✨ Add solved-captcha as option of remediationCustomHeader (#310)

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>

.github/workflows/main.yml

@@ -1,5 +1,8 @@
 name: Main
 
+permissions:
+  contents: read
+
 on:
   push:
     branches:

README.md

@@ -420,7 +420,7 @@ make run
 - RemediationHeadersCustomName
   - string
   - default: ""
-  - Name of the header you want in response when request are cancelled (possible value of the header `ban` or `captcha`)
+  - Name of the header you want in response when request are handled by plugin (possible value of the header `ban`, `captcha` or `solved-captcha`)
 - ForwardedHeadersCustomName
   - string
   - default: "X-Forwarded-For"

pkg/captcha/captcha.go

@@ -94,6 +94,9 @@ func (c *Client) ServeHTTP(rw http.ResponseWriter, r *http.Request, remoteIP str
 	if valid {
 		c.log.Debug("captcha:ServeHTTP captcha:valid")
 		c.cacheClient.Set(remoteIP+"_captcha", cache.CaptchaDoneValue, c.gracePeriodSeconds)
+		if c.remediationCustomHeader != "" {
+			rw.Header().Set(c.remediationCustomHeader, "solved-captcha")
+		}
 		http.Redirect(rw, r, r.URL.String(), http.StatusFound)
 		return
 	}

pkg/configuration/configuration.go

@@ -277,6 +277,10 @@ func ValidateParams(config *Config) error {
 	if err != nil {
 		return err
 	}
+	appsecKey, err := GetVariable(config, "CrowdsecAppsecKey")
+	if err != nil {
+		return err
+	}
 	certBouncer, err := GetVariable(config, "CrowdsecLapiTLSCertificateBouncer")
 	if err != nil {
 		return err
@@ -285,12 +289,21 @@ func ValidateParams(config *Config) error {
 	if err != nil {
 		return err
 	}
+
 	// We need to either have crowdsecLapiKey defined or the BouncerCert and Bouncerkey
-	if lapiKey == "" && (certBouncer == "" || certBouncerKey == "") {
+	if lapiKey == "" && (certBouncer == "" || certBouncerKey == "") && config.CrowdsecMode != AppsecMode {
 		return errors.New("CrowdsecLapiKey || (CrowdsecLapiTLSCertificateBouncer && CrowdsecLapiTLSCertificateBouncerKey): cannot be all empty")
 	} else if lapiKey != "" && (certBouncer == "" || certBouncerKey == "") {
 		lapiKey = strings.TrimSpace(lapiKey)
-		if err = validateParamsAPIKey(lapiKey); err != nil {
+		if err = validateParamsAPIKey(lapiKey, "CrowdsecLapiKey"); err != nil {
+			return err
+		}
+	}
+
+	// Validate CrowdsecAppsecKey if provided
+	if appsecKey != "" {
+		appsecKey = strings.TrimSpace(appsecKey)
+		if err = validateParamsAPIKey(appsecKey, "CrowdsecAppsecKey"); err != nil {
 			return err
 		}
 	}
@@ -329,10 +342,10 @@ func validateURL(variable, scheme, host, path string) error {
 // field name. RFC 7230 says:
 // valid ! # $ % & ' * + - . ^ _ ` | ~ DIGIT ALPHA
 // See https://httpwg.github.io/specs/rfc7230.html#rule.token.separators
-func validateParamsAPIKey(lapiKey string) error {
+func validateParamsAPIKey(key string, paramName string) error {
 	reg := regexp.MustCompile("^[a-zA-Z0-9 !#$%&'*+-.^_`|~=/]*$")
-	if !reg.MatchString(lapiKey) {
-		return fmt.Errorf("CrowdsecLapiKey doesn't valid this regexp: '/%s/'", reg.String())
+	if !reg.MatchString(key) {
+		return fmt.Errorf("%s doesn't validate this regexp: '/%s/'", paramName, reg.String())
 	}
 	return nil
 }

pkg/configuration/configuration_test.go

@@ -206,22 +206,23 @@ func Test_validateParamsRequired(t *testing.T) {
 func Test_validateParamsAPIKey(t *testing.T) {
 	type args struct {
 		lapiKey   string
+		paramName string
 	}
 	tests := []struct {
 		name    string
 		args    args
 		wantErr bool
 	}{
-		{name: "Validate all the valid characters", args: args{lapiKey: "test!#$%&'*+-.^_`|~"}, wantErr: false},
-		{name: "Not validate a @", args: args{lapiKey: "test@"}, wantErr: true},
-		{name: "Not validate a (", args: args{lapiKey: "test("}, wantErr: true},
-		{name: "Not validate a [", args: args{lapiKey: "test["}, wantErr: true},
-		{name: "Not validate a ?", args: args{lapiKey: "test?"}, wantErr: true},
-		{name: "Not validate a \\n, (must be trimed before)", args: args{lapiKey: "test\n"}, wantErr: true},
+		{name: "Validate all the valid characters", args: args{lapiKey: "test!#$%&'*+-.^_`|~", paramName: "CrowdsecParamName"}, wantErr: false},
+		{name: "Not validate a @", args: args{lapiKey: "test@", paramName: "CrowdsecParamName"}, wantErr: true},
+		{name: "Not validate a (", args: args{lapiKey: "test(", paramName: "CrowdsecParamName"}, wantErr: true},
+		{name: "Not validate a [", args: args{lapiKey: "test[", paramName: "CrowdsecParamName"}, wantErr: true},
+		{name: "Not validate a ?", args: args{lapiKey: "test?", paramName: "CrowdsecParamName"}, wantErr: true},
+		{name: "Not validate a \\n, (must be trimed before)", args: args{lapiKey: "test\n", paramName: "CrowdsecParamName"}, wantErr: true},
 	}
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			if err := validateParamsAPIKey(tt.args.lapiKey); (err != nil) != tt.wantErr {
+			if err := validateParamsAPIKey(tt.args.lapiKey, tt.args.paramName); (err != nil) != tt.wantErr {
 				t.Errorf("validateParamsAPIKey() error = %v, wantErr %v", err, tt.wantErr)
 			}
 		})