test: add matrix coverage and deepen plugin test suites

Author: TheophileDiot

.tests/clamav.sh

@@ -85,6 +85,37 @@ if [ "$success" == "ko" ] ; then
 	echo "❌ Error did not receive 403 code"
 	exit 1
 fi
+
+# A clean file must NOT be denied by ClamAV. The hello upstream only accepts GET,
+# so a clean multipart POST reaches it and comes back 405 (method). Accept any 2xx
+# or non-403 4xx, but fail on 403 (denied) and on 5xx/000 (a crash or fail-closed
+# regression must not hide behind "not 403").
+echo "ℹ️ Testing that a clean file is not blocked ..."
+printf 'just a clean file\n' > /tmp/bunkerweb-plugins/clamav/clean.txt
+code="$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Host: www.example.com" -F "file=@/tmp/bunkerweb-plugins/clamav/clean.txt" http://localhost)"
+case "$code" in
+403) clean_err="should not be denied by ClamAV" ;;
+000 | 5??) clean_err="caused an upstream error/crash" ;;
+*) clean_err="" ;;
+esac
+if [ -n "$clean_err" ] ; then
+	docker compose logs
+	docker compose down -v
+	echo "❌ Error: clean file $clean_err (got $code)"
+	exit 1
+fi
+
+# Upload EICAR a second time: it must still be denied. This re-hits the same
+# SHA-512, exercising the result cache (is_in_cache) rather than a fresh scan.
+echo "ℹ️ Testing repeated EICAR is still denied (cache path) ..."
+code="$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Host: www.example.com" -F "file=@/tmp/bunkerweb-plugins/clamav/eicar.com" http://localhost)"
+if [ "$code" != "403" ] ; then
+	docker compose logs
+	docker compose down -v
+	echo "❌ Error: repeated EICAR should stay denied (got $code, expected 403)"
+	exit 1
+fi
+
 if [ "$1" = "verbose" ] ; then
 	docker compose logs
 fi

.tests/coraza.sh

@@ -84,6 +84,27 @@ if [ "$success" == "ko" ] ; then
 	exit 1
 fi
 
+# Scanner User-Agent (CRS 913xxx, request-headers phase): a different rule family
+# than the LFI args above, widening coverage to header inspection.
+echo "ℹ️ Testing with a scanner User-Agent ..."
+ret="$(curl -s -o /dev/null -w "%{http_code}" -H "Host: www.example.com" -H "User-Agent: sqlmap/1.4.7" http://localhost/)"
+if [ "$ret" != "403" ] ; then
+	docker compose logs
+	docker compose down -v
+	echo "❌ Error: scanner User-Agent should be blocked (got $ret, expected 403)"
+	exit 1
+fi
+
+# A benign request with a normal query arg must pass (no false positive -> 200).
+echo "ℹ️ Testing that a benign request passes ..."
+ret="$(curl -s -o /dev/null -w "%{http_code}" -H "Host: www.example.com" "http://localhost/?q=hello-world")"
+if [ "$ret" != "200" ] ; then
+	docker compose logs
+	docker compose down -v
+	echo "❌ Error: benign request should pass (got $ret, expected 200)"
+	exit 1
+fi
+
 # We're done
 if [ "$1" = "verbose" ] ; then
 	docker compose logs

.tests/notifier.sh

@@ -3,18 +3,19 @@
 # shellcheck disable=SC1091
 . .tests/utils.sh
 
-echo "ℹ️ Starting Notifier (discord/slack/webhook) tests ..."
+echo "ℹ️ Starting Notifier (discord/slack/webhook/matrix) tests ..."
 
 # Create working directory
 if [ -d /tmp/bunkerweb-plugins ] ; then
 	do_and_check_cmd sudo rm -rf /tmp/bunkerweb-plugins
 fi
 do_and_check_cmd mkdir -p /tmp/bunkerweb-plugins/notifier/bw-data/plugins
 
-# Copy all three notifier plugins
+# Copy all four notifier plugins
 do_and_check_cmd cp -r ./discord /tmp/bunkerweb-plugins/notifier/bw-data/plugins
 do_and_check_cmd cp -r ./slack /tmp/bunkerweb-plugins/notifier/bw-data/plugins
 do_and_check_cmd cp -r ./webhook /tmp/bunkerweb-plugins/notifier/bw-data/plugins
+do_and_check_cmd cp -r ./matrix /tmp/bunkerweb-plugins/notifier/bw-data/plugins
 do_and_check_cmd sudo chown -R 101:101 /tmp/bunkerweb-plugins/notifier/bw-data
 
 # Copy compose + the rate-limit mock config
@@ -111,6 +112,9 @@ check_echo_notifier() {
 
 check_echo_notifier slack /slack '"text"'
 check_echo_notifier webhook /webhook '"content"'
+# matrix posts a PUT to the Matrix "send message" endpoint on the same echo mock.
+# Assert the room-send path was hit and the org.matrix.custom.html payload shape.
+check_echo_notifier matrix "/_matrix/client" '"formatted_body"'
 
