Skip to content

Commit 1dd30c1

Browse files
eilanderteilandert
committed
Added workflow integrations/lint and regressiontests for all PL1 rules
1 parent ad1ef59 commit 1dd30c1

File tree

11 files changed

+466
-0
lines changed

11 files changed

+466
-0
lines changed

‎.github/workflows/integration.yml

+7
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
---
2+
on: [push, pull_request] # yamllint disable-line rule:truthy
3+
name: Integration tests
4+
5+
jobs:
6+
integration-tests:
7+
uses: coreruleset/crs-plugin-test-action/.github/workflows/integration.yaml@main

‎.github/workflows/lint.yml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
on: [push, pull_request] # yamllint disable-line rule:truthy
3+
4+
jobs:
5+
plugin-lint:
6+
uses: coreruleset/crs-plugin-test-action/.github/workflows/lint.yaml@main

‎tests/regression/wordpress-hardening-plugin/9522102.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
meta:
3+
author: Thijs Eilander
4+
description: wordpress-hardening-plugin
5+
enabled: true
6+
name: 9522102.yaml
7+
tests:
8+
- test_title: 9522102
9+
desc: Test if xmlrpc.php is blocked
10+
stages:
11+
- stage:
12+
input:
13+
dest_addr: 127.0.0.1
14+
headers:
15+
Host: localhost
16+
User-Agent: OWASP CRS
17+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
18+
port: 80
19+
method: GET
20+
uri: /xmlrpc.php
21+
data: |
22+
text
23+
output:
24+
log_contains: id "9522102"

‎tests/regression/wordpress-hardening-plugin/9522104.yaml

+109
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,109 @@
1+
---
2+
meta:
3+
author: Thijs Eilander
4+
description: wordpress-hardening-plugin
5+
enabled: true
6+
name: 9522104.yaml
7+
tests:
8+
- test_title: 9522104-1
9+
desc: Test if user enumeration is blocked
10+
stages:
11+
- stage:
12+
input:
13+
dest_addr: 127.0.0.1
14+
headers:
15+
Host: localhost
16+
User-Agent: OWASP CRS
17+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
18+
port: 80
19+
method: GET
20+
uri: /author=1
21+
data: |
22+
text
23+
output:
24+
log_contains: id "9522104"
25+
- test_title: 9522104-2
26+
desc: Test if user enumeration is blocked
27+
stages:
28+
- stage:
29+
input:
30+
dest_addr: 127.0.0.1
31+
headers:
32+
Host: localhost
33+
User-Agent: OWASP CRS
34+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
35+
port: 80
36+
method: GET
37+
uri: /AUTHOR=99999999999999999999999
38+
data: |
39+
text
40+
output:
41+
log_contains: id "9522104"
42+
- test_title: 9522104-3
43+
desc: Test if user enumeration is blocked
44+
stages:
45+
- stage:
46+
input:
47+
dest_addr: 127.0.0.1
48+
headers:
49+
Host: localhost
50+
User-Agent: OWASP CRS
51+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
52+
port: 80
53+
method: GET
54+
uri: /wp-json/wp/v2/users
55+
data: |
56+
text
57+
output:
58+
log_contains: id "9522104"
59+
- test_title: 9522104-4
60+
desc: Test if user enumeration is blocked
61+
stages:
62+
- stage:
63+
input:
64+
dest_addr: 127.0.0.1
65+
headers:
66+
Host: localhost
67+
User-Agent: OWASP CRS
68+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
69+
port: 80
70+
method: GET
71+
uri: /wp-json/wp/v2/USERS=99999999999999999999999
72+
data: |
73+
text
74+
output:
75+
log_contains: id "9522104"
76+
- test_title: 9522104-5
77+
desc: Test if user enumeration is blocked
78+
stages:
79+
- stage:
80+
input:
81+
dest_addr: 127.0.0.1
82+
headers:
83+
Host: localhost
84+
User-Agent: OWASP CRS
85+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
86+
port: 80
87+
method: GET
88+
uri: /wp-json/wp/v2/users?search=test
89+
data: |
90+
text
91+
output:
92+
log_contains: id "9522104"
93+
- test_title: 9522104-6
94+
desc: Test if user enumeration is blocked
95+
stages:
96+
- stage:
97+
input:
98+
dest_addr: 127.0.0.1
99+
headers:
100+
Host: localhost
101+
User-Agent: OWASP CRS
102+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
103+
port: 80
104+
method: GET
105+
uri: /section/news?rest_route=/wp/v2/users
106+
data: |
107+
text
108+
output:
109+
log_contains: id "9522104"

‎tests/regression/wordpress-hardening-plugin/9522107.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
meta:
3+
author: Thijs Eilander
4+
description: wordpress-hardening-plugin
5+
enabled: true
6+
name: 9522107.yaml
7+
tests:
8+
- test_title: 9522107
9+
desc: Test if restapi works
10+
stages:
11+
- stage:
12+
input:
13+
dest_addr: 127.0.0.1
14+
headers:
15+
Host: localhost
16+
User-Agent: OWASP CRS
17+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
18+
port: 80
19+
method: GET
20+
uri: /wp-json/wp-statistics/v2/hit?wp_statistics_hit_rest=yes&track_all=1&current_page_type=home&current_page_id=445&search_query&page_uri=Lw=&referred=&_=1707944400020
21+
data: |
22+
text
23+
output:
24+
no_log_contains: id "9522107"

