generated from jric11/baseProject
23 lines
1.9 KiB
Python
23 lines
1.9 KiB
Python
"""Read-only checks of a deployed HTTPS host; never sends account email or writes data."""
|
|
import argparse,http.cookiejar,ssl,urllib.error,urllib.parse,urllib.request
|
|
parser=argparse.ArgumentParser();parser.add_argument('url');args=parser.parse_args()
|
|
url=args.url.rstrip('/');parts=urllib.parse.urlsplit(url)
|
|
if parts.scheme!='https' or parts.query or parts.fragment or parts.username:raise SystemExit('Use the trusted HTTPS application base URL.')
|
|
client=urllib.request.build_opener(urllib.request.HTTPCookieProcessor(http.cookiejar.CookieJar()),urllib.request.HTTPSHandler(context=ssl.create_default_context()))
|
|
def get(path):
|
|
try:
|
|
with client.open(url+'/'+path,timeout=25) as response:return response.status,response.headers,response.read(),response.geturl()
|
|
except urllib.error.HTTPError as error:return error.code,error.headers,error.read(),error.geturl()
|
|
failures=[]
|
|
status,headers,body,final=get('main.php')
|
|
if status!=200 or urllib.parse.urlsplit(final).scheme!='https':failures.append('HTTPS login page unavailable.')
|
|
for name in ['Strict-Transport-Security','Content-Security-Policy','X-Content-Type-Options','Referrer-Policy','X-Frame-Options']:
|
|
if not headers.get(name):failures.append('Missing '+name)
|
|
cookie=';'.join(headers.get_all('Set-Cookie') or [])
|
|
if not all(flag in cookie.lower() for flag in ['secure','httponly','samesite=lax']):failures.append('Session cookie flags are missing.')
|
|
for path in ['xml/settings.local.xml','xml/settings.xml','.tools/backups/probe.sql','.git/config','vendor/autoload.php','bin/migrate-production.php','classes/Base.php','tests/http_fixture.php','composer.lock','release-manifest.json']:
|
|
if get(path)[0] not in [403,404]:failures.append('Private path was not denied: '+path)
|
|
for failure in failures:print('FAIL: '+failure)
|
|
if failures:raise SystemExit(1)
|
|
print('HTTPS, security headers, cookies, and private-path checks passed. Verify inbox delivery and operational jobs separately.')
|