fix(security): enforce HTTPS for HTTP hook URLs

Add TLS requirement for HTTP hook destinations: - Warn when plain http:// URLs are used - Reject remote http:// in production mode - Allow http://localhost and http://127.0.0.1 for dev Prevents secret exfiltration over unencrypted channels.
2026-04-02 15:01:15 +09:00
parent a637cca702
commit 5a2814980e
2 changed files with 204 additions and 1 deletions
@@ -0,0 +1,179 @@
+import { describe, it, expect, mock, beforeEach, afterEach } from "bun:test"
+import type { HookHttp } from "./types"
+
+const mockFetch = mock(() =>
+  Promise.resolve(new Response(JSON.stringify({}), { status: 200 }))
+)
+const mockLog = mock(() => {})
+
+const originalFetch = globalThis.fetch
+const originalEnv = process.env
+
+async function importFreshExecuteHttpHook() {
+  const modulePath = `${new URL("./execute-http-hook.ts", import.meta.url).pathname}?t=${Date.now()}-${Math.random()}`
+  return import(modulePath)
+}
+
+describe("executeHttpHook TLS security", () => {
+  beforeEach(() => {
+    globalThis.fetch = mockFetch as unknown as typeof fetch
+    mockFetch.mockReset()
+    mockFetch.mockImplementation(() =>
+      Promise.resolve(new Response(JSON.stringify({}), { status: 200 }))
+    )
+  })
+
+  afterEach(() => {
+    globalThis.fetch = originalFetch
+    process.env = originalEnv
+    mock.restore()
+  })
+
+  describe("#given production mode", () => {
+    beforeEach(() => {
+      process.env = { ...originalEnv, NODE_ENV: "production" }
+    })
+
+    it("#when hook uses remote http:// URL #then rejects with exit code 1", async () => {
+      const { executeHttpHook } = await import("./execute-http-hook")
+      const hook: HookHttp = { type: "http", url: "http://example.com/hooks" }
+
+      const result = await executeHttpHook(hook, "{}")
+
+      expect(result.exitCode).toBe(1)
+      expect(result.stderr).toContain("HTTP hook URL must use HTTPS in production")
+      expect(mockFetch).not.toHaveBeenCalled()
+    })
+
+    it("#when hook uses remote HTTP:// URL #then rejects with exit code 1", async () => {
+      const { executeHttpHook } = await import("./execute-http-hook")
+      const hook: HookHttp = { type: "http", url: "HTTP://example.com/hooks" }
+
+      const result = await executeHttpHook(hook, "{}")
+
+      expect(result.exitCode).toBe(1)
+      expect(result.stderr).toContain("HTTP hook URL must use HTTPS in production")
+      expect(mockFetch).not.toHaveBeenCalled()
+    })
+
+    it("#when hook uses remote http:// URL #then logs warning before rejection", async () => {
+      mock.module("../../shared", () => ({
+        log: mockLog,
+      }))
+      const { executeHttpHook } = await importFreshExecuteHttpHook()
+      const hook: HookHttp = { type: "http", url: "http://example.com/hooks" }
+
+      const result = await executeHttpHook(hook, "{}")
+
+      expect(result.exitCode).toBe(1)
+      expect(mockLog).toHaveBeenCalledWith("HTTP hook URL uses insecure protocol", {
+        url: "http://example.com/hooks",
+      })
+      expect(mockFetch).not.toHaveBeenCalled()
+    })
+
+    it("#when hook uses http://localhost #then allows execution", async () => {
+      const { executeHttpHook } = await import("./execute-http-hook")
+      const hook: HookHttp = { type: "http", url: "http://localhost:8080/hooks" }
+
+      const result = await executeHttpHook(hook, "{}")
+
+      expect(result.exitCode).toBe(0)
+      expect(mockFetch).toHaveBeenCalledTimes(1)
+    })
+
+    it("#when hook uses http://127.0.0.1 #then allows execution", async () => {