 # discord posts to the rate-limit mock (429 + Retry-After, then 200). With
 # DISCORD_RETRY_IF_LIMITED=yes the plugin retries once, so the mock should see

.tests/notifier/docker-compose.yml

@@ -20,7 +20,7 @@ services:
     environment:
       - BUNKERWEB_INSTANCES=bunkerweb
       - MULTISITE=yes
-      - SERVER_NAME=discord.example.com slack.example.com webhook.example.com
+      - SERVER_NAME=discord.example.com slack.example.com webhook.example.com matrix.example.com
       - API_WHITELIST_IP=127.0.0.0/8 10.20.30.0/24
       - LOG_LEVEL=info
       - USE_BAD_BEHAVIOR=no
@@ -43,6 +43,12 @@ services:
       - DISCORD_RETRY_IF_LIMITED=yes
       - SLACK_WEBHOOK_URL=http://mock:8080/slack
       - WEBHOOK_URL=http://mock:8080/webhook
+      # matrix posts a PUT to /_matrix/client/... on the catch-all echo mock (no
+      # 429-retry path of its own). Globals are mandatory; values are dummies.
+      - MATRIX_BASE_URL=http://mock:8080
+      - MATRIX_ROOM_ID=!test:example.com
+      - MATRIX_ACCESS_TOKEN=test-token
+      - MATRIX_INCLUDE_HEADERS=yes
       # discord.example.com : notify on a blacklisted URI
       - discord.example.com_USE_REVERSE_PROXY=yes
       - discord.example.com_REVERSE_PROXY_HOST=http://hello:8080
@@ -64,6 +70,13 @@ services:
       - webhook.example.com_USE_WEBHOOK=yes
       - webhook.example.com_USE_BLACKLIST=yes
       - webhook.example.com_BLACKLIST_URI=/blocked
+      # matrix.example.com
+      - matrix.example.com_USE_REVERSE_PROXY=yes
+      - matrix.example.com_REVERSE_PROXY_HOST=http://hello:8080
+      - matrix.example.com_REVERSE_PROXY_URL=/
+      - matrix.example.com_USE_MATRIX=yes
+      - matrix.example.com_USE_BLACKLIST=yes
+      - matrix.example.com_BLACKLIST_URI=/blocked
     networks:
       - bw-universe
 

.tests/virustotal.sh

@@ -100,14 +100,22 @@ if ! docker compose logs mock 2>/dev/null | grep -F "/files/275a021bbfb6489e54d4
 	exit 1
 fi
 
-# A clean file must pass through (mock returns 404 = not found on VT = clean)
-echo "ℹ️ Testing that a clean file passes ..."
+# A clean file must NOT be denied (mock returns 404 = not found on VT = clean).
+# The hello upstream only accepts GET, so the clean multipart POST reaches it and
+# comes back 405 (method). Accept any 2xx or non-403 4xx, but fail on 403 (denied)
+# and on 5xx/000 (a crash or fail-closed regression must not hide behind "not 403").
+echo "ℹ️ Testing that a clean file is not blocked ..."
 printf 'just a clean file\n' > /tmp/bunkerweb-plugins/virustotal/clean.txt
 code="$(curl -s -o /dev/null -w "%{http_code}" -X POST -H "Host: www.example.com" -F "file=@/tmp/bunkerweb-plugins/virustotal/clean.txt" http://localhost)"
-if [ "$code" != "200" ] ; then
+case "$code" in
+403) clean_err="should not be denied by VirusTotal" ;;
+000 | 5??) clean_err="caused an upstream error/crash" ;;
+*) clean_err="" ;;
+esac
+if [ -n "$clean_err" ] ; then
 	docker compose logs
 	docker compose down -v
-	echo "❌ Error: clean file should pass (got $code, expected 200)"
+	echo "❌ Error: clean file $clean_err (got $code)"
 	exit 1
 fi
 
@@ -121,6 +129,20 @@ if [ "$code" != "403" ] ; then
 	exit 1
 fi
 
+# Error paths: a VT API failure must FAIL OPEN — the request is allowed through,
+# never denied (403) and never leaked as a server error (5xx) to the client.
+# 5.5.5.5 -> mock returns 500 ; 6.6.6.6 -> mock returns unparsable JSON.
+for bad_ip in 5.5.5.5 6.6.6.6 ; do
+	echo "ℹ️ Testing fail-open when VT API errors for $bad_ip ..."
+	code="$(curl -s -o /dev/null -w "%{http_code}" -H "Host: www.example.com" -H "X-Forwarded-For: $bad_ip" http://localhost/)"
+	if [ "$code" != "200" ] ; then
+		docker compose logs
+		docker compose down -v
+		echo "❌ Error: VT API failure for $bad_ip should fail open (got $code, expected 200)"
+		exit 1
+	fi
+done
+
 if [ "$1" = "verbose" ] ; then
 	docker compose logs
 fi

