Merge pull request #1160 from serlo/staging

Deployment

Author: kulla

.github/dependabot.yml

@@ -6,6 +6,11 @@ updates:
     directory: '/'
     schedule:
       interval: 'weekly'
+    groups:
+      minor-and-patch:
+        update-types:
+          - 'patch'
+          - 'minor'
     ignore:
       # we want LTS version of node and not suggested current version
       - dependency-name: '@types/node'

.github/workflows/checks.yml

@@ -10,34 +10,34 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: ./.github/actions/setup-node
       - run: yarn test
 
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: ./.github/actions/setup-node
       - run: yarn build --env production
 
   eslint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: ./.github/actions/setup-node
       - run: yarn lint:eslint
 
   prettier:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: ./.github/actions/setup-node
       - run: yarn lint:prettier
 
   tsc:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: ./.github/actions/setup-node
       - run: yarn lint:tsc

.github/workflows/deploy.yml

@@ -9,7 +9,7 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
       - uses: ./.github/actions/setup-node
       - run: yarn deploy --env ${GITHUB_REF_NAME}
         env:

.tool-versions

@@ -1 +1 @@
-nodejs 20.12.1
+nodejs 24.9.0

__tests__/__utils__/services/database.ts

@@ -1,7 +1,6 @@
 import { Instance } from '../../../src/utils'
 
 declare global {
-  // eslint-disable-next-line no-var
   var uuids: Uuid[]
 }
 

__tests__/__utils__/test-environment.ts

@@ -12,7 +12,6 @@ import { CFEnvironment, CFVariables, isInstance } from '../../src/utils'
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 
 declare global {
-  // eslint-disable-next-line no-var
   var server: ReturnType<typeof import('msw/node').setupServer>
 }
 

__tests__/block-common-hacker-paths.ts

@@ -0,0 +1,77 @@
+import { givenUuid, currentTestEnvironment } from './__utils__'
+import { Instance } from '../src/utils'
+
+describe('blocks common hacker paths', () => {
+  const env = currentTestEnvironment()
+
+  beforeEach(() => {
+    givenUuid({
+      __typename: 'Article',
+      alias: '/legitimate-path',
+      content: 'legitimate content',
+      instance: Instance.En,
+    })
+  })
+
+  test.each([
+    '/.env',
+    '/.git',
+    '/.aws/config',
+    '/.ssh/id_rsa',
+    '/.docker/config',
+    '/config.json',
+    '/config.php',
+    '/configuration.php',
+  ])('blocks file-based attack path: %s', async (path) => {
+    const response = await env.fetch({ subdomain: 'en', pathname: path })
+    expect(response.status).toBe(404)
+  })
+
+  test.each([
+    '/wp-admin',
+    '/wp-login.php',
+    '/wp-content/plugins',
+    '/wp-includes/file.php',
+    '/xmlrpc.php',
+    '/wp-config.php',
+  ])('blocks WordPress-related path: %s', async (path) => {
+    const response = await env.fetch({ subdomain: 'en', pathname: path })
+    expect(response.status).toBe(404)
+  })
+
+  test.each([
+    '/phpmyadmin',
+    '/pma',
+    '/admin',
+    '/administrator',
+    '/cpanel',
+    '/plesk',
+    '/webmail',
+    '/joomla/admin',
+    '/drupal/admin',
+  ])('blocks CMS and admin panel path: %s', async (path) => {
+    const response = await env.fetch({ subdomain: 'en', pathname: path })
+    expect(response.status).toBe(404)
+  })
+
+  test.each([
+    '/test.php',
+    '/index.asp',
+    '/default.aspx',
+    '/login.jsp',
+    '/script.cgi',
+    '/file.pl',
+  ])('blocks disallowed file extension: %s', async (path) => {
+    const response = await env.fetch({ subdomain: 'en', pathname: path })
+    expect(response.status).toBe(404)
+  })
+
+  test('legitimate paths still work and redirect properly', async () => {
+    const response = await env.fetch({
+      subdomain: 'en',
+      pathname: '/legitimate-path',
+    })
+    // This should not be blocked and should work as normal
+    expect(response.status).not.toBe(404)
+  })
+})

__tests__/redirects.ts

@@ -45,24 +45,16 @@ test('de.serlo.org/datenschutz', async () => {
   expectToBeRedirectTo(response, target, 301)
 })
 
-test('de.serlo.org/impressum', async () => {
-  const response = await env.fetch({
-    subdomain: 'de',
-    pathname: '/impressum',
-  })
-
-  const target = 'https://de.serlo.org/legal'
-  expectToBeRedirectTo(response, target, 301)
-})
-
-test('de.serlo.org/impressum', async () => {
-  const response = await env.fetch({
-    subdomain: 'de',
-    pathname: '/imprint',
-  })
-
-  const target = 'https://de.serlo.org/legal'
-  expectToBeRedirectTo(response, target, 301)
+describe('Imprint', () => {
+  test.each(['/impressum', '/imprint', '/legal'])(
+    'de.serlo.org%s',
+    async (pathname) => {
+      const response = await env.fetch({ subdomain: 'de', pathname })
+
+      const target = 'https://chancenwerk.de/impressum/'
+      expectToBeRedirectTo(response, target, 302)
+    },
+  )
 })
 
 test('de.serlo.org/nutzungsbedingungen ', async () => {

jest.config.json

@@ -3,8 +3,7 @@
     "^.+\\.tsx?$": [
       "ts-jest",
       {
-        "useESM": true,
-        "isolatedModules": true
+        "useESM": true
       }
     ]
   },

jest.setup.ts

@@ -82,8 +82,6 @@ function mockSentryServer() {
 export {}
 
 declare global {
-  // eslint-disable-next-line no-var
   var server: ReturnType<typeof import('msw/node').setupServer>
-  // eslint-disable-next-line no-var
   var sentryEvents: SentryEvent[]
 }