+      const { executeHttpHook } = await import("./execute-http-hook")
+      const hook: HookHttp = { type: "http", url: "http://127.0.0.1:8080/hooks" }
+
+      const result = await executeHttpHook(hook, "{}")
+
+      expect(result.exitCode).toBe(0)
+      expect(mockFetch).toHaveBeenCalledTimes(1)
+    })
+
+    it("#when hook uses https:// #then allows execution", async () => {
+      const { executeHttpHook } = await import("./execute-http-hook")
+      const hook: HookHttp = { type: "http", url: "https://example.com/hooks" }
+
+      const result = await executeHttpHook(hook, "{}")
+
+      expect(result.exitCode).toBe(0)
+      expect(mockFetch).toHaveBeenCalledTimes(1)
+    })
+  })
+
+  describe("#given non-production mode", () => {
+    beforeEach(() => {
+      process.env = { ...originalEnv, NODE_ENV: "development" }
+    })
+
+    it("#when hook uses remote http:// URL #then allows execution", async () => {
+      const { executeHttpHook } = await import("./execute-http-hook")
+      const hook: HookHttp = { type: "http", url: "http://example.com/hooks" }
+
+      const result = await executeHttpHook(hook, "{}")
+
+      expect(result.exitCode).toBe(0)
+      expect(mockFetch).toHaveBeenCalledTimes(1)
+    })
+
+    it("#when hook uses http://localhost #then allows execution", async () => {
+      const { executeHttpHook } = await import("./execute-http-hook")
+      const hook: HookHttp = { type: "http", url: "http://localhost:8080/hooks" }
+
+      const result = await executeHttpHook(hook, "{}")
+
+      expect(result.exitCode).toBe(0)
+      expect(mockFetch).toHaveBeenCalledTimes(1)
+    })
+
+    it("#when hook uses https:// #then allows execution", async () => {
+      const { executeHttpHook } = await import("./execute-http-hook")
+      const hook: HookHttp = { type: "http", url: "https://example.com/hooks" }
+
+      const result = await executeHttpHook(hook, "{}")
+
+      expect(result.exitCode).toBe(0)
+      expect(mockFetch).toHaveBeenCalledTimes(1)
+    })
+
+    it("#when hook uses plain http:// URL #then writes warning log", async () => {
+      mock.module("../../shared", () => ({
+        log: mockLog,
+      }))
+      const { executeHttpHook } = await importFreshExecuteHttpHook()
+      const hook: HookHttp = { type: "http", url: "http://example.com/hooks" }
+
+      await executeHttpHook(hook, "{}")
+
+      expect(mockLog).toHaveBeenCalledWith("HTTP hook URL uses insecure protocol", {
+        url: "http://example.com/hooks",
+      })
+    })
+  })
+
+  describe("#given invalid URL handling is preserved", () => {
+    it("#when URL is invalid #then rejects with exit code 1", async () => {
+      process.env = { ...originalEnv, NODE_ENV: "production" }
+      const { executeHttpHook } = await import("./execute-http-hook")
+      const hook: HookHttp = { type: "http", url: "not-a-valid-url" }
+
+      const result = await executeHttpHook(hook, "{}")
+
+      expect(result.exitCode).toBe(1)
+      expect(result.stderr).toContain("HTTP hook URL is invalid")
+    })
+
+    it("#when URL uses disallowed scheme #then rejects with exit code 1", async () => {
+      process.env = { ...originalEnv, NODE_ENV: "production" }
+      const { executeHttpHook } = await import("./execute-http-hook")
+      const hook: HookHttp = { type: "http", url: "file:///etc/passwd" }
+
+      const result = await executeHttpHook(hook, "{}")
+
+      expect(result.exitCode).toBe(1)
+      expect(result.stderr).toContain('HTTP hook URL scheme "file:" is not allowed')
+    })
+  })
+})