‎tests/regression/wordpress-hardening-plugin/9522109.yaml

+23
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,23 @@
1+
---
2+
meta:
3+
author: Thijs Eilander
4+
description: wordpress-hardening-plugin
5+
enabled: true
6+
name: 9522109.yaml
7+
tests:
8+
- test_title: 9522109
9+
desc: Test if admin login is blocked (default)
10+
stages:
11+
- stage:
12+
input:
13+
dest_addr: 127.0.0.1
14+
headers:
15+
Host: localhost
16+
User-Agent: OWASP CRS
17+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
18+
port: 80
19+
method: POST
20+
uri: /wp-login.php
21+
data: log=admin&pwd=admin&wp-submit=Log%20In
22+
output:
23+
log_contains: id "9522109"

‎tests/regression/wordpress-hardening-plugin/9522111.yaml

+24
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,24 @@
1+
---
2+
meta:
3+
author: Thijs Eilander
4+
description: wordpress-hardening-plugin
5+
enabled: true
6+
name: 9522111.yaml
7+
tests:
8+
- test_title: 95222111
9+
desc: Test if wp-cron.php works
10+
stages:
11+
- stage:
12+
input:
13+
dest_addr: 127.0.0.1
14+
headers:
15+
Host: localhost
16+
User-Agent: OWASP CRS
17+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
18+
port: 80
19+
method: GET
20+
uri: /wp-cron.php
21+
data: |
22+
text
23+
output:
24+
no_log_contains: id "95222111"

‎tests/regression/wordpress-hardening-plugin/9522202.yaml

+92
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
---
2+
meta:
3+
author: Thijs Eilander
4+
description: wordpress-hardening-plugin
5+
enabled: true
6+
name: 9522202.yaml
7+
tests:
8+
- test_title: 9522202-1
9+
desc: test for no direct access to files/dirs in wordpress-hardening-files.data
10+
stages:
11+
- stage:
12+
input:
13+
dest_addr: 127.0.0.1
14+
headers:
15+
Host: localhost
16+
User-Agent: OWASP CRS
17+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
18+
port: 80
19+
method: GET
20+
uri: /readme.txt
21+
data: |
22+
text
23+
output:
24+
log_contains: id "9522202"
25+
- test_title: 9522202-2
26+
desc: test for no direct access to files/dirs in wordpress-hardening-files.data
27+
stages:
28+
- stage:
29+
input:
30+
dest_addr: 127.0.0.1
31+
headers:
32+
Host: localhost
33+
User-Agent: OWASP CRS
34+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
35+
port: 80
36+
method: GET
37+
uri: /wp-config.php
38+
data: |
39+
text
40+
output:
41+
log_contains: id "9522202"
42+
- test_title: 9522202-3
43+
desc: test for no direct access to files/dirs in wordpress-hardening-files.data
44+
stages:
45+
- stage:
46+
input:
47+
dest_addr: 127.0.0.1
48+
headers:
49+
Host: localhost
50+
User-Agent: OWASP CRS
51+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
52+
port: 80
53+
method: GET
54+
uri: /wp-config-sample.php
55+
data: |
56+
text
57+
output:
58+
log_contains: id "9522202"
59+
- test_title: 9522202-4
60+
desc: test for no direct access to files/dirs in wordpress-hardening-files.data
61+
stages:
62+
- stage:
63+
input:
64+
dest_addr: 127.0.0.1
65+
headers:
66+
Host: localhost
67+
User-Agent: OWASP CRS
68+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
69+
port: 80
70+
method: GET
71+
uri: /wp-content/wp-rocket-config/dynamic-lists.json
72+
data: |
73+
text
74+
output:
75+
log_contains: id "9522202"
76+
- test_title: 9522202-5
77+
desc: test for no direct access to files/dirs in wordpress-hardening-files.data
78+
stages:
79+
- stage:
80+
input:
81+
dest_addr: 127.0.0.1
82+
headers:
83+
Host: localhost
84+
User-Agent: OWASP CRS
85+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
86+
port: 80
87+
method: GET
88+
uri: /wp-content/mu-plugins/test.php
89+
data: |
90+
text
91+
output:
92+
log_contains: id "9522202"

‎tests/regression/wordpress-hardening-plugin/9522205.yaml

+58
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,58 @@
1+
---
2+
meta:
3+
author: Thijs Eilander
4+
description: wordpress-hardening-plugin
5+
enabled: true
6+
name: 9522102.yaml
7+
tests:
8+
- test_title: 9522205-1
9+
desc: Test nasty shit in /wp-content/uploads
10+
stages:
11+
- stage:
12+
input:
13+
dest_addr: 127.0.0.1
14+
headers:
15+
Host: localhost
16+
User-Agent: OWASP CRS
17+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
18+
port: 80
19+
method: GET
20+
uri: /wp-content/uploads/2024/15/2/test.lua
21+
data: |
22+
text
23+
output:
24+
log_contains: id "9522205"
25+
- test_title: 9522205-2
26+
desc: Test nasty shit in /wp-content/uploads
27+
stages:
28+
- stage:
29+
input:
30+
dest_addr: 127.0.0.1
31+
headers:
32+
Host: localhost
33+
User-Agent: OWASP CRS
34+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
35+
port: 80
36+
method: GET
37+
uri: /wp-content/uploads/test/test/test/test/test/test/test/test/test/test/test/test.js
38+
data: |
39+
text
40+
output:
41+
log_contains: id "9522205"
42+
- test_title: 9522205-3
43+
desc: Test nasty shit in /wp-content/uploads
44+
stages:
45+
- stage:
46+
input:
47+
dest_addr: 127.0.0.1
48+
headers:
49+
Host: localhost
50+
User-Agent: OWASP CRS
51+
Accept: text/xml,application/xml,application/xhtml+xml,text/html;q=0.9,text/plain;q=0.8,image/png,*/*;q=0.5
52+
port: 80
53+
method: GET
54+
uri: /wp-content/uploads/2024/15/2/test.webp
55+
data: |
56+
text
57+
output:
58+
no_log_contains: id "9522205"

0 commit comments

Comments
 (0)