.tests/virustotal/vt-mock.conf

@@ -22,6 +22,18 @@ server {
     location = /ip_addresses/1.2.3.4 {
         return 200 '{"data":{"attributes":{"last_analysis_stats":{"harmless":0,"malicious":10,"suspicious":0,"undetected":0,"timeout":0}}}}';
     }
+
+    # Error-path IPs: exercise the plugin's fail-open behaviour. A VT API failure
+    # (5xx) or an unparsable body must NOT deny the request. 5.5.5.5 -> upstream
+    # 500; 6.6.6.6 -> HTTP 200 with a body that is not valid JSON.
+    location = /ip_addresses/5.5.5.5 {
+        return 500 '{"error":{"code":"InternalError"}}';
+    }
+    location = /ip_addresses/6.6.6.6 {
+        default_type text/plain;
+        return 200 'this is not json';
+    }
+
     location /ip_addresses/ {
         return 200 '{"data":{"attributes":{"last_analysis_stats":{"harmless":80,"malicious":0,"suspicious":0,"undetected":0,"timeout":0}}}}';
     }

clamav/clamav.lua

@@ -1,3 +1,4 @@
+local clamav_helpers = require("clamav.clamav_helpers")
 local class = require("middleclass")
 local plugin = require("bunkerweb.plugin")
 local sha512 = require("resty.sha512")
@@ -17,18 +18,9 @@ local to_hex = str.to_hex
 local has_variable = utils.has_variable
 local get_deny_status = utils.get_deny_status
 local tonumber = tonumber
-local floor = math.floor
-
-local stream_size = function(size)
-	return ("%c%c%c%c")
-		:format(
-			size % 0x100,
-			floor(size / 0x100) % 0x100,
-			floor(size / 0x10000) % 0x100,
-			floor(size / 0x1000000) % 0x100
-		)
-		:reverse()
-end
+-- The big-endian INSTREAM length prefix lives in clamav/clamav_helpers.lua so it
+-- can be unit-tested with busted outside OpenResty (see spec/clamav_helpers_spec.lua).
+local stream_size = clamav_helpers.stream_size
 
 local read_all = function(form)
 	while true do

clamav/clamav_helpers.lua

@@ -0,0 +1,22 @@
+-- Pure helpers extracted from clamav.lua so they can be unit-tested with busted
+-- outside the OpenResty runtime. No ngx/resty dependencies — see
+-- spec/clamav_helpers_spec.lua.
+local floor = math.floor
+
+local _M = {}
+
+-- Encode a chunk length as the 4-byte big-endian (network byte order) prefix the
+-- ClamAV INSTREAM protocol expects before each chunk. The bytes are built
+-- little-endian then reversed, so byte 1 is the most-significant.
+function _M.stream_size(size)
+	return ("%c%c%c%c")
+		:format(
+			size % 0x100,
+			floor(size / 0x100) % 0x100,
+			floor(size / 0x10000) % 0x100,
+			floor(size / 0x1000000) % 0x100
+		)
+		:reverse()
+end
+
+return _M

discord/discord.lua

@@ -1,5 +1,6 @@
 local cjson = require("cjson")
 local class = require("middleclass")
+local discord_helpers = require("discord.discord_helpers")
 local http = require("resty.http")
 local plugin = require("bunkerweb.plugin")
 local utils = require("bunkerweb.utils")
@@ -20,8 +21,6 @@ local has_variable = utils.has_variable
 local get_variable = utils.get_variable
 local get_reason = utils.get_reason
 local tostring = tostring
-local len = string.len
-local sub = string.sub
 local format = string.format
 local encode = cjson.encode
 local floor = math.floor
@@ -48,13 +47,9 @@ function discord:log(bypass_use_discord)
 	local timestamp = ngx_req.start_time()
 	local formattedTimestamp = date("!%Y-%m-%dT%H:%M:%S", timestamp)
 	local milliseconds = floor((timestamp - floor(timestamp)) * 1000)
-	local formatField = function(inputString)
-		if len(inputString) <= 1021 then
-			return inputString
-		else
-			return sub(inputString, 1, 1021) .. "..."
-		end
-	end
+	-- Discord caps embed field values at 1024 chars; truncation lives in
+	-- discord/discord_helpers.lua (see spec/discord_helpers_spec.lua).
+	local formatField = discord_helpers.format_field
 
 	local data = {
 		username = "BunkerWeb",

discord/discord_helpers.lua

@@ -0,0 +1,18 @@
+-- Pure helpers extracted from discord.lua so they can be unit-tested with busted
+-- outside the OpenResty runtime. No ngx/resty dependencies — see
+-- spec/discord_helpers_spec.lua.
+local len = string.len
+local sub = string.sub
+
+local _M = {}
+
+-- Discord embed field values are capped at 1024 characters. Truncate to 1021 and
+-- append "..." so the value always fits, leaving shorter strings untouched.
+function _M.format_field(input_string)
+	if len(input_string) <= 1021 then
+		return input_string
+	end
+	return sub(input_string, 1, 1021) .. "..."
+end
+
+return _M