From fbec28b3fe751d95325614a230f998ee290220bd Mon Sep 17 00:00:00 2001 From: Bryce Kwon Date: Fri, 16 Oct 2026 22:13:35 -1000 Subject: Load auth libraries only when a request needs one Required at the top, a missing luaossl or luaposix failed every request to the site, public pages included, and each public page paid to load both. --- tests/extensions/test-auth.lua | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'tests/extensions') diff --git a/tests/extensions/test-auth.lua b/tests/extensions/test-auth.lua index e0d2fe5..eb402da 100644 --- a/tests/extensions/test-auth.lua +++ b/tests/extensions/test-auth.lua @@ -328,4 +328,17 @@ out, ret = run_action("authenticate-post", { }) h.contains("even a signed unsafe destination is not followed", out, "Status: 404") +-- The libraries load only once a request needs one, so with every one of +-- them gone a public repository is still served, while a protected one +-- fails closed instead of reaching its content. +for _, name in ipairs({ "openssl.rand", "openssl.hmac", "posix.sys.stat", "posix.unistd" }) do + package.loaded[name] = nil + h.preload_failure(name) +end +out, ret = run_action("authenticate-cookie", { repo = "unlisted" }) +h.equals("without the libraries a public repository is served", ret, 1) +h.check("while a protected one fails closed", not pcall(run_action, + "authenticate-cookie", { repo = "secret-repo", cookie = "cgitauth=" .. session })) +h.check("and so does its login form", not pcall(run_action, "body", {})) + h.finish() -- cgit