"].first ?? ""
+                headers.add(name: "Location", value: targetURL)
+                self.resps.append(HTTPResponseBuilder(status: .found, headers: headers))
+                return
             case "/percent%20encoded":
                 if req.method != .GET {
                     self.resps.append(HTTPResponseBuilder(status: .methodNotAllowed))

Tests/AsyncHTTPClientTests/HTTPClientTests.swift

@@ -198,6 +198,95 @@ class HTTPClientTests: XCTestCase {
 
         response = try localClient.get(url: self.defaultHTTPBinURLPrefix + "redirect/https?port=\(httpsBin.port)").wait()
         XCTAssertEqual(response.status, .ok)
+
+        XCTAssertNoThrow(try TemporaryFileHelpers.withTemporaryUnixDomainSocketPathName { httpSocketPath in
+            XCTAssertNoThrow(try TemporaryFileHelpers.withTemporaryUnixDomainSocketPathName { httpsSocketPath in
+                let socketHTTPBin = HTTPBin(bindTarget: .unixDomainSocket(httpSocketPath))
+                let socketHTTPSBin = HTTPBin(ssl: true, bindTarget: .unixDomainSocket(httpsSocketPath))
+                defer {
+                    XCTAssertNoThrow(try socketHTTPBin.shutdown())
+                    XCTAssertNoThrow(try socketHTTPSBin.shutdown())
+                }
+
+                // From HTTP or HTTPS to HTTP+UNIX should fail to redirect
+                var targetURL = "http+unix://\(httpSocketPath.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed)!)/ok"
+                var request = try Request(url: self.defaultHTTPBinURLPrefix + "redirect/target", method: .GET, headers: ["X-Target-Redirect-URL": targetURL], body: nil)
+
+                var response = try localClient.execute(request: request).wait()
+                XCTAssertEqual(response.status, .found)
+                XCTAssertEqual(response.headers.first(name: "Location"), targetURL)
+
+                request = try Request(url: "https://localhost:\(httpsBin.port)/redirect/target", method: .GET, headers: ["X-Target-Redirect-URL": targetURL], body: nil)
+
+                response = try localClient.execute(request: request).wait()
+                XCTAssertEqual(response.status, .found)
+                XCTAssertEqual(response.headers.first(name: "Location"), targetURL)
+
+                // From HTTP or HTTPS to HTTPS+UNIX should also fail to redirect
+                targetURL = "https+unix://\(httpsSocketPath.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed)!)/ok"
+                request = try Request(url: self.defaultHTTPBinURLPrefix + "redirect/target", method: .GET, headers: ["X-Target-Redirect-URL": targetURL], body: nil)
+
+                response = try localClient.execute(request: request).wait()
+                XCTAssertEqual(response.status, .found)
+                XCTAssertEqual(response.headers.first(name: "Location"), targetURL)
+
+                request = try Request(url: "https://localhost:\(httpsBin.port)/redirect/target", method: .GET, headers: ["X-Target-Redirect-URL": targetURL], body: nil)
+
+                response = try localClient.execute(request: request).wait()
+                XCTAssertEqual(response.status, .found)
+                XCTAssertEqual(response.headers.first(name: "Location"), targetURL)
+
+                // ... while HTTP+UNIX to HTTP, HTTPS, or HTTP(S)+UNIX should succeed
+                targetURL = self.defaultHTTPBinURLPrefix + "ok"
+                request = try Request(url: "http+unix://\(httpSocketPath.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed)!)/redirect/target", method: .GET, headers: ["X-Target-Redirect-URL": targetURL], body: nil)
+
+                response = try localClient.execute(request: request).wait()
+                XCTAssertEqual(response.status, .ok)
+
+                targetURL = "https://localhost:\(httpsBin.port)/ok"
+                request = try Request(url: "http+unix://\(httpSocketPath.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed)!)/redirect/target", method: .GET, headers: ["X-Target-Redirect-URL": targetURL], body: nil)
+
+                response = try localClient.execute(request: request).wait()
+                XCTAssertEqual(response.status, .ok)
+
+                targetURL = "http+unix://\(httpSocketPath.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed)!)/ok"
+                request = try Request(url: "http+unix://\(httpSocketPath.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed)!)/redirect/target", method: .GET, headers: ["X-Target-Redirect-URL": targetURL], body: nil)
+
+                response = try localClient.execute(request: request).wait()
+                XCTAssertEqual(response.status, .ok)
+
+                targetURL = "https+unix://\(httpsSocketPath.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed)!)/ok"
+                request = try Request(url: "http+unix://\(httpSocketPath.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed)!)/redirect/target", method: .GET, headers: ["X-Target-Redirect-URL": targetURL], body: nil)
+
+                response = try localClient.execute(request: request).wait()
+                XCTAssertEqual(response.status, .ok)
+
+                // ... and HTTPS+UNIX to HTTP, HTTPS, or HTTP(S)+UNIX should succeed
+                targetURL = self.defaultHTTPBinURLPrefix + "ok"
+                request = try Request(url: "https+unix://\(httpsSocketPath.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed)!)/redirect/target", method: .GET, headers: ["X-Target-Redirect-URL": targetURL], body: nil)
+
+                response = try localClient.execute(request: request).wait()
+                XCTAssertEqual(response.status, .ok)
+
+                targetURL = "https://localhost:\(httpsBin.port)/ok"
+                request = try Request(url: "https+unix://\(httpsSocketPath.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed)!)/redirect/target", method: .GET, headers: ["X-Target-Redirect-URL": targetURL], body: nil)
+
+                response = try localClient.execute(request: request).wait()
+                XCTAssertEqual(response.status, .ok)
+
+                targetURL = "http+unix://\(httpSocketPath.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed)!)/ok"
+                request = try Request(url: "https+unix://\(httpsSocketPath.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed)!)/redirect/target", method: .GET, headers: ["X-Target-Redirect-URL": targetURL], body: nil)
+
+                response = try localClient.execute(request: request).wait()
+                XCTAssertEqual(response.status, .ok)
+
+                targetURL = "https+unix://\(httpsSocketPath.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed)!)/ok"
+                request = try Request(url: "https+unix://\(httpsSocketPath.addingPercentEncoding(withAllowedCharacters: .urlHostAllowed)!)/redirect/target", method: .GET, headers: ["X-Target-Redirect-URL": targetURL], body: nil)
+
+                response = try localClient.execute(request: request).wait()
+                XCTAssertEqual(response.status, .ok)
+            })
+        })
     }
 
     func testHttpHostRedirect() {