anti
b26dd8f529
Adds per-mint nonce gating, structural shape validation, mint UUID consistency checks, and a per-(token, IP) rate limiter to the canary worker so attackers who extract a canary from a decky filesystem cannot poison fingerprint forensics by replaying or forging ?d= submissions. Changes: base.py fingerprint_nonce: Optional[str] added to CanaryArtifact so generators can surface the nonce to the cultivator without coupling the generator directly to DB code. obfuscator.py nonce_for(callback_token, mint_uuid): HMAC-SHA256 keyed on DECNET_CANARY_FINGERPRINT_SECRET, truncated to 16 hex chars. FingerprintSecretMissing raised at mint time if env var is unset. render_fingerprint_js() now accepts nonce= and substitutes MINT_NONCE. fingerprint_payload.js New MINT_NONCE placeholder. Appended as &k= on all beacon URLs (bare-open, single-shot, chunked). Using &k= avoids colliding with &n= (chunk total). fingerprint_html.py / fingerprint_svg.py Derive nonce via nonce_for() and pass to render_fingerprint_js(). Set artifact.fingerprint_nonce so the cultivator can persist it. cultivator.py Passes fingerprint_nonce into create_canary_token() when present on the artifact; NULL for all non-fingerprint generators. canary.py (model) fingerprint_nonce: Optional[str] = Field(default=None, max_length=16) added to CanaryToken. None for non-fingerprint tokens. worker.py _extract_fingerprint now returns (meta_dict, parsed_fp) tuple. _record_hit accepts parsed_fp + raw_nonce and runs 4 layers after token lookup: nonce match, shape check, mint UUID consistency, rate limit. Each failure sets _fp_invalid_* flag and drops structured _fp. Trigger row always lands regardless. tests/canary/conftest.py Session-scoped autouse fixture sets DECNET_CANARY_FINGERPRINT_SECRET so fingerprint generator and worker tests work offline. tests 5 new worker HTTP tests and 2 new generator tests covering each validation layer.
107 lines
4.0 KiB
Python
107 lines
4.0 KiB
Python
"""Shared fixtures for canary tests — minimal DOCX/XLSX/HTML/PDF fixtures.
|
|
|
|
We synthesise the OOXML zips inline rather than checking real binary
|
|
fixtures into the repo. Keeps the test surface portable and the diff
|
|
reviewable; the smallest valid DOCX is ~12 files but Word/LibreOffice
|
|
both accept a stripped-down skeleton with just ``[Content_Types].xml``,
|
|
``_rels/.rels``, ``word/document.xml``, and ``word/_rels/document.xml.rels``.
|
|
"""
|
|
from __future__ import annotations
|
|
|
|
import io
|
|
import os
|
|
import zipfile
|
|
|
|
import pytest
|
|
|
|
|
|
@pytest.fixture(autouse=True, scope="session")
|
|
def _canary_fingerprint_secret():
|
|
"""Ensure DECNET_CANARY_FINGERPRINT_SECRET is set for all canary tests.
|
|
|
|
Fingerprint generators call nonce_for() which raises if the env var
|
|
is unset. A test-only sentinel value is fine — it just needs to exist.
|
|
"""
|
|
key = "DECNET_CANARY_FINGERPRINT_SECRET"
|
|
prev = os.environ.get(key)
|
|
os.environ.setdefault(key, "test-secret-for-canary-tests-only")
|
|
yield
|
|
if prev is None:
|
|
os.environ.pop(key, None)
|
|
else:
|
|
os.environ[key] = prev
|
|
|
|
|
|
_DOCX_CONTENT_TYPES = (
|
|
'<?xml version="1.0" encoding="UTF-8" standalone="yes"?>'
|
|
'<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">'
|
|
'<Default Extension="xml" ContentType="application/xml"/>'
|
|
'<Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>'
|
|
'<Override PartName="/word/document.xml" '
|
|
'ContentType="application/vnd.openxmlformats-officedocument.wordprocessingml.document.main+xml"/>'
|
|
'</Types>'
|
|
)
|
|
|
|
_DOCX_PACKAGE_RELS = (
|
|
'<?xml version="1.0" encoding="UTF-8" standalone="yes"?>'
|
|
'<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">'
|
|
'<Relationship Id="rId1" '
|
|
'Type="http://schemas.openxmlformats.org/officeDocument/2006/relationships/officeDocument" '
|
|
'Target="word/document.xml"/>'
|
|
'</Relationships>'
|
|
)
|
|
|
|
_DOCX_DOCUMENT = (
|
|
'<?xml version="1.0" encoding="UTF-8" standalone="yes"?>'
|
|
'<w:document xmlns:w="http://schemas.openxmlformats.org/wordprocessingml/2006/main">'
|
|
'<w:body><w:p><w:r><w:t>Existing content.</w:t></w:r></w:p></w:body>'
|
|
'</w:document>'
|
|
)
|
|
|
|
_DOCX_DOCUMENT_RELS = (
|
|
'<?xml version="1.0" encoding="UTF-8" standalone="yes"?>'
|
|
'<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">'
|
|
'</Relationships>'
|
|
)
|
|
|
|
|
|
@pytest.fixture
|
|
def minimal_docx() -> bytes:
|
|
"""Return a tiny but structurally valid DOCX as bytes."""
|
|
out = io.BytesIO()
|
|
with zipfile.ZipFile(out, "w", zipfile.ZIP_DEFLATED) as zf:
|
|
zf.writestr("[Content_Types].xml", _DOCX_CONTENT_TYPES)
|
|
zf.writestr("_rels/.rels", _DOCX_PACKAGE_RELS)
|
|
zf.writestr("word/document.xml", _DOCX_DOCUMENT)
|
|
zf.writestr("word/_rels/document.xml.rels", _DOCX_DOCUMENT_RELS)
|
|
return out.getvalue()
|
|
|
|
|
|
_XLSX_CONTENT_TYPES = (
|
|
'<?xml version="1.0" encoding="UTF-8" standalone="yes"?>'
|
|
'<Types xmlns="http://schemas.openxmlformats.org/package/2006/content-types">'
|
|
'<Default Extension="xml" ContentType="application/xml"/>'
|
|
'<Default Extension="rels" ContentType="application/vnd.openxmlformats-package.relationships+xml"/>'
|
|
'<Override PartName="/xl/workbook.xml" '
|
|
'ContentType="application/vnd.openxmlformats-officedocument.spreadsheetml.sheet.main+xml"/>'
|
|
'</Types>'
|
|
)
|
|
|
|
_XLSX_WORKBOOK_RELS = (
|
|
'<?xml version="1.0" encoding="UTF-8" standalone="yes"?>'
|
|
'<Relationships xmlns="http://schemas.openxmlformats.org/package/2006/relationships">'
|
|
'</Relationships>'
|
|
)
|
|
|
|
|
|
@pytest.fixture
|
|
def minimal_xlsx() -> bytes:
|
|
"""Return a tiny but structurally valid XLSX as bytes."""
|
|
out = io.BytesIO()
|
|
with zipfile.ZipFile(out, "w", zipfile.ZIP_DEFLATED) as zf:
|
|
zf.writestr("[Content_Types].xml", _XLSX_CONTENT_TYPES)
|
|
zf.writestr("_rels/.rels", _DOCX_PACKAGE_RELS.replace("word/document.xml", "xl/workbook.xml"))
|
|
zf.writestr("xl/workbook.xml", '<workbook/>')
|
|
zf.writestr("xl/_rels/workbook.xml.rels", _XLSX_WORKBOOK_RELS)
|
|
return out.getvalue()
|