mirror of
https://github.com/maxlerebourg/crowdsec-bouncer-traefik-plugin.git
synced 2026-07-21 19:48:59 +02:00
mhxandClaude Opus 4.8
8497f7de75
Address review feedback on the binary e2e suite: - mocklapi: add an AppSec WAF stand-in (--appsec-addr) that blocks any URI containing "rpc2" — the exact probe from examples/appsec-enabled — and allows the rest. Lets the suite exercise the plugin's AppSec wiring (header forwarding + allow/block enforcement) without the real CRS engine. - new scenarios/appsec: benign request passes, /foo/rpc2 is 403. - custom-ban-page: assert the banned response carries the custom remediation header (remediationHeadersCustomName), per review. - README: drop the "don't open issues / AppSec intentionally absent" framing; describe what the suite actually covers, including AppSec wiring. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
24 lines
911 B
Bash
Executable File
24 lines
911 B
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
HERE="$(cd "$(dirname "$0")" && pwd)"
|
|
# shellcheck source=../../lib/common.sh
|
|
source "$HERE/../../lib/common.sh"
|
|
|
|
SCENARIO=appsec
|
|
|
|
# AppSec wiring check: the plugin forwards each request to the AppSec engine and
|
|
# enforces its verdict. The mock emulates one virtual-patching rule (block any
|
|
# URI containing "rpc2"), mirroring examples/appsec-enabled. This proves the
|
|
# plugin's AppSec path end to end (header forwarding + allow/block handling); it
|
|
# does not test the real WAF's detection accuracy.
|
|
body() {
|
|
echo "[$SCENARIO] benign request must pass (AppSec allows)"
|
|
assert_status "http://127.0.0.1:${WEB_PORT}/foo" 200 -H "X-Forwarded-For: 1.2.3.4"
|
|
|
|
echo "[$SCENARIO] request whose URI contains 'rpc2' must be blocked (AppSec 403)"
|
|
assert_status "http://127.0.0.1:${WEB_PORT}/foo/rpc2" 403 -H "X-Forwarded-For: 1.2.3.4"
|
|
}
|
|
|
|
run_scenario "$SCENARIO" "$HERE" body
|